Submitted URL: https://abroadlynijiz.site/rs?y=eGs6rHCGrjn8qjrGpdkFrHsFqdr4sSE5qdkEpjnIqHaFpjU9vdaKrdsGpdr6qdg6rdCEpjsGqdU9vcsFCfxUmGJ5DcJ...
Effective URL: https://cd-down.com/?a=93446&c=209072
Submission: On March 11 via manual from CA

Summary

This website contacted 5 IPs in 3 countries across 8 domains to perform 5 HTTP transactions. The main IP is 2a05:d018:483:6130:eaf9:f6f2:ce6:f56c, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is cd-down.com.
TLS certificate: Issued by Amazon on April 4th 2019. Valid for: a year.
This is the only time cd-down.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.73.198.53 14618 (AMAZON-AES)
1 1 173.239.53.18 27257 (WEBAIR-IN...)
1 2 88.208.7.132 39572 (ADVANCEDH...)
1 1 35.175.38.64 14618 (AMAZON-AES)
1 2 144.34.189.188 25820 (IT7NET)
1 2a05:d018:483... 16509 (AMAZON-02)
1 2a05:d018:483... 16509 (AMAZON-02)
5 5
Apex Domain
Subdomains
Transfer
2 cctrack.site
cctrack.site
1 KB
2 t7rsx24c5.com
t7rsx24c5.com
4 KB
1 gdmconvtrck.com
gdmconvtrck.com
1 KB
1 cd-down.com
cd-down.com
1 KB
1 ortrun-adi.com
ortrun-adi.com
497 B
1 mopushy.com
xml.mopushy.com
204 B
1 abroadlynijiz.site
abroadlynijiz.site
211 B
0 slimtraf.com Failed
stream.slimtraf.com Failed
5 8
Domain Requested by
2 cctrack.site 1 redirects t7rsx24c5.com
2 t7rsx24c5.com 1 redirects
1 gdmconvtrck.com cd-down.com
1 cd-down.com cctrack.site
1 ortrun-adi.com 1 redirects
1 xml.mopushy.com 1 redirects
1 abroadlynijiz.site 1 redirects
0 stream.slimtraf.com Failed gdmconvtrck.com
5 8

This site contains no links.

Subject Issuer Validity Valid
t7rsx24c5.com
Let's Encrypt Authority X3
2020-02-18 -
2020-05-18
3 months crt.sh
www.cctrack.site
Sectigo RSA Domain Validation Secure Server CA
2019-07-04 -
2020-07-03
a year crt.sh
cd-down.com
Amazon
2019-04-04 -
2020-05-04
a year crt.sh
gdmconvtrck.com
Amazon
2019-04-19 -
2020-05-19
a year crt.sh

This page contains 1 frames:

Frame: https://stream.slimtraf.com/directclick/?pid=xz0Scozj6e4l6_SoIjrlQHsu30o1&wsid=e27704f997434016abeaae45346b3c3912215&subid=93446
Frame ID: 263BA197A6B75C815BF331BE359E2F2F
Requests: 5 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://abroadlynijiz.site/rs?y=eGs6rHCGrjn8qjrGpdkFrHsFqdr4sSE5qdkEpjnIqHaFpjU9vdaKrdsGpdr6qdg6rdCEpjs... HTTP 307
    https://xml.mopushy.com/click?i=7MCLasA0bus_0&__id__=ab-safe-keeping.icu HTTP 302
    https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0 Page URL
  2. https://t7rsx24c5.com/d/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0 HTTP 302
    http://ortrun-adi.com/%7Bnsid%7D_MjIzNTcyLjg0NTA5NA==_3359_2960?adTagId=fa4b5a50-02d6-11e9-a241-0a... HTTP 302
    https://cctrack.site/click.php?c=36&key=q5l11yeloczm67km1p53nq1h HTTP 302
    https://cctrack.site/jump/?jl=2103268 Page URL
  3. https://cd-down.com/?a=93446&c=209072 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

80 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

5
IPs

3
Countries

6 kB
Transfer

18 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://abroadlynijiz.site/rs?y=eGs6rHCGrjn8qjrGpdkFrHsFqdr4sSE5qdkEpjnIqHaFpjU9vdaKrdsGpdr6qdg6rdCEpjsGqdU9vcsFCfxUmGJ5DcJVn8Y7lxhpkxtPrHnSvcteuHmklU4niNbeCy83D6VHDfs7mM9Svy48ByEIBNlIBcEEvTaEpdC9rdU8rdnGrTr7rjn4rSESqdw8qHrFher4rynFgTYFpyn9qdxMrHUHrdY4hetThdUSvctSpdY9qMk5rjgEhyqUqHhSqjw9gen7rTk5qHDMrdaHrcsIsMlZqTw8hjsEvjbSqTwJqyw8rG8ZrTa6vjC9petVhdtZrdg6qisIsMxSvfqZhMkJA7lVCyVKhG4Pg6kSvy48ByEIsNmVC6mNf6YHrSsIBNlIBx9%3D&z=KLUv%2FSBIQQIAaHR0cHM6Ly94bWwubW9wdXNoeS5jb20vY2xpY2s%2FaT03TUNMYXNBMGJ1c18wJl9faWRfXz1hYi1zYWZlLWtlZXBpbmcuaWN1 HTTP 307
    https://xml.mopushy.com/click?i=7MCLasA0bus_0&__id__=ab-safe-keeping.icu HTTP 302
    https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0 Page URL
  2. https://t7rsx24c5.com/d/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0 HTTP 302
    http://ortrun-adi.com/%7Bnsid%7D_MjIzNTcyLjg0NTA5NA==_3359_2960?adTagId=fa4b5a50-02d6-11e9-a241-0a15cb739170&cpm=0.01&extclickid=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611_2960_3829_7MCLasA0bus_0&fallbackUrl=https://t7rsx24c5.com/d/2960?rt%3Dbu%26rank%3D1%26nsid%3D223572.845094%26uuid%3D84ac583dd5d1816c7c7cf0f034b2d9b2&isubid=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611_2960_3829_7MCLasA0bus_0&iclick_id=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611 HTTP 302
    https://cctrack.site/click.php?c=36&key=q5l11yeloczm67km1p53nq1h HTTP 302
    https://cctrack.site/jump/?jl=2103268 Page URL
  3. https://cd-down.com/?a=93446&c=209072 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://abroadlynijiz.site/rs?y=eGs6rHCGrjn8qjrGpdkFrHsFqdr4sSE5qdkEpjnIqHaFpjU9vdaKrdsGpdr6qdg6rdCEpjsGqdU9vcsFCfxUmGJ5DcJVn8Y7lxhpkxtPrHnSvcteuHmklU4niNbeCy83D6VHDfs7mM9Svy48ByEIBNlIBcEEvTaEpdC9rdU8rdnGrTr7rjn4rSESqdw8qHrFher4rynFgTYFpyn9qdxMrHUHrdY4hetThdUSvctSpdY9qMk5rjgEhyqUqHhSqjw9gen7rTk5qHDMrdaHrcsIsMlZqTw8hjsEvjbSqTwJqyw8rG8ZrTa6vjC9petVhdtZrdg6qisIsMxSvfqZhMkJA7lVCyVKhG4Pg6kSvy48ByEIsNmVC6mNf6YHrSsIBNlIBx9%3D&z=KLUv%2FSBIQQIAaHR0cHM6Ly94bWwubW9wdXNoeS5jb20vY2xpY2s%2FaT03TUNMYXNBMGJ1c18wJl9faWRfXz1hYi1zYWZlLWtlZXBpbmcuaWN1 HTTP 307
  • https://xml.mopushy.com/click?i=7MCLasA0bus_0&__id__=ab-safe-keeping.icu HTTP 302
  • https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
Request Chain 1
  • https://t7rsx24c5.com/d/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0 HTTP 302
  • http://ortrun-adi.com/%7Bnsid%7D_MjIzNTcyLjg0NTA5NA==_3359_2960?adTagId=fa4b5a50-02d6-11e9-a241-0a15cb739170&cpm=0.01&extclickid=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611_2960_3829_7MCLasA0bus_0&fallbackUrl=https://t7rsx24c5.com/d/2960?rt%3Dbu%26rank%3D1%26nsid%3D223572.845094%26uuid%3D84ac583dd5d1816c7c7cf0f034b2d9b2&isubid=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611_2960_3829_7MCLasA0bus_0&iclick_id=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611 HTTP 302
  • https://cctrack.site/click.php?c=36&key=q5l11yeloczm67km1p53nq1h HTTP 302
  • https://cctrack.site/jump/?jl=2103268
Request Chain 3
  • https://cd-down.com/?a=93446&c=207105&oc=96964&sr=t&so=75441&sc=10801054&rc=24_98850&ref=https%3A%2F%2Fcctrack.site%2Fjump%2F%3Fjl%3D2103268&vt=1583963612978&h=be6bf6b55364906245a6a637a1a9970756eab8a9&req=https%3A%2F%2Fcd-down.com%2F%3Fa%3D93446%26c%3D209072&us=c7f7db6ec5ba44718bf451dcef68c280 HTTP 302
  • https://stream.slimtraf.com/directclick/?pid=xz0Scozj6e4l6_SoIjrlQHsu30o1&wsid=e27704f997434016abeaae45346b3c3912215&subid=93446

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
2960
t7rsx24c5.com/i/
Redirect Chain
  • https://abroadlynijiz.site/rs?y=eGs6rHCGrjn8qjrGpdkFrHsFqdr4sSE5qdkEpjnIqHaFpjU9vdaKrdsGpdr6qdg6rdCEpjsGqdU9vcsFCfxUmGJ5DcJVn8Y7lxhpkxtPrHnSvcteuHmklU4niNbeCy83D6VHDfs7mM9Svy48ByEIBNlIBcEEvTaEpdC9r...
  • https://xml.mopushy.com/click?i=7MCLasA0bus_0&__id__=ab-safe-keeping.icu
  • https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
15 KB
3 KB
Document
General
Full URL
https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.208.7.132 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx-more /
Resource Hash
8b8705ff895495e0822e8e62c691b69a07ae5b33893d9900bef3bb756f03776c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

:method
GET
:authority
t7rsx24c5.com
:scheme
https
:path
/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Wed, 11 Mar 2020 21:53:29 GMT
content-type
text/html; charset=utf8
vary
Accept-Encoding
server
nginx-more
strict-transport-security
max-age=15768000
content-encoding
br

Redirect headers

Server
nginx
Date
Wed, 11 Mar 2020 21:53:31 GMT
Content-Length
0
Connection
keep-alive
Location
https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
Cookie set /
cctrack.site/jump/
Redirect Chain
  • https://t7rsx24c5.com/d/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
  • http://ortrun-adi.com/%7Bnsid%7D_MjIzNTcyLjg0NTA5NA==_3359_2960?adTagId=fa4b5a50-02d6-11e9-a241-0a15cb739170&cpm=0.01&extclickid=84ac583dd5d1816c7c7cf0f034b2d9b2_1583963611_2960_3829_7MCLasA0bus_0&...
  • https://cctrack.site/click.php?c=36&key=q5l11yeloczm67km1p53nq1h
  • https://cctrack.site/jump/?jl=2103268
317 B
616 B
Document
General
Full URL
https://cctrack.site/jump/?jl=2103268
Requested by
Host: t7rsx24c5.com
URL: https://t7rsx24c5.com/i/2960?nsid=223572.845094&partner_subid=7MCLasA0bus_0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
144.34.189.188 Los Angeles, United States, ASN25820 (IT7NET, CA),
Reverse DNS
144.34.189.188.16clouds.com
Software
nginx / PHP/5.5.38
Resource Hash
b431f4da0eff89a5a25d7025e247ccc1bb3f06323de2595be34904cd04ffb589

Request headers

Host
cctrack.site
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
offerLink=tw4viZBPms%2FHGwa0wDTgAQ%3D%3DukwGqZB7LoDQzm%2FTGcOnRM3uj1PhIJvJM4AyGw1LVxrW3CD0V8aOlPREgw1KOz2z; IMT1583963612296=rJGPqkTepNPblZfrGA15vg%3D%3DUNf3MrkU4xuOMIinHk0FQIyNoUuhmACaKMy5hSibX4o%3D
Upgrade-Insecure-Requests
1
Origin
null
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Server
nginx
Date
Wed, 11 Mar 2020 21:53:32 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Powered-By
PHP/5.5.38
P3P
CP="This site does not have a p3p policy."
Set-Cookie
offerLink=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=cctrack.site
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Wed, 11 Mar 2020 21:53:32 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.5.38
Set-Cookie
offerLink=tw4viZBPms%2FHGwa0wDTgAQ%3D%3DukwGqZB7LoDQzm%2FTGcOnRM3uj1PhIJvJM4AyGw1LVxrW3CD0V8aOlPREgw1KOz2z; expires=Wed, 11-Mar-2020 22:53:32 GMT; Max-Age=3600; path=/; domain=cctrack.site IMT1583963612296=rJGPqkTepNPblZfrGA15vg%3D%3DUNf3MrkU4xuOMIinHk0FQIyNoUuhmACaKMy5hSibX4o%3D; expires=Fri, 13-Mar-2020 03:53:32 GMT; Max-Age=108000; path=/; domain=cctrack.site
Location
https://cctrack.site/jump/?jl=2103268
Primary Request /
cd-down.com/
2 KB
1 KB
Document
General
Full URL
https://cd-down.com/?a=93446&c=209072
Requested by
Host: cctrack.site
URL: https://cctrack.site/jump/?jl=2103268
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:483:6130:eaf9:f6f2:ce6:f56c Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ab899666ff5ca8c40319eab09460b316a23878e1ccc022ab65f61d9e6530c340

Request headers

:method
GET
:authority
cd-down.com
:scheme
https
:path
/?a=93446&c=209072
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://cctrack.site/jump/?jl=2103268
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://cctrack.site/jump/?jl=2103268

Response headers

status
200
date
Wed, 11 Mar 2020 21:53:32 GMT
content-type
text/html;charset=utf-8
server
nginx
vary
Accept-Encoding
cache-control
no-cache, must-revalidate
pragma
no-cache
expires
Sat, 1 May 2020 12:00:00 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
content-encoding
gzip
trck
gdmconvtrck.com/
1 KB
1 KB
Script
General
Full URL
https://gdmconvtrck.com/trck
Requested by
Host: cd-down.com
URL: https://cd-down.com/?a=93446&c=209072
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:483:6110:ec0e:b108:7f12:f2f9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
16a3a14b05f72bd946c85256f3ba27ac3663a7894593bfbac06954cb39c4bbd8

Request headers

Referer
https://cd-down.com/?a=93446&c=209072
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Wed, 11 Mar 2020 21:53:33 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
*, *
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/javascript;charset=utf-8
status
200
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
expires
Sat, 1 May 2020 12:00:00 GMT
/
stream.slimtraf.com/directclick/
Redirect Chain
  • https://cd-down.com/?a=93446&c=207105&oc=96964&sr=t&so=75441&sc=10801054&rc=24_98850&ref=https%3A%2F%2Fcctrack.site%2Fjump%2F%3Fjl%3D2103268&vt=1583963612978&h=be6bf6b55364906245a6a637a1a9970756eab...
  • https://stream.slimtraf.com/directclick/?pid=xz0Scozj6e4l6_SoIjrlQHsu30o1&wsid=e27704f997434016abeaae45346b3c3912215&subid=93446
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
stream.slimtraf.com
URL
https://stream.slimtraf.com/directclick/?pid=xz0Scozj6e4l6_SoIjrlQHsu30o1&wsid=e27704f997434016abeaae45346b3c3912215&subid=93446

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000