appfly.mobi Open in urlscan Pro
13.57.152.13 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://go.bluegorillatree.top/
Effective URL:
http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mj...
Submission: On April 11 via manual (April 11th 2018, 1:18:58 am UTC) from GB

Summary HTTP 5 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 13.57.152.13, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is appfly.mobi.

This is the only time appfly.mobi was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 2	35.227.241.201 35.227.241.201		15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.57.152.13 13.57.152.13		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	94.31.29.54 94.31.29.54		54104 (AS-STACKPATH) (AS-STACKPATH - netDNA)
1	216.58.214.42 216.58.214.42		15169 (GOOGLE) (GOOGLE - Google LLC)
5	5

2 35.227.241.201 (Ann Arbor, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 201.241.227.35.bc.googleusercontent.com

go.bluegorillatree.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.57.152.13 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-13-57-152-13.us-west-1.compute.amazonaws.com

appfly.mobi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 94.31.29.54 (United Kingdom)

ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.54.IPYX-077437-ZYO.above.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.214.42 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s09-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jquery.com code.jquery.com	105 KB
2	bluegorillatree.top 1 redirects go.bluegorillatree.top	2 KB
1	googleapis.com ajax.googleapis.com	63 KB
1	appfly.mobi appfly.mobi	2 KB
5	4

	Domain	Requested by
2	code.jquery.com	appfly.mobi
2	go.bluegorillatree.top	1 redirects
1	ajax.googleapis.com	appfly.mobi
1	appfly.mobi
5	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
Frame ID: 5770F08568B8393AD829050C00ABB204
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://go.bluegorillatree.top/ HTTP 302
http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-b... Page URL
http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SS... Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery Mobile (Mobile Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /jquery\.mobile(?:-([\d.]+rc\d))?.*\.js(?:\?ver=([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i
script /jquery\.mobile(?:-([\d.]+rc\d))?.*\.js(?:\?ver=([\d.]+))?/i
script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

172 kB
Transfer

528 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://go.bluegorillatree.top/ HTTP 302
http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2 Page URL
http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://go.bluegorillatree.top/ HTTP 302
http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2

5 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

goaway.php Show response
go.bluegorillatree.top/click/
Redirect Chain

http://go.bluegorillatree.top/
http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh...

610 B
793 B

141ms
140ms

Document
text/html

35.227.241.201
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2
Protocol: HTTP/1.1
Server: 35.227.241.201 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 201.241.227.35.bc.googleusercontent.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 448f9221ec0c956cd16cb1e5f6a17d7d78597bcfe69e3b19e43f5e0cb3884aec

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: go.bluegorillatree.top
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Cookie: tr[u]=UI%231523409528372115acd62787436e1; tr[cid]=5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C; tr[ts]=2018-04-11+01%3A18%3A48; tr[pid]=1; tr[co]=1; GCLB=CM_viv3JuazE_gE
Connection: keep-alive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 11 Apr 2018 01:18:48 GMT
Via: 1.1 google
Server: nginx/1.4.6 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Pragma: no-cache
Date: Wed, 11 Apr 2018 01:18:48 GMT
Via: 1.1 google
Server: nginx/1.4.6 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Location: /click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2
Cache-Control: no-cache,no-store, must-revalidate
Set-Cookie: tr[u]=UI%231523409528372115acd62787436e1; expires=Fri, 11-May-2018 01:18:48 GMT; Max-Age=2592000; path=/; HttpOnly tr[cid]=5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C; expires=Fri, 11-May-2018 01:18:48 GMT; Max-Age=2592000; path=/; HttpOnly tr[ts]=2018-04-11+01%3A18%3A48; expires=Fri, 11-May-2018 01:18:48 GMT; Max-Age=2592000; path=/; HttpOnly tr[pid]=1; expires=Fri, 11-May-2018 01:18:48 GMT; Max-Age=2592000; path=/; HttpOnly tr[co]=1; expires=Fri, 11-May-2018 01:18:48 GMT; Max-Age=2592000; path=/; HttpOnly GCLB=CM_viv3JuazE_gE; path=/; HttpOnly
X-Robots-Tag: noindex

