ga2safe.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 185.7.97.99, located in Netherlands and belongs to MOJHOST-EU, NL. The main domain is ga2safe.com.
TLS certificate: Issued by R3 on March 8th 2023. Valid for: 3 months.

This is the only time ga2safe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	217.22.16.16 217.22.16.16	42567 (MOJHOST-EU) (MOJHOST-EU)
1	185.7.97.99 185.7.97.99	42567 (MOJHOST-EU) (MOJHOST-EU)
4	185.7.97.104 185.7.97.104	42567 (MOJHOST-EU) (MOJHOST-EU)
5	2

1 217.22.16.16 (Netherlands) 1 redirects

ASN42567 (MOJHOST-EU, NL)
PTR: smtp1-22.securesendings.com

securesendings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.7.97.99 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
PTR: smtp1-7.ga2safe.com

ga2safe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.7.97.104 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
PTR: smtp1-5.trackingbuddies.com

trackingbuddies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	trackingbuddies.com trackingbuddies.com	326 KB
1	ga2safe.com ga2safe.com	23 KB
1	securesendings.com 1 redirects securesendings.com	614 B
5	3

	Domain	Requested by
4	trackingbuddies.com	ga2safe.com
1	ga2safe.com
1	securesendings.com	1 redirects
5	3

This site contains links to these domains. Also see Links.

Domain
umbalabob.go2cloud.org

Subject Issuer	Validity	Valid
ga2safe.com R3	`2023-03-08` - `2023-06-06`	3 months	crt.sh
trackingbuddies.com R3	`2023-03-08` - `2023-06-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8
Frame ID: 28252832BAC6CCAA3106DAA6986E1936
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://securesendings.com/ga/click/2-5013272-5-4995-14804-5387-6ad973a735-8ceaeca960 HTTP 302
https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

349 kB
Transfer

347 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://umbalabob.go2cloud.org/aff_ad?campaign_id=5&aff_id=12&aff_sub5=&source=

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://securesendings.com/ga/click/2-5013272-5-4995-14804-5387-6ad973a735-8ceaeca960 HTTP 302
https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 2-0-5-3250-0-edbcd03da8 Show response ga2safe.com/ga/webviews/ Redirect Chain https://securesendings.com/ga/click/2-5013272-5-4995-14804-5387-6ad973a735-8ceaeca960 https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8	23 KB 23 KB	160ms 95ms	Document text/html	185.7.97.99 MOJHOST-EU
General Check archive.org Show headers Download Go to Full URL https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 185.7.97.99 , Netherlands, ASN42567 (MOJHOST-EU, NL), Reverse DNS smtp1-7.ga2safe.com Software Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 / Phusion Passenger 6.0.4 Resource Hash `093636e1f585a8eba5321812b4f2c2270db09f60544ce9b816efdb541097eb60` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection Keep-Alive Content-Type text/html; charset=utf-8 Date Tue, 04 Apr 2023 06:37:22 GMT Expires Mon, 01 Jan 1990 00:00:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 Status 200 OK Transfer-Encoding chunked X-Powered-By Phusion Passenger 6.0.4 X-Rack-Cache miss X-Request-Id 857afc0f2e36974ab2e759c18870c54e X-Runtime 0.079787 X-UA-Compatible IE=Edge,chrome=1 Redirect headers Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection Keep-Alive Content-Type text/html; charset=utf-8 Date Tue, 04 Apr 2023 06:37:22 GMT Expires Mon, 01 Jan 1990 00:00:00 GMT Keep-Alive timeout=5, max=100 Location https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Pragma no-cache Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 Status 302 Found Transfer-Encoding chunked X-Powered-By Phusion Passenger 6.0.4 X-Rack-Cache miss X-Request-Id ce13af98c3071384ffe009d3aece17db X-Runtime 0.032260 X-UA-Compatible IE=Edge,chrome=1
GET H/1.1	200 OK	IMG_5028.jpg trackingbuddies.com/ga/campaign_images/3250/	199 KB 199 KB	69ms 14ms	Image image/jpeg	185.7.97.104 MOJHOST-EU
General Check archive.org Show headers Download Go to Show image Full URL https://trackingbuddies.com/ga/campaign_images/3250/IMG_5028.jpg Requested by Host: ga2safe.com URL: https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 185.7.97.104 , Netherlands, ASN42567 (MOJHOST-EU, NL), Reverse DNS smtp1-5.trackingbuddies.com Software Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 / Resource Hash `516f44998140fd6249de57d316dee44ff324578e18f1c73089e78fba97bc469d` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ga2safe.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Tue, 04 Apr 2023 06:37:22 GMT Last-Modified Mon, 03 Apr 2023 14:56:11 GMT Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 ETag "31be7-5f86fc27e36aa" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 203751
GET H/1.1	200 OK	67063_7.jpg trackingbuddies.com/ga/campaign_images/3250/	54 KB 55 KB	57ms 14ms	Image image/jpeg	185.7.97.104 MOJHOST-EU
General Check archive.org Show headers Download Go to Show image Full URL https://trackingbuddies.com/ga/campaign_images/3250/67063_7.jpg Requested by Host: ga2safe.com URL: https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 185.7.97.104 , Netherlands, ASN42567 (MOJHOST-EU, NL), Reverse DNS smtp1-5.trackingbuddies.com Software Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 / Resource Hash `393b8fdca162f5d17913e495888a1346edeb0456e7991509dda2ee691cd15c60` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ga2safe.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Tue, 04 Apr 2023 06:37:22 GMT Last-Modified Mon, 03 Apr 2023 14:56:11 GMT Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 ETag "d8f2-5f86fc27e0f9b" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 55538
GET H/1.1	200 OK	353133_1.jpg trackingbuddies.com/ga/campaign_images/3250/	47 KB 47 KB	57ms 14ms	Image image/jpeg	185.7.97.104 MOJHOST-EU
General Check archive.org Show headers Download Go to Show image Full URL https://trackingbuddies.com/ga/campaign_images/3250/353133_1.jpg Requested by Host: ga2safe.com URL: https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 185.7.97.104 , Netherlands, ASN42567 (MOJHOST-EU, NL), Reverse DNS smtp1-5.trackingbuddies.com Software Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 / Resource Hash `2fa82fd324228db6450be75d9f409f1dc099f9737c78ef826f41bd892b8d6f3f` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ga2safe.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Tue, 04 Apr 2023 06:37:22 GMT Last-Modified Mon, 03 Apr 2023 14:56:11 GMT Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 ETag "bc1f-5f86fc27ea40a" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 48159
GET H/1.1	200 OK	111643_1.jpg trackingbuddies.com/ga/campaign_images/3250/	24 KB 25 KB	58ms 14ms	Image image/jpeg	185.7.97.104 MOJHOST-EU
General Check archive.org Show headers Download Go to Show image Full URL https://trackingbuddies.com/ga/campaign_images/3250/111643_1.jpg Requested by Host: ga2safe.com URL: https://ga2safe.com/ga/webviews/2-0-5-3250-0-edbcd03da8 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 185.7.97.104 , Netherlands, ASN42567 (MOJHOST-EU, NL), Reverse DNS smtp1-5.trackingbuddies.com Software Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 / Resource Hash `bd81ce2c0e7b98e8fb95aff86a01ed00b9433e58e7e8bd01e950f7cb945c8588` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ga2safe.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Tue, 04 Apr 2023 06:37:22 GMT Last-Modified Mon, 03 Apr 2023 14:56:11 GMT Server Apache/2.4.43 (Unix) OpenSSL/1.0.2k-fips PHP/7.3.16 ETag "6115-5f86fc2800780" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 24853

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ga2safe.com
securesendings.com
trackingbuddies.com
185.7.97.104
185.7.97.99
217.22.16.16
093636e1f585a8eba5321812b4f2c2270db09f60544ce9b816efdb541097eb60
2fa82fd324228db6450be75d9f409f1dc099f9737c78ef826f41bd892b8d6f3f
393b8fdca162f5d17913e495888a1346edeb0456e7991509dda2ee691cd15c60
516f44998140fd6249de57d316dee44ff324578e18f1c73089e78fba97bc469d
bd81ce2c0e7b98e8fb95aff86a01ed00b9433e58e7e8bd01e950f7cb945c8588

ga2safe.com Open in urlscan Pro 185.7.97.99 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

349 kBTransfer

347 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

ga2safe.com Open in urlscan Pro
185.7.97.99 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

349 kB
Transfer

347 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions