Submitted URL: http://download-file.ml/PfgAVzPF
Effective URL: https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams
Submission Tags: falconsandbox
Submission: On December 16 via api from US

Summary

This website contacted 5 IPs in 4 countries across 7 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3037::681c:941, located in United States and belongs to CLOUDFLARENET, US. The main domain is trk.yearmeeting.site.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 7th 2020. Valid for: a year.
This is the only time trk.yearmeeting.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:303... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 172.67.177.33 13335 (CLOUDFLAR...)
2 2 18.202.12.61 16509 (AMAZON-02)
1 1 2.16.107.32 20940 (AKAMAI-ASN1)
1 52.216.186.213 16509 (AMAZON-02)
8 5
Domain Requested by
4 download-file.ml download-file.ml
code.jquery.com
2 trk.rockwound.site 2 redirects
1 s3.amazonaws.com trk.yearmeeting.site
1 www.7dm059r4d5.com 1 redirects
1 impress.polar-track.com trk.yearmeeting.site
1 trk.yearmeeting.site download-file.ml
1 code.jquery.com download-file.ml
8 7

This site contains no links.

Subject Issuer Validity Valid
jquery.org
Sectigo RSA Domain Validation Secure Server CA
2020-10-06 -
2021-10-16
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-07 -
2021-08-07
a year crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2
2020-08-04 -
2021-08-09
a year crt.sh

This page contains 1 frames:

Frame: https://s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/eibhlTv
Frame ID: CB9D528CB09AB9665122E675E5310BB1
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://download-file.ml/PfgAVzPF Page URL
  2. https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

50 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

5
IPs

4
Countries

56 kB
Transfer

170 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://download-file.ml/PfgAVzPF Page URL
  2. https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • http://trk.rockwound.site/aff_c?source=58802&offer_id=193&aff_click_id=2wcnp5Ak&aff_id=1962&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_unique1=&aff_unique2=&aff_unique3=&name=Microsoft%20Teams&url= HTTP 302
  • http://trk.rockwound.site/aff_r?offer_id=193&aff_id=1962&url=http%3A%2F%2Fwww.7dm059r4d5.com%2FDsHRYKXLSIYNtpql7l6A9UC%3Fcc%3DPL%26clickId%3D10286947d45f30244a5cec8dcf5a64%26subaff%3D58802%26e%3D5%26g%3D9c58ca4e-5f28-4fa5-8a62-5dffd86ba77f&urlauth=454816555785190759618386276024 HTTP 302
  • http://www.7dm059r4d5.com/DsHRYKXLSIYNtpql7l6A9UC?cc=PL&clickId=10286947d45f30244a5cec8dcf5a64&subaff=58802&e=5&g=9c58ca4e-5f28-4fa5-8a62-5dffd86ba77f HTTP 302
  • https://s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/eibhlTv

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set PfgAVzPF
download-file.ml/
676 B
1 KB
Document
General
Full URL
http://download-file.ml/PfgAVzPF
Protocol
HTTP/1.1
Server
2606:4700:3030::6812:3b3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad09c4d6c8018154792f43a9b1a5e5ec0cfe692b1a685fd531efb041e8009bed

Request headers

Host
download-file.ml
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 06:19:09 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d35a1ce1832c3b31f7e40cf21b77c34911608099548; expires=Fri, 15-Jan-21 06:19:08 GMT; path=/; domain=.download-file.ml; HttpOnly; SameSite=Lax
CF-Cache-Status
DYNAMIC
cf-request-id
070bcce3eb000005e97593c000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NEehMca%2FPYDNXCVV2owVIYCg4C1b7lEq22Z4kIhUgQyh%2FFprzSD0LKeJ%2FmOGZ%2FzGvcs3Lerunb6qSUFj61KZToc1K7Em5c8z0xyYS2rSWP1ZSf2x4Hzh4Fsw9Ghp"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
60264a7fdc5805e9-FRA
Content-Encoding
gzip
jquery-1.x-git.min.js
code.jquery.com/
95 KB
33 KB
Script
General
Full URL
https://code.jquery.com/jquery-1.x-git.min.js
Requested by
Host: download-file.ml
URL: http://download-file.ml/PfgAVzPF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
5a325cf127c6cf1272cd26810b58e77e7ed1364f3484bb2b6121060f383faceb

Request headers

Referer
http://download-file.ml/PfgAVzPF
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 16 Dec 2020 06:19:09 GMT
content-encoding
gzip
last-modified
Wed, 22 Jun 2016 11:33:22 GMT
server
nginx
etag
W/"576a7782-17b4c"
vary
Accept-Encoding
x-hw
1608099549.dop237.fr8.t,1608099549.cds268.fr8.hc,1608099549.cds235.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public
accept-ranges
bytes
content-length
33773
03032020.js
download-file.ml/
71 KB
19 KB
Script
General
Full URL
http://download-file.ml/03032020.js
Requested by
Host: download-file.ml
URL: http://download-file.ml/PfgAVzPF
Protocol
HTTP/1.1
Server
2606:4700:3030::6812:3b3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
128342db7f585729448247ba218d8dd821f4a4835b4c0dada288e2ab698be279

Request headers

Referer
http://download-file.ml/PfgAVzPF
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 06:19:09 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
5626
Transfer-Encoding
chunked
Connection
keep-alive
cf-request-id
070bcce75b000005e956863000000001
Last-Modified
Tue, 03 Mar 2020 10:49:06 GMT
Server
cloudflare
ETag
W/"5e5e3622-11dcc"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yMOOiRBZeCK9G6vqjUfvi%2BMsNP2cAmdPYVX1SpeoswDrVZewoXlGoTs8bAMnYMNdnnAO%2BUcmrEPAeqfBABeXYM1JeVAkfTjgxgK%2Bi0eyywrDKTkiPXdDa4iKwYSP"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=14400
CF-RAY
60264a855f7305e9-FRA
ppicheck.php
download-file.ml/
20 B
646 B
XHR
General
Full URL
http://download-file.ml/ppicheck.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.x-git.min.js
Protocol
HTTP/1.1
Server
2606:4700:3030::6812:3b3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Request headers

Accept
*/*
Referer
http://download-file.ml/PfgAVzPF
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Wed, 16 Dec 2020 06:19:09 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HLhaRAah4s9AXUfIq7gd1JPmCiArBiwL4dDVYhaZ284j6xyHUWvxhumO%2BW3h58xwGAVa6sF7D7mDVtW7uaJ%2Bze4NdNLfu2%2BhJWcShNlqJtN4T3OAKvqsot%2FWUW19"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html; charset=UTF-8
Connection
keep-alive
CF-RAY
60264a85aff205e9-FRA
cf-request-id
070bcce788000005e96ca8c000000001
finger.php
download-file.ml/
0
623 B
XHR
General
Full URL
http://download-file.ml/finger.php
Requested by
Host: download-file.ml
URL: http://download-file.ml/03032020.js
Protocol
HTTP/1.1
Server
2606:4700:3030::6812:3b3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
http://download-file.ml/PfgAVzPF
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

Date
Wed, 16 Dec 2020 06:19:10 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=c6WmYumUC%2F0AaCJko8UP6TLBRxbJPJkYHJtuIiHxKaGLO9M61E6ibJFNuSD350CezIL%2BthWU7KqhwQFBMciSwJlyXRmOSk9mT3tPYZCdW4VtFyL92%2FnPsZDTVByy"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html; charset=UTF-8
Connection
keep-alive
CF-RAY
60264a876b6f05e9-FRA
cf-request-id
070bcce8a0000005e9853ed000000001
Primary Request qlw934
trk.yearmeeting.site/
3 KB
1 KB
Document
General
Full URL
https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams
Requested by
Host: download-file.ml
URL: http://download-file.ml/03032020.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681c:941 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.1.27
Resource Hash
f0a73d11a5c6ea013ba21ca31554677004ea3c01923a0120b447a5ef2b502539

Request headers

:method
GET
:authority
trk.yearmeeting.site
:scheme
https
:path
/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://download-file.ml/PfgAVzPF
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://download-file.ml/PfgAVzPF

Response headers

date
Wed, 16 Dec 2020 06:19:10 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d245bbb4505c8e3c32cf3091511630f9e1608099550; expires=Fri, 15-Jan-21 06:19:10 GMT; path=/; domain=.yearmeeting.site; HttpOnly; SameSite=Lax
x-powered-by
PHP/7.1.27
cf-cache-status
DYNAMIC
cf-request-id
070bccebb100002c01d5891000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XPxm7oabcmWsxjuNfCh%2FCkULamu62rWTCltCpXBgwgEMRoeo5Yi%2BDlkNPJY99VX9geG3bs5iKIxnP4CNAX09CgEO%2BeWjDnzMm0nUiwDBKqpMXWVHWrzfNE2s%2Be6odvutbg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
60264a8c4f812c01-FRA
content-encoding
br
aff_i
impress.polar-track.com/
43 B
797 B
Image
General
Full URL
https://impress.polar-track.com/aff_i?offer_id=193&aff_id=1962&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&source=58802
Requested by
Host: trk.yearmeeting.site
URL: https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac05f643d51698438fc2504bc237b5a39ce1248b037dbf446aaca4ce65c3182c

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 16 Dec 2020 06:19:10 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
tracking_id
102d57acb07381930e63c98caf1ae9
content-length
43
cf-request-id
070bcced4d00001e6d6aadf000000001
x-request-id
56ecce9819015012ac543affb1e84556
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WdR5NkpaYJMltzy9YTskpuOz%2FpFPSUrHSFWUAmUsijN8MI3dpi7kaLyumMCEMXYS9xEVCRx4%2BACrRdo34GVb%2FT5ZXe03C7i0LyD5ekEDYBHiY%2F8KoptLCA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cf-ray
60264a8eec461e6d-AMS
access-control-allow-headers
Tune-SDK-Version
expires
Sat, 26 Jul 1997 05:00:00 GMT
eibhlTv
s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/
Redirect Chain
  • http://trk.rockwound.site/aff_c?source=58802&offer_id=193&aff_click_id=2wcnp5Ak&aff_id=1962&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_unique1=&aff_unique2=&aff_unique3=&name=Microsoft%20...
  • http://trk.rockwound.site/aff_r?offer_id=193&aff_id=1962&url=http%3A%2F%2Fwww.7dm059r4d5.com%2FDsHRYKXLSIYNtpql7l6A9UC%3Fcc%3DPL%26clickId%3D10286947d45f30244a5cec8dcf5a64%26subaff%3D58802%26e%3D5%...
  • http://www.7dm059r4d5.com/DsHRYKXLSIYNtpql7l6A9UC?cc=PL&clickId=10286947d45f30244a5cec8dcf5a64&subaff=58802&e=5&g=9c58ca4e-5f28-4fa5-8a62-5dffd86ba77f
  • https://s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/eibhlTv
0
0
Document
General
Full URL
https://s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/eibhlTv
Requested by
Host: trk.yearmeeting.site
URL: https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.186.213 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Host
s3.amazonaws.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://trk.yearmeeting.site/qlw934?click_id=2wcnp5Ak&source=58802&title=Microsoft%20Teams

Response headers

x-amz-id-2
P6oYEFw01bETL6SYNNktYewEi7l0G5VVXjmHyUTSOPOkLym06BWv7cXPQiCV8kT2miy4IliArhw=
x-amz-request-id
58D4FB8F7635246E
Date
Wed, 16 Dec 2020 06:19:13 GMT
Last-Modified
Wed, 16 Dec 2020 06:19:12 GMT
ETag
"c06f4a2fdc20c933332e8f4d7e636ea1"
Content-Disposition
attachment; filename="Install.dmg"
Accept-Ranges
bytes
Content-Type
text/plain
Content-Length
3553471
Server
AmazonS3

Redirect headers

Content-Type
text/html; charset=utf-8
Location
https://s3.amazonaws.com/e4e0d01a-19f1-4903-a7de-8bce6c0c3e/8it/ajCXs/Fpv/C06F4A2FDC20C933332E8F4D7E636EA1/uQlo/eibhlTv
Access-Control-Allow-Origin
*
p3p
CP="CAO PSA OUR"
Content-Length
236
Expires
Wed, 16 Dec 2020 06:19:11 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Wed, 16 Dec 2020 06:19:11 GMT
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
.download-file.ml/ Name: __cfduid
Value: d35a1ce1832c3b31f7e40cf21b77c34911608099548