Submitted URL: https://p348774.clksite.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r
Effective URL: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97...
Submission: On August 21 via manual from PH

Summary

This website contacted 2 IPs in 3 countries across 5 domains to perform 5 HTTP transactions. The main IP is 195.201.197.250, located in Germany and belongs to HETZNER-AS, DE. The main domain is rr.tracker.mobiletracking.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 25th 2019. Valid for: 3 months.
This is the only time rr.tracker.mobiletracking.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 173.192.101.24 36351 (SOFTLAYER)
1 1 108.168.193.183 36351 (SOFTLAYER)
1 1 54.236.74.179 14618 (AMAZON-AES)
2 195.201.197.250 24940 (HETZNER-AS)
3 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 2
Domain Requested by
3 magic.wizards.com rr.tracker.mobiletracking.ru
1 v9.tracker.mobiletracking.ru rr.tracker.mobiletracking.ru
1 rr.tracker.mobiletracking.ru
1 usd.odysseus-nua.com 1 redirects
1 mybestdc.com 1 redirects
1 p348774.clksite.com 1 redirects
5 6

This site contains no links.

Subject Issuer Validity Valid
rr.tracker.mobiletracking.ru
Let's Encrypt Authority X3
2019-07-25 -
2019-10-23
3 months crt.sh
media.wizards.com
GeoTrust RSA CA 2018
2019-01-23 -
2019-11-15
10 months crt.sh
v9.tracker.mobiletracking.ru
Let's Encrypt Authority X3
2019-08-05 -
2019-11-03
3 months crt.sh

This page contains 1 frames:

Primary Page: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Frame ID: B41C5FC697C27E0EB7AAE42B41A67986
Requests: 5 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://p348774.clksite.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r HTTP 301
    https://mybestdc.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r HTTP 302
    http://usd.odysseus-nua.com/zcvisitor/84f58d20-c455-11e9-bd0e-12b108eadc72?campaignid=69dfa1d0-9604-11e9... HTTP 302
    https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

2
IPs

3
Countries

654 kB
Transfer

653 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://p348774.clksite.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r HTTP 301
    https://mybestdc.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r HTTP 302
    http://usd.odysseus-nua.com/zcvisitor/84f58d20-c455-11e9-bd0e-12b108eadc72?campaignid=69dfa1d0-9604-11e9-99de-12077332b422 HTTP 302
    https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set 1ZKprCpf
rr.tracker.mobiletracking.ru/
Redirect Chain
  • https://p348774.clksite.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r
  • https://mybestdc.com/adServe/banners?tid=LABS_FRAUD_LINK&action=r
  • http://usd.odysseus-nua.com/zcvisitor/84f58d20-c455-11e9-bd0e-12b108eadc72?campaignid=69dfa1d0-9604-11e9-99de-12077332b422
  • https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_...
4 KB
2 KB
Document
General
Full URL
https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.201.197.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.250.197.201.195.clients.your-server.de
Software
nginx /
Resource Hash
0887de74e08e6755f920ece07247191c7b86b54de28acab677e046fe22e0564a

Request headers

Host
rr.tracker.mobiletracking.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Server
nginx
Date
Wed, 21 Aug 2019 20:52:01 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
no-cache, no-store, must-revalidate,post-check=0,pre-check=0
Expires
0
Last-Modified
Wed, 21 Aug 2019 20:52:01 GMT
Pragma
no-cache
Set-Cookie
_subid=3onle56de1bf8bb31k68ef;Expires=Saturday, 21-Sep-2019 20:52:01 GMT;Max-Age=2678400;Path=/ _token=uuid_3onle56de1bf8bb31k68ef_3onle56de1bf8bb31k68ef5d5daef12e50a5.78584682;Expires=Saturday, 21-Sep-2019 20:52:01 GMT;Max-Age=2678400;Path=/ bdb95=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjIzODFcIjoxNTY2NDIwNzIxfSxcImNhbXBhaWduc1wiOntcIjE2NDJcIjoxNTY2NDIwNzIxfSxcInRpbWVcIjoxNTY2NDIwNzIxfSJ9.NNiCxGjCBh8v8UtMAqTb2Tev7T4bPgRCGBGXxlwuGBs;Expires=Saturday, 21-Sep-2019 20:52:01 GMT;Max-Age=2678400;Path=/
Content-Encoding
gzip

Redirect headers

Date
Wed, 21 Aug 2019 20:51:59 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Location
https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Server
ZeroPark-Traffic
Arena_Logo.png
magic.wizards.com/sites/mtg/files/
91 KB
92 KB
Image
General
Full URL
https://magic.wizards.com/sites/mtg/files/Arena_Logo.png
Requested by
Host: rr.tracker.mobiletracking.ru
URL: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::14df , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
400165fde8bda18feee613b2278c14ece107f4efa6a789df9e1a8eb2ef588e87
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Response headers

X-EdgeConnect-Origin-MEX-Latency
558
Date
Wed, 21 Aug 2019 20:52:01 GMT
X-Content-Type-Options
nosniff
X-EdgeConnect-MidMile-RTT
0
Akamai-X-True-EdgeControl-TTL
1209600, 1209600, 1209600
X-Age
0
X-AH-Environment
prod
Content-Length
93591
X-Request-ID
v-66c15758-bedd-11e9-97d4-1f8fcfd443ed
Last-Modified
Wed, 20 Mar 2019 23:26:42 GMT
Server
nginx
Cache-Control
max-age=674751
Content-Type
image/png
Expires
Thu, 29 Aug 2019 16:17:52 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Cache-Hits
1
Button_Orange.gif
magic.wizards.com/sites/mtg/files/
93 KB
93 KB
Image
General
Full URL
https://magic.wizards.com/sites/mtg/files/Button_Orange.gif
Requested by
Host: rr.tracker.mobiletracking.ru
URL: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::14df , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
33a1a5dcf7a0b0cba3f4c5384420bda64e6c77d43b93eb085fae0669ad07382f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Response headers

X-EdgeConnect-Origin-MEX-Latency
284
Date
Wed, 21 Aug 2019 20:52:01 GMT
X-Content-Type-Options
nosniff
X-EdgeConnect-MidMile-RTT
5
Akamai-X-True-EdgeControl-TTL
1209600, 1209600, 1209600
Connection
keep-alive
X-AH-Environment
prod
Content-Length
95031
X-Request-ID
v-6686962c-bedd-11e9-b415-3b9447753b37
Accept-Ranges
bytes
Last-Modified
Mon, 22 Apr 2019 21:52:08 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=674864
X-Age
0
Expires
Thu, 29 Aug 2019 16:19:45 GMT
jquery.js
v9.tracker.mobiletracking.ru/
11 KB
11 KB
Script
General
Full URL
https://v9.tracker.mobiletracking.ru/jquery.js
Requested by
Host: rr.tracker.mobiletracking.ru
URL: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.201.197.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.250.197.201.195.clients.your-server.de
Software
nginx /
Resource Hash
1c54a3abcca9144326f21ece0f96a383c3cef393b57bd2af3ca4c7487447d8ca

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Response headers

Date
Wed, 21 Aug 2019 20:52:02 GMT
Last-Modified
Sun, 11 Aug 2019 19:49:02 GMT
Server
nginx
ETag
"5d50712e-2a5c"
Content-Type
application/javascript
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10844
Expires
Wed, 21 Aug 2019 21:52:02 GMT
M20_KeyArt_Preloader4.jpg
magic.wizards.com/sites/mtg/files/
455 KB
455 KB
Image
General
Full URL
https://magic.wizards.com/sites/mtg/files/M20_KeyArt_Preloader4.jpg
Requested by
Host: rr.tracker.mobiletracking.ru
URL: https://rr.tracker.mobiletracking.ru/1ZKprCpf?keyword=&external_id=zr84f58d20c45511e9bd0e12b108eadc728f33b95b9a2f4b698d79bf8bf7d30f97040652530f3db8716d&creative_id=foxtrot-pig-zcvMaQB0&ad_campaign_id=1230011&sub_id_1=ultramarine-clam&sub_id_2=best%2Bdeals%2Cclktag%2Cclktag.com&sub_id_3=Magic%3A+The+Gathering+Arena+T1-01&sub_id_4=unknown&sub_id_5=clktag.com&sub_id_6=Firefox&extra_param_1=&extra_param_2=&extra_param_3=&extra_param_4=&extra_param_5=&extra_param_6=&extra_param_7=&extra_param_10=69dfa1d0-9604-11e9-99de-12077332b422
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::14df , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
ed169541baf3d697274cf4fa90c69a2f0b9b846d039404c543da161367731a15
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lp.mobiletracking.ru/Games/mtgarena/index_en.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Response headers

X-EdgeConnect-Origin-MEX-Latency
682
Date
Wed, 21 Aug 2019 20:52:01 GMT
X-Content-Type-Options
nosniff
X-EdgeConnect-MidMile-RTT
0
Akamai-X-True-EdgeControl-TTL
1209600, 1209600, 1209600
X-Age
0
X-AH-Environment
prod
Content-Length
465518
X-Request-ID
v-668a8ed0-bedd-11e9-98d3-ef9a23619b18
Last-Modified
Tue, 02 Jul 2019 16:39:10 GMT
Server
nginx
Cache-Control
max-age=674728
Content-Type
image/jpeg
Expires
Thu, 29 Aug 2019 16:17:29 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Cache-Hits
1

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| subid function| diff_to_GMT number| w number| h string| s function| addPixel function| getURLParameter object| result object| canvas object| gl undefined| debugInfo undefined| vendor undefined| renderer undefined| iframe undefined| newURL undefined| img undefined| links undefined| iframe2 undefined| html object| dt object| sandblaster

0 Cookies