de.popcorntimes.tv Open in urlscan Pro
51.254.238.186 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sub.avgle.com/sound?lajxij=9&refer=https%3A%2F%2Favgle.com%2Fvideo%2Ftdm6P6ZlM6V%2F%25E3%2583%2586%25E3%2582%2...
Effective URL:
http://de.popcorntimes.tv/cx/200-euro-gratis/
Submission: On November 30 via manual (November 30th 2018, 5:56:14 pm UTC) from US

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 14 IPs in 6 countries across 16 domains to perform 25 HTTP transactions. The main IP is 51.254.238.186, located in France and belongs to OVH, FR. The main domain is de.popcorntimes.tv.

This is the only time de.popcorntimes.tv was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	198.134.112.243 198.134.112.243	27257 (WEBAIR-IN...) (WEBAIR-INTERNET - Webair Internet Development Company Inc.)
1 2	188.42.162.193 188.42.162.193	35415 (WEBZILLA) (WEBZILLA)
1	188.42.160.80 188.42.160.80	35415 (WEBZILLA) (WEBZILLA)
1	34.251.105.46 34.251.105.46	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	185.49.145.151 185.49.145.151	35415 (WEBZILLA) (WEBZILLA)
1	172.104.244.192 172.104.244.192	63949 (LINODE-AP...) (LINODE-AP Linode)
1 1	2606:4700:10:... 2606:4700:10::6814:802e	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2	52.70.67.134 52.70.67.134	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	95.211.229.247 95.211.229.247	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
2 2	78.46.155.195 78.46.155.195	24940 (HETZNER-AS) (HETZNER-AS)
2	51.254.238.186 51.254.238.186	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:820::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	176.9.51.167 176.9.51.167	24940 (HETZNER-AS) (HETZNER-AS)
1	2606:4700:10:... 2606:4700:10::6814:3777	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 4	188.40.20.23 188.40.20.23	24940 (HETZNER-AS) (HETZNER-AS)
1 1	67.199.248.10 67.199.248.10	395224 (BITLY-AS) (BITLY-AS - Bitly Inc)
2	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
25	14

1 198.134.112.243 (Garden City, United States) 1 redirects

ASN27257 (WEBAIR-INTERNET - Webair Internet Development Company Inc., US)

sub.avgle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.42.162.193 (Luxembourg) 1 redirects

ASN35415 (WEBZILLA, NL)

bestadbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.42.160.80 (Luxembourg)

ASN35415 (WEBZILLA, NL)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.105.46 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-251-105-46.eu-west-1.compute.amazonaws.com

ad.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.49.145.151 (Netherlands)

ASN35415 (WEBZILLA, NL)
PTR: v-6-07-17-d6376-151.webazilla.com

rtmatcher.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.104.244.192 (Absecon, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1821-192.members.linode.com

mediaonly.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:802e (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.70.67.134 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-70-67-134.compute-1.amazonaws.com

sp.popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.211.229.247 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

syndication.exdynsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 78.46.155.195 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: dedi3961.your-server.de

www1.lustich.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.254.238.186 (France)

ASN16276 (OVH, FR)
PTR: ip186.ip-51-254-238.eu

de.popcorntimes.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.51.167 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.167.51.9.176.clients.your-server.de

serv1swork.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:3777 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.pushcrew.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 188.40.20.23 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.23.20.40.188.clients.your-server.de

privatelink.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.privatelink.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.10 (United States) 1 redirects

