amazing-offers-for-you.fetchit.site Open in urlscan Pro
2400:cb00:2048:1::6818:7d37  Public Scan

Submitted URL: http://t1.wiseforwarding.com/c55c7b6?p=001314_7825d2e5
Effective URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Submission: On July 05 via manual from US

Summary

This website contacted 7 IPs in 2 countries across 10 domains to perform 19 HTTP transactions. The main IP is 2400:cb00:2048:1::6818:7d37, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is amazing-offers-for-you.fetchit.site.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on June 28th 2018. Valid for: 6 months.
This is the only time amazing-offers-for-you.fetchit.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 34.232.240.132 14618 (AMAZON-AES)
1 1 34.198.88.244 14618 (AMAZON-AES)
1 1 34.234.11.208 14618 (AMAZON-AES)
1 1 198.134.116.30 27257 (WEBAIR-IN...)
2 2400:cb00:204... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 205.185.216.10 20446 (HIGHWINDS3)
8 205.185.216.42 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
19 7
Domain Requested by
10 img.revcontent.com amazing-offers-for-you.fetchit.site
3 fonts.gstatic.com amazing-offers-for-you.fetchit.site
2 www.google-analytics.com www.googletagmanager.com
amazing-offers-for-you.fetchit.site
2 amazing-offers-for-you.fetchit.site amazing-offers-for-you.fetchit.site
1 www.googletagmanager.com amazing-offers-for-you.fetchit.site
1 fonts.googleapis.com amazing-offers-for-you.fetchit.site
1 mob.popshore.club 1 redirects
1 t1.trackingfall.com 1 redirects
1 t1.contentfall.com 1 redirects
1 t1.wiseforwarding.com 1 redirects
19 10

This site contains links to these domains. Also see Links.

Domain
ols.dedicatefind.com
Subject Issuer Validity Valid
sni102622.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-06-28 -
2019-01-04
6 months crt.sh

This page contains 1 frames:

Primary Page: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Frame ID: BC8889021B49009EE6A36FED4CB07608
Requests: 19 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://t1.wiseforwarding.com/c55c7b6?p=001314_7825d2e5 HTTP 302
    http://t1.contentfall.com/c/3101rca?c=0&po=&a=c55c7b6&p=000199_001314_7825d2e5&s=199&st=339&f=4&sh=&ct... HTTP 302
    http://t1.trackingfall.com/3101rca?a=c55c7b6&c=0&callback_url=%7Bcallbackurl%7D&f=4&p=000199_001314_782... HTTP 302
    http://mob.popshore.club/redirect?feed=122827&auth=ebuQy0&url=http%3A%2F%2Fmyfinancetoday.com&subid=0... HTTP 302
    https://amazing-offers-for-you.fetchit.site/rc/red Page URL
  2. https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Overall confidence: 100%
Detected patterns
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i

Page Statistics

19
Requests

11 %
HTTPS

45 %
IPv6

10
Domains

10
Subdomains

7
IPs

2
Countries

164 kB
Transfer

243 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://t1.wiseforwarding.com/c55c7b6?p=001314_7825d2e5 HTTP 302
    http://t1.contentfall.com/c/3101rca?c=0&po=&a=c55c7b6&p=000199_001314_7825d2e5&s=199&st=339&f=4&sh=&ct=&w=&h=&isp=Hetzner%20Online%20GmbH&callback_url={callbackurl}&xcl=mobrain_173222 HTTP 302
    http://t1.trackingfall.com/3101rca?a=c55c7b6&c=0&callback_url=%7Bcallbackurl%7D&f=4&p=000199_001314_7825d2e5&po=&s=199&sh=&st=339&xcl=mobrain_173222 HTTP 302
    http://mob.popshore.club/redirect?feed=122827&auth=ebuQy0&url=http%3A%2F%2Fmyfinancetoday.com&subid=000364_000199_001314_7825d2e5&query=1807051152a57771ced25c2e HTTP 302
    https://amazing-offers-for-you.fetchit.site/rc/red Page URL
  2. https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://t1.wiseforwarding.com/c55c7b6?p=001314_7825d2e5 HTTP 302
  • http://t1.contentfall.com/c/3101rca?c=0&po=&a=c55c7b6&p=000199_001314_7825d2e5&s=199&st=339&f=4&sh=&ct=&w=&h=&isp=Hetzner%20Online%20GmbH&callback_url={callbackurl}&xcl=mobrain_173222 HTTP 302
  • http://t1.trackingfall.com/3101rca?a=c55c7b6&c=0&callback_url=%7Bcallbackurl%7D&f=4&p=000199_001314_7825d2e5&po=&s=199&sh=&st=339&xcl=mobrain_173222 HTTP 302
  • http://mob.popshore.club/redirect?feed=122827&auth=ebuQy0&url=http%3A%2F%2Fmyfinancetoday.com&subid=000364_000199_001314_7825d2e5&query=1807051152a57771ced25c2e HTTP 302
  • https://amazing-offers-for-you.fetchit.site/rc/red

