Submitted URL: http://constintptr.com/1560200/
Effective URL: https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Submission: On September 21 via manual from HU

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 7 HTTP transactions. The main IP is 35.201.127.73, located in Ann Arbor, United States and belongs to GOOGLE - Google LLC, US. The main domain is www.trafyield.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on November 16th 2017. Valid for: a year.
This is the only time www.trafyield.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 188.72.213.121 35415 (WEBZILLA)
1 3.120.62.80 16509 (AMAZON-02)
1 1 34.251.105.46 16509 (AMAZON-02)
2 185.49.145.151 35415 (WEBZILLA)
1 139.162.189.24 63949 (LINODE-AP...)
2 35.201.127.73 15169 (GOOGLE)
7 5
Apex Domain
Subdomains
Transfer
3 rtmark.net
my.rtmark.net
mt.rtmark.net
708 B
2 trafyield.com
www.trafyield.com
2 KB
2 constintptr.com
constintptr.com
8 KB
1 mediaonly.ru
mediaonly.ru
521 B
1 crwdcntrl.net
ad.crwdcntrl.net
311 B
7 5
Domain Requested by
2 www.trafyield.com mediaonly.ru
www.trafyield.com
2 mt.rtmark.net constintptr.com
2 constintptr.com 1 redirects
1 mediaonly.ru constintptr.com
1 ad.crwdcntrl.net 1 redirects
1 my.rtmark.net constintptr.com
7 6

This site contains no links.

Subject Issuer Validity Valid
www.trafyield.com
COMODO RSA Domain Validation Secure Server CA
2017-11-16 -
2018-11-16
a year crt.sh

This page contains 1 frames:

Frame: https://www.trafyield.com/jump/next.php?stamat=m%7C%2CgYiN24iYrB1dAN0dEdHP3xP.e4e%2C5dRS3gPOWdIqmP6b5NidaipKxMc3ew5N05qtHqKPKcxE4RSGkY0NJ35DdXXD-an1OHKopJZorTw9sf093l2XHUlPn9gU0KljCwlMt9vcO1A%2C&cbrandom=0.09366089382227982&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
Frame ID: 8F6DA7AB9B9C1360C11ACBF891F4A0D2
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://constintptr.com/1560200/ Page URL
  2. http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=494aed8c22516e95ff9652fcbe32c66b6603803014603968006&empt... HTTP 302
    http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1 Page URL
  3. https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

4
Countries

9 kB
Transfer

19 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://constintptr.com/1560200/ Page URL
  2. http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=494aed8c22516e95ff9652fcbe32c66b6603803014603968006&empty=0&uuid=a9bf3f9d-a844-4729-9a34-1118a20ccd8f&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1560200&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fconstintptr.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1560200&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=41b6a476808ff402cfcc916069e536c3&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
    http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1 Page URL
  3. https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • http://ad.crwdcntrl.net/5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3D981fe8371180678d4ca294e36d453c14%26sg%3D%24%7Baud_ids%7D HTTP 302
  • http://mt.rtmark.net/ltm.gif?id=981fe8371180678d4ca294e36d453c14&sg=
Request Chain 4
  • http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=494aed8c22516e95ff9652fcbe32c66b6603803014603968006&empty=0&uuid=a9bf3f9d-a844-4729-9a34-1118a20ccd8f&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1560200&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fconstintptr.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1560200&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=41b6a476808ff402cfcc916069e536c3&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
  • http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set /
constintptr.com/1560200/
14 KB
6 KB
Document
General
Full URL
http://constintptr.com/1560200/
Protocol
HTTP/1.1
Server
188.72.213.121 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
Software
nginx /
Resource Hash
edc7b4bc4b0037faf41fe5738b1b5b4cb8181764f99dfc96ee078a108423d901
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Host
constintptr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx
Date
Fri, 21 Sep 2018 22:08:26 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Timing-Allow-Origin
* *
Pragma
no-cache
Cache-Control
private, max-age=0, no-cache
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie
SeenToday=1; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/ OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/ oaidts=1537567706; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ OAID=981fe8371180678d4ca294e36d453c14; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ OAID=981fe8371180678d4ca294e36d453c14; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ exsdsf=1537567706 pbk3=494aed8c22516e95ff9652fcbe32c66b6603803014603968006; expires=Fri, 21-Sep-2018 22:18:26 GMT; Max-Age=600 ltm_afu=1; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/
X-FRAME-OPTIONS
DENY
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Encoding
gzip
Strict-Transport-Security
max-age=1
X-Content-Type-Options
nosniff
img.gif
my.rtmark.net/
43 B
278 B
Other
General
Full URL
http://my.rtmark.net/img.gif?f=merge&userId=981fe8371180678d4ca294e36d453c14
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
3.120.62.80 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-62-80.eu-central-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Origin
http://constintptr.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Fri, 21 Sep 2018 22:08:26 GMT
Server
nginx/1.12.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
ltm.gif
mt.rtmark.net/
Redirect Chain
  • http://ad.crwdcntrl.net/5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3D981fe8371180678d4ca294e36d453c14%26sg%3D%24%7Baud_ids%7D
  • http://mt.rtmark.net/ltm.gif?id=981fe8371180678d4ca294e36d453c14&sg=
43 B
215 B
Other
General
Full URL
http://mt.rtmark.net/ltm.gif?id=981fe8371180678d4ca294e36d453c14&sg=
Protocol
HTTP/1.1
Server
185.49.145.151 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
v-6-07-17-d6376-151.webazilla.com
Software
nginx /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 21 Sep 2018 22:08:26 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Fri, 21 Sep 2018 22:08:26 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
http://mt.rtmark.net/ltm.gif?id=981fe8371180678d4ca294e36d453c14&sg=
Cache-Control
no-cache
X-Server
10.26.17.14
Connection
keep-alive
Content-Length
0
Expires
0
omr.gif
mt.rtmark.net/
43 B
215 B
Other
General
Full URL
http://mt.rtmark.net/omr.gif?s=afu&geo=DE&p=5%2C101&zoneid=1560200&oaid=981fe8371180678d4ca294e36d453c14
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
185.49.145.151 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
v-6-07-17-d6376-151.webazilla.com
Software
nginx /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Origin
http://constintptr.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 21 Sep 2018 22:08:26 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
winmactraffergotoads.php
mediaonly.ru/
Redirect Chain
  • http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=494aed8c22516e95ff9652fcbe32c66b6603803014603968006&empty=0&uuid=a9bf3f9d-a844-4729-9a34-1118a20ccd8f&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit...
  • http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
282 B
521 B
Document
General
Full URL
http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
139.162.189.24 Frankfurt, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1506-24.members.linode.com
Software
Apache /
Resource Hash

Request headers

Host
mediaonly.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200

Response headers

Date
Fri, 21 Sep 2018 22:08:26 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Keep-Alive
timeout=5, max=100
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Server
nginx
Date
Fri, 21 Sep 2018 22:08:26 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Timing-Allow-Origin
* *
Pragma
no-cache
Cache-Control
private, max-age=0, no-cache
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie
65a89d51a74c843ac913134976da73e8=p20tp7xJDVHd5gJ8SmzB8LYJzcl2HKxfeWdFK8F7dN8; expires=Fri, 28-Sep-2018 22:08:26 GMT; Max-Age=604800 OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/ ppucnt=1; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/ ppucntstart=1537567706; expires=Sat, 22-Sep-2018 22:08:26 GMT; Max-Age=86400; path=/ allcnt=1; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ OAID=981fe8371180678d4ca294e36d453c14; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ _OACCAP[1251542]=1; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ _OACBLOCK[1251542]=1537567706; expires=Sun, 21-Oct-2018 22:08:26 GMT; Max-Age=2592000; path=/ _OXCCLK[1251542]=1; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/ _OXPCLK[116508]=1; expires=Sat, 21-Sep-2019 22:08:26 GMT; Max-Age=31536000; path=/
P3P
CP="CUR ADM OUR NOR STA NID"
Location
http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Strict-Transport-Security
max-age=1
X-Content-Type-Options
nosniff
Primary Request next.php
www.trafyield.com/jump/
5 KB
2 KB
Document
General
Full URL
https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Requested by
Host: mediaonly.ru
URL: http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.127.73 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
73.127.201.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
4e3d3bde082adb4b437fd999a3722655cabf0d840fc3c1b9a1a9b01c0ec58d00

Request headers

:method
GET
:authority
www.trafyield.com
:scheme
https
:path
/jump/next.php?r=1930331&sub1===AMwIDM2UTM
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://mediaonly.ru/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://mediaonly.ru/

Response headers

status
200
server
openresty
date
Fri, 21 Sep 2018 22:08:27 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
referrer-policy
no-referrer
link
<//www.trafyield.com>; rel=dns-prefetch,<//www.trafyield.com>; rel=preconnect
x-ua
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-encoding
gzip
via
1.1 google
alt-svc
clear
next.php
www.trafyield.com/jump/
0
0
Document
General
Full URL
https://www.trafyield.com/jump/next.php?stamat=m%7C%2CgYiN24iYrB1dAN0dEdHP3xP.e4e%2C5dRS3gPOWdIqmP6b5NidaipKxMc3ew5N05qtHqKPKcxE4RSGkY0NJ35DdXXD-an1OHKopJZorTw9sf093l2XHUlPn9gU0KljCwlMt9vcO1A%2C&cbrandom=0.09366089382227982&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
Requested by
Host: www.trafyield.com
URL: https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.127.73 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
73.127.201.35.bc.googleusercontent.com
Software
openresty /
Resource Hash

Request headers

:method
GET
:authority
www.trafyield.com
:scheme
https
:path
/jump/next.php?stamat=m%7C%2CgYiN24iYrB1dAN0dEdHP3xP.e4e%2C5dRS3gPOWdIqmP6b5NidaipKxMc3ew5N05qtHqKPKcxE4RSGkY0NJ35DdXXD-an1OHKopJZorTw9sf093l2XHUlPn9gU0KljCwlMt9vcO1A%2C&cbrandom=0.09366089382227982&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
server
openresty
date
Fri, 21 Sep 2018 22:08:27 GMT
referrer-policy
no-referrer
vary
Accept-Encoding
x-ua
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
via
1.1 google
alt-svc
clear

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| inIframe function| checkDocumentBody function| documentAsyncWriteElementFromHtml undefined| ufp function| ReopenUrlBuilder function| preppopedRedirect

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff
X-Frame-Options DENY