urlscan.io logo urlscan.io
SecurityTrails logo

copymoney.mrtext.ru Open in urlscan Pro
85.119.149.96  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://copymoney.mrtext.ru/
Effective URL: http://copymoney.mrtext.ru/
Submission: On December 03 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 17 HTTP transactions. The main IP is 85.119.149.96, located in Russian Federation and belongs to SELECTEL, RU. The main domain is copymoney.mrtext.ru.
This is the only time copymoney.mrtext.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 85.119.149.96 49505 (SELECTEL)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 80.93.179.60 49505 (SELECTEL)
2 2a03:2880:f11... 32934 (FACEBOOK)
17 6
10    85.119.149.96 (Russian Federation)

ASN49505 (SELECTEL, RU)
copymoney.mrtext.ru
s.plpstatic.ru
2    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    80.93.179.60 (Russian Federation)

ASN49505 (SELECTEL, RU)
u21.plpstatic.ru
2    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
Domain Requested by
7 s.plpstatic.ru copymoney.mrtext.ru
s.plpstatic.ru
3 copymoney.mrtext.ru 1 redirects copymoney.mrtext.ru
2 www.facebook.com copymoney.mrtext.ru
2 u21.plpstatic.ru copymoney.mrtext.ru
2 fonts.gstatic.com s.plpstatic.ru
2 connect.facebook.net copymoney.mrtext.ru
connect.facebook.net
17 6

This site contains links to these domains. Also see Links.

Domain
monecle.com
mrtext.ru
udaprof.ru
Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-11 -
2021-12-10		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://copymoney.mrtext.ru/
Frame ID: 095F35AA8B384EED597E5E1468DC7CBA
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Мини-курс «‎Успешный копирайтер как зарабатывать 100 000 рублей в месяц на текстах»

Page URL History Show full URLs

  1. https://copymoney.mrtext.ru/ HTTP 301
    http://copymoney.mrtext.ru/ Page URL

Page Statistics

17
Requests

35 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

524 kB
Transfer

2114 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://copymoney.mrtext.ru/ HTTP 301
    http://copymoney.mrtext.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
copymoney.mrtext.ru/
Redirect Chain
  • https://copymoney.mrtext.ru/
  • http://copymoney.mrtext.ru/
88 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
32060f721100af04d951cb0df05d3bdf1e67f65e56204b5b3873508c88c6aff1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
openresty
Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=20
Content-encoding
gzip

Redirect headers

Server
openresty
Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Type
text/html
Content-Length
166
Connection
keep-alive
Keep-Alive
timeout=20
Location
http://copymoney.mrtext.ru/
vendors.css
s.plpstatic.ru/assets/3.3/ 		308 KB
39 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/vendors.css
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
6d667d5cfda46a7ba15af323d00258b1ecd0b20175f12a170fc7fc8f8432c586

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:17 GMT
Server
openresty
ETag
"5fd08975-9992"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
39314
plp.css
s.plpstatic.ru/assets/3.3/ 		562 KB
48 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/plp.css
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
a082cea8852599e45ab6564a61945b4524750e4bdd7f159dbe1fa6f74b11f4f1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:17 GMT
Server
openresty
ETag
"5fd08975-be09"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
48649
nodes.css
s.plpstatic.ru/assets/3.3/ 		115 KB
47 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/nodes.css
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
65d6da3a6bfafe9c78b2bf1e00e5d724f68221a9e48d545969045bc1d6d26b46

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:21 GMT
Server
openresty
ETag
"5fd08979-bb83"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
48003
vendors.js
s.plpstatic.ru/assets/3.3/ 		355 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/vendors.js
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
4a8106ac064e738cd838a7a836bd9527ef3f6b40d9ef44dcdd742c3aef3d818c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:14 GMT
Server
openresty
ETag
"5fd08972-1ae00"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
110080
plp.js
s.plpstatic.ru/assets/3.3/ 		118 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/plp.js
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
1c93b031ae7d6784e8d506789cb88b1345cf0384d43e710c944164875b19ca92

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:19 GMT
Server
openresty
ETag
"5fd08977-7298"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
29336
nodes.js
s.plpstatic.ru/assets/3.3/ 		51 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/assets/3.3/nodes.js
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
074aa9cd8cbc7faacff2683de887204fc0ce0f3303f05680c1c9b8bf148077dd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Dec 2020 08:23:17 GMT
Server
openresty
ETag
"5fd08975-250b"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
9483
fbevents.js
connect.facebook.net/en_US/ 		98 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
25965
x-xss-protection
0
pragma
public
x-fb-debug
Sj3fGMukYhnKKhrR5g46uN1+6lQncL4gQlCjsgz+o9ZfO+cf8VvTJN8RG1s+LhoxeQ2HLZKqmjHSIqCZiHZ2Cg==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 03 Dec 2021 10:17:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
acbaa72f68fd7ecda4ac57895168fe64bc5b706bdc5ad7745e2a9e86ecc6627c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		72 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e6f25c73e33c988f6335eeeb5fcb71905d31951e6ad7d8d7d387ea3552e7ba3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		75 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8d9285e57657d4bf53b0e4f77fa52cd66c518722b77c44eb33f0869a18787181

