urlscan.io logo urlscan.io
SecurityTrails logo

core.royalads.net Open in urlscan Pro
151.80.221.9  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://attractivelyhotgirls.xyz/
Effective URL: http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Submission: On January 02 via manual from RO
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 151.80.221.9, located in Netherlands and belongs to OVH, FR. The main domain is core.royalads.net.
This is the only time core.royalads.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 168.235.77.111 3842 (RAMNODE)
2 2 2606:4700:20:... 13335 (CLOUDFLAR...)
3 5 34.205.243.28 14618 (AMAZON-AES)
3 6 151.80.221.9 16276 (OVH)
1 188.164.249.105 35415 (WEBZILLA)
6 3
1    168.235.77.111 (Atlanta, United States)

ASN3842 (RAMNODE - RamNode LLC, US)
PTR: us-west-2.robssatellitetv.com
attractivelyhotgirls.xyz
2    2606:4700:20::681a:3bc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
popcash.net
5    34.205.243.28 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-205-243-28.compute-1.amazonaws.com
ps.popcash.net
6    151.80.221.9 (Netherlands)

ASN16276 (OVH, FR)
PTR: core.royalads.net
core.royalads.net
1    188.164.249.105 (Netherlands)

ASN35415 (WEBZILLA, NL)
adsremnant.com
Apex Domain
Subdomains		 Transfer
7 popcash.net
popcash.net
ps.popcash.net
2 KB
6 royalads.net
core.royalads.net
3 KB
1 adsremnant.com
adsremnant.com
126 B
1 attractivelyhotgirls.xyz
attractivelyhotgirls.xyz
348 B
6 4
Domain Requested by
6 core.royalads.net 3 redirects ps.popcash.net
core.royalads.net
5 ps.popcash.net 3 redirects core.royalads.net
2 popcash.net 2 redirects
1 adsremnant.com core.royalads.net
1 attractivelyhotgirls.xyz 1 redirects
6 5

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Frame: http://adsremnant.com/remnant
Frame ID: 302B1E04CEB4B4FB5F10C2BB25FE437A
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://attractivelyhotgirls.xyz/ HTTP 302
    http://popcash.net/world/go/165282/470986 HTTP 301
    http://ps.popcash.net/go/165282/470986 Page URL
  2. http://ps.popcash.net/ad/ad?p=165282&w=470986&t=99baa3d92e2b309d&r=&vw=1600&vh=1200 HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL
  3. http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net... HTTP 302
    http://popcash.net/world/go/79141/465699 HTTP 301
    http://ps.popcash.net/go/79141/465699 Page URL
  4. http://ps.popcash.net/ad/ad?p=79141&w=465699&t=3305485a1a43921c&r=aHR0cCUzQSUyRiUyRmNvcmUucm95YWxh... HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL
  5. http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net... HTTP 302
    http://ps.popcash.net/ad/ad?p=201730&w=488087&d=821f52f841fd93b97d45-1556198054488087 HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

3 kB
Transfer

3 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://attractivelyhotgirls.xyz/ HTTP 302
    http://popcash.net/world/go/165282/470986 HTTP 301
    http://ps.popcash.net/go/165282/470986 Page URL
  2. http://ps.popcash.net/ad/ad?p=165282&w=470986&t=99baa3d92e2b309d&r=&vw=1600&vh=1200 HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL
  3. http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net%2Fgo%2F165282%2F470986&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0 HTTP 302
    http://popcash.net/world/go/79141/465699 HTTP 301
    http://ps.popcash.net/go/79141/465699 Page URL
  4. http://ps.popcash.net/ad/ad?p=79141&w=465699&t=3305485a1a43921c&r=aHR0cCUzQSUyRiUyRmNvcmUucm95YWxhZHMubmV0JTJG&vw=1600&vh=1200 HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL
  5. http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net%2Fgo%2F79141%2F465699&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0 HTTP 302
    http://ps.popcash.net/ad/ad?p=201730&w=488087&d=821f52f841fd93b97d45-1556198054488087 HTTP 303
    http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://attractivelyhotgirls.xyz/ HTTP 302
  • http://popcash.net/world/go/165282/470986 HTTP 301
  • http://ps.popcash.net/go/165282/470986
Request Chain 1
  • http://ps.popcash.net/ad/ad?p=165282&w=470986&t=99baa3d92e2b309d&r=&vw=1600&vh=1200 HTTP 303
  • http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Request Chain 2
  • http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net%2Fgo%2F165282%2F470986&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0 HTTP 302
  • http://popcash.net/world/go/79141/465699 HTTP 301
  • http://ps.popcash.net/go/79141/465699
Request Chain 3
  • http://ps.popcash.net/ad/ad?p=79141&w=465699&t=3305485a1a43921c&r=aHR0cCUzQSUyRiUyRmNvcmUucm95YWxhZHMubmV0JTJG&vw=1600&vh=1200 HTTP 303
  • http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Request Chain 4
  • http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fcore.royalads.net%2F&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0 HTTP 302
  • http://adsremnant.com/remnant

