Submitted URL: http://cmvwdevaykmftwdischf.ahdaaf.org/Le/xx.php?REDACTED
Effective URL: http://www.gold1.life/
Submission: On March 30 via automatic, source openphish

Summary

This website contacted 4 IPs in 2 countries across 7 domains to perform 10 HTTP transactions. The main IP is 160.153.128.46, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is www.gold1.life.
This is the only time www.gold1.life was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 217.182.8.57 16276 (OVH)
1 1 104.31.66.6 13335 (CLOUDFLAR...)
1 2 160.153.128.46 26496 (AS-26496-...)
1 104.27.182.206 13335 (CLOUDFLAR...)
6 216.58.207.66 15169 (GOOGLE)
2 172.217.22.66 15169 (GOOGLE)
10 4
Domain Requested by
6 pagead2.googlesyndication.com www.gold1.life
pagead2.googlesyndication.com
2 www.gold1.life 1 redirects
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.com.ua pagead2.googlesyndication.com
1 smikta.net www.gold1.life
1 www.warz.online 1 redirects
1 cmvwdevaykmftwdischf.ahdaaf.org 1 redirects
10 7

This site contains links to these domains. Also see Links.

Domain
www.glype.com
Subject Issuer Validity Valid

This page contains 4 frames:

Primary Page: http://www.gold1.life/
Frame ID: FF384936EA24F71532E55033590D3EA
Requests: 6 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Frame ID: F626A0AEA08D4075993AF255C119355F
Requests: 2 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Frame ID: 8FC06725A147993A5B6E201A0A9FCAE1
Requests: 1 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Frame ID: E8E33464707921B9B30969FD00F595E8
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://cmvwdevaykmftwdischf.ahdaaf.org/Le/xx.php?REDACTED HTTP 302
    http://www.warz.online/live.php HTTP 302
    http://www.gold1.life/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^google_ad_/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i

Overall confidence: 100%
Detected patterns
  • env /^gaGlobal$/i

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

4
IPs

2
Countries

125 kB
Transfer

678 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cmvwdevaykmftwdischf.ahdaaf.org/Le/xx.php?REDACTED HTTP 302
    http://www.warz.online/live.php HTTP 302
    http://www.gold1.life/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.gold1.life/includes/main.js?1.4.15 HTTP 302
  • http://smikta.net/protected?1.4.15

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.gold1.life/
Redirect Chain
  • http://cmvwdevaykmftwdischf.ahdaaf.org/Le/xx.php?REDACTED
  • http://www.warz.online/live.php
  • http://www.gold1.life/
8 KB
3 KB
Document
General
Full URL
http://www.gold1.life/
Protocol
HTTP/1.1
Server
160.153.128.46 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-160-153-128-46.ip.secureserver.net
Software
Apache / PHP/5.4.45
Resource Hash
c9e841f75c29fa629fd95f8166faddfa09c2916864b5f24b3260234f1723dcb4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.gold1.life
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 30 Mar 2018 18:56:37 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Sep 2017 09:01:09 GMT
Server
Apache
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding,User-Agent
Content-Type
text/html
Set-Cookie
s=jjkfnkpjeakjhrckp8mjlcumh6; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
2927

Redirect headers

Date
Fri, 30 Mar 2018 18:56:37 GMT
Server
cloudflare
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding,User-Agent
Content-Type
text/html
Location
http://www.gold1.life
Set-Cookie
__cfduid=d99d86629c81111c742a60f8c5b2c048c1522436197; expires=Sat, 30-Mar-19 18:56:37 GMT; path=/; domain=.warz.online; HttpOnly
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
403ccc1c774b2762-FRA
Cookie set protected
smikta.net/
Redirect Chain
  • http://www.gold1.life/includes/main.js?1.4.15
  • http://smikta.net/protected?1.4.15
0
0
Script
General
Full URL
http://smikta.net/protected?1.4.15
Requested by
Host: www.gold1.life
URL: http://www.gold1.life/
Protocol
HTTP/1.1
Server
104.27.182.206 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
smikta.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://www.gold1.life/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Fri, 30 Mar 2018 18:56:38 GMT
Content-Encoding
gzip
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Set-Cookie
__cfduid=ddd9bf0eb53950b197009762561c2a9651522436197; expires=Sat, 30-Mar-19 18:56:37 GMT; path=/; domain=.smikta.net; HttpOnly
Connection
keep-alive
CF-RAY
403ccc1d308396d6-FRA

Redirect headers

Location
http://smikta.net/protected?1.4.15
Date
Fri, 30 Mar 2018 18:56:37 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
218
Content-Type
text/html; charset=iso-8859-1
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
70 KB
26 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.gold1.life
URL: http://www.gold1.life/
Protocol
HTTP/1.1
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
85adce93b42a820975d5de6265f2b99bcc0563e772690c2331725fd7401670bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Fri, 30 Mar 2018 18:56:37 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
10809832035539517893
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
26442
X-XSS-Protection
1; mode=block
Expires
Fri, 30 Mar 2018 18:56:37 GMT
integrator.js
adservice.google.com.ua/adsid/
111 B
633 B
Script
General
Full URL
https://adservice.google.com.ua/adsid/integrator.js?domain=www.gold1.life
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Mar 2018 18:56:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="42,41,39,35",hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length
105
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
111 B
633 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.gold1.life
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Mar 2018 18:56:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="42,41,39,35",hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length
105
x-xss-protection
1; mode=block
ca-pub-1197260706192222.js
pagead2.googlesyndication.com/pub-config/r20160913/
225 B
613 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1197260706192222.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
sffe /
Resource Hash
52198fe753c18904faad4a4ca53ce12833d84501949ebe576ef640232e25a8f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 30 Mar 2018 08:25:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 29 Mar 2018 21:05:51 GMT
server
sffe
age
37878
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="42,41,39,35",hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length
159
x-xss-protection
1; mode=block
expires
Fri, 30 Mar 2018 20:25:20 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/ Frame F626
175 KB
65 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
910aa1228a6fed9d1da1af83c5af2bf570214656196039c8cc112bafe8c9bac3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Fri, 30 Mar 2018 18:56:38 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
9068830962689697644
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
66427
X-XSS-Protection
1; mode=block
Expires
Fri, 30 Mar 2018 18:56:38 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/ Frame F626
75 KB
28 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Protocol
SPDY
Server
172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s17-in-f66.1e100.net
Software
cafe /
Resource Hash
0083e7f86b56688c06123b1d38881f358d1099fd6cae8380b2943e1fd2586a2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Wed, 28 Mar 2018 05:23:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
221591
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="42,41,39,35",hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length
28253
x-xss-protection
1; mode=block
server
cafe
etag
17944869355315252644
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 11 Apr 2018 05:23:27 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/ Frame 8FC0
175 KB
0
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
910aa1228a6fed9d1da1af83c5af2bf570214656196039c8cc112bafe8c9bac3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Fri, 30 Mar 2018 18:56:38 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=UTF-8
Server
cafe
ETag
9068830962689697644
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
66427
X-XSS-Protection
1; mode=block
Expires
Fri, 30 Mar 2018 18:56:38 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/ Frame E8E3
175 KB
0
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180327/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
910aa1228a6fed9d1da1af83c5af2bf570214656196039c8cc112bafe8c9bac3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Fri, 30 Mar 2018 18:56:38 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=UTF-8
Server
cafe
ETag
9068830962689697644
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
66427
X-XSS-Protection
1; mode=block
Expires
Fri, 30 Mar 2018 18:56:38 GMT

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ginf object| adsbygoogle object| google_js_reporting_queue object| google_ad_modifications boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken function| google_spfd number| google_unique_id object| google_t12n_vars object| google_jobrunner object| google_iframe_oncopy object| google_persistent_state_async object| google_reactive_ads_global_state object| google_pub_config object| __google_ad_urls number| google_global_correlator object| gaGlobal object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_AdSense_getAdAdapterInstance boolean| google_onload_fired function| google_osd_amcb

2 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
www.gold1.life/ Name: s
Value: jjkfnkpjeakjhrckp8mjlcumh6