www.2-spyware.com Open in urlscan Pro
209.126.117.72 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.2-spyware.com/file-nc-exe.html#:~:text=Terms%20and%20Privacy.-
Effective URL:
https://www.2-spyware.com/file-nc-exe.html
Submission: On September 03 via api (September 3rd 2020, 8:11:24 am UTC) from US

Summary HTTP 30 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 11 domains to perform 30 HTTP transactions. The main IP is 209.126.117.72, located in St Louis, United States and belongs to AS-30083-GO-DADDY-COM-LLC, US. The main domain is www.2-spyware.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 12th 2020. Valid for: 3 months.

This is the only time www.2-spyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	209.126.117.72 209.126.117.72	30083 (AS-30083-...) (AS-30083-GO-DADDY-COM-LLC)
7	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3037::681c:12c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	109.235.67.100 109.235.67.100	62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
2	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
30	10

11 209.126.117.72 (St Louis, United States)

ASN30083 (AS-30083-GO-DADDY-COM-LLC, US)
PTR: usloft4272.serverprofi24.eu

www.2-spyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::681c:12c5 (United States)

ASN13335 (CLOUDFLARENET, US)

track.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.235.67.100 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)
PTR: server.hey.lt

www.hey.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	2-spyware.com www.2-spyware.com	264 KB
6	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	143 KB
2	doubleclick.net googleads.g.doubleclick.net
2	twitter.com platform.twitter.com	29 KB
2	facebook.net connect.facebook.net	61 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	hey.lt www.hey.lt	828 B
1	track.lt track.lt	471 B
1	googletagservices.com www.googletagservices.com	28 KB
1	google.com adservice.google.com	890 B
1	google.de adservice.google.de	890 B
30	11

	Domain	Requested by
11	www.2-spyware.com	www.2-spyware.com
4	pagead2.googlesyndication.com	www.2-spyware.com pagead2.googlesyndication.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	platform.twitter.com	www.2-spyware.com platform.twitter.com
2	connect.facebook.net	www.2-spyware.com connect.facebook.net
2	www.google-analytics.com	www.2-spyware.com www.google-analytics.com
1	www.hey.lt
1	track.lt	www.2-spyware.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
30	12

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.reimageplus.com
www.enigmasoftware.com
www.malwarebytes.com
www.combocleaner.com
virusactivity.com
www.hey.lt
feeds.feedburner.com
esolutions.lt

Subject Issuer	Validity	Valid
2-spyware.com Let's Encrypt Authority X3	`2020-08-12` - `2020-11-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
*.google.de GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
hey.lt Sectigo RSA Domain Validation Secure Server CA	`2019-03-04` - `2021-06-01`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.2-spyware.com/file-nc-exe.html
Frame ID: D100EF6F91E9B52267778FACCCAD60CD
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200831/r20190131/zrt_lookup.html
Frame ID: 995B73D4414D08CE7E03ED1268512B13
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.2-spyware.com
Frame ID: 56CD6A8042C66D65D10E78E67B510DEF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1599120667&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Ffile-nc-exe.html&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1599120666928&bpp=11&bdt=140&idt=84&shv=r20200831&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1145520692442&frm=20&pv=2&ga_vid=1488336823.1599120667&ga_sid=1599120667&ga_hid=404208314&ga_fc=0&iag=0&icsg=2099903&dssz=19&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067105&oid=3&pvsid=586145148180314&pem=704&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=98
Frame ID: 9F66CC6569E02FB2645DED29087EAB9B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 7A6DB4A744A26E4F2C2C9D33952A8994
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

30
Requests

100 %
HTTPS

78 %
IPv6

11
Domains

12
Subdomains

10
IPs

4
Countries

545 kB
Transfer

1362 kB
Size

4
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/kiguolis

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ukiguolis

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/terms-of-use/
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/privacy-policy/
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/system-requirements/
Title: Supported versions

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/refund-policy/
Title: Refund Policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/enigmasoft-privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/spyhunter5-eula/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/privacy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/tos/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/eula/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/refund-policy/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://virusactivity.com/

Search URL Search Domain Scan URL

URL: https://www.hey.lt/details.php?id=spyware

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/2-spyware/XBaU
Title: Rss feed

Search URL Search Domain Scan URL

URL: https://twitter.com/2spyware
Title: Follow us

Search URL Search Domain Scan URL

URL: https://www.facebook.com/2spyware
Title: Like us

Search URL Search Domain Scan URL

URL: http://esolutions.lt/
Title: esolutions.lt

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request file-nc-exe.html Show response
www.2-spyware.com/ 92 KB
24 KB 489ms
235ms Document
text/html 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 0ae5c0c5c0799f62f31a76788d77a39e18c4af8082bd188a935da9fc4d0d2ad3

Request headers

:method: GET
:authority: www.2-spyware.com
:scheme: https
:path: /file-nc-exe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: cloudflare-nginx
date: Thu, 03 Sep 2020 08:11:06 GMT
content-type: text/html; charset=UTF-8
content-length: 24019
x-pingback: https://www.2-spyware.com/news/xmlrpc.php
vary: Accept-Encoding
content-encoding: gzip
accept-ranges: bytes
x-varnish: 1894532517
age: 0
via: 1.1 varnish

GET
H2 200 style_2s.min.css
www.2-spyware.com/news/wp-content/themes/AskIt/css/ 174 KB
31 KB 139ms
139ms Stylesheet
text/css 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/css/style_2s.min.css?ver=1599041919
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 7c745df241a1a57e05070c5756097ae326ee187df168e042e505c71dd035e66c

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
last-modified: Wed, 02 Sep 2020 10:18:24 GMT
server: cloudflare-nginx
age: 0
etag: "2b775-5ae51f4ab3c00-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532518
accept-ranges: bytes
content-length: 31212
via: 1.1 varnish

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 127 KB
44 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45c41e72f72f08728c8e74f2a77772dfe3c06edbb36cbd822101ed63184ca472

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 44921
x-xss-protection: 0
server: cafe
etag: 4474441792832422739
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Sep 2020 08:11:06 GMT

GET
H2 200 nc-exe.png
www.2-spyware.com/news/wp-content/uploads/failai/ 74 KB
74 KB 247ms
247ms Image
image/png 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/failai/nc-exe.png
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: bd81b578a6ba72ef999e70d2f88ba78d9948f7030ef10a40e28785b280829f9b

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Thu, 02 Aug 2018 09:35:13 GMT
server: cloudflare-nginx
age: 0
etag: "126f9-572708733a33b"
vary: User-Agent
content-type: image/png
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532519
accept-ranges: bytes
content-length: 75513

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Aug 2020 20:46:40 GMT
server: Golfe2
age: 3326
date: Thu, 03 Sep 2020 07:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18323
expires: Thu, 03 Sep 2020 09:15:40 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ead6b89a6e75f30dc7f237f6542252db7dc6b2332014102b3f1813c74f4ae6aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: xe4fajAULzyNTepc/7uyGg==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1779
etag: "22fff94f272c8027bc4c84d6661f9cef"
x-fb-debug: i7XwkxI4lbW3m9nNmjCUuGTtqQTSMGvCJmBi04QDomSqfM0IHGugEHgZ/L9YScmhJovH6jeJk7HaC/2lTFajuw==
x-fb-trip-id: 664085054
x-fb-content-md5: a9dcf196eb496bc7d0fca2cc1edb2229
x-frame-options: DENY
date: Thu, 03 Sep 2020 08:11:06 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 03 Sep 2020 08:26:35 GMT

GET
H2 200 compare.jpg.webp
www.2-spyware.com/news/wp-content/themes/AskIt/images/ 9 KB
10 KB 351ms
350ms Image
image/webp 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/images/compare.jpg.webp
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: a831430060169b3e40ab7b884ef0a0f8a8d54fbe984aff2e16f2427f9cbbd5d8

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Mon, 03 Aug 2020 13:06:28 GMT
server: cloudflare-nginx
age: 0
etag: "25e0-5abf8ce7b9d00"
vary: User-Agent
content-type: image/webp
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532520
accept-ranges: bytes
content-length: 9696