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
RjgO7rYTmqiVp7vzi-Q5UbO3LdcAZYWl9Si6vvxL-qU.woff
fonts.gstatic.com/s/opensans/v13/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/RjgO7rYTmqiVp7vzi-Q5UbO3LdcAZYWl9Si6vvxL-qU.woff
Requested by
Host: s.plpstatic.ru
URL: http://s.plpstatic.ru/assets/3.3/plp.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e8f00bed071bc169467cc91b1d2d8405ce391f070d10e6c97781c20d4d96170
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://s.plpstatic.ru/
Origin
http://copymoney.mrtext.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 04:34:44 GMT
x-content-type-options
nosniff
age
20545
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19400
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:45:38 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 03 Dec 2022 04:34:44 GMT
343165_D_0.woff2
s.plpstatic.ru/fonts/ttnorms/ 		36 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://s.plpstatic.ru/fonts/ttnorms/343165_D_0.woff2
Requested by
Host: s.plpstatic.ru
URL: http://s.plpstatic.ru/assets/3.3/plp.css
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
008154743af1b195c7d4b73c67101bc656d45219930c5206e3eb26499af222c4

Request headers

Referer
http://s.plpstatic.ru/assets/3.3/plp.css
Origin
http://copymoney.mrtext.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Last-Modified
Wed, 09 Dec 2020 08:24:00 GMT
Server
openresty
ETag
"5fd089a0-8f77"
Content-Type
application/font-woff2
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
36727
k3k702ZOKiLJc3WVjuplzAcuEIXEaFWBWXA4NoGd_Oo.woff
fonts.gstatic.com/s/opensans/v13/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzAcuEIXEaFWBWXA4NoGd_Oo.woff
Requested by
Host: s.plpstatic.ru
URL: http://s.plpstatic.ru/assets/3.3/plp.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd01185f335d20e75286a45c3c44d4f9af567fff4c78dbf6ec414a60f3c602f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://s.plpstatic.ru/
Origin
http://copymoney.mrtext.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:32:12 GMT
x-content-type-options
nosniff
age
305097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19196
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:46:23 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 29 Nov 2022 21:32:12 GMT
67caa90f4bbc5306aaf6d4ea899dfc57.jpg
u21.plpstatic.ru/s/1ifc83051/2a085a920326bb969396f9975cb8559d/ 		306 B
650 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u21.plpstatic.ru/s/1ifc83051/2a085a920326bb969396f9975cb8559d/67caa90f4bbc5306aaf6d4ea899dfc57.jpg
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
80.93.179.60 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
046e1380cf81772ac16b98adc3477dec298a4a6a067dd51f37436d906ef558f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Server
openresty
Content-Type
image/jpeg
Expires
Sat, 03 Dec 2022 10:17:09 GMT
Cache-Control
max-age=31536000, public, max-age=2592000, s-maxage=2592000
X-Request-Time
0.000
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
306
X-Proxy-Cache
HIT
23d447208ea5fca4bbafe7b15c58b981.jpg
u21.plpstatic.ru/s/163qch4061/2a085a920326bb969396f9975cb8559d/ 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u21.plpstatic.ru/s/163qch4061/2a085a920326bb969396f9975cb8559d/23d447208ea5fca4bbafe7b15c58b981.jpg
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
80.93.179.60 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
c2f0f0091cfe99e9340495eccc58a862b60502a0b15db7069471e4bd77e75c23

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Fri, 03 Dec 2021 10:17:09 GMT
Server
openresty
Content-Type
image/jpeg
Expires
Sat, 03 Dec 2022 10:17:09 GMT
Cache-Control
max-age=31536000, public, max-age=2592000, s-maxage=2592000
X-Request-Time
0.000
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
40076
X-Proxy-Cache
HIT
758519364552978
connect.facebook.net/signals/config/ 		305 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/758519364552978?v=2.9.48&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3bfdeb35c2e6712284c96a536e5f5241d82bc86ee5f68f5de3c40d076d21ed63
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
QTVtShuC32f77ZmMs9TkVY1fBsn6chweChsDNP0YyTkNDFyXFAfjL5ECTJK09Dyv/FIZJlEj631lxK660eYgGA==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 03 Dec 2021 10:17:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=758519364552978&ev=PageView&dl=http%3A%2F%2Fcopymoney.mrtext.ru%2F&rl=&if=false&ts=1638526629960&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1638526629960.1481487411&it=1638526629866&coo=false&rqm=GET
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:17:09 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Fri, 03 Dec 2021 10:17:09 GMT
/
copymoney.mrtext.ru/ 		2 B
289 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://copymoney.mrtext.ru/
Requested by
Host: copymoney.mrtext.ru
URL: http://copymoney.mrtext.ru/
Protocol
HTTP/1.1
Server
85.119.149.96 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
openresty /
Resource Hash
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Request headers

Referer
http://copymoney.mrtext.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Fri, 03 Dec 2021 10:17:10 GMT
Server
openresty
Connection
keep-alive
Keep-Alive
timeout=20
Transfer-Encoding
chunked
Content-Type
application/octet-stream
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=758519364552978&ev=Microdata&dl=http%3A%2F%2Fcopymoney.mrtext.ru%2F&rl=&if=false&ts=1638526631464&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%D0%9C%D0%B8%D0%BD%D0%B8-%D0%BA%D1%83%D1%80%D1%81%20%C2%AB%E2%80%8E%D0%A3%D1%81%D0%BF%D0%B5%D1%88%D0%BD%D1%8B%D0%B9%20%D0%BA%D0%BE%D0%BF%D0%B8%D1%80%D0%B0%D0%B9%D1%82%D0%B5%D1%80%20%D0%BA%D0%B0%D0%BA%20%D0%B7%D0%B0%D1%80%D0%B0%D0%B1%D0%B0%D1%82%D1%8B%D0%B2%D0%B0%D1%82%D1%8C%20100%20000%20%D1%80%D1%83%D0%B1%D0%BB%D0%B5%D0%B9%20%D0%B2%20%D0%BC%D0%B5%D1%81%D1%8F%D1%86%20%D0%BD%D0%B0%20%D1%82%D0%B5%D0%BA%D1%81%D1%82%D0%B0%D1%85%C2%BB%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1638526629960.1481487411&it=1638526629866&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://copymoney.mrtext.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:17:11 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Fri, 03 Dec 2021 10:17:11 GMT

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| plp number| plp_page_id number| plp_content_id string| plp_lang string| lptag function| error_handler object| _trackJs function| fbq function| _fbq function| onYouTubeIframeAPIReady object| ytp function| $ function| jQuery function| _ object| Modernizr function| WOW object| store function| sweetAlertInitialize function| swal function| sweetAlert object| stackEffects function| Snowfall function| particlesJS object| creatium object| cr object| jQuery1110035093375022253936 object| goodshare object| x

2 Cookies

Domain/Path Name / Value
.mrtext.ru/ Name: _fbp
Value: fb.1.1638526629960.1481487411
copymoney.mrtext.ru/ Name: plp7_2919056
Value: 61a9eea607723f66761945

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
copymoney.mrtext.ru
fonts.gstatic.com
s.plpstatic.ru
u21.plpstatic.ru
www.facebook.com
2a00:1450:4001:803::2003
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
80.93.179.60
85.119.149.96
008154743af1b195c7d4b73c67101bc656d45219930c5206e3eb26499af222c4
046e1380cf81772ac16b98adc3477dec298a4a6a067dd51f37436d906ef558f8
074aa9cd8cbc7faacff2683de887204fc0ce0f3303f05680c1c9b8bf148077dd
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1c93b031ae7d6784e8d506789cb88b1345cf0384d43e710c944164875b19ca92
32060f721100af04d951cb0df05d3bdf1e67f65e56204b5b3873508c88c6aff1
3bfdeb35c2e6712284c96a536e5f5241d82bc86ee5f68f5de3c40d076d21ed63
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
4a8106ac064e738cd838a7a836bd9527ef3f6b40d9ef44dcdd742c3aef3d818c
5e6f25c73e33c988f6335eeeb5fcb71905d31951e6ad7d8d7d387ea3552e7ba3
65d6da3a6bfafe9c78b2bf1e00e5d724f68221a9e48d545969045bc1d6d26b46
6d667d5cfda46a7ba15af323d00258b1ecd0b20175f12a170fc7fc8f8432c586
8d9285e57657d4bf53b0e4f77fa52cd66c518722b77c44eb33f0869a18787181
9e8f00bed071bc169467cc91b1d2d8405ce391f070d10e6c97781c20d4d96170
a082cea8852599e45ab6564a61945b4524750e4bdd7f159dbe1fa6f74b11f4f1
acbaa72f68fd7ecda4ac57895168fe64bc5b706bdc5ad7745e2a9e86ecc6627c
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
c2f0f0091cfe99e9340495eccc58a862b60502a0b15db7069471e4bd77e75c23
cd01185f335d20e75286a45c3c44d4f9af567fff4c78dbf6ec414a60f3c602f8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629