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
470986
ps.popcash.net/go/165282/
Redirect Chain
  • http://attractivelyhotgirls.xyz/
  • http://popcash.net/world/go/165282/470986
  • http://ps.popcash.net/go/165282/470986
426 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
http://ps.popcash.net/go/165282/470986
Protocol
HTTP/1.1
Server
34.205.243.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-243-28.compute-1.amazonaws.com
Software
nginx /
Resource Hash
9677ae7f26eb79d945d399f6966a07ba0440c2015f94373b1efe334a0a4377c9

Request headers

Host
ps.popcash.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Cookie
__cfduid=daacb466de1d9fa684f1eb7b8e3824db21577996514
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 02 Jan 2020 20:21:54 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Server
nginx
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

Date
Thu, 02 Jan 2020 20:21:54 GMT
Content-Type
text/html
Content-Length
162
Connection
keep-alive
Set-Cookie
__cfduid=daacb466de1d9fa684f1eb7b8e3824db21577996514; expires=Sat, 01-Feb-20 20:21:54 GMT; path=/; domain=.popcash.net; HttpOnly; SameSite=Lax
Location
http://ps.popcash.net/go/165282/470986
CF-Cache-Status
DYNAMIC
Server
cloudflare
CF-RAY
54ef71276b7f6395-FRA
Cookie set /
core.royalads.net/click/
Redirect Chain
  • http://ps.popcash.net/ad/ad?p=165282&w=470986&t=99baa3d92e2b309d&r=&vw=1600&vh=1200
  • http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
652 B
700 B 		Document
General
Check archive.org
Download Go to
Full URL
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Requested by
Host: ps.popcash.net
URL: http://ps.popcash.net/go/165282/470986
Protocol
HTTP/1.1
Server
151.80.221.9 , Netherlands, ASN16276 (OVH, FR),
Reverse DNS
core.royalads.net
Software
nginx /
Resource Hash
8d3188d8f7336b4318599937269ec8667a612f3a0683d37ea72ae0321427c251

Request headers

Host
core.royalads.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://ps.popcash.net/go/165282/470986
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://ps.popcash.net/go/165282/470986

Response headers

Server
nginx
Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
no-cache
Set-Cookie
cflag=551;Domain=core.royalads.net;Path=/
Content-Encoding
gzip

Redirect headers

Date
Thu, 02 Jan 2020 20:21:54 GMT
Content-Type
text/html; charset=utf-8
Content-Length
99
Connection
keep-alive
Server
nginx
Location
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
465699
ps.popcash.net/go/79141/
Redirect Chain
  • http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net%2Fgo%2F165282%2F470986&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0
  • http://popcash.net/world/go/79141/465699
  • http://ps.popcash.net/go/79141/465699
469 B
527 B 		Document
General
Check archive.org
Download Go to
Full URL
http://ps.popcash.net/go/79141/465699
Requested by
Host: core.royalads.net
URL: http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Protocol
HTTP/1.1
Server
34.205.243.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-243-28.compute-1.amazonaws.com
Software
nginx /
Resource Hash
40e3d557d52a748d39530dad0513b13da71b1376e116ab178039410e397c87f0