GET
H2 200 jquery-3.5.1.min.js Show response
www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/ 87 KB
30 KB 352ms
351ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: cloudflare-nginx
age: 0
etag: "15d84-5a4da870aa1c0-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532521
accept-ranges: bytes
content-length: 30910
via: 1.1 varnish

GET
H2 200 esol-email.js Show response
www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/ 4 KB
1 KB 351ms
350ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/esol-email.js?ver=1.0.1
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: c6ebf212edfaaf5d74025a919eebdd462feed26676999480891b7d9c3159e6d6

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 09:59:55 GMT
server: cloudflare-nginx
age: 0
etag: "ed2-59e5e08c81cc0-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532522
accept-ranges: bytes
content-length: 1211
via: 1.1 varnish

GET
H2 200 all.min.js Show response
www.2-spyware.com/news/wp-content/themes/AskIt/js/ 53 KB
16 KB 351ms
350ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/js/all.min.js?ver=1595244873
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 8b4df7cd262606ef4bd552cc2b2e149a3207e032245ef1f246371ebe2052bede

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
last-modified: Thu, 23 Jul 2020 13:40:41 GMT
server: cloudflare-nginx
age: 0
etag: "d321-5ab1c0098c840-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532523
accept-ranges: bytes
content-length: 15963
via: 1.1 varnish

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edd8076d1897300f954c3e2ff22561988017747a10983e2f34c613b3da103549

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 logo2x.png
www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/ 6 KB
7 KB 349ms
347ms Image
image/png 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/logo2x.png
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Thu, 11 Jun 2020 12:55:56 GMT
server: cloudflare-nginx
age: 0
etag: "1948-5a7ce7b392f00"
vary: User-Agent
content-type: image/png
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532524
accept-ranges: bytes
content-length: 6472

GET
H2 200 sprites.png
www.2-spyware.com/news/wp-content/themes/esolaskit/css/ 44 KB
45 KB 349ms
348ms Image
image/png 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/css/sprites.png?v=k6j5tim3
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: ed39b882f90708af2ee950e46c0f4e1c5814428a1ecc9f70707d6ae1470937ac

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Thu, 11 Jun 2020 12:55:56 GMT
server: cloudflare-nginx
age: 0
etag: "b1fb-5a7ce7b392f00"
vary: User-Agent
content-type: image/png
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532525
accept-ranges: bytes
content-length: 45563

GET
DATA 200
OK truncated
/ 213 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7909baf134ca656d1e4dbc68819638cc2e1e7bdbd8ccaaebc3cf86b3e7a9e4fd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 30ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40DA) /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 08:11:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 20:40:54 GMT
Server: ECS (fcn/40DA)
Age: 227
Etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28881

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 194 KB
59 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f7b22ac29d35beb9bed25508fe2451ef04107bea3f8ca1c53c551cd674522a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://www.2-spyware.com
Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 4ThCcPr9Yjsdi45yxHxu1w==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 59847
etag: "a1ada4730b3868e3c70ed957ee991f58"
x-fb-debug: 6llTO8J49MNkQa0qG/dN4OFzO7TV6UtYZL3+ct1xMSJpGfg3Hx8XEDJ/SYeRZ876tRiyiaQE7Ry0FlHSBoq4XQ==
x-fb-trip-id: 2030378118
x-fb-content-md5: ab1c4a6fffd8c4109946d462f946e1b2
x-frame-options: DENY
date: Thu, 03 Sep 2020 08:11:06 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Fri, 03 Sep 2021 06:37:04 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
66 B 13ms
12ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j85&a=404208314&t=pageview&_s=1&dl=https%3A%2F%2Fwww.2-spyware.com%2Ffile-nc-exe.html&ul=en-us&de=UTF-8&dt=What%20is%20nc.exe%3F&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=242244616&gjid=60027692&cid=1488336823.1599120667&tid=UA-60636-1&_gid=477766876.1599120667&_r=1&z=966677453

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 03 Sep 2020 08:11:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.2-spyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
890 B 35ms
15ms Script
application/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.2-spyware.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
890 B 36ms
16ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.2-spyware.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/ 228 KB
86 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab1bc0fc9d97fbc0dbeb5170601f9e3ec9d35545f900f174bfe9390ac009f6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 87707
x-xss-protection: 0
server: cafe
etag: 3465727129889255062
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Sep 2020 08:11:06 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200831/r20190131/ Frame 995B 0
0 6ms
5ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200831/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200831/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/file-nc-exe.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/file-nc-exe.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Mon, 31 Aug 2020 20:11:25 GMT
expires: Mon, 14 Sep 2020 20:11:25 GMT
content-type: text/html; charset=UTF-8
etag: 9704104221650600920
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4744
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 215981
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html
platform.twitter.com/widgets/ Frame 56CD 0
0 8ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.2-spyware.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D4) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.2-spyware.com/file-nc-exe.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/file-nc-exe.html

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 98303
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 03 Sep 2020 08:11:06 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Tue, 01 Sep 2020 17:58:17 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40D4)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 9F66 0
0 71ms
70ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1599120667&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Ffile-nc-exe.html&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1599120666928&bpp=11&bdt=140&idt=84&shv=r20200831&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1145520692442&frm=20&pv=2&ga_vid=1488336823.1599120667&ga_sid=1599120667&ga_hid=404208314&ga_fc=0&iag=0&icsg=2099903&dssz=19&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067105&oid=3&pvsid=586145148180314&pem=704&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=98

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1599120667&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Ffile-nc-exe.html&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1599120666928&bpp=11&bdt=140&idt=84&shv=r20200831&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1145520692442&frm=20&pv=2&ga_vid=1488336823.1599120667&ga_sid=1599120667&ga_hid=404208314&ga_fc=0&iag=0&icsg=2099903&dssz=19&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067105&oid=3&pvsid=586145148180314&pem=704&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=98
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/file-nc-exe.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/file-nc-exe.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 03 Sep 2020 08:11:07 GMT
server: cafe
content-length: 34
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 03-Sep-2020 08:26:07 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Thu, 03 Sep 2020 08:11:07 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
28 KB 60ms
41ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f0f0573723f7309c09eb7d2d71512e6be2e8e76e395672c77ef4e70e9322582

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1599061127637494"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27490
x-xss-protection: 0
expires: Thu, 03 Sep 2020 08:11:07 GMT

GET
DATA 200
OK truncated
/ 85 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 index.php Show response
track.lt/visitapi/ 116 B
471 B 78ms
61ms XHR
text/html 2606:4700:3037::681c:12c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://track.lt/visitapi/index.php?r=
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::681c:12c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.3
Resource Hash: be79ce60bc2200a2ce2c467ab82b48080af41be4ea43d071a2eabacb19b1c1a5

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/5.3.3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: text/html
access-control-allow-origin: https://www.2-spyware.com
cf-ray: 5ccdff8a9fb31f35-FRA
cf-request-id: 04f49e0a9c00001f351d2ed200000001

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9c400058817ddace359f2881ed3efc3cbd19d8cb03a195fc1354e5d475ad5a6

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 visited-porn-sites-you-are-infected_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
13 KB 129ms
128ms Image
image/jpeg 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/visited-porn-sites-you-are-infected_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 4473c97cf92b148c2b75290404fec7b83d1864fe9cf8376f80f25077f1fe1e21

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Wed, 07 Feb 2018 11:27:44 GMT
server: cloudflare-nginx
age: 0
etag: "3200-5649d957a666b"
vary: User-Agent
content-type: image/jpeg
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532529
accept-ranges: bytes, bytes
content-length: 12800

GET
H2 200 stay-home-stay-safe-use-vpn_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
14 KB 130ms
129ms Image
image/jpeg 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/stay-home-stay-safe-use-vpn_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/file-nc-exe.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:06 GMT
via: 1.1 varnish
last-modified: Tue, 31 Mar 2020 14:32:30 GMT
server: cloudflare-nginx
age: 0
etag: "352d-5a227700c2d9a"
vary: User-Agent
content-type: image/jpeg
status: 200
cache-control: max-age=15854400, public
x-varnish: 1894532528
accept-ranges: bytes, bytes
content-length: 13613

GET
H/1.1 200
OK count.php
www.hey.lt/ 450 B
828 B 161ms
53ms Image
image/png 109.235.67.100
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.hey.lt/count.php?id=spyware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 109.235.67.100 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: server.hey.lt
Software: Apache /
Resource Hash: 9f66c6c54a8a222053eb9e6305845bfeb96c548d27b120ebd21c18dbd05be738

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Sep 2020 08:11:07 GMT
Server: Apache
P3P: CP="NID"
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 450
Expires: Thu, 1 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 46ms
33ms XHR
application/json 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200831&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b851cfc0727a2772b7799020ebecf22886f42bf2b8ccac1b2228ef31408b577a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 03 Sep 2020 08:11:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6504
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200831/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 08:11:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Thu, 03 Sep 2020 08:11:07 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 7A6D 0
0 26ms
13ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/file-nc-exe.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/file-nc-exe.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Thu, 03 Sep 2020 08:01:16 GMT
expires: Fri, 03 Sep 2021 08:01:16 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 591
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
32 B 40ms
39ms Image
image/gif 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200831&jk=586145148180314&bg=!g4ClgJhY156yC6jieoYCAAAAVVIAAAANCgFyY4qEkYJnYfLcYl4f-FZ0jJ76oUCv5npZFGkDZK92xljpK9MemAOQRE7DxU0Ac2Xym3LZog6nWpp9TnkqCF4qH_5nkTZSKEKJrGZSUhsgguzpICsIAxWxIu0V7xWeJDn3AxOeVnJVxrrfvdO_9w5nR7Jo4INWwenSNtR0a-lfEHUwvBv1PPpbGeyp0rW755Z7CCUTE3y21lFbklHcFtNaYeLFkwquyLM-NRx0XqzF3SDC0Q58vDYFXpyhY3C7iWGzWe43dqZSzf1iMNiGZczyh7oWAcTDYRFNiZTw7J6_kRDlR_xFeopvvEjZDo9ojnMjSpOjXWDJZpQmF2q_MFiT6s4l2Tqxj2nsyaDyhYyB0vWEMqcPvTiejfAFmRgLKgkmDKvI8airlia5Xy90kSFt9PFHol-SVyGngpCsJ_eNwYfh2E4fYJO543WOGva4uUpt53qhDtUsdZd-sMHeklI_BWeEfiWfgHzRfZxa2fhAqhUCvpkBqvB2DPbIkhNT_OlXxB2Kn_QqKbxeF62CctMB9woPnFvH8PhWtuorPr8_TXLalQuWsRYQCrqck3MeGer8XNjiOWTlwLJb3G7o-bMPUkan4prLNn-uBd_FGGLvoHt8rR60U4n1AnDMq-RgaoYDFDk9m62POGULNUU15nKH_hlrI5kgOFMMwg401-5B8qmj3eTzh7JGagrDEmkxIGOTBJhEdyuXshA5IO_OCIThHFMCZd1_PI8AImPEc26ue7K827gI-OChG_hmp6jsRZgLJ329iJDwLX5rufY-bo99s2BUgPXMgNfhq3ghQlKX0NOh8kc51D4bcZoPT6I0U_w0AzD9apsAmS6UIs3Jg146zdH6WIPe2rGHK44FeMYIq8COKrk3parSeLgen3W8ZPTnWXOuddtMaa5snu3e5uT_BN1fP4M1S9VOJj-Lj2eEW5bYwGkl9ZxtLYTYwTyR8Qz-WO_1YZNcmwlT77wus0IKoTLm1-vYloxXcbyrH86WhjnG_od8GurJcZvLmFXmZV06-W1YUY0m2BWj4VhPoWONeLD5FtFt6yJV401xIDfhIA

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/file-nc-exe.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Sep 2020 08:11:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 12:12:01	Name: test_cookie Value: CheckForPermission
.2-spyware.com/	1970-01-19 12:13:27	Name: _gid Value: GA1.2.477766876.1599120667
.2-spyware.com/	1970-01-19 12:12:00	Name: _gat Value: 1
.2-spyware.com/	1970-01-20 05:43:12	Name: _ga Value: GA1.2.1488336823.1599120667

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: Invalid App Id: Must be a number or numeric string representing the application id.
console-api	warning	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: FB.getLoginStatus() called before calling FB.init().
console-api	debug	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: sdkperf: it took 31 ms and 62612 bytes to load https://connect.facebook.net/en_US/all.js
console-api	debug	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: sdkperf: init logged after 181 ms
console-api	info	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: domReady
console-api	info	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: XFBML Parsing Start 1
console-api	info	URL: https://connect.facebook.net/en_US/all.js?hash=eac9a976632116d004ec1f096d391d1d&ua=modern_es6(Line 52) Message: XFBML Parsing Finish 1, 0 tags found

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
connect.facebook.net
googleads.g.doubleclick.net
pagead2.googlesyndication.com
platform.twitter.com
tpc.googlesyndication.com
track.lt
www.2-spyware.com
www.google-analytics.com
www.googletagservices.com
www.hey.lt
109.235.67.100
209.126.117.72
2606:2800:234:59:254c:406:2366:268c
2606:4700:3037::681c:12c5
2a00:1450:4001:801::2002
2a00:1450:4001:801::200e
2a00:1450:4001:809::2001
2a00:1450:4001:825::2002
2a03:2880:f01c:8012:face:b00c:0:3
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874
0ae5c0c5c0799f62f31a76788d77a39e18c4af8082bd188a935da9fc4d0d2ad3
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
3ab1bc0fc9d97fbc0dbeb5170601f9e3ec9d35545f900f174bfe9390ac009f6b
4473c97cf92b148c2b75290404fec7b83d1864fe9cf8376f80f25077f1fe1e21
45c41e72f72f08728c8e74f2a77772dfe3c06edbb36cbd822101ed63184ca472
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7909baf134ca656d1e4dbc68819638cc2e1e7bdbd8ccaaebc3cf86b3e7a9e4fd
7c745df241a1a57e05070c5756097ae326ee187df168e042e505c71dd035e66c
8b4df7cd262606ef4bd552cc2b2e149a3207e032245ef1f246371ebe2052bede
9f0f0573723f7309c09eb7d2d71512e6be2e8e76e395672c77ef4e70e9322582
9f66c6c54a8a222053eb9e6305845bfeb96c548d27b120ebd21c18dbd05be738
a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9
a831430060169b3e40ab7b884ef0a0f8a8d54fbe984aff2e16f2427f9cbbd5d8
a9c400058817ddace359f2881ed3efc3cbd19d8cb03a195fc1354e5d475ad5a6
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341
b851cfc0727a2772b7799020ebecf22886f42bf2b8ccac1b2228ef31408b577a
bd81b578a6ba72ef999e70d2f88ba78d9948f7030ef10a40e28785b280829f9b
be79ce60bc2200a2ce2c467ab82b48080af41be4ea43d071a2eabacb19b1c1a5
c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e
c6ebf212edfaaf5d74025a919eebdd462feed26676999480891b7d9c3159e6d6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ead6b89a6e75f30dc7f237f6542252db7dc6b2332014102b3f1813c74f4ae6aa
ed39b882f90708af2ee950e46c0f4e1c5814428a1ecc9f70707d6ae1470937ac
edd8076d1897300f954c3e2ff22561988017747a10983e2f34c613b3da103549
f7b22ac29d35beb9bed25508fe2451ef04107bea3f8ca1c53c551cd674522a44
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.2-spyware.com Open in urlscan Pro 209.126.117.72 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

30 Requests

100 %HTTPS

78 %IPv6

11 Domains

12 Subdomains

10 IPs

4 Countries

545 kBTransfer

1362 kBSize

4 Cookies

20 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.2-spyware.com Open in urlscan Pro
209.126.117.72 Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

100 %
HTTPS

78 %
IPv6

11
Domains

12
Subdomains

10
IPs

4
Countries

545 kB
Transfer

1362 kB
Size

4
Cookies

30 HTTP transactions
6 data transactions