GET
H/1.1 200
OK Primary Request / Show response
appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/ 5 KB
2 KB 382ms
186ms Document
text/html 13.57.152.13
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
Protocol: HTTP/1.1
Server: 13.57.152.13 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-13-57-152-13.us-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) / HHVM/3.14.1
Resource Hash: 8cc233b0f88b03b0aff6d34e9d4248b09783c8d708b87da3321076d90bc30ded

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: appfly.mobi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: http://go.bluegorillatree.top/click/goaway.php?t_url=http%3A%2F%2Fappfly.mobi%2Fred%2Fcb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2%2F%3Falg%3D2%26clickid%3D5%257CS%257Ca1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww%257CE%257C%26source%3D_%23sdpi%23%26source2%3D%26idfa%3Dnull%26androidid%3Dnull&st=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 11 Apr 2018 01:18:48 GMT
Content-Encoding: gzip
Server: nginx/1.4.6 (Ubuntu)
X-Powered-By: HHVM/3.14.1
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Content-Length: 1967

GET
H/1.1 200
OK jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
38 KB 13ms
8ms Script
application/javascript 94.31.29.54
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: appfly.mobi
URL: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
Protocol: HTTP/1.1
Server: 94.31.29.54 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS: 94.31.29.54.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 11 Apr 2018 01:18:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:07 GMT
Server: NetDNA-cache/2.2
ETag: W/"54499a47-1762a"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.mobile-1.4.5.min.js Show response
code.jquery.com/mobile/1.4.5/ 195 KB
67 KB 13ms
7ms Script
application/javascript 94.31.29.54
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
Requested by: Host: appfly.mobi
URL: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
Protocol: HTTP/1.1
Server: 94.31.29.54 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS: 94.31.29.54.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 2ec93e0833cecd36a92e8033596d06fd6790795892dc5333cb0a733d957c4979

Request headers

Referer: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 11 Apr 2018 01:18:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 31 Oct 2014 19:18:30 GMT
Server: NetDNA-cache/2.2
ETag: W/"5453e086-30dcf"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/ 234 KB
63 KB 12ms
7ms Script
text/javascript 216.58.214.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js

Requested by

Host: appfly.mobi
URL: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_

Protocol

HTTP/1.1

Server

216.58.214.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s09-in-f10.1e100.net

Software

sffe /

Resource Hash

7ab17d7c830048456601619d3a6422eb5e419b1d0bfef58d8b1c533435d2e054

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://appfly.mobi/red/cb58d75c-b4c1-11e7-bd8a-0aa1dc7bdff2/?alg=2&clickid=5|S|a1GZ1eW8Q5ZHN8SSTB88fDE1M3jM0MD3k1Mjh18fDUz3NTI0f1HwxfH2ww|E|&source=_
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 04 Feb 2018 11:04:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Dec 2016 18:17:03 GMT
Server: sffe
Age: 5667287
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 64362
X-XSS-Protection: 1; mode=block
Expires: Mon, 04 Feb 2019 11:04:02 GMT

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jQuery111104927880760465946 function| lock object| element

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
appfly.mobi
code.jquery.com
go.bluegorillatree.top
13.57.152.13
216.58.214.42
35.227.241.201
94.31.29.54
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
2ec93e0833cecd36a92e8033596d06fd6790795892dc5333cb0a733d957c4979
448f9221ec0c956cd16cb1e5f6a17d7d78597bcfe69e3b19e43f5e0cb3884aec
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
7ab17d7c830048456601619d3a6422eb5e419b1d0bfef58d8b1c533435d2e054
8cc233b0f88b03b0aff6d34e9d4248b09783c8d708b87da3321076d90bc30ded