Submitted URL: http://kmjzb.saqibsiddiqui.com/CWJnPtoLLY/xx.php?REDACTED
Effective URL: http://www.gold1.life/
Submission: On March 06 via automatic, source openphish

Summary

This website contacted 4 IPs in 2 countries across 7 domains to perform 10 HTTP transactions. The main IP is 160.153.128.46, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is www.gold1.life.
This is the only time www.gold1.life was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 173.212.227.86 51167 (CONTABO)
1 1 104.31.66.6 13335 (CLOUDFLAR...)
1 2 160.153.128.46 26496 (AS-26496-...)
1 104.27.183.206 13335 (CLOUDFLAR...)
4 216.58.206.2 15169 (GOOGLE)
4 216.58.214.98 15169 (GOOGLE)
10 4
Domain Requested by
6 pagead2.googlesyndication.com www.gold1.life
pagead2.googlesyndication.com
2 www.gold1.life 1 redirects
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 smikta.net www.gold1.life
1 www.warz.online 1 redirects
1 kmjzb.saqibsiddiqui.com 1 redirects
10 7

This site contains links to these domains. Also see Links.

Domain
www.glype.com
Subject Issuer Validity Valid

This page contains 4 frames:

Primary Page: http://www.gold1.life/
Frame ID: (5EDA9BF4AD8D1E673A5F976DDACA084)
Requests: 6 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (1227B22875C6C07759646E3C0F94120E)
Requests: 2 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (1D6FC0389A7D1F99B26DA43C4E0E0A48)
Requests: 1 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (20BD30A535C487839A2A8FE9FD293469)
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://kmjzb.saqibsiddiqui.com/CWJnPtoLLY/xx.php?REDACTED HTTP 302
    http://www.warz.online/live.php HTTP 302
    http://www.gold1.life/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^google_ad_/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i

Overall confidence: 100%
Detected patterns
  • env /^gaGlobal$/i

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

4
IPs

2
Countries

124 kB
Transfer

688 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://kmjzb.saqibsiddiqui.com/CWJnPtoLLY/xx.php?REDACTED HTTP 302
    http://www.warz.online/live.php HTTP 302
    http://www.gold1.life/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.gold1.life/includes/main.js?1.4.15 HTTP 302
  • http://smikta.net/protected?1.4.15

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.gold1.life/
Redirect Chain
  • http://kmjzb.saqibsiddiqui.com/CWJnPtoLLY/xx.php?REDACTED
  • http://www.warz.online/live.php
  • http://www.gold1.life/
8 KB
3 KB
Document
General
Full URL
http://www.gold1.life/
Protocol
HTTP/1.1
Server
160.153.128.46 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-160-153-128-46.ip.secureserver.net
Software
Apache / PHP/5.4.45
Resource Hash
d10ef734eef928680e46e9aafe8f4fd34845d000d4a9c13ffc625259e135c0cb

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
www.gold1.life
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 06 Mar 2018 09:40:43 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Sep 2017 09:01:09 GMT
Server
Apache
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding,User-Agent
Content-Type
text/html
Set-Cookie
s=hbvopc40qp5ah5rbkkph23l3j0; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
2932

Redirect headers

Date
Tue, 06 Mar 2018 09:40:43 GMT
Server
cloudflare
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding,User-Agent
Content-Type
text/html
Location
http://www.gold1.life
Set-Cookie
__cfduid=d4e4bd158166a6197295dd5cbffa2cb5f1520329243; expires=Wed, 06-Mar-19 09:40:43 GMT; path=/; domain=.warz.online; HttpOnly
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
3f73dcc9672d2360-FRA
Cookie set protected
smikta.net/
Redirect Chain
  • http://www.gold1.life/includes/main.js?1.4.15
  • http://smikta.net/protected?1.4.15
0
0
Script
General
Full URL
http://smikta.net/protected?1.4.15
Requested by
Host: www.gold1.life
URL: http://www.gold1.life/
Protocol
HTTP/1.1
Server
104.27.183.206 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
smikta.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://www.gold1.life/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 06 Mar 2018 09:40:47 GMT
Content-Encoding
gzip
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Set-Cookie
__cfduid=d973d23bdd45a86aec94785d0a9984d441520329247; expires=Wed, 06-Mar-19 09:40:47 GMT; path=/; domain=.smikta.net; HttpOnly
Connection
keep-alive
CF-RAY
3f73dce6f31497bc-FRA

Redirect headers

Location
http://smikta.net/protected?1.4.15
Date
Tue, 06 Mar 2018 09:40:43 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
218
Content-Type
text/html; charset=iso-8859-1
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
71 KB
27 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.gold1.life
URL: http://www.gold1.life/
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
0c61d254d90238145611a374b297786047e47688e2699c3374651e5cf099bb68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Tue, 06 Mar 2018 09:40:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
8037863889845716279
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
26874
X-XSS-Protection
1; mode=block
Expires
Tue, 06 Mar 2018 09:40:43 GMT
integrator.js
adservice.google.de/adsid/
108 B
174 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.gold1.life
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
216.58.214.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s05-in-f98.1e100.net
Software
cafe /
Resource Hash
fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 06 Mar 2018 09:40:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length
107
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
108 B
174 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.gold1.life
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
216.58.214.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s05-in-f98.1e100.net
Software
cafe /
Resource Hash
fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 06 Mar 2018 09:40:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length
107
x-xss-protection
1; mode=block
ca-pub-1197260706192222.js
pagead2.googlesyndication.com/pub-config/r20160913/
225 B
290 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1197260706192222.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
216.58.214.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s05-in-f98.1e100.net
Software
sffe /
Resource Hash
52198fe753c18904faad4a4ca53ce12833d84501949ebe576ef640232e25a8f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Tue, 06 Mar 2018 09:20:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 05 Mar 2018 21:36:41 GMT
server
sffe
age
1203
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length
159
x-xss-protection
1; mode=block
expires
Tue, 06 Mar 2018 21:20:44 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (122
178 KB
67 KB
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
0ea789854e9792f778e0027d6185ea36278ad9d0f86a8c9499a97fc7ff06d616
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Tue, 06 Mar 2018 09:40:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
6030538908378513493
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
67839
X-XSS-Protection
1; mode=block
Expires
Tue, 06 Mar 2018 09:40:47 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (122
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Protocol
SPDY
Server
216.58.214.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s05-in-f98.1e100.net
Software
cafe /
Resource Hash
c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.gold1.life/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Wed, 28 Feb 2018 14:07:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
502402
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length
27467
x-xss-protection
1; mode=block
server
cafe
etag
11784303078778526260
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 14 Mar 2018 14:07:26 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (1D6
178 KB
0
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
0ea789854e9792f778e0027d6185ea36278ad9d0f86a8c9499a97fc7ff06d616
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 06 Mar 2018 09:40:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=UTF-8
Server
cafe
ETag
6030538908378513493
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
67839
X-XSS-Protection
1; mode=block
Expires
Tue, 06 Mar 2018 09:40:47 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (20B
178 KB
0
Script
General
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
0ea789854e9792f778e0027d6185ea36278ad9d0f86a8c9499a97fc7ff06d616
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 06 Mar 2018 09:40:47 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=UTF-8
Server
cafe
ETag
6030538908378513493
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
67839
X-XSS-Protection
1; mode=block
Expires
Tue, 06 Mar 2018 09:40:47 GMT

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ginf object| adsbygoogle object| google_js_reporting_queue object| google_ad_modifications boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken function| google_spfd number| google_unique_id object| google_t12n_vars object| google_jobrunner object| google_iframe_oncopy object| google_persistent_state_async object| google_reactive_ads_global_state object| google_pub_config object| __google_ad_urls number| google_global_correlator object| gaGlobal object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_AdSense_getAdAdapterInstance boolean| google_onload_fired function| google_osd_amcb

3 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: DSID
Value: NO_DATA
.doubleclick.net/ Name: IDE
Value: AHWqTUkje-q0roAamH6_Ii-JbULChfpJK57qzU0QGeOeg4KF6UtzYSNI0PMlzL_h
www.gold1.life/ Name: s
Value: hbvopc40qp5ah5rbkkph23l3j0