ww25.rhgd.quicksslconnection.com Open in urlscan Pro
199.59.243.200 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://storage.googleapis.com/lohome/hopines.html#c16315sanLU35573Xshw10717Rub1258paxe1491
Effective URL:
http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Submission: On November 13 via api (November 13th 2021, 6:39:19 pm UTC) from BE — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 199.59.243.200, located in United States and belongs to AMAZON-02, US. The main domain is ww25.rhgd.quicksslconnection.com.

This is the only time ww25.rhgd.quicksslconnection.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:802::2010	15169 (GOOGLE) (GOOGLE)
1 2	62.210.107.9 62.210.107.9	12876 (Online SAS) (Online SAS)
1 1	34.120.100.155 34.120.100.155	15169 (GOOGLE) (GOOGLE)
1 1	70.32.1.32 70.32.1.32	32181 (ASN-GIGENET) (ASN-GIGENET)
5	199.59.243.200 199.59.243.200	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
8	4

1 2a00:1450:4001:802::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 62.210.107.9 (France) 1 redirects

ASN12876 (Online SAS, FR)
PTR: forcedfuscus.com

62.210.107.9	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.100.155 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 155.100.120.34.bc.googleusercontent.com

www.kkqlwn8trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.32.1.32 (Ashburn, United States) 1 redirects

ASN32181 (ASN-GIGENET, US)
PTR: ip-70.32.1.32.hosted.by.gigenet.com

rhgd.quicksslconnection.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 199.59.243.200 (United States)

ASN16509 (AMAZON-02, US)

ww25.rhgd.quicksslconnection.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	quicksslconnection.com 1 redirects rhgd.quicksslconnection.com ww25.rhgd.quicksslconnection.com	26 KB
1	google.com www.google.com
1	kkqlwn8trk.com 1 redirects www.kkqlwn8trk.com	280 B
1	googleapis.com storage.googleapis.com	822 B
8	4

	Domain	Requested by
5	ww25.rhgd.quicksslconnection.com	62.210.107.9 ww25.rhgd.quicksslconnection.com
1	www.google.com	ww25.rhgd.quicksslconnection.com
1	rhgd.quicksslconnection.com	1 redirects
1	www.kkqlwn8trk.com	1 redirects
1	storage.googleapis.com
8	5

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Frame ID: 8749A77E720ADB68FC0C069A128E6B95
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://storage.googleapis.com/lohome/hopines.html Page URL
http://62.210.107.9/rd/c16315sanLU35573Xshw10717Rub1258paxe1491 Page URL
http://62.210.107.9/track/c16315sanLU35573Xshw10717Rub1258paxe1491 HTTP 302
https://www.kkqlwn8trk.com/9ZM6TPS/2STK2S3/?sub1=16&sub2=1491-16315&sub3=35573-10717-1258 HTTP 302
https://rhgd.quicksslconnection.com/?__pcd=9 HTTP 302
http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686 Page URL

Page Statistics

8
Requests

25 %
HTTPS

33 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

27 kB
Transfer

75 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://storage.googleapis.com/lohome/hopines.html Page URL
http://62.210.107.9/rd/c16315sanLU35573Xshw10717Rub1258paxe1491 Page URL
http://62.210.107.9/track/c16315sanLU35573Xshw10717Rub1258paxe1491 HTTP 302
https://www.kkqlwn8trk.com/9ZM6TPS/2STK2S3/?sub1=16&sub2=1491-16315&sub3=35573-10717-1258 HTTP 302
https://rhgd.quicksslconnection.com/?__pcd=9 HTTP 302
http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 hopines.html Show response
storage.googleapis.com/lohome/ 247 B
822 B 2788ms
369ms Document
text/html 2a00:1450:4001:802::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/lohome/hopines.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: e66d2d234349041743bec1d6260ce3e325fbcad3a0124e0d97ecb6e764281296

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

x-guploader-uploadid: ADPycducSnBrs2g-ULHNDu3viDX4xPBlXGlLrOlsPvi0GM64p3Wi2hC3XtxloLlhczeMcklHPr7YhfcLaiIM6ylJW8k
expires: Sat, 13 Nov 2021 19:16:06 GMT
date: Sat, 13 Nov 2021 18:16:06 GMT
last-modified: Mon, 01 Nov 2021 09:05:38 GMT
etag: "a360f0fe557e63d80e2915fb0c7fe135"
x-goog-generation: 1635757538817387
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 247
content-type: text/html
x-goog-hash: crc32c=D2Dc3g== md5=o2Dw/lV+Y9gOKRX7DH/hNQ==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 247
server: UploadServer
age: 1386
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK c16315sanLU35573Xshw10717Rub1258paxe1491
62.210.107.9/rd/ 231 B
348 B 39ms
19ms Document
text/html 62.210.107.9
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: http://62.210.107.9/rd/c16315sanLU35573Xshw10717Rub1258paxe1491
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/lohome/hopines.html
Protocol: HTTP/1.1
Server: 62.210.107.9 , France, ASN12876 (Online SAS, FR),
Reverse DNS: forcedfuscus.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Content-Type: text/html; charset=utf-8
Date: Sat, 13 Nov 2021 18:39:12 GMT
Content-Length: 231

GET
H/1.1

200
OK

Primary Request / Show response
ww25.rhgd.quicksslconnection.com/
Redirect Chain

http://62.210.107.9/track/c16315sanLU35573Xshw10717Rub1258paxe1491
https://www.kkqlwn8trk.com/9ZM6TPS/2STK2S3/?sub1=16&sub2=1491-16315&sub3=35573-10717-1258
https://rhgd.quicksslconnection.com/?__pcd=9
http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686

2 KB
2 KB

282ms
180ms

Document
text/html

199.59.243.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Requested by: Host: 62.210.107.9
URL: http://62.210.107.9/rd/c16315sanLU35573Xshw10717Rub1258paxe1491
Protocol: HTTP/1.1
Server: 199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 297451a41217cb8ea23b0ec8d99ebf65a05ade189d8efd252f5f05a4c972219b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://62.210.107.9/rd/c16315sanLU35573Xshw10717Rub1258paxe1491

Response headers

Server: openresty
Date: Sat, 13 Nov 2021 18:39:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_mvbip0NyTeEAR9PF9HMM29r1DPcOSbunBBH+FV0QsVSYpL9m1C3VpKt1CHYRTKSGhughwtk19qnFfNL+2bTWJQ==
Cache-Control: no-cache no-store, must-revalidate post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Pragma: no-cache
Content-Encoding: gzip

Redirect headers

Date: Sat, 13 Nov 2021 18:39:13 GMT
Server: Apache/2.4.25 (Debian)
Location: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK parking.2.72.6.js Show response
ww25.rhgd.quicksslconnection.com/js/ 58 KB
19 KB 97ms
97ms Script
application/javascript 199.59.243.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ww25.rhgd.quicksslconnection.com/js/parking.2.72.6.js
Requested by: Host: ww25.rhgd.quicksslconnection.com
URL: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Protocol: HTTP/1.1
Server: 199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: ff99193cec587d152cbcc39019c81a27e015ea489d570e3994e707fd1fc479db

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 13 Nov 2021 18:39:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 12 Nov 2021 18:55:46 GMT
Server: openresty
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H/1.1 200
OK _fd Show response
ww25.rhgd.quicksslconnection.com/ 6 KB
3 KB 168ms
168ms Fetch
text/html 199.59.243.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ww25.rhgd.quicksslconnection.com/_fd?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Requested by: Host: ww25.rhgd.quicksslconnection.com
URL: http://ww25.rhgd.quicksslconnection.com/js/parking.2.72.6.js
Protocol: HTTP/1.1
Server: 199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: d4a5b75dad4c84f5bb9e8bab87202172a29e3fd3f45b91bc960a6150d7456f07

Request headers

Accept: application/json
Referer: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json

Response headers

X-Version: 2.72.6
Date: Sat, 13 Nov 2021 18:39:14 GMT
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 caf.js
www.google.com/adsense/domains/ 9 KB
0 1197ms
437ms Script
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/adsense/domains/caf.js

Requested by

Host: ww25.rhgd.quicksslconnection.com
URL: http://ww25.rhgd.quicksslconnection.com/js/parking.2.72.6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://ww25.rhgd.quicksslconnection.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 13 Nov 2021 18:39:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: clear
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "11300829884176005992"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
expires: Sat, 13 Nov 2021 18:39:15 GMT

GET
H/1.1 200
OK px.gif
ww25.rhgd.quicksslconnection.com/ 42 B
421 B 187ms
180ms Image
image/gif 199.59.243.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ww25.rhgd.quicksslconnection.com/px.gif?ch=1&rn=9.299309127429439
Requested by: Host: ww25.rhgd.quicksslconnection.com
URL: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Protocol: HTTP/1.1
Server: 199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 13 Nov 2021 18:39:14 GMT
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Server: openresty
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK px.gif
ww25.rhgd.quicksslconnection.com/ 42 B
421 B 186ms
179ms Image
image/gif 199.59.243.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ww25.rhgd.quicksslconnection.com/px.gif?ch=2&rn=9.299309127429439
Requested by: Host: ww25.rhgd.quicksslconnection.com
URL: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
Protocol: HTTP/1.1
Server: 199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://ww25.rhgd.quicksslconnection.com/?__pcd=9&subid1=20211114-0539-1346-aa1f-1d7ee829e686
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 13 Nov 2021 18:39:14 GMT
Last-Modified: Wed, 15 Sep 2021 19:38:30 GMT
Server: openresty
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.kkqlwn8trk.com/	1970-01-19 22:41:55	Name: uniqueClick_2STK2S3 Value: 3dc0e42f-0e73-4b5d-8aee-98bd8703419c:1636828753
rhgd.quicksslconnection.com/	1970-01-23 14:16:28	Name: __tad Value: 1636828753.2736311
ww25.rhgd.quicksslconnection.com/	1970-01-19 22:40:29	Name: parking_session Value: ef08d259-71ab-a516-89f3-a9d3bcbe4517

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rhgd.quicksslconnection.com
storage.googleapis.com
ww25.rhgd.quicksslconnection.com
www.google.com
www.kkqlwn8trk.com
199.59.243.200
2a00:1450:4001:802::2010
2a00:1450:4001:829::2004
34.120.100.155
62.210.107.9
70.32.1.32
297451a41217cb8ea23b0ec8d99ebf65a05ade189d8efd252f5f05a4c972219b
d4a5b75dad4c84f5bb9e8bab87202172a29e3fd3f45b91bc960a6150d7456f07
e66d2d234349041743bec1d6260ce3e325fbcad3a0124e0d97ecb6e764281296
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ff99193cec587d152cbcc39019c81a27e015ea489d570e3994e707fd1fc479db

ww25.rhgd.quicksslconnection.com Open in urlscan Pro 199.59.243.200 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

8 Requests

25 %HTTPS

33 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

27 kBTransfer

75 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

3 Cookies

Indicators

ww25.rhgd.quicksslconnection.com Open in urlscan Pro
199.59.243.200 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

25 %
HTTPS

33 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

27 kB
Transfer

75 kB
Size

3
Cookies

8 HTTP transactions
0 data transactions