ASN395224 (BITLY-AS - Bitly Inc, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	privatelink.de 1 redirects privatelink.de www.privatelink.de	308 B
3	popcash.net 2 redirects popcash.net sp.popcash.net	1 KB
2	google-analytics.com www.google-analytics.com	17 KB
2	popcorntimes.tv de.popcorntimes.tv	1 KB
2	lustich.de 2 redirects www1.lustich.de	509 B
2	exdynsrv.com 1 redirects syndication.exdynsrv.com	2 KB
2	bestadbid.com 1 redirects bestadbid.com	7 KB
1	bit.ly 1 redirects bit.ly	400 B
1	pushcrew.com cdn.pushcrew.com	62 KB
1	serv1swork.com serv1swork.com	584 KB
1	googletagmanager.com www.googletagmanager.com	32 KB
1	mediaonly.ru mediaonly.ru	469 B
1	rtmatcher.net rtmatcher.net	215 B
1	crwdcntrl.net ad.crwdcntrl.net	337 B
1	rtmark.net my.rtmark.net	366 B
1	avgle.com 1 redirects sub.avgle.com	552 B
25	16

	Domain	Requested by
2	www.google-analytics.com	www.googletagmanager.com de.popcorntimes.tv
2	www.privatelink.de	1 redirects de.popcorntimes.tv
2	privatelink.de	de.popcorntimes.tv
2	de.popcorntimes.tv	syndication.exdynsrv.com de.popcorntimes.tv
2	www1.lustich.de	2 redirects
2	syndication.exdynsrv.com	1 redirects sp.popcash.net
2	sp.popcash.net	1 redirects mediaonly.ru
2	bestadbid.com	1 redirects
1	bit.ly	1 redirects
1	cdn.pushcrew.com	de.popcorntimes.tv
1	serv1swork.com	de.popcorntimes.tv
1	www.googletagmanager.com	de.popcorntimes.tv
1	popcash.net	1 redirects
1	mediaonly.ru	bestadbid.com
1	rtmatcher.net	bestadbid.com
1	ad.crwdcntrl.net	bestadbid.com
1	my.rtmark.net	bestadbid.com
1	sub.avgle.com	1 redirects
25	18

This site contains no links.

Subject Issuer	Validity	Valid
exdynsrv.com Let's Encrypt Authority X3	`2018-09-26` - `2018-12-25`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2018-11-07` - `2019-01-30`	3 months	crt.sh
*.pushcrew.com Go Daddy Secure Certificate Authority - G2	`2016-06-02` - `2019-07-31`	3 years	crt.sh
*.privatelink.de COMODO RSA Domain Validation Secure Server CA	`2017-09-08` - `2020-09-07`	3 years	crt.sh

This page contains 4 frames:

Primary Page: http://de.popcorntimes.tv/cx/200-euro-gratis/
Frame ID: 1BC657ABEB9B503FF5480841E036941E
Requests: 22 HTTP requests in this frame

Frame: http://privatelink.de/?https%3A%2F%2Ft.co%2FHXFJWCUIIe
Frame ID: F6874240BCA01092690A7E136EF76A23
Requests: 1 HTTP requests in this frame

Frame: http://privatelink.de/?https%3A%2F%2Fde.777.com%2F
Frame ID: B9FF36603A57E1C5DC2202EC1BE11167
Requests: 1 HTTP requests in this frame

Frame: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Frame ID: 30AFBBD86CD6AB8EEE41D54C895E7678
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://sub.avgle.com/sound?lajxij=9&refer=https%3A%2F%2Favgle.com%2Fvideo%2Ftdm6P6ZlM6V%2F%25E3%2... HTTP 302
http://bestadbid.com/afu.php?zoneid=1462665&var=14271515 Page URL
http://bestadbid.com/?r=%2Fmb%2Fhan&pbk3=578b67d94677c56886f6361c383755f96629713903452801236&empt... HTTP 302
http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665 Page URL
http://popcash.net/world/go/187798/404594 HTTP 301
http://sp.popcash.net/go/187798/404594 Page URL
http://sp.popcash.net/sgo/ad?p=187798&w=404594&t=b230467372114f32&r=aHR0cCUzQSUyRiUyRm1lZGlhb25seS... HTTP 303
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8 Page URL
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8&p=http%3A%2F%2Fsp.popcash.net%2F... HTTP 302
http://www1.lustich.de/link HTTP 301
http://www1.lustich.de/link/ HTTP 302
http://de.popcorntimes.tv/cx/200-euro-gratis/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