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
red
amazing-offers-for-you.fetchit.site/rc/
Redirect Chain
  • http://t1.wiseforwarding.com/c55c7b6?p=001314_7825d2e5
  • http://t1.contentfall.com/c/3101rca?c=0&po=&a=c55c7b6&p=000199_001314_7825d2e5&s=199&st=339&f=4&sh=&ct=&w=&h=&isp=Hetzner%20Online%20GmbH&callback_url={callbackurl}&xcl=mobrain_173222
  • http://t1.trackingfall.com/3101rca?a=c55c7b6&c=0&callback_url=%7Bcallbackurl%7D&f=4&p=000199_001314_7825d2e5&po=&s=199&sh=&st=339&xcl=mobrain_173222
  • http://mob.popshore.club/redirect?feed=122827&auth=ebuQy0&url=http%3A%2F%2Fmyfinancetoday.com&subid=000364_000199_001314_7825d2e5&query=1807051152a57771ced25c2e
  • https://amazing-offers-for-you.fetchit.site/rc/red
249 B
532 B
Document
General
Full URL
https://amazing-offers-for-you.fetchit.site/rc/red
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6818:7d37 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
amazing-offers-for-you.fetchit.site
:scheme
https
:path
/rc/red
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
BC8889021B49009EE6A36FED4CB07608

Response headers

status
200
date
Thu, 05 Jul 2018 14:52:44 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dfcda448fe41d6a9ccf69d6a88c7522ed1530802363; expires=Fri, 05-Jul-19 14:52:43 GMT; path=/; domain=.fetchit.site; HttpOnly; Secure
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
435aa835cbdd26a2-FRA
content-encoding
gzip

Redirect headers

Location
https://amazing-offers-for-you.fetchit.site/rc/red
Connection
keep-alive
Content-Length
0
Primary Request newsponsored
amazing-offers-for-you.fetchit.site/rc/
21 KB
12 KB
Document
General
Full URL
https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/red
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6818:7d37 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e72fbd2d11fe5b45094ee6263a9112008ae8e8ba5957d7198133847fb6f8b1ca

Request headers

:method
GET
:authority
amazing-offers-for-you.fetchit.site
:scheme
https
:path
/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://amazing-offers-for-you.fetchit.site/rc/red
accept-encoding
gzip, deflate
cookie
__cfduid=dfcda448fe41d6a9ccf69d6a88c7522ed1530802363
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
BC8889021B49009EE6A36FED4CB07608
Referer
https://amazing-offers-for-you.fetchit.site/rc/red

Response headers

status
200
date
Thu, 05 Jul 2018 14:52:44 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
set-cookie
allowClick=1; expires=Thu, 05-Jul-2018 14:57:44 GMT; Max-Age=300; path=/
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
435aa8373c8326a2-FRA
content-encoding
gzip
css
fonts.googleapis.com/
9 KB
875 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
SPDY
Server
2a00:1450:4001:820::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
ca29a9646f1d38999895936bf9cc7e6c841aac0d6a6bd15f1ba503383e890ffe
Security Headers
Name Value
Strict-Transport-Security max-age=600
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=600
content-encoding
gzip
last-modified
Thu, 05 Jul 2018 14:52:44 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 05 Jul 2018 14:52:44 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection
1; mode=block
expires
Thu, 05 Jul 2018 14:52:44 GMT
/
img.revcontent.com/
9 KB
9 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15288200511942775899.png&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
23edfd598ecce326aa62caf2cbd1d686bc962f8a775eae1b461392bcc7d4f3ee

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Tue, 12 Jun 2018 16:14:12 GMT
ETag
"1528820052"
X-HW
1530802364.dop003.fr8.t,1530802364.cds023.fr8.shn,1530802364.dop003.fr8.t,1530802364.cds022.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9015
/
img.revcontent.com/
8 KB
9 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15132594901242122891.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
e67e18bc5b86cb516fad4806ff098f1d46ae74a06b9c55aea59cff64f498d11e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Thu, 14 Dec 2017 13:51:31 GMT
ETag
"1513259491"
X-HW
1530802364.dop003.fr8.t,1530802364.cds045.fr8.shn,1530802364.dop003.fr8.t,1530802364.cds022.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
8444
/
img.revcontent.com/
9 KB
9 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15300949361665775811.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
ec1abace7c6927d02ddf2bd7fcc5339a01c78143ebd69b86769dba9acdc2d7d6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Wed, 27 Jun 2018 10:22:17 GMT
ETag
"1530094937"
X-HW
1530802364.dop002.fr8.t,1530802364.cds004.fr8.shn,1530802364.dop002.fr8.t,1530802364.cds013.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
8969
/
img.revcontent.com/
8 KB
8 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15105838641446766441.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
931a64ad13cce3d3d5b597d67ea1af59deffa513775a799ed0092797bd789c81

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Mon, 13 Nov 2017 14:37:45 GMT
ETag
"1510583865"
X-HW
1530802364.dop002.fr8.t,1530802364.cds019.fr8.shn,1530802364.dop002.fr8.t,1530802364.cds026.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
8121
/
img.revcontent.com/
7 KB
7 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15198344600018358676.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
1c024c185a6fe78d0e5dff2035f4cc6c365da6ff740a8bf45b79aff45c46ace7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Wed, 28 Feb 2018 16:14:21 GMT
ETag
"1519834461"
X-HW
1530802364.dop003.fr8.t,1530802364.cds038.fr8.shn,1530802364.dop003.fr8.t,1530802364.cds008.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
6781
/
img.revcontent.com/
6 KB
6 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15214779772023049292.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
c966608dda6895b497828746245ede453d19556fb0d1402dfed5f58dc596e3ce

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Mon, 19 Mar 2018 16:46:18 GMT
ETag
"1521477978"
X-HW
1530802364.dop002.fr8.t,1530802364.cds004.fr8.shn,1530802364.dop002.fr8.t,1530802364.cds026.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5887
/
img.revcontent.com/
10 KB
10 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15210258330320567003.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
ef97cc81348e6749838f5dc38db3e30a03ba94e9b8be89a97a3c2c8e38689fa0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Wed, 14 Mar 2018 11:10:34 GMT
ETag
"1521025834"
X-HW
1530802364.dop003.fr8.t,1530802364.cds038.fr8.shn,1530802364.dop003.fr8.t,1530802364.cds012.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
10011
/
img.revcontent.com/
7 KB
8 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15244916350978642828.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
ca506822ff660da30a04d35f114107c59f1ea88ff0f63a63a7dfbdda764d2be7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Mon, 23 Apr 2018 13:53:56 GMT
ETag
"1524491636"
X-HW
1530802364.dop002.fr8.t,1530802364.cds019.fr8.shn,1530802364.dop002.fr8.t,1530802364.cds032.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
7411
/
img.revcontent.com/
8 KB
9 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15300976030813538880.png&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
b785cf746f9d48fa44d35f5d8cb9c6962d7d205265dbf75bb85f9d67e97cd084

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Wed, 27 Jun 2018 11:06:44 GMT
ETag
"1530097604"
X-HW
1530802364.dop002.fr8.t,1530802364.cds006.fr8.shn,1530802364.dop002.fr8.t,1530802364.cds007.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
8479
/
img.revcontent.com/
6 KB
6 KB
Image
General
Full URL
https://img.revcontent.com/?url=https://revcontent-p0.s3.amazonaws.com/content/images/15300980470641174801.jpg&static=true&pos=face&h=140&w=140&static=true&fmt=jpeg
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
HTTP/1.1
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
5d5f348ce94ef96a8ea805d61b4ec48da8de1fa024fad7304c3c2827d7da37c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 14:52:44 GMT
Last-Modified
Wed, 27 Jun 2018 11:14:08 GMT
ETag
"1530098048"
X-HW
1530802364.dop003.fr8.t,1530802364.cds023.fr8.shn,1530802364.dop003.fr8.t,1530802364.cds009.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5909
js
www.googletagmanager.com/gtag/
69 KB
24 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-120508216-5
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/newsponsored?uid=S0gwnr2vNBBYtDIXBGMc08MWca8Bzq6iJwCHxwD6nPlLF6T6aB&src=1
Protocol
SPDY
Server
2a00:1450:4001:812::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
586b6cc92300bf37644154bb7313abad16c6561168ca4d291b5106981bbd5266
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 05 Jul 2018 14:52:44 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
24842
x-xss-protection
1; mode=block
expires
Thu, 05 Jul 2018 14:52:44 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/click
Protocol
SPDY
Server
2a00:1450:4001:820::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Origin
https://amazing-offers-for-you.fetchit.site

Response headers

date
Mon, 02 Jul 2018 15:52:41 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
age
255603
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
10788
x-xss-protection
1; mode=block
expires
Tue, 02 Jul 2019 15:52:41 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/
10 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/click
Protocol
SPDY
Server
2a00:1450:4001:820::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Origin
https://amazing-offers-for-you.fetchit.site

Response headers

date
Mon, 02 Jul 2018 12:51:27 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:51 GMT
server
sffe
age
266477
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
10748
x-xss-protection
1; mode=block
expires
Tue, 02 Jul 2019 12:51:27 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/click
Protocol
SPDY
Server
2a00:1450:4001:820::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Origin
https://amazing-offers-for-you.fetchit.site

Response headers

date
Mon, 02 Jul 2018 15:03:24 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:33:03 GMT
server
sffe
age
258560
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
10764
x-xss-protection
1; mode=block
expires
Tue, 02 Jul 2019 15:03:24 GMT
analytics.js
www.google-analytics.com/
34 KB
14 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-120508216-5
Protocol
SPDY
Server
2a00:1450:4001:812::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 May 2018 01:10:24 GMT
server
Golfe2
age
6472
date
Thu, 05 Jul 2018 13:04:52 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
14386
expires
Thu, 05 Jul 2018 15:04:52 GMT
collect
www.google-analytics.com/r/
35 B
112 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j68&a=585045107&t=pageview&_s=1&dl=https%3A%2F%2Famazing-offers-for-you.fetchit.site%2Frc%2Fclick&ul=en-us&de=UTF-8&dt=Offer%20Recommendation&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=897839709&gjid=1679598766&cid=736216670.1530802364&tid=UA-120508216-5&_gid=30232887.1530802364&_r=1&gtm=u6c&z=182196018
Requested by
Host: amazing-offers-for-you.fetchit.site
URL: https://amazing-offers-for-you.fetchit.site/rc/click
Protocol
SPDY
Server
2a00:1450:4001:812::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 05 Jul 2018 14:52:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| erlog function| goToAd function| gtag object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

5 Cookies

Domain/Path Name / Value
.fetchit.site/ Name: _gat_gtag_UA_120508216_5
Value: 1
.fetchit.site/ Name: _gid
Value: GA1.2.30232887.1530802364
amazing-offers-for-you.fetchit.site/ Name: allowClick
Value: 1
.fetchit.site/ Name: _ga
Value: GA1.2.736216670.1530802364
.fetchit.site/ Name: __cfduid
Value: dfcda448fe41d6a9ccf69d6a88c7522ed1530802363

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazing-offers-for-you.fetchit.site
fonts.googleapis.com
fonts.gstatic.com
img.revcontent.com
mob.popshore.club
t1.contentfall.com
t1.trackingfall.com
t1.wiseforwarding.com
www.google-analytics.com
www.googletagmanager.com
198.134.116.30
205.185.216.10
205.185.216.42
2400:cb00:2048:1::6818:7d37
2a00:1450:4001:812::2008
2a00:1450:4001:812::200e
2a00:1450:4001:820::2003
2a00:1450:4001:820::200a
34.198.88.244
34.232.240.132
34.234.11.208
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
1c024c185a6fe78d0e5dff2035f4cc6c365da6ff740a8bf45b79aff45c46ace7
23edfd598ecce326aa62caf2cbd1d686bc962f8a775eae1b461392bcc7d4f3ee
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
586b6cc92300bf37644154bb7313abad16c6561168ca4d291b5106981bbd5266
5d5f348ce94ef96a8ea805d61b4ec48da8de1fa024fad7304c3c2827d7da37c3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
931a64ad13cce3d3d5b597d67ea1af59deffa513775a799ed0092797bd789c81
b785cf746f9d48fa44d35f5d8cb9c6962d7d205265dbf75bb85f9d67e97cd084
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
c966608dda6895b497828746245ede453d19556fb0d1402dfed5f58dc596e3ce
ca29a9646f1d38999895936bf9cc7e6c841aac0d6a6bd15f1ba503383e890ffe
ca506822ff660da30a04d35f114107c59f1ea88ff0f63a63a7dfbdda764d2be7
e67e18bc5b86cb516fad4806ff098f1d46ae74a06b9c55aea59cff64f498d11e
e72fbd2d11fe5b45094ee6263a9112008ae8e8ba5957d7198133847fb6f8b1ca
ec1abace7c6927d02ddf2bd7fcc5339a01c78143ebd69b86769dba9acdc2d7d6
ef97cc81348e6749838f5dc38db3e30a03ba94e9b8be89a97a3c2c8e38689fa0