URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Submission: On September 14 via api from US — Scanned from US

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 6 HTTP transactions. The main IP is 116.202.159.170, located in Nuremberg, Germany and belongs to HETZNER-AS, DE. The main domain is reda.likethatmove.com.
TLS certificate: Issued by R10 on September 8th 2024. Valid for: 3 months.
This is the only time reda.likethatmove.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 116.202.159.170 24940 (HETZNER-AS)
1 3.5.69.11 16509 (AMAZON-02)
2 2 104.18.193.136 13335 (CLOUDFLAR...)
1 2 104.18.42.32 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
6 5
Apex Domain
Subdomains
Transfer
3 likethatmove.com
reda.likethatmove.com
584 KB
2 betus.com.pa
www.betus.com.pa — Cisco Umbrella Rank: 203997
840 B
2 revmasters.com
record.revmasters.com — Cisco Umbrella Rank: 211454
866 B
1 slotsparadise.com
slotsparadise.com
1 amazonaws.com
mainstreamlp.s3-eu-west-1.amazonaws.com
0 vegasaces.com Failed
vegasaces.com Failed
6 6
Domain Requested by
3 reda.likethatmove.com 1 redirects reda.likethatmove.com
2 www.betus.com.pa 1 redirects reda.likethatmove.com
2 record.revmasters.com 2 redirects
1 slotsparadise.com reda.likethatmove.com
1 mainstreamlp.s3-eu-west-1.amazonaws.com reda.likethatmove.com
0 vegasaces.com Failed reda.likethatmove.com
6 6

This site contains links to these domains. Also see Links.

Domain
www.yahoo.com
Subject Issuer Validity Valid
reda.likethatmove.com
R10
2024-09-08 -
2024-12-07
3 months crt.sh
*.s3-eu-west-1.amazonaws.com
Amazon RSA 2048 M01
2024-06-22 -
2025-05-28
a year crt.sh
betus.com.pa
E5
2024-08-11 -
2024-11-09
3 months crt.sh
slotsparadise.com
WE1
2024-09-11 -
2024-12-10
3 months crt.sh

This page contains 4 frames:

Primary Page: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Frame ID: 1F46B8D47F74EFDC6F1E7E802B682F88
Requests: 3 HTTP requests in this frame

Frame: https://www.betus.com.pa/miscellaneous/landing?offer=michaelv125&token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&promo=michaelv125&a=AO1213443712&b=1&c=55
Frame ID: 5388852FCE0C794511C052816CD26875
Requests: 1 HTTP requests in this frame

Frame: https://slotsparadise.com/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R8X4Ia_9-2y6GNd7ZgqdRLk
Frame ID: FD97E82D73DCDFCAA80342FC0D0D0472
Requests: 1 HTTP requests in this frame

Frame: https://vegasaces.com/lobby/welcome?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk
Frame ID: 80C36B5829D26763DB3E96797D036EAC
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745 HTTP 301
    https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

20 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

584 kB
Transfer

588 kB
Size

26
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745 HTTP 301
    https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://record.revmasters.com/_46oeeYwxk8Ghvo5nC3tZQ2Nd7ZgqdRLk/1/ HTTP 301
  • https://www.betus.com.pa/bounce.aspx?token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&a=AO1213443712&b=1&c=55&dest=/landing.aspx?offer=michaelv125 HTTP 302
  • https://www.betus.com.pa/miscellaneous/landing?offer=michaelv125&token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&promo=michaelv125&a=AO1213443712&b=1&c=55
Request Chain 3
  • https://record.revmasters.com/_46oeeYwxk8FqMwBAsL0sWWNd7ZgqdRLk/1/ HTTP 301
  • https://slotsparadise.com/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R8X4Ia_9-2y6GNd7ZgqdRLk
Request Chain 4
  • https://record.revmasters.com/_46oeeYwxk8FaH3NB0WmewGNd7ZgqdRLk/1/ HTTP 301
  • https://vegasaces.com/bounce?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk&dest=/lobby/welcome HTTP 302
  • https://vegasaces.com/lobby/welcome?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Redirect Chain
  • https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745
  • https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
7 KB
3 KB
Document
General
Full URL
https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
116.202.159.170 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.170.159.202.116.clients.your-server.de
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
4ff4685654c0ad75e53ed621c87cf4d9932ae790f428a9b06c19907910927a94

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sat, 14 Sep 2024 15:14:01 GMT
Server
nginx/1.16.1 (Ubuntu)
Transfer-Encoding
chunked

Redirect headers

Connection
keep-alive
Content-Length
178
Content-Type
text/html
Date
Sat, 14 Sep 2024 15:14:00 GMT
Location
https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Server
nginx/1.16.1 (Ubuntu)
jquery-3.3.1.min.js.download
mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/
0
0
Script
General
Full URL
https://mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/jquery-3.3.1.min.js.download
Requested by
Host: reda.likethatmove.com
URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.5.69.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-eu-west-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://reda.likethatmove.com/
Origin
https://reda.likethatmove.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Sat, 14 Sep 2024 15:14:00 GMT
Server
AmazonS3
x-amz-request-id
NAR1QESXYAGDMCW7
Transfer-Encoding
chunked
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET, HEAD, DELETE, PUT, POST
Access-Control-Allow-Origin
*
Content-Type
application/xml
x-amz-id-2
hVd0diEA678UPxNjNOmYnUNcSFrPHu50JKBXPrFNL24wKGPvSZf7AYb/lH7ft5vXthoiaPIMYM3Jdj8UsZvAQTlG0nDITsYq
circleloading3.gif
reda.likethatmove.com/lpz/lpfiles/cassandra/
581 KB
581 KB
Image
General
Full URL
https://reda.likethatmove.com/lpz/lpfiles/cassandra/circleloading3.gif
Requested by
Host: reda.likethatmove.com
URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
116.202.159.170 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.170.159.202.116.clients.your-server.de
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
2a1b881900a46ce2ab374b6eefeef1de12eb4662276f543b9ef4b7e448f8692e

Request headers

Referer
https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Sat, 14 Sep 2024 15:14:01 GMT
Last-Modified
Wed, 09 Jun 2021 15:07:55 GMT
Server
nginx/1.16.1 (Ubuntu)
ETag
"60c0d94b-914db"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
595163
landing
www.betus.com.pa/miscellaneous/ Frame 5388
Redirect Chain
  • https://record.revmasters.com/_46oeeYwxk8Ghvo5nC3tZQ2Nd7ZgqdRLk/1/
  • https://www.betus.com.pa/bounce.aspx?token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&a=AO1213443712&b=1&c=55&dest=/landing.aspx?offer=michaelv125
  • https://www.betus.com.pa/miscellaneous/landing?offer=michaelv125&token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&promo=michaelv125&a=AO1213443712&b=1&c=55
0
0
Document
General
Full URL
https://www.betus.com.pa/miscellaneous/landing?offer=michaelv125&token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&promo=michaelv125&a=AO1213443712&b=1&c=55
Requested by
Host: reda.likethatmove.com
URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.42.32 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://reda.likethatmove.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache,no-store
cf-cache-status
DYNAMIC
cf-ray
8c31530e48264345-EWR
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sat, 14 Sep 2024 15:14:02 GMT
expires
-1
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-sid
NX02

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
8c31530d3f244345-EWR
content-type
text/html; charset=utf-8
date
Sat, 14 Sep 2024 15:14:02 GMT
location
/miscellaneous/landing?offer=michaelv125&token=a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk&promo=michaelv125&a=AO1213443712&b=1&c=55
server
cloudflare
vary
Accept-Encoding
x-aspnet-version
4.0.30319
x-sid
N04
/
slotsparadise.com/ Frame FD97
Redirect Chain
  • https://record.revmasters.com/_46oeeYwxk8FqMwBAsL0sWWNd7ZgqdRLk/1/
  • https://slotsparadise.com/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R8X4Ia_9-2y6GNd7ZgqdRLk
0
0
Document
General
Full URL
https://slotsparadise.com/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R8X4Ia_9-2y6GNd7ZgqdRLk
Requested by
Host: reda.likethatmove.com
URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:4400::ac40:903e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=2592000

Request headers

Referer
https://reda.likethatmove.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache,no-store
cf-cache-status
DYNAMIC
cf-ray
8c31530c9c0b42e5-EWR
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 14 Sep 2024 15:14:02 GMT
expires
-1
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=2592000
x-powered-by
ASP.NET

Redirect headers

access-control-allow-origin
*
cache-control
private, no-cache, must-revalidate
cf-cache-status
BYPASS
cf-ray
8c31530aefd7434c-EWR
content-type
text/html; charset=utf-8
date
Sat, 14 Sep 2024 15:14:02 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
location
https://slotsparadise.com/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R8X4Ia_9-2y6GNd7ZgqdRLk
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-powered-by
ZBan
welcome
vegasaces.com/lobby/ Frame 80C3
Redirect Chain
  • https://record.revmasters.com/_46oeeYwxk8FaH3NB0WmewGNd7ZgqdRLk/1/
  • https://vegasaces.com/bounce?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk&dest=/lobby/welcome
  • https://vegasaces.com/lobby/welcome?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
vegasaces.com
URL
https://vegasaces.com/lobby/welcome?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2

26 Cookies

Domain/Path Name / Value
record.revmasters.com/ Name: VID1
Value: KSxDRFgsUzBRLjMkVgpgCg%3D%3D
.revmasters.com/ Name: ZBan
Value: a8m79pEZ4R-fw1dYdwnlAWNd7ZgqdRLk
.vegasaces.com/ Name: __cf_bm
Value: mFQJA1y9piu088f8gYoGyIDA8S2.Uz.B2Fk04PKktNY-1726326842-1.0.1.1-Vhig4.aZgGVHPci87IU5DTvKNG1L7yglqm_reiBMSDnkxal8bnCAMqUskrdhb0laiDUWJHFZmHW67zE2.kWWPA
.betus.com.pa/ Name: __cf_bm
Value: 2c9reoo49HclFIWIAc39IvXA2OLdI.YiIx3KgiQ_HH8-1726326842-1.0.1.1-sI7iCQb11ZyEmj0H2xlQwzmYY9K5zTpJaLNt62jRsmXOMm6xf1pLcANhaIKmQPVb898X0v9OBDsmec56axkZWw
.slotsparadise.com/ Name: __cf_bm
Value: 2WMsDUijc020YuyUvHrNormF8aAGdMPLacRXhF42.ok-1726326842-1.0.1.1-ib_zGWG06_35zbq8VXtSikCdtn2JhZcq.0hqyqWXj.OzejJ44.Hjk9aC0sg9_lfx72eCTvkYsa21kPdUbyEfvQ
.betuscdn.com/ Name: __cf_bm
Value: V94xL4MszTO0zXAfp5yQEZvWNJ2YWp2KG3h0P.o0APA-1726326843-1.0.1.1-FoNAa1FtxTa97.9putKrd7IVaVfS6CL_Zdb.UHrYWTwOW5_IoYUnALlr67XLR1c.MZ5oeB557nnjGZ3w0SX8KQ
.betus.com.pa/ Name: cf_clearance
Value: 0D6sHUnPgpRJYVUmO9kNaiwu2G3ti2LZmVn7ADF0AWI-1726326843-1.2.1.1-bKy0uJX.hupZMXdtTghvCskqh4kIus6shBaaRyEqyRbVPbXewd.wDxYap90PDIjuEdwyUC2ypF8RXxhL3ZZUdjLWyGkCidx2qGMevGUHEZyN.yZotykkT2YWl0_88m98U1DzZQU9_UGuXb.M.gV6mmjnHNAeN3sFdVYA01o60IzCrIwbHYSWRIAywVl9Qld0B10fdmIWkPkKpam3W1nTF5QDYZWQ9gpcvZ2F1yHkkzHGoWL83Z.bE_uO25LGk3AQg6rYtPaNP6S1cwcbwx8zQOSay3HaMsjG_Q_H4sXXtEUMNeA6hHzRSttDzIE6celBtIULc4IaIY3qKN.gVeaaO9Yg36SjXjvWVPjIwpD0egzWziBpgAGjMO9JK3mgKzxe
.sitescout.com/ Name: ssi
Value: 31f8371c-908a-4f47-8c93-ece2d7ab55c1#1726326844285
mtm.betus.com.pa/ Name: __cflb
Value: 02DiuE7jcZXfjHugnzmhSadwMycTC32XkwiT6gprsTNzQ
.slotsparadise.com/ Name: __zzatgib-w-valhalla
Value: MDA0dC0cTHtmcDhhDHEWTT17CT4VHThHKHIzd2UbN1ddHBEkWA4hPwtpW1Y0ZxUbQEgYL0tueitBaB9lT10kQ1VRdRdgSkMrNhZGRhxyM3c/awgiGVETKl94R1drZVVCODFnDE9PTRI9XypYXnpACmB4PXJuYWsvZHtFJF8cPHVlL0koeSltbh5gfRcmSlgJfFsZGghyJVN/Pl1xdil0XDwgD1s5IVQNIA5EaQsbQzVoDHt1J3Z+KmUzPGwfZUpbJUtZUnknGQ1pOlwbPx4ifHwuMBtFMV8sfFURDyYVNhcjez8vVBBFTxgNDV9Idg==v2EtyA==
.exelator.com/ Name: EE
Value: "970a289504dd25340b839f57515b5a38"
.adform.net/ Name: C
Value: 1
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcHS3CDRyMLS1MAkJcXI1NjEIMnC2DLN1NzU0DTJNNHYYnFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIYkl%252BUWb6otDgxUUpaQyLSopPBZ%252F40QsAVEYqHQ%253D%253D"
.tapad.com/ Name: TapAd_TS
Value: 1726326845050
.tapad.com/ Name: TapAd_DID
Value: 882c5918-9219-4aa9-8ef0-d707e309fd33
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: 56779d1247303a84f2ea42c1d2d10570
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4nGNQMDUzN7dMMTQyMTc2ME60MEkzSk00MUo2TDFKMTQwNTdgAIK0pytsGRAAADzRCkc%3D"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4nGNgYGBIe7rClgEOABvGAjE%3D"
.rlcdn.com/ Name: rlas3
Value: L1Hp32GP/JIGqsBNLCadlMuODFEu1/rIUwZxSkcFmiY=
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.rlcdn.com/ Name: pxrc
Value: CL3QlrcGEgUI6AcQAA==
.adform.net/ Name: uid
Value: 3337822414861592147
.demdex.net/ Name: demdex
Value: 63058688769837828910187924473644012969
.sitescout.com/ Name: _ssuma
Value: eyI0NSI6MTcyNjMyNjg0NTQ0OCwiMiI6MTcyNjMyNjg0NDMxOSwiNjgiOjE3MjYzMjY4NDU0NDgsIjQiOjE3MjYzMjY4NDQzMTksIjQ4IjoxNzI2MzI2ODQ1NDQ4LCIzOSI6MTcyNjMyNjg0NDMxOSwiMTciOjE3MjYzMjY4NDU0NDgsIjciOjE3MjYzMjY4NDQzMTksIjgiOjE3MjYzMjY4NDQzMTksIjQyIjoxNzI2MzI2ODQ1NDQ4fQ
.dpm.demdex.net/ Name: dpm
Value: 63058688769837828910187924473644012969

2 Console Messages

Source Level URL
Text
network error URL: https://mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/jquery-3.3.1.min.js.download
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
security error URL: https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/(Line 4)
Message:
Mixed Content: The page at 'https://reda.likethatmove.com/lpz/Mainstream/IQ_Download_Video/AR/7745/' was loaded over HTTPS, but requested an insecure frame 'http://vegasaces.com/lobby/welcome/?si=3&bt=AO1213443712&dtag=a8m79pEZ4R9W5YX7vr_o12Nd7ZgqdRLk'. This request has been blocked; the content must be served over HTTPS.