25
Requests

24 %
HTTPS

24 %
IPv6

16
Domains

18
Subdomains

14
IPs

6
Countries

705 kB
Transfer

1212 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sub.avgle.com/sound?lajxij=9&refer=https%3A%2F%2Favgle.com%2Fvideo%2Ftdm6P6ZlM6V%2F%25E3%2583%2586%25E3%2582%25B9%25E3%2583%2588%25E6%2592%25AE%25E3%2582%258A%25E3%2583%258F%25E3%2583%25A1%25E6%2592%25AE%25E3%2582%258A%25E6%2598%25A0%25E5%2583%258F&kw=%5B%22%E3%83%86%E3%82%B9%E3%83%88%E6%92%AE%E3%82%8A%E3%83%8F%E3%83%A1%E6%92%AE%E3%82%8A%E6%98%A0%E5%83%8F%22%2C%22-%22%2C%22avgle%22%5D&key=fdbd8a99ad6810595035524027896c49&scrWidth=1440&scrHeight=900&tz=9&ship=&pst=&res=4.31&dev=r&adb=n&adb=n HTTP 302
http://bestadbid.com/afu.php?zoneid=1462665&var=14271515 Page URL
http://bestadbid.com/?r=%2Fmb%2Fhan&pbk3=578b67d94677c56886f6361c383755f96629713903452801236&empty=0&var=14271515&uuid=8c476074-422d-41fe-a3cf-eb4cd70664af&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1462665&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fbestadbid.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1462665&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=a566f8eeb44bf24e876764ba99ea1cb0&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665 Page URL
http://popcash.net/world/go/187798/404594 HTTP 301
http://sp.popcash.net/go/187798/404594 Page URL
http://sp.popcash.net/sgo/ad?p=187798&w=404594&t=b230467372114f32&r=aHR0cCUzQSUyRiUyRm1lZGlhb25seS5ydSUyRg==&vw=1600&vh=1200 HTTP 303
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8 Page URL
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8&p=http%3A%2F%2Fsp.popcash.net%2Fgo%2F187798%2F404594&tested=1&check=4aac90945af22701a235bc3636c0a0d2&screen_resolution=1600x1200&container_resolution=1600x1200&iframe=0 HTTP 302
http://www1.lustich.de/link HTTP 301
http://www1.lustich.de/link/ HTTP 302
http://de.popcorntimes.tv/cx/200-euro-gratis/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://sub.avgle.com/sound?lajxij=9&refer=https%3A%2F%2Favgle.com%2Fvideo%2Ftdm6P6ZlM6V%2F%25E3%2583%2586%25E3%2582%25B9%25E3%2583%2588%25E6%2592%25AE%25E3%2582%258A%25E3%2583%258F%25E3%2583%25A1%25E6%2592%25AE%25E3%2582%258A%25E6%2598%25A0%25E5%2583%258F&kw=%5B%22%E3%83%86%E3%82%B9%E3%83%88%E6%92%AE%E3%82%8A%E3%83%8F%E3%83%A1%E6%92%AE%E3%82%8A%E6%98%A0%E5%83%8F%22%2C%22-%22%2C%22avgle%22%5D&key=fdbd8a99ad6810595035524027896c49&scrWidth=1440&scrHeight=900&tz=9&ship=&pst=&res=4.31&dev=r&adb=n&adb=n HTTP 302
http://bestadbid.com/afu.php?zoneid=1462665&var=14271515

Request Chain 4

http://bestadbid.com/?r=%2Fmb%2Fhan&pbk3=578b67d94677c56886f6361c383755f96629713903452801236&empty=0&var=14271515&uuid=8c476074-422d-41fe-a3cf-eb4cd70664af&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1462665&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fbestadbid.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1462665&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=a566f8eeb44bf24e876764ba99ea1cb0&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665

Request Chain 5

http://popcash.net/world/go/187798/404594 HTTP 301
http://sp.popcash.net/go/187798/404594

Request Chain 6

http://sp.popcash.net/sgo/ad?p=187798&w=404594&t=b230467372114f32&r=aHR0cCUzQSUyRiUyRm1lZGlhb25seS5ydSUyRg==&vw=1600&vh=1200 HTTP 303
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8

Request Chain 13

http://bit.ly/2oHl00R HTTP 301
https://www.privatelink.de/sf/?http://privatelink.de/%3Fhttps://t.co/z7rulNZ8zx HTTP 301
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set afu.php Show response
bestadbid.com/
Redirect Chain

http://sub.avgle.com/sound?lajxij=9&refer=https%3A%2F%2Favgle.com%2Fvideo%2Ftdm6P6ZlM6V%2F%25E3%2583%2586%25E3%2582%25B9%25E3%2583%2588%25E6%2592%25AE%25E3%2582%258A%25E3%2583%258F%25E3%2583%25A1%2...
http://bestadbid.com/afu.php?zoneid=1462665&var=14271515

13 KB
6 KB

58ms
40ms

Document
text/html

188.42.162.193
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

http://bestadbid.com/afu.php?zoneid=1462665&var=14271515

Protocol

HTTP/1.1

Server

188.42.162.193 , Luxembourg, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

4959088222ea53a6768325d7eb4583ce1f87d1ac7c7e1e276e102dbb171ac8db

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Host: bestadbid.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx
Date: Fri, 30 Nov 2018 17:55:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Timing-Allow-Origin: * *
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: SeenToday=1; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ oaidts=1543600555; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ OAID=d4eb9e4f69893db050a44d281ef014a9; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ OXVAR=14271515; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ OAID=d4eb9e4f69893db050a44d281ef014a9; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ exsdsf=1543600555 pbk3=578b67d94677c56886f6361c383755f96629713903452801236; expires=Fri, 30-Nov-2018 18:05:55 GMT; Max-Age=600 ltm_afu=1; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/
X-FRAME-OPTIONS: DENY
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Encoding: gzip
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

Redirect headers

Server: nginx/1.15.1
Date: Fri, 30 Nov 2018 17:55:38 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Set-Cookie: u_pl=14271515; expires=Sat, 01 Dec 2018 17:55:55 GMT backurled=14271515; expires=Fri, 30 Nov 2018 17:56:55 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

POST
H/1.1 200
OK img.gif
my.rtmark.net/ 43 B
366 B 38ms
15ms Other
image/gif 188.42.160.80
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

http://my.rtmark.net/img.gif?f=merge&userId=d4eb9e4f69893db050a44d281ef014a9

Requested by

Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665

Protocol

HTTP/1.1

Server

188.42.160.80 , Luxembourg, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Origin: http://bestadbid.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 30 Nov 2018 17:55:55 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: image/gif
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43

POST
H/1.1 404
Not Found pe=y
ad.crwdcntrl.net/5/c=10546/ 0
337 B 86ms
30ms Other
text/html 34.251.105.46
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://ad.crwdcntrl.net/5/c=10546/pe=y?http%3A%2F%2Frtmatcher.net%2Fltm.gif%3Fid%3Dd4eb9e4f69893db050a44d281ef014a9%26sg%3D%24%7Baud_ids%7D
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Protocol: HTTP/1.1
Server: 34.251.105.46 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-251-105-46.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Origin: http://bestadbid.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 30 Nov 2018 17:55:55 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Oct 2018 15:33:14 GMT
Vary: Accept-Encoding
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
X-Server: 10.26.4.222
Connection: keep-alive
Content-Type: text/html
Content-Length: 20

POST
H/1.1 200
OK omr.gif
rtmatcher.net/ 43 B
215 B 40ms
12ms Other
image/gif 185.49.145.151
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://rtmatcher.net/omr.gif?s=afu&geo=DE&p=5%2C101&zoneid=1462665&oaid=d4eb9e4f69893db050a44d281ef014a9
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Protocol: HTTP/1.1
Server: 185.49.145.151 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-6-07-17-d6376-151.webazilla.com
Software: nginx /
Resource Hash

Request headers

Referer: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Origin: http://bestadbid.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 30 Nov 2018 17:55:55 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

EddU4ZpDHvDE.php
mediaonly.ru/
Redirect Chain

http://bestadbid.com/?r=%2Fmb%2Fhan&pbk3=578b67d94677c56886f6361c383755f96629713903452801236&empty=0&var=14271515&uuid=8c476074-422d-41fe-a3cf-eb4cd70664af&ad_scheme=1&rotation_type=3&ppucounter=0&...
http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665

230 B
469 B

72ms
49ms

Document
text/html

172.104.244.192
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Protocol: HTTP/1.1
Server: 172.104.244.192 Absecon, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: li1821-192.members.linode.com
Software: Apache /
Resource Hash

Request headers

Host: mediaonly.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://bestadbid.com/afu.php?zoneid=1407888&var=1462665

Response headers

Date: Fri, 30 Nov 2018 17:55:55 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Server: nginx
Date: Fri, 30 Nov 2018 17:55:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Timing-Allow-Origin: * *
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: 65a89d51a74c843ac913134976da73e8=GB9Ye3LiuR_qp4SOA8OyEWLxrumzM6H5rS4dIfX3U9M; expires=Fri, 07-Dec-2018 17:55:55 GMT; Max-Age=604800 OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ ppucnt=1; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ ppucntstart=1543600555; expires=Sat, 01-Dec-2018 17:55:55 GMT; Max-Age=86400; path=/ allcnt=1; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ OAID=d4eb9e4f69893db050a44d281ef014a9; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ _OACCAP[1492591]=1; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ _OACBLOCK[1492591]=1543600555; expires=Sun, 30-Dec-2018 17:55:55 GMT; Max-Age=2592000; path=/ _OXCCLK[1492591]=1; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/ _OXPCLK[116508]=1; expires=Sat, 30-Nov-2019 17:55:55 GMT; Max-Age=31536000; path=/
P3P: CP="CUR ADM OUR NOR STA NID"
Location: http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET
H/1.1

200
OK

404594 Show response
sp.popcash.net/go/187798/
Redirect Chain

http://popcash.net/world/go/187798/404594
http://sp.popcash.net/go/187798/404594

467 B
516 B

212ms
93ms

Document
text/html

52.70.67.134
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://sp.popcash.net/go/187798/404594
Requested by: Host: mediaonly.ru
URL: http://mediaonly.ru/EddU4ZpDHvDE.php?zoneid=1462665
Protocol: HTTP/1.1
Server: 52.70.67.134 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-70-67-134.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7d0656e951eba0426dfd12b29abf9b4874f71d993b4b3fcde8f615e2c2ec32c2

Request headers

Host: sp.popcash.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://mediaonly.ru/
Accept-Encoding: gzip, deflate
Cookie: __cfduid=d155437e6a8156fdfa16b03ece457022e1543600555
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://mediaonly.ru/

Response headers

Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 30 Nov 2018 17:55:56 GMT
Server: nginx
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive

Redirect headers

Date: Fri, 30 Nov 2018 17:55:56 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Set-Cookie: __cfduid=d155437e6a8156fdfa16b03ece457022e1543600555; expires=Sat, 30-Nov-19 17:55:55 GMT; path=/; domain=.popcash.net; HttpOnly
Location: http://sp.popcash.net/go/187798/404594
Server: cloudflare
CF-RAY: 481f301287a7c2a1-FRA

GET
H/1.1

200
OK

Cookie set splash.php Show response
syndication.exdynsrv.com/
Redirect Chain

http://sp.popcash.net/sgo/ad?p=187798&w=404594&t=b230467372114f32&r=aHR0cCUzQSUyRiUyRm1lZGlhb25seS5ydSUyRg==&vw=1600&vh=1200
https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8

1 KB
942 B

60ms
14ms

Document
text/html

95.211.229.247
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8
Requested by: Host: sp.popcash.net
URL: http://sp.popcash.net/go/187798/404594
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 95.211.229.247 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx /
Resource Hash: 048e5a37626e7f8a7f6143b7137ad24b7ca543d692ec9a51934159982a8d909e

Request headers

Host: syndication.exdynsrv.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://sp.popcash.net/go/187798/404594
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://sp.popcash.net/go/187798/404594

Response headers

Server: nginx
Date: Fri, 30 Nov 2018 17:55:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%225c0179ac7eb925.984071981570310990%22%3B%7D; expires=Sun, 29-Nov-2020 17:55:56 GMT; Max-Age=63072000; domain=exdynsrv.com
Content-Encoding: gzip

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Fri, 30 Nov 2018 17:55:56 GMT
Location: https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8
Server: nginx
Content-Length: 111
Connection: keep-alive

GET
H/1.1

200
OK

Primary Request / Show response
de.popcorntimes.tv/cx/200-euro-gratis/
Redirect Chain

https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8&p=http%3A%2F%2Fsp.popcash.net%2Fgo%2F187798%2F404594&tested=1&check=4aac90945af22701a235bc3636c0a0d2&screen_resolution=1...
http://www1.lustich.de/link
http://www1.lustich.de/link/
http://de.popcorntimes.tv/cx/200-euro-gratis/

2 KB
1 KB

52ms
8ms

Document
text/html

51.254.238.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Requested by: Host: syndication.exdynsrv.com
URL: https://syndication.exdynsrv.com/splash.php?idzone=3207861&sub=404594&type=8
Protocol: HTTP/1.1
Server: 51.254.238.186 , France, ASN16276 (OVH, FR),
Reverse DNS: ip186.ip-51-254-238.eu
Software: nginx/1.6.2 /
Resource Hash: ec4989cc11953414d314ef036075da7e6286cf5111559e371a6349265b144b06

Request headers

Host: de.popcorntimes.tv
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.6.2
Date: Fri, 30 Nov 2018 17:55:56 GMT
Content-Type: text/html
Last-Modified: Fri, 26 Oct 2018 13:47:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

Redirect headers

Date: Fri, 30 Nov 2018 17:55:56 GMT
Server: Apache
Location: http://de.popcorntimes.tv/cx/200-euro-gratis/
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK showads.js Show response
de.popcorntimes.tv/cx/200-euro-gratis/ 21 B
269 B 9ms
8ms Script
application/javascript 51.254.238.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://de.popcorntimes.tv/cx/200-euro-gratis/showads.js
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: HTTP/1.1
Server: 51.254.238.186 , France, ASN16276 (OVH, FR),
Reverse DNS: ip186.ip-51-254-238.eu
Software: nginx/1.6.2 /
Resource Hash: abd9155ac0fe0e62fdb9e2c1c333357cd33107972a57eff5224b0f3d0d2df316

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: de.popcorntimes.tv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 30 Nov 2018 17:55:56 GMT
Last-Modified: Mon, 01 Oct 2018 19:08:58 GMT
Server: nginx/1.6.2
ETag: "5bb270ca-15"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21

GET
S 200 js Show response
www.googletagmanager.com/gtag/ 87 KB
32 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:820::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-117671757-2

Requested by

Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:820::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

8ca8dc09743d48fb7506abbfe82036964812a7e318ea9d525d7e39a8e9769e33

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 30 Nov 2018 17:55:56 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 32167
x-xss-protection: 1; mode=block
expires: Fri, 30 Nov 2018 17:55:56 GMT

GET
H/1.1 200
OK 1351010345bbdc42.3.n.2.1.l60.js Show response
serv1swork.com/ 583 KB
584 KB 43ms
1ms Script
application/javascript 176.9.51.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://serv1swork.com/1351010345bbdc42.3.n.2.1.l60.js
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: HTTP/1.1
Server: 176.9.51.167 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.51.9.176.clients.your-server.de
Software: nginx/1.13.8 / Express
Resource Hash: 9103cd80a8f14222a8a13c83f44009fbc1196bf5ee0547aaaccb38b9438c023d

