sf-helper.net Open in urlscan Pro
136.243.42.155 Public Scan

URL:
http://sf-helper.net/
Submission: On September 29 via manual (September 29th 2018, 7:56:23 pm UTC) from PL

Summary HTTP 7 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 136.243.42.155, located in Germany and belongs to HETZNER-AS, DE. The main domain is sf-helper.net.

This is the only time sf-helper.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	136.243.42.155 136.243.42.155	24940 (HETZNER-AS) (HETZNER-AS)
2	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
7	3

5 136.243.42.155 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.155.42.243.136.clients.your-server.de

sf-helper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	sf-helper.net sf-helper.net	14 KB
2	google-analytics.com www.google-analytics.com	16 KB
7	2

	Domain	Requested by
5	sf-helper.net	sf-helper.net
2	www.google-analytics.com	sf-helper.net
7	2

This site contains links to these domains. Also see Links.

Domain
safeweb.norton.com
savefrom.net

Subject Issuer	Validity	Valid
*.google-analytics.com Google Internet Authority G3	`2018-08-28` - `2018-11-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://sf-helper.net/
Frame ID: 40A66282C2ACA85BFF8EA018EB1539B2
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Page Statistics

7
Requests

29 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

30 kB
Transfer

72 kB
Size

4
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://safeweb.norton.com/report/show?url=http://savefrom.net/
Title: Norton™ Safe Web

Search URL Search Domain Scan URL

URL: http://savefrom.net/user.php
Title: Go to the main page

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
sf-helper.net/ 2 KB
1 KB 67ms
1ms Document
text/html 136.243.42.155
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://sf-helper.net/
Protocol: HTTP/1.1
Server: 136.243.42.155 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.155.42.243.136.clients.your-server.de
Software: nginx / PHP/5.6.36
Resource Hash: 4b4b603585d48fe165c7662386b9f45670b2caba6f5b46c2a4a4f45c1dde67a4

Request headers

Host: sf-helper.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx
Date: Sat, 29 Sep 2018 19:56:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Set-Cookie: lang=en; expires=Mon, 01-Oct-2018 01:56:13 GMT; Max-Age=108000
Content-Encoding: gzip

GET
H/1.1 200
OK normalize.css
sf-helper.net/assets/css/ 8 KB
3 KB 1ms
1ms Stylesheet
text/css 136.243.42.155
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://sf-helper.net/assets/css/normalize.css
Requested by: Host: sf-helper.net
URL: http://sf-helper.net/
Protocol: HTTP/1.1
Server: 136.243.42.155 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.155.42.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 69fcf7682b771176634dc54deb0c412cf9ec40df931d56a0480ee51b47ed1598

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sf-helper.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://sf-helper.net/
Cookie: lang=en
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 29 Sep 2018 19:56:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Jan 2016 10:12:52 GMT
Server: nginx
ETag: W/"5694d1a4-1e1c"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK main.css
sf-helper.net/assets/css/ 19 KB
7 KB 2ms
1ms Stylesheet
text/css 136.243.42.155
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://sf-helper.net/assets/css/main.css
Requested by: Host: sf-helper.net
URL: http://sf-helper.net/
Protocol: HTTP/1.1
Server: 136.243.42.155 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.155.42.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 5d1636e63917a35539a2a183c7146a3072c63169f56ec6d84adf083502824592

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sf-helper.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://sf-helper.net/
Cookie: lang=en
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 29 Sep 2018 19:56:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 09 Sep 2016 10:30:19 GMT
Server: nginx
ETag: W/"57d28f3b-4c9d"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK icon_32.png
sf-helper.net/assets/img/ 1 KB
2 KB 3ms
0ms Image
image/png 136.243.42.155
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sf-helper.net/assets/img/icon_32.png
Requested by: Host: sf-helper.net
URL: http://sf-helper.net/
Protocol: HTTP/1.1
Server: 136.243.42.155 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.155.42.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 348c23cd5b0854b9a6484cca124a51227e4e34122e60bf7823309c8d9222f2c7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sf-helper.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sf-helper.net/
Cookie: lang=en
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 29 Sep 2018 19:56:13 GMT
Last-Modified: Fri, 28 Jan 2011 13:22:00 GMT
Server: nginx
ETag: "4d42c2f8-544"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1348

GET
H/1.1 200
OK symantec.png
sf-helper.net/assets/img/ 752 B
983 B 4ms
0ms Image
image/png 136.243.42.155
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sf-helper.net/assets/img/symantec.png
Requested by: Host: sf-helper.net
URL: http://sf-helper.net/
Protocol: HTTP/1.1
Server: 136.243.42.155 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.155.42.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 96defeb3c3de5eead4d0ab713c34e4c4d65df84050b4220ad9f19e1cbc9f1c73

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sf-helper.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sf-helper.net/
Cookie: lang=en
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 29 Sep 2018 19:56:13 GMT
Last-Modified: Fri, 09 Sep 2016 10:30:19 GMT
Server: nginx
ETag: "57d28f3b-2f0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 752

GET
S 200 analytics.js Show response
www.google-analytics.com/ 39 KB
16 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: sf-helper.net
URL: http://sf-helper.net/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 13 Sep 2018 23:12:19 GMT
server: Golfe2
age: 1027
date: Sat, 29 Sep 2018 19:39:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 16173
expires: Sat, 29 Sep 2018 21:39:06 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d9f9651cbedfd302eea83ec44c40f9d11a44fe6d0628c2176a1d04c3b877436

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f357787c36a87c83e2a01e53bf52529757bfd11e3ddd0978f4c3e17368cbfd88

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
S 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:817::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j69&a=629608579&t=pageview&_s=1&dl=http%3A%2F%2Fsf-helper.net%2F&ul=en-us&de=UTF-8&dt=SaveFrom.net%20Helper&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=847731918&gjid=745030335&cid=821080066.1538250974&tid=UA-67738130-8&_gid=349730820.1538250974&_r=1&z=1307625275

Requested by

Host: sf-helper.net
URL: http://sf-helper.net/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://sf-helper.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 29 Sep 2018 19:56:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sf-helper.net/	1970-01-18 19:17:31	Name: _gat Value: 1
.sf-helper.net/	1970-01-18 19:18:57	Name: _gid Value: GA1.2.349730820.1538250974
.sf-helper.net/	1970-01-19 12:48:42	Name: _ga Value: GA1.2.821080066.1538250974
sf-helper.net/	1970-01-18 19:19:18	Name: lang Value: en

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sf-helper.net
www.google-analytics.com
136.243.42.155
2a00:1450:4001:817::200e
348c23cd5b0854b9a6484cca124a51227e4e34122e60bf7823309c8d9222f2c7
4b4b603585d48fe165c7662386b9f45670b2caba6f5b46c2a4a4f45c1dde67a4
5d1636e63917a35539a2a183c7146a3072c63169f56ec6d84adf083502824592
69fcf7682b771176634dc54deb0c412cf9ec40df931d56a0480ee51b47ed1598
6d9f9651cbedfd302eea83ec44c40f9d11a44fe6d0628c2176a1d04c3b877436
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
96defeb3c3de5eead4d0ab713c34e4c4d65df84050b4220ad9f19e1cbc9f1c73
ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c
f357787c36a87c83e2a01e53bf52529757bfd11e3ddd0978f4c3e17368cbfd88

sf-helper.net Open in urlscan Pro 136.243.42.155 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

29 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

30 kBTransfer

72 kBSize

4 Cookies

2 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

4 Cookies

Indicators

sf-helper.net Open in urlscan Pro
136.243.42.155 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

29 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

30 kB
Transfer

72 kB
Size

4
Cookies

7 HTTP transactions
2 data transactions