1.lookinews.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main IP is 45.133.44.21, located in Philadelphia, United States and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is 1.lookinews.com. The Cisco Umbrella rank of the primary domain is 919832.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on October 30th 2023. Valid for: 3 months.

This is the only time 1.lookinews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	138.201.62.254 138.201.62.254	24940 (HETZNER-AS) (HETZNER-AS)
1 1	2606:4700:303... 2606:4700:3033::ac43:b019	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	45.133.44.21 45.133.44.21	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	45.133.44.20 45.133.44.20	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	3

2 138.201.62.254 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.254.62.201.138.clients.your-server.de

c.1td.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:b019 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

intellectborrowing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.133.44.21 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

1.lookinews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.133.44.20 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

2818.selornews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	1td.eu 2 redirects c.1td.eu — Cisco Umbrella Rank: 548810	279 B
1	selornews.com 2818.selornews.com — Cisco Umbrella Rank: 668159	7 KB
1	lookinews.com 1.lookinews.com — Cisco Umbrella Rank: 919832	16 KB
1	intellectborrowing.com 1 redirects intellectborrowing.com — Cisco Umbrella Rank: 986733	1010 B
2	4

	Domain	Requested by
2	c.1td.eu	2 redirects
1	2818.selornews.com	1.lookinews.com
1	1.lookinews.com
1	intellectborrowing.com	1 redirects
2	4

This site contains no links.

Subject Issuer	Validity	Valid
*.lookinews.com ZeroSSL RSA Domain Secure Site CA	`2023-10-30` - `2024-01-28`	3 months	crt.sh
*.selornews.com ZeroSSL RSA Domain Secure Site CA	`2023-10-30` - `2024-01-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq
Frame ID: 12D0D43ACBE9220C6C937CF94422B1B6
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://c.1td.eu/ HTTP 301
https://c.1td.eu/ HTTP 302
https://intellectborrowing.com/NP7j7T HTTP 302
https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid... Page URL

Page Statistics

2
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

24 kB
Transfer

23 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://c.1td.eu/ HTTP 301
https://c.1td.eu/ HTTP 302
https://intellectborrowing.com/NP7j7T HTTP 302
https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response 1.lookinews.com/not-a-robot/ Redirect Chain http://c.1td.eu/ https://c.1td.eu/ https://intellectborrowing.com/NP7j7T https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq	16 KB 16 KB	28ms 3ms	Document text/html	45.133.44.21 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.21 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `59ab2ba6810f26ec74a0f105e33ab64ea87925cff1760c45611ee65e1ce14bd0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ranges bytes access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS access-control-allow-origin * access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 content-length 16145 content-type text/html; charset=utf-8 date Tue, 28 Nov 2023 01:57:32 GMT etag 4f69c4d0e508822d6e1176133dd07533 expires Thu, 30 Nov 2023 01:57:32 GMT last-modified Wed, 22 Dec 2021 16:37:28 GMT server nginx/1.24.0 vary Accept-Encoding x-openstack-request-id tx3898d40ef9464084ad698-00655cd11b x-proxy-cache HIT x-timestamp 1640191047.28578 x-trans-id tx3898d40ef9464084ad698-00655cd11b Redirect headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate,post-check=0,pre-check=0 cf-cache-status DYNAMIC cf-ray 82cf00284e53afbe-NRT content-type text/html; charset=UTF-8 date Tue, 28 Nov 2023 01:57:32 GMT expires 0 last-modified Tue, 28 Nov 2023 01:57:32 GMT location https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QgWvqHQG2CuTKcxG5ZSH66k3Av%2FrRNUbst%2Bq7bwCksryLqtxRYXHx%2F%2FuTnZRaQ9C2Vq09armoicuDW%2FQAk0lTvkJcjjU%2BgAV54rSHM1m7o9rQzNS3TpxT4nsFuG%2BWhfyLN%2B5vgNUGbzKznNIFemZcDAicZ%2Bg"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	script.js Show response 2818.selornews.com/	7 KB 7 KB	50ms 1ms	Script application/javascript	45.133.44.20 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://2818.selornews.com/script.js?slug=not-a-robot Requested by Host: 1.lookinews.com URL: https://1.lookinews.com/not-a-robot/index.html?rc=0&mrc=2&fsc=0&zoneid=1989183&tbz=1989185&var=&ymid=1feg428drloq Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.20 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `6a56198e94d0e7c8168e2d91ccbeaa1c97d0b57517d8e6465d35899a3a14e779` Request headers accept-language jp-JP,jp;q=0.9 Referer https://1.lookinews.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Response headers expires Thu, 30 Nov 2023 01:57:32 GMT date Tue, 28 Nov 2023 01:57:32 GMT x-openstack-request-id txccf4ea61e3684a1d89ec8-00655cd0dd content-length 6698 x-trans-id txccf4ea61e3684a1d89ec8-00655cd0dd last-modified Mon, 18 Sep 2023 15:14:40 GMT server nginx/1.24.0 etag 01594894bf3ab29e4bc6d231ec7843d5 vary Accept-Encoding access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * x-timestamp 1695050079.46623 access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 accept-ranges bytes access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization x-proxy-cache HIT
GET DATA	200 OK	truncated /	748 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23` Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
intellectborrowing.com/	1970-01-20 17:16:55	Name: _subid Value: 1feg428drloq
intellectborrowing.com/	1970-01-20 17:16:55	Name: _token Value: uuid_1feg428drloq_1feg428drloq6565490c2bd7a9.14326769
intellectborrowing.com/	1970-01-21 02:08:16	Name: e609b Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI3M1wiOjE3MDExMzY2NTJ9LFwiY2FtcGFpZ25zXCI6e1wiMjA4XCI6MTcwMTEzNjY1Mn0sXCJ0aW1lXCI6MTcwMTEzNjY1Mn0ifQ.LpjO0rULZqkU28RVNq-k33Vv4Gvynh4DAuxS77EtjRo

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.lookinews.com
2818.selornews.com
c.1td.eu
intellectborrowing.com
138.201.62.254
2606:4700:3033::ac43:b019
45.133.44.20
45.133.44.21
59ab2ba6810f26ec74a0f105e33ab64ea87925cff1760c45611ee65e1ce14bd0
6a56198e94d0e7c8168e2d91ccbeaa1c97d0b57517d8e6465d35899a3a14e779
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

1.lookinews.com Open in urlscan Pro 45.133.44.21 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

24 kBTransfer

23 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

3 Cookies

Indicators

1.lookinews.com Open in urlscan Pro
45.133.44.21 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

24 kB
Transfer

23 kB
Size

3
Cookies

2 HTTP transactions
1 data transactions