Request headers

Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 30 Nov 2018 17:55:56 GMT
apicache-version: 1.2.3
Server: nginx/1.13.8
apicache-store: memory
x-powered-by: Express
Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1800
X-Cache: HIT
Connection: keep-alive
Access-Control-Allow-Headers: content-type
Content-Length: 597316
etag: W/"91d44-7/Zn+pm9TuditRfu56Rb7ph/EFs"
Expires: Fri, 30 Nov 2018 18:25:56 GMT

GET
S 200 fcee07991d2e46c4f3ddfde70722c38f.js Show response
cdn.pushcrew.com/js/ 212 KB
62 KB 62ms
9ms Script
application/javascript 2606:4700:10::6814:3777
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pushcrew.com/js/fcee07991d2e46c4f3ddfde70722c38f.js
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700:10::6814:3777 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39fa7962bd01e6cd2c1912ea36d75ee56516d8563bb88360fad642861be648b4

Request headers

Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 30 Nov 2018 17:55:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 26 Oct 2018 09:38:06 GMT
server: cloudflare
etag: W/"5bd2e07e-34e02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=43200
cf-ray: 481f3017af8c96f4-FRA
expires: Sat, 01 Dec 2018 05:55:56 GMT

GET
H/1.1 200
OK Cookie set /
privatelink.de/ Frame F687 0
0 34ms
2ms Document
text/html 188.40.20.23
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://privatelink.de/?https%3A%2F%2Ft.co%2FHXFJWCUIIe
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: HTTP/1.1
Server: 188.40.20.23 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.23.20.40.188.clients.your-server.de
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Host: privatelink.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/

Response headers

Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=6B92A08E472912F6203D435A4D8045C7; Path=/; HttpOnly
Referrer-Policy: no-referrer
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 4851
Date: Fri, 30 Nov 2018 17:55:56 GMT

GET
H/1.1 200
OK Cookie set /
privatelink.de/ Frame B9FF 0
0 32ms
1ms Document
text/html 188.40.20.23
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://privatelink.de/?https%3A%2F%2Fde.777.com%2F
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: HTTP/1.1
Server: 188.40.20.23 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.23.20.40.188.clients.your-server.de
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Host: privatelink.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/

Response headers

Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=45C82A867E4CBBACAC893BA2EF008BCA; Path=/; HttpOnly
Referrer-Policy: no-referrer
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 4827
Date: Fri, 30 Nov 2018 17:55:56 GMT

GET
H/1.1

200
OK

/
www.privatelink.de/ Frame 30AF
Redirect Chain

http://bit.ly/2oHl00R
https://www.privatelink.de/sf/?http://privatelink.de/%3Fhttps://t.co/z7rulNZ8zx
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx

0
0

2ms
2ms

Document
text/html

188.40.20.23
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Requested by: Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.20.23 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.23.20.40.188.clients.your-server.de
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Host: www.privatelink.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=F7131137ECC8775C64FB293453F5B5B7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: Apache-Coyote/1.1
Referrer-Policy: no-referrer
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 5005
Date: Fri, 30 Nov 2018 17:55:56 GMT

Redirect headers

Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F7131137ECC8775C64FB293453F5B5B7; Path=/; Secure; HttpOnly
Referrer-Policy: no-referrer
Location: /?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Content-Length: 0
Date: Fri, 30 Nov 2018 17:55:56 GMT

GET
S 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:820::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-117671757-2

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:820::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Nov 2018 21:10:09 GMT
server: Golfe2
age: 2330
date: Fri, 30 Nov 2018 17:17:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17404
expires: Fri, 30 Nov 2018 19:17:06 GMT

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
BLOB 200
OK 166fcf8b-42a4-4405-97fc-27009b5dd8f2
http://de.popcorntimes.tv/ 34 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://de.popcorntimes.tv/166fcf8b-42a4-4405-97fc-27009b5dd8f2
Requested by: Host: bestadbid.com
URL: http://bestadbid.com/afu.php?zoneid=1462665&var=14271515
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length: 34654
Content-Type: application/javascript

GET
S 200 collect
www.google-analytics.com/r/ 35 B
105 B 14ms
13ms Image
image/gif 2a00:1450:4001:820::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j72&aip=1&a=456107402&t=pageview&_s=1&dl=http%3A%2F%2Fde.popcorntimes.tv%2Fcx%2F200-euro-gratis%2F&ul=en-us&de=UTF-8&dt=200%20Euro%20gratis%20-%20Critch%20Bonus&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=481796336&gjid=561091390&cid=48807955.1543600557&tid=UA-117671757-2&_gid=1943464026.1543600557&_r=1&gtm=2oubc0&z=1182816101

Requested by

Host: de.popcorntimes.tv
URL: http://de.popcorntimes.tv/cx/200-euro-gratis/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:820::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://de.popcorntimes.tv/cx/200-euro-gratis/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Nov 2018 17:55:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
privatelink.de/	1969-12-31 23:59:59	Name: JSESSIONID Value: 6B92A08E472912F6203D435A4D8045C7
.popcorntimes.tv/	1970-01-18 20:46:40	Name: _gat_gtag_UA_117671757_2 Value: 1
.popcorntimes.tv/	1970-01-18 20:48:06	Name: _gid Value: GA1.2.1943464026.1543600557
www.privatelink.de/	1969-12-31 23:59:59	Name: JSESSIONID Value: F7131137ECC8775C64FB293453F5B5B7
.popcorntimes.tv/	1970-01-19 14:17:52	Name: _ga Value: GA1.2.48807955.1543600557

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.crwdcntrl.net
bestadbid.com
bit.ly
cdn.pushcrew.com
de.popcorntimes.tv
mediaonly.ru
my.rtmark.net
popcash.net
privatelink.de
rtmatcher.net
serv1swork.com
sp.popcash.net
sub.avgle.com
syndication.exdynsrv.com
www.google-analytics.com
www.googletagmanager.com
www.privatelink.de
www1.lustich.de
172.104.244.192
176.9.51.167
185.49.145.151
188.40.20.23
188.42.160.80
188.42.162.193
198.134.112.243
2606:4700:10::6814:3777
2606:4700:10::6814:802e
2a00:1450:4001:820::2008
2a00:1450:4001:820::200e
34.251.105.46
51.254.238.186
52.70.67.134
67.199.248.10
78.46.155.195
95.211.229.247
048e5a37626e7f8a7f6143b7137ad24b7ca543d692ec9a51934159982a8d909e
39fa7962bd01e6cd2c1912ea36d75ee56516d8563bb88360fad642861be648b4
4959088222ea53a6768325d7eb4583ce1f87d1ac7c7e1e276e102dbb171ac8db
7d0656e951eba0426dfd12b29abf9b4874f71d993b4b3fcde8f615e2c2ec32c2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8ca8dc09743d48fb7506abbfe82036964812a7e318ea9d525d7e39a8e9769e33
9103cd80a8f14222a8a13c83f44009fbc1196bf5ee0547aaaccb38b9438c023d
abd9155ac0fe0e62fdb9e2c1c333357cd33107972a57eff5224b0f3d0d2df316
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
d7637743e2d7530a5d83178ec2572eb76d2fc94aaa88257b1262e257eda6730a
ec4989cc11953414d314ef036075da7e6286cf5111559e371a6349265b144b06

de.popcorntimes.tv Open in urlscan Pro 51.254.238.186 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

24 %HTTPS

24 %IPv6

16 Domains

18 Subdomains

14 IPs

6 Countries

705 kBTransfer

1212 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

de.popcorntimes.tv Open in urlscan Pro
51.254.238.186 Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

24 %
HTTPS

24 %
IPv6

16
Domains

18
Subdomains

14
IPs

6
Countries

705 kB
Transfer

1212 kB
Size

5
Cookies

25 HTTP transactions
0 data transactions