Submitted URL: https://escortfete.com/redirect.htm
Effective URL: https://ventadistribution.ru/shmaller.htm
Submission: On October 14 via automatic, source openphish — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 87.236.16.49, located in St Petersburg, Russian Federation and belongs to BEGET-AS, RU. The main domain is ventadistribution.ru.
TLS certificate: Issued by R3 on October 3rd 2023. Valid for: 3 months.
This is the only time ventadistribution.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
8 87.236.16.49 198610 (BEGET-AS)
1 2a00:1148:db0... 47764 (VK-AS)
2 217.69.139.101 47764 (VK-AS)
12 4
Apex Domain
Subdomains
Transfer
8 ventadistribution.ru
ventadistribution.ru
860 KB
2 imgsmail.ru
img.imgsmail.ru — Cisco Umbrella Rank: 34272
1 KB
1 mradx.net
r.mradx.net — Cisco Umbrella Rank: 22016
1 KB
1 escortfete.com
escortfete.com
598 B
12 4
Domain Requested by
8 ventadistribution.ru ventadistribution.ru
2 img.imgsmail.ru ventadistribution.ru
1 r.mradx.net ventadistribution.ru
1 escortfete.com
12 4

This site contains no links.

Subject Issuer Validity Valid
escortfete.com
GTS CA 1P5
2023-08-27 -
2023-11-25
3 months crt.sh
ventadistribution.ru
R3
2023-10-03 -
2024-01-01
3 months crt.sh
*.mradx.net
GlobalSign RSA OV SSL CA 2018
2023-08-01 -
2024-09-01
a year crt.sh
*.imgsmail.ru
GlobalSign RSA OV SSL CA 2018
2023-02-14 -
2024-03-17
a year crt.sh

This page contains 2 frames:

Primary Page: https://ventadistribution.ru/shmaller.htm
Frame ID: 19D2A5336FB6C02A9101B0B7B953360C
Requests: 11 HTTP requests in this frame

Frame: https://ventadistribution.ru/shmaller_files/saved_resource.htm
Frame ID: 6DC2E3F2ADDD1733D989BDE93D3B8929
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

IMG_20230803_0001.pdf / Облако Mail.Ru

Page URL History Show full URLs

  1. https://escortfete.com/redirect.htm Page URL
  2. https://ventadistribution.ru/shmaller.htm Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

862 kB
Transfer

2994 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://escortfete.com/redirect.htm Page URL
  2. https://ventadistribution.ru/shmaller.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
redirect.htm
escortfete.com/
90 B
598 B
Document
General
Full URL
https://escortfete.com/redirect.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1dc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85e0907c498fb3fba205ace554f4cc3ebb713613e8d318065d29007b8f80ed0a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
816232ae0bf965dc-FRA
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Sat, 14 Oct 2023 19:23:38 GMT
last-modified
Thu, 12 Oct 2023 06:33:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
platform
hostinger
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P6W5TwEc7CCc49xrVx6brY%2B6dmV74f8sDuG%2FlV%2F65S91Bsb%2B8crAxkZk7aQ52G%2FtU%2Bu0AgzHJ5cs4KhWI9ocFJj0UVLct8Jsto0wYYcXixJnwSPf41FasdjQXAPqXU1Oe4BFsEMJjRzc5oz7TA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-turbo-charged-by
LiteSpeed
Primary Request shmaller.htm
ventadistribution.ru/
673 KB
225 KB
Document
General
Full URL
https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
f42a7690a03b4f56645644326e1f5f8e4ba21fbf9bab3d76c4bc17bc5093e818

Request headers

Referer
https://escortfete.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Sat, 14 Oct 2023 19:23:39 GMT
etag
W/"a84f8-60783e3b52962"
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
vary
Accept-Encoding
external.js
ventadistribution.ru/shmaller_files/
216 KB
42 KB
Script
General
Full URL
https://ventadistribution.ru/shmaller_files/external.js
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
622941c58a58f88b5a82675fc1f4be15c0b232030cbef896a060af6f89c0078c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"6527e346-35fea"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=604800
expires
Sat, 21 Oct 2023 19:23:39 GMT
mapi.htm
ventadistribution.ru/shmaller_files/
225 B
351 B
Script
General
Full URL
https://ventadistribution.ru/shmaller_files/mapi.htm
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
11374163be1580c6940c7344ab1a2845ef385474d9644fb90998f46a2bfb30e2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"e1-60783e3b50f58"
vary
Accept-Encoding
content-type
text/html
jquery.js
ventadistribution.ru/shmaller_files/
84 KB
29 KB
Script
General
Full URL
https://ventadistribution.ru/shmaller_files/jquery.js
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"6527e346-14e55"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=604800
expires
Sat, 21 Oct 2023 19:23:39 GMT
portal-menu__logo.svg
ventadistribution.ru/shmaller_files/
4 KB
2 KB
Image
General
Full URL
https://ventadistribution.ru/shmaller_files/portal-menu__logo.svg
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
293796339f774ab6c5a9c81739a61979410a25cbc6378013e57b00bdfebf1386

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"6527e346-fad"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=604800
expires
Sat, 21 Oct 2023 19:23:39 GMT
%2520%2520%2520-.htm
ventadistribution.ru/shmaller_files/
263 B
263 B
Image
General
Full URL
https://ventadistribution.ru/shmaller_files/%2520%2520%2520-.htm
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"107-60783e3b4db42"
vary
Accept-Encoding
content-type
text/html
main.css
ventadistribution.ru/shmaller_files/
2 MB
560 KB
Stylesheet
General
Full URL
https://ventadistribution.ru/shmaller_files/main.css
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
8df4bfb6d214e2a833550b9c1278ca338c605b191b521688db19d945adb019bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/shmaller.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
content-encoding
gzip
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
etag
W/"6527e346-1f779d"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=604800
expires
Sat, 21 Oct 2023 19:23:39 GMT
saved_resource.htm
ventadistribution.ru/shmaller_files/ Frame 6DC2
635 B
538 B
Document
General
Full URL
https://ventadistribution.ru/shmaller_files/saved_resource.htm
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.49 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.sectoid.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
7a9bad7357559979cd905dfcfc9eb96472e98d0180d301086a5ed90c86e8ad51

Request headers

Referer
https://ventadistribution.ru/shmaller.htm
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Sat, 14 Oct 2023 19:23:39 GMT
etag
W/"27b-60783e3b50f58"
last-modified
Thu, 12 Oct 2023 12:15:02 GMT
server
nginx-reuseport/1.21.1
vary
Accept-Encoding
65C1D5.svg
r.mradx.net/img/70/
2 KB
1 KB
Image
General
Full URL
https://r.mradx.net/img/70/65C1D5.svg
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:1148:db00::28 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
e80d001d44a491091e48a85aac180af5c6aa585f606ecc0ef812ff82cfa1c4ed

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Sat, 14 Oct 2023 19:23:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Aug 2018 15:44:32 GMT
Server
nginx
ETag
W/"5b69be60-6b9"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Connection
keep-alive
Timing-Allow-Origin
*
Expires
Thu, 31 Dec 2037 23:55:55 GMT
icons.png
img.imgsmail.ru/ph/0.58.21/authForm/
696 B
926 B
Image
General
Full URL
https://img.imgsmail.ru/ph/0.58.21/authForm/icons.png
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.69.139.101 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
img.imgsmail.ru
Software
nginx /
Resource Hash
24982aae0d85f39fc1ae4456e837394cf6f11a8f6de9f78729eddc922b8aa0ad
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2017 20:41:19 GMT
server
nginx
etag
"58a8b16f-2b8"
vary
Origin
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
timing-allow-origin
*
content-length
696
expires
Thu, 31 Dec 2037 23:55:55 GMT
close.v2.png
img.imgsmail.ru/p/popup/
196 B
411 B
Image
General
Full URL
https://img.imgsmail.ru/p/popup/close.v2.png
Requested by
Host: ventadistribution.ru
URL: https://ventadistribution.ru/shmaller.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.69.139.101 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
img.imgsmail.ru
Software
nginx /
Resource Hash
1d18375dcac07f3b45e1895c8c332781951a06f835c14dc916e03d55d565268a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ventadistribution.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Sat, 14 Oct 2023 19:23:39 GMT
x-content-type-options
nosniff
last-modified
Sat, 18 Feb 2017 20:41:24 GMT
server
nginx
etag
"58a8b174-c4"
content-type
image/png
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
196
expires
Sat, 21 Oct 2023 19:23:39 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery function| CheckPasswd

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests