ww1.refundrealestate.com Open in urlscan Pro
64.190.63.136 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://refundrealestate.com/azc7t
Effective URL:
http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Submission: On March 14 via api (March 14th 2024, 12:07:58 am UTC) from US — Scanned from US

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 7 domains to perform 16 HTTP transactions. The main IP is 64.190.63.136, located in Germany and belongs to SEDO-AS, DE. The main domain is ww1.refundrealestate.com.

This is the only time ww1.refundrealestate.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.227.226.240 67.227.226.240	32244 (LIQUIDWEB) (LIQUIDWEB)
2	64.190.63.136 64.190.63.136	47846 (SEDO-AS) (SEDO-AS)
2	67.225.218.50 67.225.218.50	32244 (LIQUIDWEB) (LIQUIDWEB)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2004	15169 (GOOGLE) (GOOGLE)
1	205.234.175.175 205.234.175.175	30081 (CACHENETW...) (CACHENETWORKS)
1	2607:f8b0:400... 2607:f8b0:4006:822::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:821::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
16	8

1 67.227.226.240 (United States) 1 redirects

ASN32244 (LIQUIDWEB, US)
PTR: lb01.parklogic.com

refundrealestate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.190.63.136 (Germany)

ASN47846 (SEDO-AS, DE)

ww1.refundrealestate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.225.218.50 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb01.parklogic.com

parking.parklogic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.234.175.175 (United States)

ASN30081 (CACHENETWORKS, US)
PTR: vip1.G-anycast1.cachefly.net

img.sedoparking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::2002 (United States)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:821::200e (United States)

ASN15169 (GOOGLE, US)

www.adsensecustomsearchads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:817::2001 (United States)

ASN15169 (GOOGLE, US)

afs.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	adsensecustomsearchads.com www.adsensecustomsearchads.com — Cisco Umbrella Rank: 2527	56 KB
3	refundrealestate.com 1 redirects refundrealestate.com ww1.refundrealestate.com	8 KB
2	googleusercontent.com afs.googleusercontent.com — Cisco Umbrella Rank: 9742	1 KB
2	parklogic.com parking.parklogic.com — Cisco Umbrella Rank: 201151	2 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 5045	597 B
1	sedoparking.com img.sedoparking.com — Cisco Umbrella Rank: 67337	14 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	52 KB
16	7

	Domain	Requested by
3	www.adsensecustomsearchads.com	www.google.com www.adsensecustomsearchads.com
2	afs.googleusercontent.com
2	parking.parklogic.com	ww1.refundrealestate.com parking.parklogic.com
2	ww1.refundrealestate.com	ww1.refundrealestate.com
1	partner.googleadservices.com	www.google.com
1	img.sedoparking.com	ww1.refundrealestate.com
1	www.google.com	ww1.refundrealestate.com
1	refundrealestate.com	1 redirects
16	8

This site contains links to these domains. Also see Links.

Domain
www.sedo.com

Subject Issuer	Validity	Valid
*.googleadservices.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Frame ID: 1AA0E7F2FDCF5FB1DD52B0AD9729269A
Requests: 11 HTTP requests in this frame

Frame: https://www.adsensecustomsearchads.com/afs/ads/i/iframe.html
Frame ID: 5EB5254E6CE4D49E96EE00E2B7E65089
Requests: 1 HTTP requests in this frame

Frame: https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C516795&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fww1.refundrealestate.com%2Fcaf%2F%3Fses%3DY3JlPTE3MTAzNzQ4NzImdGNpZD13dzEucmVmdW5kcmVhbGVzdGF0ZS5jb202NWYyM2ZkOGM5OTdmMi40MTE2OTczMCZ0YXNrPXNlYXJjaCZkb21haW49cmVmdW5kcmVhbGVzdGF0ZS5jb20mYV9pZD0zJnNlc3Npb249cWk5azNQS1htQmxSczdPdWVEY2s%3D&type=3&uiopt=false&swp=as-drid-2486365152940696&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C17301421%2C17301431%2C17301433%2C17301436%2C71847096&client_gdprApplies=0&format=r3%7Cs&nocache=1021710374872996&num=0&output=afd_ads&domain_name=ww1.refundrealestate.com&v=3&bsl=8&pac=0&u_his=2&u_tz=-600&dt=1710374873017&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=951&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=610814804&rurl=http%3A%2F%2Fww1.refundrealestate.com%2Fazc7t%3Fusid%3D15%26utid%3D27413918036
Frame ID: B809B62DB732C8798DEB37830101C413
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

refundrealestate.com - refundrealestate Resources and Information.

Page URL History Show full URLs

http://refundrealestate.com/azc7t HTTP 302
http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036 Page URL

Detected technologies

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

Page Statistics

16
Requests

38 %
HTTPS

50 %
IPv6

7
Domains

8
Subdomains

8
IPs

2
Countries

133 kB
Transfer

335 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sedo.com/services/parking.php3
Title: Sedo Domain Parking

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://refundrealestate.com/azc7t HTTP 302
http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request azc7t Show response
ww1.refundrealestate.com/
Redirect Chain

http://refundrealestate.com/azc7t
http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036

22 KB
8 KB

354ms
124ms

Document
text/html

64.190.63.136
SEDO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Protocol: HTTP/1.1
Server: 64.190.63.136 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software: NginX / PHP/8.1.17
Resource Hash: 76f5dd705ee4911f83f67b8a5b557f4c22ea8017d4576a376e6ce11c61213aab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 14 Mar 2024 00:07:52 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 14 Mar 2024 00:07:52 GMT
pragma: no-cache
server: NginX
transfer-encoding: chunked
vary: Accept-Encoding
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_TPSPkRhFmjr6RIXDzvsKVWb+jlExsm8fXsf0wbW0JY9sXOhI9MGGbBnvdLjIYW1Qpw+NEzeO/fSdKkIte2KSVg==
x-cache-miss-from: parking-5747c769c4-hhv8v
x-powered-by: PHP/8.1.17

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 14 Mar 2024 00:07:52 GMT
Location: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Pragma: no-cache
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16

GET
H/1.1 200
OK enhance.js Show response
parking.parklogic.com/page/ 1 KB
1 KB 93ms
39ms Script
text/javascript 67.225.218.50
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://parking.parklogic.com/page/enhance.js?pcId=2&domain=refundrealestate.com
Requested by: Host: ww1.refundrealestate.com
URL: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Protocol: HTTP/1.1
Server: 67.225.218.50 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash: 2926b830591229100fc07b76b8641ad64aa76295cc98521f2083a2cf16073360

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Thu, 14 Mar 2024 00:07:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
Connection: Keep-Alive
X-Powered-By: PHP/5.4.16
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/javascript

GET
H/1.1 200
OK caf.js Show response
www.google.com/adsense/domains/ 141 KB
52 KB 22ms
17ms Script
text/javascript 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.google.com/adsense/domains/caf.js

Requested by

Host: ww1.refundrealestate.com
URL: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036

Protocol

HTTP/1.1

Server

2607:f8b0:4006:81e::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c816422093e8caadfc1abf2fa0e8491962bddc831179a9580d2943066745242

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Thu, 14 Mar 2024 00:07:52 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
ETag: "931756533773701105"
Vary: Accept-Encoding
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Content-Type: text/javascript; charset=UTF-8
Cache-Control: private, max-age=3600
Accept-Ranges: bytes
Link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
Expires: Thu, 14 Mar 2024 00:07:52 GMT

GET
H/1.1 200
OK arrows-curved.png
img.sedoparking.com/templates/bg/ 13 KB
14 KB 19ms
3ms Image
image/png 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.sedoparking.com/templates/bg/arrows-curved.png
Requested by: Host: ww1.refundrealestate.com
URL: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Protocol: HTTP/1.1
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 7aa2a3e9a9575a27f5593c3b0357423128c468a46ed20d284ce5a21555ee67bc

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Thu, 14 Mar 2024 00:07:52 GMT
x-cf-tsc: 1692335877
X-CF3: H
CF4ttl: 31536000.000
X-CF1: 11696:fB.ewr1:cf:cacheN.ewr1-01:H
X-CF-ReqID: e3a838d01896c1d20f5e7b3bfab5f901
Connection: keep-alive
Content-Length: 13502
X-CF2: H
Last-Modified: Tue, 12 Oct 2021 05:19:02 GMT
Server: CFS 0215
X-CFF: B
Content-Type: image/png
Access-Control-Allow-Origin: *
X-CFHash: "107694ee1e94990d97b7e58651ffd6a0"
Cache-Control: max-age=604800
CF4Age: 0
Accept-Ranges: bytes
Expires: Thu, 21 Mar 2024 00:07:52 GMT

GET
H/1.1 200
OK scribe.php Show response
parking.parklogic.com/page/ 50 B
365 B 66ms
35ms Fetch
text/html 67.225.218.50
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=refundrealestate.com&pId=130&usid=15&utid=27413918036&query=null&domainJs=ww1.refundrealestate.com&path=/azc7t&ss=true&lp=1
Requested by: Host: parking.parklogic.com
URL: http://parking.parklogic.com/page/enhance.js?pcId=2&domain=refundrealestate.com
Protocol: HTTP/1.1
Server: 67.225.218.50 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash: 65677216950b148bb05b4e820f53dde24a0ee43782262849abe5069c9ceb7fae

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Thu, 14 Mar 2024 00:07:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 394 B
597 B 211ms
17ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=ww1.refundrealestate.com&client=dp-sedo80_3ph&product=SAS&callback=__sasCookie

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cca2e46696fb26eafd4846fa8ff67781abbd610a7d9d6eb76c7cf400106e81df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 00:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 245
x-xss-protection: 0

GET
H2 200 iframe.html Show response
www.adsensecustomsearchads.com/afs/ads/i/ Frame 5EB5 2 KB
1 KB 222ms
36ms Document
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.adsensecustomsearchads.com/afs/ads/i/iframe.html

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b01520c343b6a495a4bd2fd3d4a3b6cdc53eded8929dbe4b4cc847d506ee0889

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-_qS5_GtyIXIxhH7-AqkDqQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ww1.refundrealestate.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 729
content-security-policy: script-src 'nonce-_qS5_GtyIXIxhH7-AqkDqQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Mar 2024 00:07:53 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 12 Mar 2024 06:00:00 GMT
pragma: no-cache
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
www.adsensecustomsearchads.com/afs/ Frame B809 14 KB
3 KB 119ms
116ms Document
text/html 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C516795&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fww1.refundrealestate.com%2Fcaf%2F%3Fses%3DY3JlPTE3MTAzNzQ4NzImdGNpZD13dzEucmVmdW5kcmVhbGVzdGF0ZS5jb202NWYyM2ZkOGM5OTdmMi40MTE2OTczMCZ0YXNrPXNlYXJjaCZkb21haW49cmVmdW5kcmVhbGVzdGF0ZS5jb20mYV9pZD0zJnNlc3Npb249cWk5azNQS1htQmxSczdPdWVEY2s%3D&type=3&uiopt=false&swp=as-drid-2486365152940696&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C17301421%2C17301431%2C17301433%2C17301436%2C71847096&client_gdprApplies=0&format=r3%7Cs&nocache=1021710374872996&num=0&output=afd_ads&domain_name=ww1.refundrealestate.com&v=3&bsl=8&pac=0&u_his=2&u_tz=-600&dt=1710374873017&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=951&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=610814804&rurl=http%3A%2F%2Fww1.refundrealestate.com%2Fazc7t%3Fusid%3D15%26utid%3D27413918036

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

12d1c568f45d0b66754a6bd17e643d38d499f8e4713e32992a5a6d01ca8c0bd8

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-D0WSCBCN0kmve6pqpFQM7g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Xss-Protection	0

Request headers

Referer: http://ww1.refundrealestate.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-disposition: inline
content-encoding: br
content-length: 2825
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-D0WSCBCN0kmve6pqpFQM7g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
content-type: text/html; charset=UTF-8
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
date: Thu, 14 Mar 2024 00:07:53 GMT
expires: Thu, 14 Mar 2024 00:07:53 GMT
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
server: gws
x-xss-protection: 0

GET
H/1.1 200
OK tsc.php Show response
ww1.refundrealestate.com/search/ 0
201 B 98ms
98ms XHR
text/html 64.190.63.136
SEDO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ww1.refundrealestate.com/search/tsc.php?200=NTM0MjE2MDg1&21=NS4xODEuMjM0LjEzMg==&681=MTcxMDM3NDg3Mjk4NzE4NGY1ZWNiMjk3NjE3NmRmYzQ2ZTUwYTA4MDVh&crc=85f1be437db1d2a1a9a6d454fb2e448bcd4635db&cv=1
Requested by: Host: ww1.refundrealestate.com
URL: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
Protocol: HTTP/1.1
Server: 64.190.63.136 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software: NginX / PHP/8.1.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: http://ww1.refundrealestate.com/azc7t?usid=15&utid=27413918036
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 00:07:53 GMT
x-cache-miss-from: parking-5747c769c4-wlt8g
server: NginX
x-powered-by: PHP/8.1.17
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 caf.js Show response
www.adsensecustomsearchads.com/adsense/domains/ Frame B809 141 KB
51 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0

Requested by

Host: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C516795&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fww1.refundrealestate.com%2Fcaf%2F%3Fses%3DY3JlPTE3MTAzNzQ4NzImdGNpZD13dzEucmVmdW5kcmVhbGVzdGF0ZS5jb202NWYyM2ZkOGM5OTdmMi40MTE2OTczMCZ0YXNrPXNlYXJjaCZkb21haW49cmVmdW5kcmVhbGVzdGF0ZS5jb20mYV9pZD0zJnNlc3Npb249cWk5azNQS1htQmxSczdPdWVEY2s%3D&type=3&uiopt=false&swp=as-drid-2486365152940696&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C17301421%2C17301431%2C17301433%2C17301436%2C71847096&client_gdprApplies=0&format=r3%7Cs&nocache=1021710374872996&num=0&output=afd_ads&domain_name=ww1.refundrealestate.com&v=3&bsl=8&pac=0&u_his=2&u_tz=-600&dt=1710374873017&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=951&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=610814804&rurl=http%3A%2F%2Fww1.refundrealestate.com%2Fazc7t%3Fusid%3D15%26utid%3D27413918036

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98bde8fe7ddbb932a732ec5b607b2768781b07ba2caca84ed02b4d86a0c1106d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.adsensecustomsearchads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 00:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "10011317064628284126"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
expires: Thu, 14 Mar 2024 00:07:53 GMT

GET
H2 200 search.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame B809 391 B
797 B 21ms
5ms Image
image/svg+xml 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.adsensecustomsearchads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Mar 2024 17:57:03 GMT
age: 22250
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 272
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Thu, 14 Mar 2024 16:57:03 GMT

GET
H2 200 chevron.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame B809 200 B
289 B 21ms
6ms Image
image/svg+xml 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.adsensecustomsearchads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Mar 2024 17:22:15 GMT
age: 24338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Thu, 14 Mar 2024 16:22:15 GMT

GET gen_204
www.adsensecustomsearchads.com/afs/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=crekv7b4a748&aqid=2T_yZeLWDrO1nboPy9mfCA&psid=3259787283&pbt=bs&adbx=520&adby=134.625&adbh=551&adbw=560&adbah=178%2C178%2C178&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=610814804&csala=27%7C0%7C296%7C32%7C12&lle=0&ifv=1&hpt=0&wbd=false

Domain: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=yvqhs4b7zled&aqid=2T_yZeLWDrO1nboPy9mfCA&pbt=bs&adbx=650&adby=807.625&adbh=16&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo80_3ph&errv=610814804&csala=5%7C0%7C318%7C32%7C12&lle=0&ifv=1&hpt=0&wbd=false

Domain: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=6d1m9e8fx86b&aqid=2T_yZeLWDrO1nboPy9mfCA&psid=3259787283&pbt=bv&adbx=520&adby=134.625&adbh=551&adbw=560&adbah=178%2C178%2C178&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=610814804&csala=27%7C0%7C296%7C32%7C12&lle=0&ifv=1&hpt=0&wbd=false

Domain: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=v0whbuc3aq1j&aqid=2T_yZeLWDrO1nboPy9mfCA&pbt=bv&adbx=650&adby=807.625&adbh=16&adbw=300&adbn=slave-1-1&eawp=partner-dp-sedo80_3ph&errv=610814804&csala=5%7C0%7C318%7C32%7C12&lle=0&ifv=1&hpt=0&wbd=false

Verdicts & Comments Add Verdict or Comment

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.refundrealestate.com/	1970-01-21 04:27:50	Name: __gsas Value: ID=7cf518e97da7abab:T=1710374873:RT=1710374873:S=ALNI_MaG5_an8n87i1sEutuRhlziY8--Xw

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: http://www.google.com/adsense/domains/caf.js(Line 200) Message: Unrecognized feature: 'attribution-reporting'.
security	warning	URL: https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0(Line 88) Message: Mixed Content: The page at 'https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=3259787283&channel=exp-0051%2Cauxa-control-1%2C516795&client=dp-sedo80_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fww1.refundrealestate.com%2Fcaf%2F%3Fses%3DY3JlPTE3MTAzNzQ4NzImdGNpZD13dzEucmVmdW5kcmVhbGVzdGF0ZS5jb202NWYyM2ZkOGM5OTdmMi40MTE2OTczMCZ0YXNrPXNlYXJjaCZkb21haW49cmVmdW5kcmVhbGVzdGF0ZS5jb20mYV9pZD0zJnNlc3Npb249cWk5azNQS1htQmxSczdPdWVEY2s%3D&type=3&uiopt=false&swp=as-drid-2486365152940696&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C17301421%2C17301431%2C17301433%2C17301436%2C71847096&client_gdprApplies=0&format=r3%7Cs&nocache=1021710374872996&num=0&output=afd_ads&domain_name=ww1.refundrealestate.com&v=3&bsl=8&pac=0&u_his=2&u_tz=-600&dt=1710374873017&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=951&frm=0&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=610814804&rurl=http%3A%2F%2Fww1.refundrealestate.com%2Fazc7t%3Fusid%3D15%26utid%3D27413918036' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://ww1.refundrealestate.com/caf/?ses=Y3JlPTE3MTAzNzQ4NzImdGNpZD13dzEucmVmdW5kcmVhbGVzdGF0ZS5jb202NWYyM2ZkOGM5OTdmMi40MTE2OTczMCZ0YXNrPXNlYXJjaCZkb21haW49cmVmdW5kcmVhbGVzdGF0ZS5jb20mYV9pZD0zJnNlc3Npb249cWk5azNQS1htQmxSczdPdWVEY2s='. This endpoint should be made available over a secure connection.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

afs.googleusercontent.com
img.sedoparking.com
parking.parklogic.com
partner.googleadservices.com
refundrealestate.com
ww1.refundrealestate.com
www.adsensecustomsearchads.com
www.google.com
www.adsensecustomsearchads.com
205.234.175.175
2607:f8b0:4006:817::2001
2607:f8b0:4006:81e::2004
2607:f8b0:4006:821::200e
2607:f8b0:4006:822::2002
64.190.63.136
67.225.218.50
67.227.226.240
12d1c568f45d0b66754a6bd17e643d38d499f8e4713e32992a5a6d01ca8c0bd8
2926b830591229100fc07b76b8641ad64aa76295cc98521f2083a2cf16073360
5c816422093e8caadfc1abf2fa0e8491962bddc831179a9580d2943066745242
65677216950b148bb05b4e820f53dde24a0ee43782262849abe5069c9ceb7fae
76f5dd705ee4911f83f67b8a5b557f4c22ea8017d4576a376e6ce11c61213aab
7aa2a3e9a9575a27f5593c3b0357423128c468a46ed20d284ce5a21555ee67bc
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1
920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563
98bde8fe7ddbb932a732ec5b607b2768781b07ba2caca84ed02b4d86a0c1106d
b01520c343b6a495a4bd2fd3d4a3b6cdc53eded8929dbe4b4cc847d506ee0889
cca2e46696fb26eafd4846fa8ff67781abbd610a7d9d6eb76c7cf400106e81df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

ww1.refundrealestate.com Open in urlscan Pro 64.190.63.136 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

38 %HTTPS

50 %IPv6

7 Domains

8 Subdomains

8 IPs

2 Countries

133 kBTransfer

335 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

37 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

ww1.refundrealestate.com Open in urlscan Pro
64.190.63.136 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

38 %
HTTPS

50 %
IPv6

7
Domains

8
Subdomains

8
IPs

2
Countries

133 kB
Transfer

335 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions