Submitted URL: https://xml.fstsrv2.com/
Effective URL: http://popunder.bid/
Submission: On July 03 via manual from PT — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 72.167.252.76, located in Ashburn, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is popunder.bid.
This is the only time popunder.bid was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 198.134.116.19 27257 (WEBAIR-IN...)
1 72.167.252.76 26496 (AS-26496-...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2
Apex Domain
Subdomains
Transfer
1 bootstrapcdn.com
netdna.bootstrapcdn.com — Cisco Umbrella Rank: 4878
21 KB
1 popunder.bid
popunder.bid
852 B
1 fstsrv2.com
xml.fstsrv2.com — Cisco Umbrella Rank: 847235
200 B
2 3
Domain Requested by
1 netdna.bootstrapcdn.com popunder.bid
1 popunder.bid
1 xml.fstsrv2.com 1 redirects
2 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://popunder.bid/
Frame ID: E111F198A93A45FBCF37271D49384AFD
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

popunder.bid

Page URL History Show full URLs

  1. https://xml.fstsrv2.com/ HTTP 302
    http://popunder.bid/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

2
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

22 kB
Transfer

100 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://xml.fstsrv2.com/ HTTP 302
    http://popunder.bid/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
popunder.bid/
Redirect Chain
  • https://xml.fstsrv2.com/
  • http://popunder.bid/
824 B
852 B
Document
General
Full URL
http://popunder.bid/
Protocol
HTTP/1.1
Server
72.167.252.76 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
76.252.167.72.host.secureserver.net
Software
Apache /
Resource Hash
e174b1c1ba782f11bc8c90b7f1ede589ef76cf108064ea91be54f1fc3a1b4f53

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Upgrade, Keep-Alive
Content-Encoding
gzip
Content-Length
506
Content-Type
text/html
Date
Mon, 03 Jul 2023 09:38:10 GMT
ETag
"3f00ab0-338-5e2913e9a7b00-gzip"
Keep-Alive
timeout=5
Last-Modified
Wed, 29 Jun 2022 07:38:52 GMT
Server
Apache
Upgrade
h2,h2c
Vary
Accept-Encoding

Redirect headers

Age
0
Cache-Control
no-store
Connection
keep-alive
Content-Length
0
Date
Mon, 03 Jul 2023 09:38:10 GMT
Location
http://popunder.bid/
Pragma
no-cache
Server
nginx
bootstrap.min.css
netdna.bootstrapcdn.com/bootstrap/3.1.0/css/
99 KB
21 KB
Stylesheet
General
Full URL
http://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css
Requested by
Host: popunder.bid
URL: http://popunder.bid/
Protocol
HTTP/1.1
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11c74aed50911d54c04455fe1d9c04f42c5f6cf438a94976f890f25f2a59f699
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://popunder.bid/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 03 Jul 2023 09:38:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
CF-Cache-Status
HIT
CDN-EdgeStorageId
941
Age
13146602
Transfer-Encoding
chunked
CDN-CachedAt
08/03/2022 13:37:39
CDN-PullZone
252412
cross-origin-resource-policy
cross-origin
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Last-Modified
Mon, 25 Jan 2021 22:03:56 GMT
CDN-ProxyVer
1.02
CDN-RequestPullCode
200
Server
cloudflare
ETag
W/"937876bacfefa6ad4b64756b3834d94c"
Vary
Accept-Encoding
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
CDN-Cache
HIT
CDN-Uid
b1941f61-b576-4f40-80de-5677acb38f74
Cache-Control
public, max-age=31919000
CDN-RequestId
1fa1143978732022826bc343745d6899
timing-allow-origin
*
CDN-RequestCountryCode
US
CDN-Status
200
CF-RAY
7e0e2775fd4a18cf-FRA
CDN-RequestPullSuccess
True

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

netdna.bootstrapcdn.com
popunder.bid
xml.fstsrv2.com
198.134.116.19
2606:4700::6812:acf
72.167.252.76
11c74aed50911d54c04455fe1d9c04f42c5f6cf438a94976f890f25f2a59f699
e174b1c1ba782f11bc8c90b7f1ede589ef76cf108064ea91be54f1fc3a1b4f53