custom-proxy.leadpages.net Open in urlscan Pro
35.202.21.90  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	Primary Request / Show response custom-proxy.leadpages.net/	10 KB 4 KB	273ms 261ms	Document text/html	35.202.21.90 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://custom-proxy.leadpages.net/ Protocol HTTP/1.1 Server 35.202.21.90 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 90.21.202.35.bc.googleusercontent.com Software Leadpages / Resource Hash cc8d5dee3ad787a0308d84cd3d551ad4978ff6a20f26156c119b644dabf21525 Request headers Host custom-proxy.leadpages.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 19 Aug 2021 00:16:16 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Cache-Control no-cache Server Leadpages Content-Encoding gzip
GET H2	200	css2 fonts.googleapis.com/	7 KB 795 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=swap Requested by Host: custom-proxy.leadpages.net URL: http://custom-proxy.leadpages.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 34cacc8b8c3f84d863e61128dd30468bdd6d98b60777623b6e223312e02a721e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 18 Aug 2021 22:40:23 GMT server ESF date Thu, 19 Aug 2021 00:16:16 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 19 Aug 2021 00:16:16 GMT
GET H2	200	hotspots.js Show response d2fcz6pgmhcecl.cloudfront.net/latest/	405 KB 132 KB	55ms 16ms	Script application/javascript	2600:9000:2156:f800:17:2777:2940:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2fcz6pgmhcecl.cloudfront.net/latest/hotspots.js Requested by Host: custom-proxy.leadpages.net URL: http://custom-proxy.leadpages.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f800:17:2777:2940:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 642ac21f2d5e2f12a47e9251226a3062e65963018aa793ff87182c408fc102ed Request headers Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-version-id HF0C7P4vHvQ8neLwMjfbj0kpoWhNyDZ0 content-encoding gzip last-modified Mon, 09 Aug 2021 08:22:38 GMT server AmazonS3 age 2218 etag W/"a921248799a3336e94db3077dd85a8a3" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront) date Wed, 18 Aug 2021 23:42:05 GMT x-amz-cf-pop FRA50-C1 x-amz-cf-id Iv-Fx5DRkl5EKRMxAZg8rgFJp7ldXLENNZPpjAfxYSvUgR-XD_7eVQ==
POST H2	200	campaigns Show response hs.qacono.com/v2/	96 B 389 B	338ms 235ms	XHR application/json	143.204.98.30 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hs.qacono.com/v2/campaigns Requested by Host: d2fcz6pgmhcecl.cloudfront.net URL: https://d2fcz6pgmhcecl.cloudfront.net/latest/hotspots.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.30 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-30.fra50.r.cloudfront.net Software / Resource Hash 2e9cf99f966a4d34984bb80b2d748478fe1dc5f6e4e2b577767efbd91d4ba184 Request headers Accept application/json, text/plain, */* Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 19 Aug 2021 00:16:17 GMT via 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 etag W/"60-qTAwELyrTliMggznCLeSLVgNir0" x-cache Miss from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * content-length 96 x-amz-cf-id X7u1F4crCkraKqvyKDFIb9MRiL_XffOs8w9AwYqAbwLYTEGoFnhtWQ==
POST H2	200	campaigns Show response hs.qacono.com/v2/	96 B 389 B	343ms 241ms	XHR application/json	143.204.98.30 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hs.qacono.com/v2/campaigns Requested by Host: d2fcz6pgmhcecl.cloudfront.net URL: https://d2fcz6pgmhcecl.cloudfront.net/latest/hotspots.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.30 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-30.fra50.r.cloudfront.net Software / Resource Hash 2e9cf99f966a4d34984bb80b2d748478fe1dc5f6e4e2b577767efbd91d4ba184 Request headers Accept application/json, text/plain, */* Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 19 Aug 2021 00:16:17 GMT via 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 etag W/"60-qTAwELyrTliMggznCLeSLVgNir0" x-cache Miss from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * content-length 96 x-amz-cf-id rROHEnkxVgQlYoq-G9oHFQuNyZoEAkJZBQQLkON_PLBmoid36LzKrQ==
GET H2	200	mem5YaGs126MiZpBA-UNirkOUuhp.woff2 fonts.gstatic.com/s/opensans/v23/	15 KB 15 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UNirkOUuhp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://custom-proxy.leadpages.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 17 Aug 2021 00:36:10 GMT x-content-type-options nosniff age 171606 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14956 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:23:40 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 17 Aug 2022 00:36:10 GMT
GET H2	200	mem5YaGs126MiZpBA-UN7rgOUuhp.woff2 fonts.gstatic.com/s/opensans/v23/	15 KB 15 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://custom-proxy.leadpages.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 17 Aug 2021 00:32:27 GMT x-content-type-options nosniff age 171829 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15112 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:23:34 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 17 Aug 2022 00:32:27 GMT
GET H2	200	mem8YaGs126MiZpBA-UFVZ0b.woff2 fonts.gstatic.com/s/opensans/v23/	14 KB 14 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFVZ0b.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://custom-proxy.leadpages.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 17 Aug 2021 00:29:17 GMT x-content-type-options nosniff age 172019 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14440 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:23:25 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 17 Aug 2022 00:29:17 GMT
GET H2	200	px.gif pxlsrc.com/	42 B 303 B	256ms 204ms	Image image/gif	143.204.98.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pxlsrc.com/px.gif?gks=HOOTY&ggb=11&zb6=0&publisherId=E839B9FE51F6&demandFlowType=2&spotLoadUuid=dfd4b0ad-2d3a-45ca-9470-94b36347db1c&templates=0%3D%255Bobject%2520Object%255D&qc=Search%20Box&x1=undefined&x2=undefined&x3=undefined&x4=undefined&x5=undefined&sectionId=SCC3D0C3E8C3F5&rdt=traffic_filtered&rdc=%7B%22rules%22%3A%5B117%5D%2C%22bot%22%3A%5B37%5D%7D&gao=hs_sdk_warning&wstu=inf&esu=91f49fa6-f09b-4807-90f6-e87f29ed5f7c&573662 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.109 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-109.fra50.r.cloudfront.net Software / Resource Hash 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292 Request headers Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 19 Aug 2021 00:16:17 GMT via 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-type image/gif cache-control no-cache, max-age=0 content-length 42 x-amz-cf-id HS6cmcPEjoVhlvgsKvpS1yLk0U5IOYzsUeSHD_IHB50W3gzxCmWOlQ==
GET H2	200	px.gif pxlsrc.com/	42 B 302 B	252ms 203ms	Image image/gif	143.204.98.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pxlsrc.com/px.gif?gks=HOOTY&ggb=11&zb6=0&publisherId=E839B9FE51F6&demandFlowType=1&spotLoadUuid=cae8eb67-e248-418b-b122-5fde111a9a0d&templates=0%3D%255Bobject%2520Object%255D&qc=Domain%20Match&x1=undefined&x2=undefined&x3=undefined&x4=undefined&x5=undefined&sectionId=SCC5FDC609C611&rdt=traffic_filtered&rdc=%7B%22rules%22%3A%5B117%5D%2C%22bot%22%3A%5B37%5D%7D&gao=hs_sdk_warning&wstu=inf&esu=00922696-07ed-4993-ad49-ba142ce12600&840975 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.109 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-109.fra50.r.cloudfront.net Software / Resource Hash 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292 Request headers Referer http://custom-proxy.leadpages.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 19 Aug 2021 00:16:17 GMT via 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-type image/gif cache-control no-cache, max-age=0 content-length 42 x-amz-cf-id 9tzRIaek_lkG1-2VDRVbi1guxnWqq0vF0_RztcOoLgRieJ7CJilyYw==

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| disableSearch function| checkSearchEnabled function| renderWithSearch function| renderWithoutSearch function| render object| regeneratorRuntime object| hotspotsTemplatesCaching function| HotspotsAPI

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

custom-proxy.leadpages.net
d2fcz6pgmhcecl.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
hs.qacono.com
pxlsrc.com
143.204.98.109
143.204.98.30
2600:9000:2156:f800:17:2777:2940:21
2a00:1450:4001:811::2003
2a00:1450:4001:831::200a
35.202.21.90
2e9cf99f966a4d34984bb80b2d748478fe1dc5f6e4e2b577767efbd91d4ba184
34cacc8b8c3f84d863e61128dd30468bdd6d98b60777623b6e223312e02a721e
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
642ac21f2d5e2f12a47e9251226a3062e65963018aa793ff87182c408fc102ed
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
cc8d5dee3ad787a0308d84cd3d551ad4978ff6a20f26156c119b644dabf21525