s1-adfly.com - urlscan.io

Summary

This website contacted 4 IPs in 1 countries across 5 domains to perform 4 HTTP transactions. The main IP is 2606:4700:31::681f:3ad, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is s1-adfly.com.

This is the only time s1-adfly.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:31:... 2606:4700:31::681f:3ad	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 3	2606:4700:20:... 2606:4700:20::6819:d374	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.2.110 151.101.2.110	54113 (FASTLY) (FASTLY - Fastly)
1	162.247.242.21 162.247.242.21	23467 (NEWRELIC-...) (NEWRELIC-AS-1 - New Relic)
4	4

1 2606:4700:31::681f:3ad (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

s1-adfly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::6819:d374 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

getcryptotab.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
get.cryptobrowser.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.242.21 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cryptobrowser.site 1 redirects get.cryptobrowser.site	269 B
1	nr-data.net bam.nr-data.net	261 B
1	newrelic.com js-agent.newrelic.com	9 KB
1	getcryptotab.com 1 redirects getcryptotab.com	334 B
1	s1-adfly.com s1-adfly.com	6 KB
4	5

	Domain	Requested by
2	get.cryptobrowser.site	1 redirects s1-adfly.com
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	s1-adfly.com
1	getcryptotab.com	1 redirects
1	s1-adfly.com
4	5

This site contains no links.

Subject Issuer	Validity	Valid
ssl371078.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-12-28` - `2019-07-06`	6 months	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-01-08` - `2019-04-14`	3 months	crt.sh
*.nr-data.net GeoTrust RSA CA 2018	`2018-01-11` - `2020-03-17`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
Frame ID: 211ED82EC887E938654E729E5FF23476
Requests: 3 HTTP requests in this frame

Frame: https://get.cryptobrowser.site/en/1/798962/?f=ct
Frame ID: 293F19192E4176A1DBA95FDA53D3AC01
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

New Relic (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^NREUM/i

Page Statistics

4
Requests

75 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

16 kB
Transfer

38 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://getcryptotab.com/798962 HTTP 302
https://get.cryptobrowser.site/798962?f=ct HTTP 302
https://get.cryptobrowser.site/en/1/798962/?f=ct

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set show.php Show response
s1-adfly.com/ 14 KB
6 KB 228ms
222ms Document
text/html 2606:4700:31::681f:3ad
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
Protocol: HTTP/1.1
Server: 2606:4700:31::681f:3ad , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.31
Resource Hash: d69bfd2e70bcab748ae8122318ca0bde61e6784eb46b2470bb053c918ee0e03f

Request headers

Host: s1-adfly.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 10 Jan 2019 08:08:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d567d290ac2aa2649eaa1583e5244415e1547107711; expires=Fri, 10-Jan-20 08:08:31 GMT; path=/; domain=.s1-adfly.com; HttpOnly
X-Powered-By: PHP/5.6.31
Vary: Accept-Encoding
X-Turbo-Charged-By: LiteSpeed
Server: cloudflare
CF-RAY: 496da7ff06d0c2f6-FRA
Content-Encoding: gzip

GET
H2

200

/
get.cryptobrowser.site/en/1/798962/ Frame 293F
Redirect Chain

https://getcryptotab.com/798962
https://get.cryptobrowser.site/798962?f=ct
https://get.cryptobrowser.site/en/1/798962/?f=ct

0
0

20ms
20ms

Document
text/html

2606:4700:20::6819:d374
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cryptobrowser.site/en/1/798962/?f=ct

Requested by

Host: s1-adfly.com
URL: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:20::6819:d374 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: get.cryptobrowser.site
:scheme: https
:path: /en/1/798962/?f=ct
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
accept-encoding: gzip, deflate, br
cookie: __cfduid=dbcc5bea99655070fb75a7fdceae80a031547107712
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962

Response headers

status: 200
date: Thu, 10 Jan 2019 08:08:32 GMT
content-type: text/html; charset=utf-8
content-language: en
strict-transport-security: max-age=15768000
cf-cache-status: HIT
expires: Thu, 10 Jan 2019 09:08:32 GMT
cache-control: public, max-age=3600
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 496da8025ed496dc-FRA
content-encoding: br

Redirect headers

status: 302
date: Thu, 10 Jan 2019 08:08:32 GMT
content-type: text/html; charset=utf-8
content-length: 0
set-cookie: __cfduid=dbcc5bea99655070fb75a7fdceae80a031547107712; expires=Fri, 10-Jan-20 08:08:32 GMT; path=/; domain=.cryptobrowser.site; HttpOnly
location: /en/1/798962/?f=ct
cache-control: max-age=0, s-maxage=0, no-cache, no-store, must-revalidate
expires: Thu, 10 Jan 2019 08:08:32 GMT
vary: Accept-Language, Cookie, Accept-Encoding
content-language: en
strict-transport-security: max-age=15768000
cf-cache-status: MISS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 496da8014dc396dc-FRA

GET
H2 200 nr-1118.min.js Show response
js-agent.newrelic.com/ 24 KB
9 KB 55ms
7ms Script
application/javascript 151.101.2.110
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1118.min.js
Requested by: Host: s1-adfly.com
URL: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3622d2041fd2390dd10eb9832096e4b89d1b925565650f004aea76adbd54f5f0

Request headers

Referer: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 10 Jan 2019 08:08:33 GMT
content-encoding: gzip
x-amz-request-id: 7429231C32B09054
x-cache: HIT
status: 200
content-length: 9288
x-amz-id-2: DSE/JvhT4QvObLHgH80fHvU/numSTuSuI9aFyf67fj7IP5z7RCF5g/NxZgTmYA5p5BDIf4eZXEo=
x-served-by: cache-hhn1541-HHN
last-modified: Wed, 02 Jan 2019 18:42:29 GMT
server: AmazonS3
x-timer: S1547107713.011530,VS0,VE0
etag: "bc81ced41f6342ffafc5ff34bc0fc8f7"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 6887

GET
H/1.1 200
OK 92a411bc23 Show response
bam.nr-data.net/1/ 57 B
261 B 457ms
113ms Script
text/javascript 162.247.242.21
New Relic

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/92a411bc23?a=2344943,2334836&v=1118.0c07c19&to=YlNSbUYAV0IFBhdaWVsZZUtdTkpZCxJNQ15F&rst=1198&ref=http://s1-adfly.com/show.php&be=237&fe=1126&dc=243&af=err,xhr&perf=%7B%22timing%22:%7B%22of%22:1547107711832,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:1,%22c%22:1,%22ce%22:6,%22rq%22:6,%22rp%22:229,%22rpe%22:231,%22dl%22:232,%22di%22:243,%22ds%22:243,%22de%22:243,%22dc%22:1125,%22l%22:1125,%22le%22:1127%7D,%22navigation%22:%7B%7D%7D&at=ThRRGw4aREw%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1118.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.21 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS: bam-9.nr-data.net
Software: /
Resource Hash: f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer: http://s1-adfly.com/show.php?url=https://getcryptotab.com/798962
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 57
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1970-01-19 03:35:45	Name: PREF Value: f1=50000000
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: X7pOUK9-bwo
.youtube.com/	1970-01-19 02:04:19	Name: VISITOR_INFO1_LIVE Value: XkW-F4SI8a8
.cryptobrowser.site/	1970-01-18 21:45:07	Name: _gat_gtag_UA_117769860_4 Value: 1
.cryptobrowser.site/	1970-01-18 21:46:34	Name: _gid Value: GA1.2.104022359.1547107713
.youtube.com/	1970-01-18 21:45:09	Name: GPS Value: 1
.s1-adfly.com/	1970-01-19 06:30:43	Name: __cfduid Value: d567d290ac2aa2649eaa1583e5244415e1547107711
.cryptobrowser.site/	1970-01-19 06:30:43	Name: __cfduid Value: dbcc5bea99655070fb75a7fdceae80a031547107712
.cryptobrowser.site/	1970-01-19 15:16:19	Name: _ga Value: GA1.2.0036f6dc-d858-33ae-3456-f6dcd8583456
.cryptobrowser.site/	1970-01-20 17:33:07	Name: _ctt_id Value: 0036f6dc-d858-33ae-3456-f6dcd8583456

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
get.cryptobrowser.site
getcryptotab.com
js-agent.newrelic.com
s1-adfly.com
151.101.2.110
162.247.242.21
2606:4700:20::6819:d374
2606:4700:31::681f:3ad
3622d2041fd2390dd10eb9832096e4b89d1b925565650f004aea76adbd54f5f0
d69bfd2e70bcab748ae8122318ca0bde61e6784eb46b2470bb053c918ee0e03f
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

s1-adfly.com Open in urlscan Pro 2606:4700:31::681f:3ad Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

50 %IPv6

5 Domains

5 Subdomains

4 IPs

1 Countries

16 kBTransfer

38 kBSize

10 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

10 Cookies

Indicators

s1-adfly.com Open in urlscan Pro
2606:4700:31::681f:3ad Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

16 kB
Transfer

38 kB
Size

10
Cookies

4 HTTP transactions
0 data transactions