Submitted URL: http://constintptr.com/1560200/
Effective URL: https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Submission: On September 19 via manual from CZ

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 7 HTTP transactions. The main IP is 35.201.127.73, located in Ann Arbor, United States and belongs to GOOGLE - Google LLC, US. The main domain is www.trafyield.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on November 16th 2017. Valid for: a year.
This is the only time www.trafyield.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 188.72.213.121 35415 (WEBZILLA)
1 18.185.153.255 16509 (AMAZON-02)
1 1 54.76.218.3 16509 (AMAZON-02)
2 185.49.145.177 35415 (WEBZILLA)
1 139.162.189.24 63949 (LINODE-AP...)
2 35.201.127.73 15169 (GOOGLE)
7 5
Apex Domain
Subdomains
Transfer
3 rtmark.net
my.rtmark.net
mt.rtmark.net
708 B
2 trafyield.com
www.trafyield.com
2 KB
2 constintptr.com
constintptr.com
8 KB
1 mediaonly.ru
mediaonly.ru
521 B
1 crwdcntrl.net
ad.crwdcntrl.net
312 B
7 5
Domain Requested by
2 www.trafyield.com mediaonly.ru
www.trafyield.com
2 mt.rtmark.net constintptr.com
2 constintptr.com 1 redirects
1 mediaonly.ru constintptr.com
1 ad.crwdcntrl.net 1 redirects
1 my.rtmark.net constintptr.com
7 6

This site contains no links.

Subject Issuer Validity Valid
www.trafyield.com
COMODO RSA Domain Validation Secure Server CA
2017-11-16 -
2018-11-16
a year crt.sh

This page contains 1 frames:

Frame: https://www.trafyield.com/jump/next.php?stamat=m%7C%2CQo2M-IjKqB1dAN0dEdHP3xP.3d4%2Cp8ncb1RcS0Hd64hoBR9op96haUe-xUG1SGQLKs_L0N05ABUa_ogtMv33YZIU51E8mNgm9JSMK8X8Q3S1MfW1FI_G-SYgN8Iks3wVNQUDCjA%2C&cbrandom=0.7604569021536642&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
Frame ID: ADF0819E23B35037C81512F174F26DAA
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://constintptr.com/1560200/ Page URL
  2. http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=19e2a2e90ba8bf79460f19be452c447c6602836955991740126&empt... HTTP 302
    http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1 Page URL
  3. https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

4
Countries

9 kB
Transfer

19 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://constintptr.com/1560200/ Page URL
  2. http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=19e2a2e90ba8bf79460f19be452c447c6602836955991740126&empty=0&uuid=831523a0-3168-4eb5-9b76-e2b5821009d5&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1560200&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fconstintptr.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1560200&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=dc7b837b3646edf9f9ca1a818a112ff4&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
    http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1 Page URL
  3. https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • http://ad.crwdcntrl.net/5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3D2625eef60bedf2eb04be882b8c0221b7%26sg%3D%24%7Baud_ids%7D HTTP 302
  • http://mt.rtmark.net/ltm.gif?id=2625eef60bedf2eb04be882b8c0221b7&sg=
Request Chain 4
  • http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=19e2a2e90ba8bf79460f19be452c447c6602836955991740126&empty=0&uuid=831523a0-3168-4eb5-9b76-e2b5821009d5&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=0&adparams=bm9qcz0w&ip=65a89d51a74c843ac913134976da73e8&zoneid=1560200&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=http%3A%2F%2Fconstintptr.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1560200&drf=&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&hil=undefined&id=dc7b837b3646edf9f9ca1a818a112ff4&co=1&rf=0&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&sf_type=1&timeout=0 HTTP 302
  • http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set /
constintptr.com/1560200/
14 KB
6 KB
Document
General
Full URL
http://constintptr.com/1560200/
Protocol
HTTP/1.1
Server
188.72.213.121 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
Software
nginx /
Resource Hash
5e884f095691bf5a4202eef7fafbeccdd60fd55f2357c07db05290fb2d00c0d3
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Host
constintptr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
ADF0819E23B35037C81512F174F26DAA

Response headers

Server
nginx
Date
Wed, 19 Sep 2018 07:39:38 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Timing-Allow-Origin
* *
Pragma
no-cache
Cache-Control
private, max-age=0, no-cache
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie
SeenToday=1; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/ OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/ oaidts=1537342778; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ OAID=2625eef60bedf2eb04be882b8c0221b7; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ OAID=2625eef60bedf2eb04be882b8c0221b7; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ exsdsf=1537342778 pbk3=19e2a2e90ba8bf79460f19be452c447c6602836955991740126; expires=Wed, 19-Sep-2018 07:49:38 GMT; Max-Age=600 ltm_afu=1; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/
X-FRAME-OPTIONS
DENY
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Encoding
gzip
Strict-Transport-Security
max-age=1
X-Content-Type-Options
nosniff
img.gif
my.rtmark.net/
43 B
278 B
Other
General
Full URL
http://my.rtmark.net/img.gif?f=merge&userId=2625eef60bedf2eb04be882b8c0221b7
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
18.185.153.255 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-185-153-255.eu-central-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Origin
http://constintptr.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Wed, 19 Sep 2018 07:39:38 GMT
Server
nginx/1.12.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
ltm.gif
mt.rtmark.net/
Redirect Chain
  • http://ad.crwdcntrl.net/5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3D2625eef60bedf2eb04be882b8c0221b7%26sg%3D%24%7Baud_ids%7D
  • http://mt.rtmark.net/ltm.gif?id=2625eef60bedf2eb04be882b8c0221b7&sg=
43 B
215 B
Other
General
Full URL
http://mt.rtmark.net/ltm.gif?id=2625eef60bedf2eb04be882b8c0221b7&sg=
Protocol
HTTP/1.1
Server
185.49.145.177 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
v-6-16-22-d6317-177.webazilla.com
Software
nginx /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 19 Sep 2018 07:39:38 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Wed, 19 Sep 2018 07:39:38 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
http://mt.rtmark.net/ltm.gif?id=2625eef60bedf2eb04be882b8c0221b7&sg=
Cache-Control
no-cache
X-Server
10.26.19.141
Connection
keep-alive
Content-Length
0
Expires
0
omr.gif
mt.rtmark.net/
43 B
215 B
Other
General
Full URL
http://mt.rtmark.net/omr.gif?s=afu&geo=DE&p=5%2C101&zoneid=1560200&oaid=2625eef60bedf2eb04be882b8c0221b7
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
185.49.145.177 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
v-6-16-22-d6317-177.webazilla.com
Software
nginx /
Resource Hash

Request headers

Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Origin
http://constintptr.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 19 Sep 2018 07:39:38 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
winmactraffergotoads.php
mediaonly.ru/
Redirect Chain
  • http://constintptr.com/?r=%2Fmb%2Fhan&pbk3=19e2a2e90ba8bf79460f19be452c447c6602836955991740126&empty=0&uuid=831523a0-3168-4eb5-9b76-e2b5821009d5&ad_scheme=1&rotation_type=3&ppucounter=0&first_visit...
  • http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
282 B
521 B
Document
General
Full URL
http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Requested by
Host: constintptr.com
URL: http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Protocol
HTTP/1.1
Server
139.162.189.24 Frankfurt, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1506-24.members.linode.com
Software
Apache /
Resource Hash

Request headers

Host
mediaonly.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
ADF0819E23B35037C81512F174F26DAA
Referer
http://constintptr.com/afu.php?zoneid=1407888&var=1560200

Response headers

Date
Wed, 19 Sep 2018 07:39:38 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Keep-Alive
timeout=5, max=100
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Server
nginx
Date
Wed, 19 Sep 2018 07:39:38 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Timing-Allow-Origin
* *
Pragma
no-cache
Cache-Control
private, max-age=0, no-cache
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie
65a89d51a74c843ac913134976da73e8=glTxofUqR-JxQEpKFR_6YXNIhpQ57jouQrc6df3B1hE; expires=Wed, 26-Sep-2018 07:39:38 GMT; Max-Age=604800 OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/ ppucnt=1; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/ ppucntstart=1537342778; expires=Thu, 20-Sep-2018 07:39:38 GMT; Max-Age=86400; path=/ allcnt=1; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ OAID=2625eef60bedf2eb04be882b8c0221b7; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ _OACCAP[1251542]=1; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ _OACBLOCK[1251542]=1537342778; expires=Fri, 19-Oct-2018 07:39:38 GMT; Max-Age=2592000; path=/ _OXCCLK[1251542]=1; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/ _OXPCLK[116508]=1; expires=Thu, 19-Sep-2019 07:39:38 GMT; Max-Age=31536000; path=/
P3P
CP="CUR ADM OUR NOR STA NID"
Location
http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Strict-Transport-Security
max-age=1
X-Content-Type-Options
nosniff
Primary Request next.php
www.trafyield.com/jump/
5 KB
2 KB
Document
General
Full URL
https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Requested by
Host: mediaonly.ru
URL: http://mediaonly.ru/winmactraffergotoads.php?zoneid=1560200&sf_type=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.127.73 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
73.127.201.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
83ad508fda74c1e103b48869ecbc1b343416d57ca5ced4f011f547130ccf2ed3

Request headers

:method
GET
:authority
www.trafyield.com
:scheme
https
:path
/jump/next.php?r=1930331&sub1===AMwIDM2UTM
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://mediaonly.ru/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
ADF0819E23B35037C81512F174F26DAA
Referer
http://mediaonly.ru/

Response headers

status
200
server
openresty
date
Wed, 19 Sep 2018 07:39:39 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
referrer-policy
no-referrer
link
<//www.trafyield.com>; rel=dns-prefetch,<//www.trafyield.com>; rel=preconnect
x-ua
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-encoding
gzip
via
1.1 google
alt-svc
clear
next.php
www.trafyield.com/jump/
0
0
Document
General
Full URL
https://www.trafyield.com/jump/next.php?stamat=m%7C%2CQo2M-IjKqB1dAN0dEdHP3xP.3d4%2Cp8ncb1RcS0Hd64hoBR9op96haUe-xUG1SGQLKs_L0N05ABUa_ogtMv33YZIU51E8mNgm9JSMK8X8Q3S1MfW1FI_G-SYgN8Iks3wVNQUDCjA%2C&cbrandom=0.7604569021536642&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
Requested by
Host: www.trafyield.com
URL: https://www.trafyield.com/jump/next.php?r=1930331&sub1===AMwIDM2UTM
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.127.73 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
73.127.201.35.bc.googleusercontent.com
Software
openresty /
Resource Hash

Request headers

:method
GET
:authority
www.trafyield.com
:scheme
https
:path
/jump/next.php?stamat=m%7C%2CQo2M-IjKqB1dAN0dEdHP3xP.3d4%2Cp8ncb1RcS0Hd64hoBR9op96haUe-xUG1SGQLKs_L0N05ABUa_ogtMv33YZIU51E8mNgm9JSMK8X8Q3S1MfW1FI_G-SYgN8Iks3wVNQUDCjA%2C&cbrandom=0.7604569021536642&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2Fmediaonly.ru%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
ADF0819E23B35037C81512F174F26DAA

Response headers

status
204
server
openresty
date
Wed, 19 Sep 2018 07:39:39 GMT
referrer-policy
no-referrer
vary
Accept-Encoding
x-ua
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
via
1.1 google
alt-svc
clear

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| inIframe function| checkDocumentBody function| documentAsyncWriteElementFromHtml undefined| ufp function| ReopenUrlBuilder function| preppopedRedirect

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff
X-Frame-Options DENY