es2259206.ganza39.online Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://es2259206.ganza39.online/
Submission: On January 19 via manual (January 19th 2024, 3:02:18 pm UTC) from BR — Scanned from NL

Summary HTTP 24 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 4 countries across 13 domains to perform 24 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is es2259206.ganza39.online.
TLS certificate: Issued by GTS CA 1P5 on January 12th 2024. Valid for: 3 months.

This is the only time es2259206.ganza39.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.21.39.40 104.21.39.40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	45.133.44.52 45.133.44.52	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
4	45.133.44.53 45.133.44.53	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	2606:4700:303... 2606:4700:3032::6815:1ef2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	157.90.84.242 157.90.84.242	24940 (HETZNER-AS) (HETZNER-AS)
2 3	2a00:1450:401... 2a00:1450:4013:c00::54	15169 (GOOGLE) (GOOGLE)
1	94.130.198.6 94.130.198.6	24940 (HETZNER-AS) (HETZNER-AS)
4	2a01:4f8:252:... 2a01:4f8:252:561a::2	24940 (HETZNER-AS) (HETZNER-AS)
1	78.47.199.202 78.47.199.202	24940 (HETZNER-AS) (HETZNER-AS)
4	2a02:b48:8301... 2a02:b48:8301::24	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
24	12

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

es2259206.ganza39.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.39.40 (None, )

ASN13335 (CLOUDFLARENET, US)

js.nextpsh.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 45.133.44.52 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

91ceadfe3f.3854704790.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 45.133.44.53 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

js.capndr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
9a3d699a42.f4042bb57f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.wpshsdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::6815:1ef2 (United States)

ASN13335 (CLOUDFLARENET, US)

storage.multstorage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.90.84.242 (Berlin, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.242.84.90.157.clients.your-server.de

fp.metricswpsh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4013:c00::54 (Groningen, Netherlands) 2 redirects

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.130.198.6 (Reilingen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.6.198.130.94.clients.your-server.de

nereserv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a01:4f8:252:561a::2 (Germany)

ASN24940 (HETZNER-AS, DE)

1f630c0f37.da5ac5f203.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.47.199.202 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.202.199.47.78.clients.your-server.de

notification.tubecup.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:b48:8301::24 (Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

static.bookmsg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bookmsg.com static.bookmsg.com — Cisco Umbrella Rank: 38343	3 KB
4	da5ac5f203.com 1f630c0f37.da5ac5f203.com	3 KB
4	3854704790.com 91ceadfe3f.3854704790.com	194 KB
3	google.com 2 redirects accounts.google.com — Cisco Umbrella Rank: 23	2 KB
2	metricswpsh.com fp.metricswpsh.com — Cisco Umbrella Rank: 37830	443 B
2	wpshsdk.com js.wpshsdk.com — Cisco Umbrella Rank: 16797	17 KB
1	tubecup.net notification.tubecup.net — Cisco Umbrella Rank: 15315	201 B
1	nereserv.com nereserv.com — Cisco Umbrella Rank: 35934	201 B
1	f4042bb57f.com 9a3d699a42.f4042bb57f.com	207 B
1	multstorage.com storage.multstorage.com — Cisco Umbrella Rank: 32053	903 B
1	capndr.com js.capndr.com — Cisco Umbrella Rank: 39610	238 B
1	nextpsh.top js.nextpsh.top — Cisco Umbrella Rank: 992979	621 B
1	ganza39.online es2259206.ganza39.online	17 KB
24	13

	Domain	Requested by
4	static.bookmsg.com	91ceadfe3f.3854704790.com
4	1f630c0f37.da5ac5f203.com	91ceadfe3f.3854704790.com
4	91ceadfe3f.3854704790.com	es2259206.ganza39.online 91ceadfe3f.3854704790.com
3	accounts.google.com	2 redirects es2259206.ganza39.online
2	fp.metricswpsh.com	91ceadfe3f.3854704790.com
2	js.wpshsdk.com	91ceadfe3f.3854704790.com js.wpshsdk.com
1	notification.tubecup.net
1	nereserv.com	91ceadfe3f.3854704790.com
1	9a3d699a42.f4042bb57f.com	91ceadfe3f.3854704790.com
1	storage.multstorage.com	91ceadfe3f.3854704790.com
1	js.capndr.com	91ceadfe3f.3854704790.com
1	js.nextpsh.top	es2259206.ganza39.online
1	es2259206.ganza39.online
24	13

This site contains no links.

Subject Issuer	Validity	Valid
ganza39.online GTS CA 1P5	`2024-01-12` - `2024-04-11`	3 months	crt.sh
nextpsh.top GTS CA 1P5	`2023-12-02` - `2024-03-01`	3 months	crt.sh
91ceadfe3f.3854704790.com R3	`2024-01-16` - `2024-04-15`	3 months	crt.sh
js.capndr.com R3	`2023-12-23` - `2024-03-22`	3 months	crt.sh
multstorage.com GTS CA 1P5	`2024-01-18` - `2024-04-17`	3 months	crt.sh
9a3d699a42.f4042bb57f.com R3	`2024-01-16` - `2024-04-15`	3 months	crt.sh
js.wpshsdk.com R3	`2023-11-21` - `2024-02-19`	3 months	crt.sh
notification.tubecup.net R3	`2024-01-03` - `2024-04-02`	3 months	crt.sh
da5ac5f203.com R3	`2024-01-15` - `2024-04-14`	3 months	crt.sh
static.bookmsg.com R3	`2023-12-07` - `2024-03-06`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://es2259206.ganza39.online/
Frame ID: 212AA4D14EFEE7B9C4680208272C9D52
Requests: 19 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: D07BD399A1F05ACE264D54F0789B13B5
Requests: 1 HTTP requests in this frame

Frame: https://static.bookmsg.com/creatives/US/US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp
Frame ID: 1C47805AE2AF2871DAEF0A98CE466014
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Checking your browser

Page Statistics

24
Requests

96 %
HTTPS

45 %
IPv6

13
Domains

13
Subdomains

12
IPs

4
Countries

237 kB
Transfer

838 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP 302
https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp21gUiA4VF6bePSscwHWtvjqx5hvqeww93KvA9z0jPP211BhffguzfvV30yLyuFqIq_QyEs0A HTTP 302
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2Crlp5ubEHWNhGxY8MvasbbhTF_cmqBKGj-G2vzMYRS3CNl8G1xzVdwkvYm_gmJW4Zg8BnLA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S856685168%3A1705676533839234&theme=glif

24 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response es2259206.ganza39.online/	39 KB 17 KB	404ms 207ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://es2259206.ganza39.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.0.19 Resource Hash `893d45803f7ec831d4093d197d351a29e63f2a3b8a88d99b79d2bbed31d57618` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 847ff51b8bdb0f87-EWR content-encoding br content-type text/html; charset=UTF-8 date Fri, 19 Jan 2024 15:02:13 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JI2OeFVxDd2NqYbWg0y0kHjTwKBtPbdvdZvLmhLzqxsympEpPwKjSwDD%2F4g5Vpy1qlAcJrYJL6%2BJo9xQs8TcxlcGlWgtYMvN4x3gUKjWfnKLBVoCjg64MlgYWS3Oj76Ko13LkkAWArYu76AYFkMjquy3wy1kX24%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.0.19
GET H2	200	ps.js Show response js.nextpsh.top/ps/	82 B 621 B	165ms 46ms	Script application/javascript	104.21.39.40 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.nextpsh.top/ps/ps.js?id=jIHmFzR1xUmCiE0pRxf_YQ Requested by Host: es2259206.ganza39.online URL: https://es2259206.ganza39.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.39.40 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f41597e9109254c277334ce27b4dd5a1b823f2b988b602f3295fc2e8cdfd54a3` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Fri, 19 Jan 2024 15:02:13 GMT content-encoding br cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DrNjII5AWMJ3QcUQusPpdLpwRgfSVKmzdejwsVeZMtpzvAVXAw1MHQaXTfJzhkXkfwaPSyLfUw%2FoofIfr84aQyppZf%2FDfqJckgOk44%2BQpE%2BxQvH8uNjLhzuXihdijysFxQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=0, no-cache, no-store, must-revalidate cf-ray 847ff51dedcf66e6-AMS alt-svc h3=":443"; ma=86400
GET H2	200	cd7017b4c2a50eb0612734b56c278159.js Show response 91ceadfe3f.3854704790.com/	102 KB 34 KB	70ms 16ms	Script application/javascript	45.133.44.52 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Requested by Host: es2259206.ganza39.online URL: https://es2259206.ganza39.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `70bef0b9b90f224dcce56929057d20668fd82f6a6044195d3655b893657ff11b` Request headers Referer https://es2259206.ganza39.online/ Origin https://es2259206.ganza39.online accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:13 GMT date Fri, 19 Jan 2024 15:02:13 GMT content-encoding gzip last-modified Tue, 16 Jan 2024 12:25:49 GMT server nginx/1.18.0 etag W/"65a675cd-1986b" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=300 x-proxy-cache HIT
GET H2	200	43957 Show response 91ceadfe3f.3854704790.com/eb3746d2aee9c2fff6fbb8d7513f7f7c/	2 KB 3 KB	17ms 17ms	XHR application/json	45.133.44.52 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://91ceadfe3f.3854704790.com/eb3746d2aee9c2fff6fbb8d7513f7f7c/43957?version_name=c Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `01a853c86a5a18b51fa0ac79826d8fba76adea15d20420fbf190524af9950bd6` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers access-control-allow-origin * date Fri, 19 Jan 2024 15:02:13 GMT cache-control max-age=300 x-proxy-cache HIT server nginx/1.18.0 content-type application/json expires Fri, 19 Jan 2024 15:07:13 GMT
GET H2	200	advertising.js Show response js.capndr.com/	0 238 B	64ms 22ms	Script application/javascript	45.133.44.53 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://js.capndr.com/advertising.js Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:13 GMT date Fri, 19 Jan 2024 15:02:13 GMT last-modified Fri, 14 Jul 2023 08:23:25 GMT server nginx/1.18.0 etag "64b105fd-0" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=300 accept-ranges bytes content-length 0 x-proxy-cache HIT
GET H2	200	count.html Show response storage.multstorage.com/log/ Frame D07B	882 B 903 B	102ms 55ms	Document text/html	2606:4700:3032::6815:1ef2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://storage.multstorage.com/log/count.html Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:1ef2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2` Request headers Referer https://es2259206.ganza39.online/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 847ff51fa989b8a6-AMS content-encoding br content-type text/html date Fri, 19 Jan 2024 15:02:13 GMT last-modified Mon, 18 Sep 2023 14:39:06 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6P3E7wQpzokisyN5%2BXowLKSDLftANnHlyhqYajBOaBSvb9UUCzBHJRMt2xI7Dd2kcAooiqZgo8AmUygnSyr32dhuk5V1UnIP3XLb%2BWlbTv5WdJ0JqKrbO4PU890FnHWWG%2BqEvfrCJsiZaG7bmykrZbYBd3jNlQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-request-id a60e825b56b3f4aa7662d85340b21365
GET H2	200	track Show response 9a3d699a42.f4042bb57f.com/in/	0 207 B	134ms 67ms	XHR text/plain	45.133.44.53 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://9a3d699a42.f4042bb57f.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNDcwNjU4OTA0ODE2MjA1ODAwMCIsInRpbWV6b25lIjoxLCJ2ZXIiOiIzLjEwMC4xIiwidGFnX2lkIjo0Mzk1Nywic2NyZWVuX3Jlc29sdXRpb24iOiIxNjAweDEyMDAiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IkV1cm9wZS9BbXN0ZXJkYW0iLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MC4wNywiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiQ2hlY2tpbmclMkN5b3VyJTJDYnJvd3NlciJ9 Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:13 GMT server nginx/1.18.0 vary Origin access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 0
GET H2	200	push.m.js Show response js.wpshsdk.com/npc/sdk/	34 KB 15 KB	64ms 21ms	Script application/javascript	45.133.44.53 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://js.wpshsdk.com/npc/sdk/push.m.js?v=1 Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `f00f8a8d2e06b1f97e778f937451a61cf5cffe091a166b87b0855dba7e29a060` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:13 GMT date Fri, 19 Jan 2024 15:02:13 GMT content-encoding gzip last-modified Wed, 27 Dec 2023 12:29:11 GMT server nginx/1.18.0 etag W/"658c1897-878d" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=300 x-proxy-cache HIT
GET H2	200	d4366bc23739d6e56532e8db0ecfd1b3.js Show response 91ceadfe3f.3854704790.com/	193 KB 56 KB	48ms 16ms	Script application/javascript	45.133.44.52 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://91ceadfe3f.3854704790.com/d4366bc23739d6e56532e8db0ecfd1b3.js Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `d0756a02b1c82a9f79197dcf9b6c793d8716f508f002bee523b00cec2988d59b` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:13 GMT date Fri, 19 Jan 2024 15:02:13 GMT content-encoding gzip last-modified Thu, 18 Jan 2024 13:31:43 GMT server nginx/1.18.0 etag W/"65a9283f-30333" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=300 x-proxy-cache HIT
POST H/1.1	200 OK	fp Show response fp.metricswpsh.com/	58 B 443 B	97ms 29ms	XHR application/json	157.90.84.242 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fp.metricswpsh.com/fp?tag_id=43957 Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/cd7017b4c2a50eb0612734b56c278159.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.242.84.90.157.clients.your-server.de Software nginx/1.20.1 / Resource Hash `19502848b55627b7db8703899758a5ab2ec6ca4316f0bdb3278bea1a7c19c80b` Request headers Referer https://es2259206.ganza39.online/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers Date Fri, 19 Jan 2024 15:02:13 GMT Server nginx/1.20.1 Vary Origin Content-Type application/json; charset=UTF-8 Access-Control-Allow-Origin https://es2259206.ganza39.online Access-Control-Allow-Credentials true Connection keep-alive Content-Length 58
OPTIONS H/1.1	204 No Content	fp fp.metricswpsh.com/ Frame	0 0	96ms 31ms	Preflight	157.90.84.242 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fp.metricswpsh.com/fp?tag_id=43957 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.242.84.90.157.clients.your-server.de Software nginx/1.20.1 / Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://es2259206.ganza39.online Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Access-Control-Allow-Credentials true Access-Control-Allow-Headers content-type Access-Control-Allow-Methods GET,HEAD,PUT,PATCH,POST,DELETE Access-Control-Allow-Origin https://es2259206.ganza39.online Connection keep-alive Date Fri, 19 Jan 2024 15:02:13 GMT Server nginx/1.20.1 Vary Origin Access-Control-Request-Method Access-Control-Request-Headers
GET H2	200	f327a9ca9e0fb77b76446a7de27a4b26.js Show response 91ceadfe3f.3854704790.com/	435 KB 102 KB	19ms 19ms	Script application/javascript	45.133.44.52 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://91ceadfe3f.3854704790.com/f327a9ca9e0fb77b76446a7de27a4b26.js Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/d4366bc23739d6e56532e8db0ecfd1b3.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `120aa0531a07558f6e5f48f0f5c20be188244fe011ccd52bb0b86c39f2061385` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:13 GMT date Fri, 19 Jan 2024 15:02:13 GMT content-encoding gzip last-modified Wed, 17 Jan 2024 09:23:49 GMT server nginx/1.18.0 etag W/"65a79ca5-6cb19" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=300 x-proxy-cache HIT
GET H2	403	identifier accounts.google.com/v3/signin/ Redirect Chain https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp21gUiA4VF6bePSscwHWtvjqx5hvqeww93KvA9z0jPP211BhffguzfvV... https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2Crlp5ubEHWNhGxY8MvasbbhTF_cmqBKGj-G2vzMYRS3CNl8G1xzVdwkvYm_gmJW4Zg8BnLA&passive...	0 0	37ms 37ms	Image text/html	2a00:1450:4013:c00::54 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2Crlp5ubEHWNhGxY8MvasbbhTF_cmqBKGj-G2vzMYRS3CNl8G1xzVdwkvYm_gmJW4Zg8BnLA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S856685168%3A1705676533839234&theme=glif Requested by Host: es2259206.ganza39.online URL: https://es2259206.ganza39.online/ Protocol H2 Server 2a00:1450:4013:c00::54 Groningen, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Redirect headers date Fri, 19 Jan 2024 15:02:13 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-OW4EYBwewrh2e2CpbODq9g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport x-content-type-options nosniff alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 406 x-xss-protection 1; mode=block pragma no-cache server GSE x-frame-options DENY report-to {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]} content-type text/html; charset=UTF-8 location https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2Crlp5ubEHWNhGxY8MvasbbhTF_cmqBKGj-G2vzMYRS3CNl8G1xzVdwkvYm_gmJW4Zg8BnLA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S856685168%3A1705676533839234&theme=glif cache-control no-cache, no-store, max-age=0, must-revalidate cross-origin-opener-policy-report-only same-origin; report-to="coop_gse_qebhlk" expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	dip Show response nereserv.com/in/	0 201 B	350ms 28ms	XHR text/plain	94.130.198.6 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://nereserv.com/in/dip?site=native-push&wl=0&event_id=00fd060e-c6d8-44df-b11f-543320ea3643&subid=416473681&sid=1784523226&spot_id=26103&created_at=2024-01-19&timezone=1&ver=8.136.0&is_native=1 Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/d4366bc23739d6e56532e8db0ecfd1b3.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.198.6 Reilingen, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.6.198.130.94.clients.your-server.de Software nginx/1.20.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:14 GMT server nginx/1.20.1 vary Origin access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 0
OPTIONS H2	204	multy 1f630c0f37.da5ac5f203.com/in/ Frame	0 0	367ms 41ms	Preflight	2a01:4f8:252:561a::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://1f630c0f37.da5ac5f203.com/in/multy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:4f8:252:561a::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx/1.20.1 / Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://es2259206.ganza39.online Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers access-control-allow-headers Content-Type access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate date Fri, 19 Jan 2024 15:02:14 GMT pragma no-cache server nginx/1.20.1 vary Origin
POST H2	200	multy Show response 1f630c0f37.da5ac5f203.com/in/	24 KB 3 KB	590ms 590ms	XHR application/json	2a01:4f8:252:561a::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://1f630c0f37.da5ac5f203.com/in/multy Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/d4366bc23739d6e56532e8db0ecfd1b3.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:4f8:252:561a::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx/1.20.1 / Resource Hash `a05893af5daa1790f46d988d1d0e6ef543c4940b32a45e42e845766a4d8e27c8` Request headers Referer https://es2259206.ganza39.online/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:14 GMT content-encoding gzip server nginx/1.20.1 vary Origin access-control-allow-methods * content-type application/json access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 2459
GET H2	200	styles.css js.wpshsdk.com/npc/sdk/push/	5 KB 1 KB	16ms 16ms	Stylesheet text/css	45.133.44.53 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://js.wpshsdk.com/npc/sdk/push/styles.css Requested by Host: js.wpshsdk.com URL: https://js.wpshsdk.com/npc/sdk/push.m.js?v=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.18.0 / Resource Hash `79df24d61a7a01e4f59b0f652485a87eda1beee40d1eada02100685101a796f2` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Fri, 19 Jan 2024 15:07:14 GMT date Fri, 19 Jan 2024 15:02:14 GMT content-encoding gzip last-modified Wed, 27 Dec 2023 12:29:14 GMT server nginx/1.18.0 etag W/"658c189a-14c6" content-type text/css access-control-allow-origin * cache-control max-age=300 x-proxy-cache HIT
GET H2	200	subscription-offers notification.tubecup.net/in/	0 201 B	98ms 27ms	Image text/plain	78.47.199.202 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://notification.tubecup.net/in/subscription-offers?href=https%3A%2F%2Fes2259206.ganza39.online%2F&tcid=0&spot_id=13227&site=tcpublisher&source_id=0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 78.47.199.202 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.202.199.47.78.clients.your-server.de Software nginx/1.18.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:14 GMT server nginx/1.18.0 vary Origin access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 0
GET H2	200	US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp static.bookmsg.com/creatives/US/	590 B 802 B	76ms 17ms	Image image/webp	2a02:b48:8301::24 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.bookmsg.com/creatives/US/US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.02&cpa=4ecde043-18ad-4a18-935e-7cdac0f75dcd&prev_step_diff=961 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `c2443b0a74b25158756abb7aa12832e5442adab247aab6e24514f54396c72579` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Sat, 18 Jan 2025 15:02:14 GMT date Fri, 19 Jan 2024 15:02:14 GMT last-modified Fri, 08 Dec 2023 10:18:03 GMT server nginx/1.24.0 etag "6572ed5b-24e" content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 590 x-proxy-cache HIT
GET H2	200	US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp static.bookmsg.com/creatives/US/	590 B 802 B	77ms 18ms	Image image/webp	2a02:b48:8301::24 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.bookmsg.com/creatives/US/US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `c2443b0a74b25158756abb7aa12832e5442adab247aab6e24514f54396c72579` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Sat, 18 Jan 2025 15:02:14 GMT date Fri, 19 Jan 2024 15:02:14 GMT last-modified Fri, 08 Dec 2023 10:18:03 GMT server nginx/1.24.0 etag "6572ed5b-24e" content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 590 x-proxy-cache HIT
GET H2	200	/ 1f630c0f37.da5ac5f203.com/in/show/	0 201 B	119ms 41ms	Image text/plain	2a01:4f8:252:561a::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://1f630c0f37.da5ac5f203.com/in/show/?tag_ab=c&site_id=3126103&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=mq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fes2259206.ganza39.online%2F&refdom=es2259206.ganza39.online&auction_time=1705676534&subid=416473681&sid=1784523226&tcid=0&ver=8.136.0&ver_c=&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-01-19&iabcat=IAB24-24&keywords=&user_fp=5013907916703193369&score=67.42693425744591&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fes2259206.ganza39.online%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=8fc5a3949d58ed66158a5da3a7b48b19&url=https%3A%2F%2Fb1.kijatrust.me%2Fkcl%3Fs%3D9%26data%3D0a54ec89778e42b4ecb19776dc622a07&icons=YVtCmHO5vjOmSDj2tXp1nDC0dJKSu7rt-Hf-3InF3JfnwijkXRK_p5nwrHGGwhasK9cv-DMzRbaIdLQTMZaiNDUOR7DF5HoU76_pFfckwWW9afxMCh9nMMuqsHpOKnpKDglHEz8WOduMYwLEA44vLnwKcK9psX3xpOyDuv1raoROJe9QXg&ext_cid=0&px_id=5326103&min_cpm=0.011331590973371847&out_id=1&campaign_type=lq-pop&aid=3583&cid=15259&uniq=&mid=7120688319913128707&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.026260875461800608&cpm=0&verify_hash=29ecef18db086961879d63f279243335&is_native=2&real_bid=0.00044923198825120805&original_bid_usd=0.000573&original_bid=0.000573&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F120.0.6099.224%20Safari%2F537.36&ip_mismatch=2a00:1630:2:602::9&geo=NL&carrier=-&label_ids=89,129,130,5,27,108,0,83&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FUS%2FUS_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp&site=native-push-mainstream&price=0.000573&hostname=auc-inpage-hz-3-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.0000005730000000000001&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.02&cpa=25e0aaf3-8ea5-488c-901a-09dd5ec2a1d4&prev_step_diff=961 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:4f8:252:561a::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx/1.20.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:14 GMT server nginx/1.20.1 vary Origin access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 0
GET H2	200	US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp static.bookmsg.com/creatives/US/ Frame 1C47	590 B 802 B	70ms 16ms	Image image/webp	2a02:b48:8301::24 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.bookmsg.com/creatives/US/US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp Requested by Host: 91ceadfe3f.3854704790.com URL: https://91ceadfe3f.3854704790.com/d4366bc23739d6e56532e8db0ecfd1b3.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `c2443b0a74b25158756abb7aa12832e5442adab247aab6e24514f54396c72579` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Sat, 18 Jan 2025 15:02:14 GMT date Fri, 19 Jan 2024 15:02:14 GMT last-modified Fri, 08 Dec 2023 10:18:03 GMT server nginx/1.24.0 etag "6572ed5b-24e" content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 590 x-proxy-cache HIT
GET DATA	200 OK	truncated / Frame 1C47	483 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp static.bookmsg.com/creatives/US/ Frame 1C47	590 B 803 B	68ms 15ms	Image image/webp	2a02:b48:8301::24 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.bookmsg.com/creatives/US/US_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&st=0.02&cpa=8eb2e294-f6e5-46d3-9d63-93d072f3941f&prev_step_diff=961 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.24.0 / Resource Hash `c2443b0a74b25158756abb7aa12832e5442adab247aab6e24514f54396c72579` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers expires Sat, 18 Jan 2025 15:02:14 GMT date Fri, 19 Jan 2024 15:02:14 GMT last-modified Fri, 08 Dec 2023 10:18:03 GMT server nginx/1.24.0 etag "6572ed5b-24e" content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 590 x-proxy-cache HIT
GET H2	200	/ 1f630c0f37.da5ac5f203.com/in/show/	0 200 B	112ms 42ms	Image text/plain	2a01:4f8:252:561a::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://1f630c0f37.da5ac5f203.com/in/show/?tag_ab=c&site_id=3126103&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=mq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fes2259206.ganza39.online%2F&refdom=es2259206.ganza39.online&auction_time=1705676534&subid=416473681&sid=1784523226&tcid=0&ver=8.136.0&ver_c=&spot_id=26103&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-01-19&iabcat=IAB24-24&keywords=&user_fp=5013907916703193369&score=67.42693425744591&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D416473681%26spot_id%3D26103%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fes2259206.ganza39.online%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=8fc5a3949d58ed66158a5da3a7b48b19&url=https%3A%2F%2Fb1.kijatrust.me%2Fkcl%3Fs%3D9%26data%3D0a54ec89778e42b4ecb19776dc622a07&icons=v82PmPL-651ZXF6rXEw7ZNIcrlV13mcvbdwM9E1HMHd0DhhhqoJbb6PLApbBsPd1OIjTKy2YAbYDqXSQuI4L8xJYJlG4AIXJbivNKR8TEnuX6Ai9Y_yzopFpTcwie6X6_O58WlwDMRPbX5oOYDqnS4c-TFmhdr11sIirwZVxE2Lc9HzVvg&ext_cid=0&px_id=5326103&min_cpm=0.011331590973371847&out_id=0&campaign_type=lq-pop&aid=3583&cid=15259&uniq=&mid=7120688319913128707&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.026260875461800608&cpm=0&verify_hash=29ecef18db086961879d63f279243335&is_native=2&real_bid=0.00044923198825120805&original_bid_usd=0.000573&original_bid=0.000573&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F120.0.6099.224%20Safari%2F537.36&ip_mismatch=2a00:1630:2:602::9&geo=NL&carrier=-&label_ids=130,108,0,83,89,5,27,129&need_redirect_show=0&applied_features=main-skins-settings,prod&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FUS%2FUS_34c3a6403004486b593fb6a3428d7a2748437f4f_icon.webp&site=native-push-mainstream&price=0.000573&hostname=auc-inpage-hz-3-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.0000005730000000000001&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&st=0.02&cpa=91b911f4-4502-438a-9d96-32cb46c92600&prev_step_diff=961 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:4f8:252:561a::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx/1.20.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://es2259206.ganza39.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers pragma no-cache date Fri, 19 Jan 2024 15:02:14 GMT server nginx/1.20.1 vary Origin access-control-allow-methods * access-control-allow-origin * cache-control no-transform, no-cache, no-store, must-revalidate access-control-allow-headers Content-Type content-length 0

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			js.nextpsh.top/	1970-01-21 03:23:56	Name: __psu Value: d9bfdeb7-7e80-4e45-bd49-3259cc4c5429
			fp.metricswpsh.com/	1970-01-21 02:33:32	Name: id Value: 17713985060237074254

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp2Crlp5ubEHWNhGxY8MvasbbhTF_cmqBKGj-G2vzMYRS3CNl8G1xzVdwkvYm_gmJW4Zg8BnLA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S856685168%3A1705676533839234&theme=glif Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1f630c0f37.da5ac5f203.com
91ceadfe3f.3854704790.com
9a3d699a42.f4042bb57f.com
accounts.google.com
es2259206.ganza39.online
fp.metricswpsh.com
js.capndr.com
js.nextpsh.top
js.wpshsdk.com
nereserv.com
notification.tubecup.net
static.bookmsg.com
storage.multstorage.com
104.21.39.40
157.90.84.242
2606:4700:3032::6815:1ef2
2a00:1450:4013:c00::54
2a01:4f8:252:561a::2
2a02:b48:8301::24
2a06:98c1:3121::3
45.133.44.52
45.133.44.53
78.47.199.202
94.130.198.6
01a853c86a5a18b51fa0ac79826d8fba76adea15d20420fbf190524af9950bd6
120aa0531a07558f6e5f48f0f5c20be188244fe011ccd52bb0b86c39f2061385
19502848b55627b7db8703899758a5ab2ec6ca4316f0bdb3278bea1a7c19c80b
444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0
70bef0b9b90f224dcce56929057d20668fd82f6a6044195d3655b893657ff11b
79df24d61a7a01e4f59b0f652485a87eda1beee40d1eada02100685101a796f2
893d45803f7ec831d4093d197d351a29e63f2a3b8a88d99b79d2bbed31d57618
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2
a05893af5daa1790f46d988d1d0e6ef543c4940b32a45e42e845766a4d8e27c8
c2443b0a74b25158756abb7aa12832e5442adab247aab6e24514f54396c72579
d0756a02b1c82a9f79197dcf9b6c793d8716f508f002bee523b00cec2988d59b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f00f8a8d2e06b1f97e778f937451a61cf5cffe091a166b87b0855dba7e29a060
f41597e9109254c277334ce27b4dd5a1b823f2b988b602f3295fc2e8cdfd54a3

es2259206.ganza39.online Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

24 Requests

96 %HTTPS

45 %IPv6

13 Domains

13 Subdomains

12 IPs

4 Countries

237 kBTransfer

838 kBSize

2 Cookies

0 Outgoing links

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

es2259206.ganza39.online Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

96 %
HTTPS

45 %
IPv6

13
Domains

13
Subdomains

12
IPs

4
Countries

237 kB
Transfer

838 kB
Size

2
Cookies

24 HTTP transactions
1 data transactions