Request headers

Host
ps.popcash.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://core.royalads.net/
Accept-Encoding
gzip, deflate
Cookie
__cfduid=daacb466de1d9fa684f1eb7b8e3824db21577996514
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://core.royalads.net/

Response headers

Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Server
nginx
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html
Content-Length
162
Connection
keep-alive
Location
http://ps.popcash.net/go/79141/465699
CF-Cache-Status
DYNAMIC
Server
cloudflare
CF-RAY
54ef712b1f9e6395-FRA
Cookie set /
core.royalads.net/click/
Redirect Chain
  • http://ps.popcash.net/ad/ad?p=79141&w=465699&t=3305485a1a43921c&r=aHR0cCUzQSUyRiUyRmNvcmUucm95YWxhZHMubmV0JTJG&vw=1600&vh=1200
  • http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
651 B
700 B 		Document
General
Check archive.org
Download Go to
Full URL
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Requested by
Host: ps.popcash.net
URL: http://ps.popcash.net/go/79141/465699
Protocol
HTTP/1.1
Server
151.80.221.9 , Netherlands, ASN16276 (OVH, FR),
Reverse DNS
core.royalads.net
Software
nginx /
Resource Hash

Request headers

Host
core.royalads.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://ps.popcash.net/go/79141/465699
Accept-Encoding
gzip, deflate
Cookie
cflag=551; hash=0d5e98e6-281a-47a2-a834-912fa8c0580d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://ps.popcash.net/go/79141/465699

Response headers

Server
nginx
Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
no-cache
Set-Cookie
cflag=551;Domain=core.royalads.net;Path=/
Content-Encoding
gzip

Redirect headers

Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html; charset=utf-8
Content-Length
99
Connection
keep-alive
Server
nginx
Location
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Primary Request Cookie set /
core.royalads.net/click/
Redirect Chain
  • http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fps.popcash.net%2Fgo%2F79141%2F465699&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0
  • http://ps.popcash.net/ad/ad?p=201730&w=488087&d=821f52f841fd93b97d45-1556198054488087
  • http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
639 B
680 B 		Document
General
Check archive.org
Download Go to
Full URL
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Requested by
Host: core.royalads.net
URL: http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Protocol
HTTP/1.1
Server
151.80.221.9 , Netherlands, ASN16276 (OVH, FR),
Reverse DNS
core.royalads.net
Software
nginx /
Resource Hash
c0c7eb262133ff58086c211dc9f7049de19dbf0cafbf472255ba137d1e9b76ab

Request headers

Host
core.royalads.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://core.royalads.net/
Accept-Encoding
gzip, deflate
Cookie
cflag=551; hash=0d5e98e6-281a-47a2-a834-912fa8c0580d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://core.royalads.net/

Response headers

Server
nginx
Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
no-cache
Set-Cookie
cflag=551;Domain=core.royalads.net;Path=/
Content-Encoding
gzip

Redirect headers

Date
Thu, 02 Jan 2020 20:21:55 GMT
Content-Type
text/html; charset=utf-8
Content-Length
99
Connection
keep-alive
Server
nginx
Location
http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
remnant
adsremnant.com/
Redirect Chain
  • http://core.royalads.net/go/?pub=668b66e2-62b7-461c-8a81-1988701f230f&ref=http%3A%2F%2Fcore.royalads.net%2F&scrw=1600&scrh=1200&nlc=aDv7BQkR5n3Ab7UV&ven=&ver=&iif=0
  • http://adsremnant.com/remnant
0
126 B 		Document
General
Check archive.org
Download Go to
Full URL
http://adsremnant.com/remnant
Requested by
Host: core.royalads.net
URL: http://core.royalads.net/click/?pub=668b66e2-62b7-461c-8a81-1988701f230f
Protocol
HTTP/1.1
Server
188.164.249.105 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host
adsremnant.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://core.royalads.net/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://core.royalads.net/

Response headers

Server
nginx
Date
Thu, 02 Jan 2020 20:20:12 GMT
Transfer-Encoding
chunked
Connection
keep-alive

Redirect headers

Server
nginx
Date
Thu, 02 Jan 2020 20:21:55 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Location
http://adsremnant.com/remnant
Cache-Control
no-cache

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies