urlscan.io logo urlscan.io
SecurityTrails logo

savings-galleria.com Open in urlscan Pro
45.33.12.116  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Effective URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Submission: On March 27 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 14 domains to perform 36 HTTP transactions. The main IP is 45.33.12.116, located in Dallas, United States and belongs to LINODE-AP Linode, LLC, US. The main domain is savings-galleria.com.
This is the only time savings-galleria.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
6 40.71.168.185 8075 (MICROSOFT...)
1 2a04:4e42::621 54113 (FASTLY)
1 192.0.78.27 2635 (AUTOMATTIC)
2 45.72.11.136 55286 (SERVER-MANIA)
1 1 52.59.80.8 16509 (AMAZON-02)
2 2 130.211.10.152 15169 (GOOGLE)
1 1 54.76.212.172 16509 (AMAZON-02)
3 45.33.12.116 63949 (LINODE-AP...)
1 205.185.208.52 20446 (HIGHWINDS3)
3 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
9 54.230.95.222 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
36 12
6    40.71.168.185 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
hancockregional.org.msgread-cv.online
1    2a04:4e42::621 (European Union)

ASN54113 (FASTLY - Fastly, US)
cdn.polyfill.io
1    192.0.78.27 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
href.li
2    45.72.11.136 (Buffalo, United States)

ASN55286 (SERVER-MANIA - B2 Net Solutions Inc., CA)
cliffzone.com
1    52.59.80.8 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-59-80-8.eu-central-1.compute.amazonaws.com
14536track.com
2    130.211.10.152 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 152.10.211.130.bc.googleusercontent.com
www.atrakr9.com
www.atrakr8.com
1    54.76.212.172 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-212-172.eu-west-1.compute.amazonaws.com
track.jvckk.com
3    45.33.12.116 (Dallas, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li966-116.members.linode.com
savings-galleria.com
1    205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com
3    2a00:1450:4001:814::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
2    2a00:1450:400c:c00::8a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
9    54.230.95.222 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-95-222.fra2.r.cloudfront.net
cdn.savings-galleria.com
7    2a00:1450:4001:809::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2a00:1450:400c:c0a::9b (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
Domain Requested by
9 cdn.savings-galleria.com savings-galleria.com
7 fonts.gstatic.com savings-galleria.com
6 hancockregional.org.msgread-cv.online hancockregional.org.msgread-cv.online
3 fonts.googleapis.com savings-galleria.com
3 savings-galleria.com cliffzone.com
savings-galleria.com
2 www.google-analytics.com 1 redirects savings-galleria.com
2 cliffzone.com href.li
cliffzone.com
1 stats.g.doubleclick.net savings-galleria.com
1 code.jquery.com savings-galleria.com
1 track.jvckk.com 1 redirects
1 www.atrakr8.com 1 redirects
1 www.atrakr9.com 1 redirects
1 14536track.com 1 redirects
1 href.li hancockregional.org.msgread-cv.online
1 cdn.polyfill.io hancockregional.org.msgread-cv.online
36 15

This site contains links to these domains. Also see Links.

Domain
www.functure.com
Subject Issuer Validity Valid
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-10-21 -
2019-04-27		 6 months crt.sh
tls.automattic.com
Let's Encrypt Authority X3		 2019-02-01 -
2019-05-02		 3 months crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Frame ID: 1C106948EAF2110771CB231AB2EAA3A2
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancoc... Page URL
  2. https://href.li/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4 Page URL
  3. http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4 Page URL
  4. http://14536track.com/path/lp.php?trvid=11835&trvx=9c354dd4&c1=NWMxYzc0MzYwZjkzYjhiNmY2YTY5MWY1Yjc... HTTP 302
    https://www.atrakr9.com/48HP5T/2TQJZ3/?sub1=%7Bc8%7D_201677&sub2=3k5p7vsaiaaf HTTP 302
    http://www.atrakr8.com/48HP5T/9K7SB2/?__po=38&__ptid=bcc0b600a8b44b509e178c382afde339&__cftoid=272T... HTTP 302
    http://track.jvckk.com/aff_c?offer_id=6225&aff_id=4155&aff_sub= HTTP 302
    http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

36
Requests

11 %
HTTPS

36 %
IPv6

14
Domains

15
Subdomains

12
IPs

4
Countries

905 kB
Transfer

1046 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg Page URL
  2. https://href.li/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4 Page URL
  3. http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4 Page URL
  4. http://14536track.com/path/lp.php?trvid=11835&trvx=9c354dd4&c1=NWMxYzc0MzYwZjkzYjhiNmY2YTY5MWY1YjcxZTVjNDI&t202kw=W10.US.KETOSSDL.CPA&c2=201677&c3={c3}&c4={c4}&c5={c5}&c6={c6}&c7={c7}&c8={c8}&c9={c9}&i={i) HTTP 302
    https://www.atrakr9.com/48HP5T/2TQJZ3/?sub1=%7Bc8%7D_201677&sub2=3k5p7vsaiaaf HTTP 302
    http://www.atrakr8.com/48HP5T/9K7SB2/?__po=38&__ptid=bcc0b600a8b44b509e178c382afde339&__cftoid=272TT4&sub1=%7Bc8%7D_201677&sub2=3k5p7vsaiaaf&sub3=&sub4=&sub5=&source_id= HTTP 302
    http://track.jvckk.com/aff_c?offer_id=6225&aff_id=4155&aff_sub= HTTP 302
    http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17
  • http://www.google-analytics.com/analytics.js HTTP 307
  • https://www.google-analytics.com/analytics.js
Request Chain 34
  • http://www.google-analytics.com/r/collect?v=1&_v=j73&a=446685892&t=pageview&_s=1&dl=http%3A%2F%2Fsavings-galleria.com%2Fhome%2Fb%2F%3Fio%3D1%26h%3D2%26agent_ID%3D4155%26campaign_ID%3D6225%26transaction_id%3D102e401b093af92f27a922746a4d8e&dr=http%3A%2F%2Fcliffzone.com%2Fclicks%3Fcid%3D23483%26pub%3D201677%26sid1%3D%26sid2%3D%26sid3%3D%26sid4&ul=en-us&de=UTF-8&dt=Choose%20a%20Category%20of%20Interest&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=844878089&gjid=1835513482&cid=1513328629.1553698708&tid=UA-57498108-1&_gid=585558424.1553698708&_r=1&z=705143980 HTTP 307
  • https://www.google-analytics.com/r/collect?v=1&_v=j73&a=446685892&t=pageview&_s=1&dl=http%3A%2F%2Fsavings-galleria.com%2Fhome%2Fb%2F%3Fio%3D1%26h%3D2%26agent_ID%3D4155%26campaign_ID%3D6225%26transaction_id%3D102e401b093af92f27a922746a4d8e&dr=http%3A%2F%2Fcliffzone.com%2Fclicks%3Fcid%3D23483%26pub%3D201677%26sid1%3D%26sid2%3D%26sid3%3D%26sid4&ul=en-us&de=UTF-8&dt=Choose%20a%20Category%20of%20Interest&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=844878089&gjid=1835513482&cid=1513328629.1553698708&tid=UA-57498108-1&_gid=585558424.1553698708&_r=1&z=705143980 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-57498108-1&cid=1513328629.1553698708&jid=844878089&_gid=585558424.1553698708&gjid=1835513482&_v=j73&z=705143980

36 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
fullmessage
hancockregional.org.msgread-cv.online/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
4e128ad54601308d32e3cc404ffffc35ace735a708806d34b50148b99c448138

Request headers

Host
hancockregional.org.msgread-cv.online
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
max-age=0
Content-Length
2876
Content-Type
text/html; charset=utf-8
Date
Wed, 27 Mar 2019 14:58:22 GMT
Last-Modified
Wed, 27 Mar 2019 09:06:19 GMT
main.c5f6a022.chunk.css
hancockregional.org.msgread-cv.online/static/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://hancockregional.org.msgread-cv.online/static/css/main.c5f6a022.chunk.css
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
4b0a710e2ac802677039fdb52acffee0d0251a6c0206e22895b11d258cb43edf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
hancockregional.org.msgread-cv.online
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Connection
keep-alive
Cache-Control
no-cache
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:22 GMT
Cache-Control
max-age=0
Last-Modified
Thu, 14 Mar 2019 07:43:03 GMT
Content-Length
2928
Content-Type
text/css; charset=utf-8
polyfill.min.js
cdn.polyfill.io/v2/ 		4 KB
997 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.polyfill.io/v2/polyfill.min.js?features=es6
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::621 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
e8af73fa4560eec175777bb3599db76a417328e8b6a2efecb9f6c1629c7dc67b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
age
686969
normalized-user-agent
chrome/67.0.0
detected-user-agent
Chrome/67.0.3396
status
200
date
Wed, 27 Mar 2019 14:58:22 GMT
request_came_from_shield
FRA
server-timing
HIT, fastly;desc="Edge time";dur=0, HIT, fastly;desc="Edge time";dur=1
content-length
926
referrer-policy
origin-when-cross-origin
etag
W/"39e-W9Ah0W2Rzzqjj5ilHv5XOdMbY9c"
vary
User-Agent, Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
1.9b2332fd.chunk.js
hancockregional.org.msgread-cv.online/static/js/ 		532 KB
532 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://hancockregional.org.msgread-cv.online/static/js/1.9b2332fd.chunk.js
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
80cc71b176624f959c839900a945e13fd32c3f3d8cc5117bc34a660cef819537

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
hancockregional.org.msgread-cv.online
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Connection
keep-alive
Cache-Control
no-cache
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:22 GMT
Cache-Control
max-age=0
Last-Modified
Thu, 14 Mar 2019 07:43:03 GMT
Content-Length
544754
Content-Type
application/javascript; charset=utf-8
main.d09a9aee.chunk.js
hancockregional.org.msgread-cv.online/static/js/ 		10 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://hancockregional.org.msgread-cv.online/static/js/main.d09a9aee.chunk.js
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
206e2a44f8b4a82443030ac92115a6ed50bf6d9f8a232e911cb373d1a7f7a32e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
hancockregional.org.msgread-cv.online
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Connection
keep-alive
Cache-Control
no-cache
Referer
http://hancockregional.org.msgread-cv.online/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:22 GMT
Cache-Control
max-age=0
Last-Modified
Thu, 14 Mar 2019 07:43:03 GMT
Content-Length
10068
Content-Type
application/javascript; charset=utf-8
fullmessage
hancockregional.org.msgread-cv.online/api/ 		522 B
646 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://hancockregional.org.msgread-cv.online/api/fullmessage?id=5c9b4f0240529f0001f69565&_dnOF4c=Wednesday&Mk9G9n6Rz7I=Hancockregional_k3sqUg
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/static/js/1.9b2332fd.chunk.js
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
hancockregional.org.msgread-cv.online
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
application/json, text/plain, */*
Referer
http://hancockregional.org.msgread-cv.online/
Connection
keep-alive
Cache-Control
no-cache
Accept
application/json, text/plain, */*
Referer
http://hancockregional.org.msgread-cv.online/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:23 GMT
Content-Length
522
Content-Type
application/json; charset=utf-8
5efb9851f33179ed77675cf1464b3079.png
hancockregional.org.msgread-cv.online/ 		12 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://hancockregional.org.msgread-cv.online/5efb9851f33179ed77675cf1464b3079.png
Protocol
HTTP/1.1
Server
40.71.168.185 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
hancockregional.org.msgread-cv.online
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://hancockregional.org.msgread-cv.online/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://hancockregional.org.msgread-cv.online/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:24 GMT
Cache-Control
max-age=0
Last-Modified
Wed, 27 Mar 2019 14:11:39 GMT
Content-Length
135559
Content-Type
image/png
/
href.li/ 		685 B
460 B 		Document
General
Check archive.org
Download Go to
Full URL
https://href.li/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Requested by
Host: hancockregional.org.msgread-cv.online
URL: http://hancockregional.org.msgread-cv.online/static/js/main.d09a9aee.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.27 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
href.li
:scheme
https
:path
/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://hancockregional.org.msgread-cv.online/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://hancockregional.org.msgread-cv.online/

Response headers

status
200
server
nginx
date
Wed, 27 Mar 2019 14:58:24 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=31536000
vary
Accept-Encoding
content-encoding
gzip
x-ac
3.fra _dca
/
href.li/ 		0
0
clicks
cliffzone.com/ 		113 KB
113 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Requested by
Host: href.li
URL: https://href.li/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Protocol
HTTP/1.1
Server
45.72.11.136 Buffalo, United States, ASN55286 (SERVER-MANIA - B2 Net Solutions Inc., CA),
Reverse DNS
Software
nginx /
Resource Hash
6b48fd4cb5c00e75144ca4f5073a466519c40850b3f85d129a42f8c4ec54c088

Request headers

Host
cliffzone.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx
Date
Wed, 27 Mar 2019 15:00:31 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
index.php
cliffzone.com/clicks/ 		292 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://cliffzone.com/clicks/index.php
Requested by
Host: cliffzone.com
URL: http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Protocol
HTTP/1.1
Server
45.72.11.136 Buffalo, United States, ASN55286 (SERVER-MANIA - B2 Net Solutions Inc., CA),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://cliffzone.com
Accept-Encoding
gzip, deflate
Host
cliffzone.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
application/x-www-form-urlencoded
Accept
*/*
Cache-Control
no-cache
Referer
http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Connection
keep-alive
Content-Length
530
Referer
http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Origin
http://cliffzone.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Wed, 27 Mar 2019 15:00:32 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request /
savings-galleria.com/home/b/
Redirect Chain
  • http://14536track.com/path/lp.php?trvid=11835&trvx=9c354dd4&c1=NWMxYzc0MzYwZjkzYjhiNmY2YTY5MWY1YjcxZTVjNDI&t202kw=W10.US.KETOSSDL.CPA&c2=201677&c3={c3}&c4={c4}&c5={c5}&c6={c6}&c7={c7}&c8={c8}&c9={c...
  • https://www.atrakr9.com/48HP5T/2TQJZ3/?sub1=%7Bc8%7D_201677&sub2=3k5p7vsaiaaf
  • http://www.atrakr8.com/48HP5T/9K7SB2/?__po=38&__ptid=bcc0b600a8b44b509e178c382afde339&__cftoid=272TT4&sub1=%7Bc8%7D_201677&sub2=3k5p7vsaiaaf&sub3=&sub4=&sub5=&source_id=
  • http://track.jvckk.com/aff_c?offer_id=6225&aff_id=4155&aff_sub=
  • http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
11 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Requested by
Host: cliffzone.com
URL: http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Protocol
HTTP/1.1
Server
45.33.12.116 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li966-116.members.linode.com
Software
Apache / PHP/5.5.9-1ubuntu4.19
Resource Hash
e2696b261c74bcff6186e79f7eabffeacde3f1d07037094bce7f10c417761043

Request headers

Host
savings-galleria.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4

Response headers

Date
Wed, 27 Mar 2019 14:33:49 GMT
Server
Apache
X-Powered-By
PHP/5.5.9-1ubuntu4.19
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
2021
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=iso-8859-1
Date
Wed, 27 Mar 2019 14:58:27 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Location
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
P3P
CP="NOI CUR OUR NOR INT"
Pragma
no-cache
Server
nginx/1.13.12
Set-Cookie
enc_aff_session_6225=ENC03f97b40eed0791c1d415d725b80b9cc20138f55e9c4e5a498759036bafffc018826584c35cc2ac01e078d8522b07820f8c7edd29accdf81fecaa3a1f57f54d384bc92ec281f2c8131240b0757e05d1606053c2e3d89dabdf0e245b869ee98521fcea891a95ffc887d7496bb083ccb84bb94dfb9e6968ae91ed4bec28a99d3d797fe7a85f6d974f6c482e5ae486af8a8724429315bde3c11d671c6efa695b3fda439e478d559e90f9954483b1ac4c0102bb3caddc535414994e10ebbac1fa57d08142b7d22; expires=Fri, 26 Apr 2019 14:58:27 GMT; path=/; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI2Ny4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzEzXzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS82Ny4wLjMzOTYuODcgU2FmYXJpLzUzNy4zNiIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==; expires=Sat, 19 Feb 2022 01:38:27 GMT; path=/;
tracking_id
102e401b093af92f27a922746a4d8e
X-Robots-Tag
noindex, nofollow
Content-Length
321
Connection
keep-alive
home.min.css
savings-galleria.com/assets/css/ 		38 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://savings-galleria.com/assets/css/home.min.css
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
45.33.12.116 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li966-116.members.linode.com
Software
Apache /
Resource Hash
ecc7ed52a5b011f5b9fe9074a7f5b83dcb43ebe50e73e8e698ff20698b345be0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:33:49 GMT
Content-Encoding
gzip
Last-Modified
Tue, 30 Oct 2018 18:24:12 GMT
Server
Apache
ETag
"992c-579764addb960-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
5157
bullet.png
savings-galleria.com/assets/img/home/other-offers/v2/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://savings-galleria.com/assets/img/home/other-offers/v2/bullet.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
45.33.12.116 Dallas, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li966-116.members.linode.com
Software
Apache /
Resource Hash
81bec84ccec2e8737f9c03e857f71ada3b457301eee5a16c51a707083304f9d7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:33:50 GMT
Last-Modified
Tue, 30 Oct 2018 18:24:12 GMT
Server
Apache
ETag
"508-579764adf5f40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1288
jquery-2.1.1.min.js
code.jquery.com/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://code.jquery.com/jquery-2.1.1.min.js
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip052.ssl.hwcdn.net
Software
nginx /
Resource Hash
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:27 GMT
Content-Encoding
gzip
Last-Modified
Fri, 24 Oct 2014 00:16:08 GMT
Server
nginx
ETag
W/"54499a48-14915"
Vary
Accept-Encoding
X-HW
1553698707.dop009.pa1.t,1553698707.cds028.pa1.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
29482
css
fonts.googleapis.com/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Montserrat:400,700
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e0aecf11fc2573785cdd6a856571786112da4dabebb6d42e3a3e0c1a1897f631
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:27 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Mar 2019 14:58:27 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Wed, 27 Mar 2019 14:58:27 GMT
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
b4fe297d2d5264988610c521459f8246baf7748f5d0c94c0af21e2c2a3af9591
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:27 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Mar 2019 14:58:27 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Wed, 27 Mar 2019 14:58:27 GMT
css
fonts.googleapis.com/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Oswald:400,700,300
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
57a4a9a0e59a064353998744a266ab25033d91f8e0eedbe4f7a6430e7c8f4ad0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 14:58:27 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Mar 2019 14:58:27 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Wed, 27 Mar 2019 14:58:27 GMT
analytics.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::8a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
6106
date
Wed, 27 Mar 2019 13:16:42 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Wed, 27 Mar 2019 15:16:42 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
home-logo.png
cdn.savings-galleria.com/global-redirects/assets/img/home/b/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/b/home-logo.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c8226316e965b18275f036029c56a27ee424ac54f347781b1e32253684c6f123

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 19 Nov 2017 02:36:01 GMT
Via
1.1 7a5407bd3564d5f8494603c5f2d0661f.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:08 GMT
Server
AmazonS3
Age
37142
ETag
"9cfbd5f06864c65696b896a92c3a5e0b"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2548
X-Amz-Cf-Id
2bdGaxqWoqJngUg1HdHC_y2UecdZBB20c5Z64UtG-O1vuWOXf3ISCw==
home-safe-secure.png
cdn.savings-galleria.com/global-redirects/assets/img/home/b/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/b/home-safe-secure.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9e860f881f88737a7b59c7818e791f1add809a003f747824675b0a0c62611392

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 27 Mar 2019 09:41:44 GMT
Via
1.1 8391f131e4acb30724947dab1f8592a5.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:09 GMT
Server
AmazonS3
Age
19005
ETag
"f4338a962226acab97ea0eb2aa1dfd40"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2255
X-Amz-Cf-Id
qAgAfzUoPVfMtsUk_ApwjerkjHFmoHeS5xnrDhWDsltocYbms0_BTQ==
bg_c.png
cdn.savings-galleria.com/global-redirects/assets/img/home/c/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/c/bg_c.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bcbebaffc97deb427a4cda5d102d61d1ee513a72c23ec8559b6cd0b02b2a486c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 26 Mar 2019 17:32:16 GMT
Via
1.1 d2625240b33e8b85b3cbea9bb40abb10.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:09 GMT
Server
AmazonS3
Age
77173
ETag
"2f2342deb9a7f02c9b12f0df87952de3"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33407
X-Amz-Cf-Id
1Mzv_bw4FUmcXa91p3DGz_QbKoi6OJhvYOXwt6bgstFcdKbHE170lQ==
work-from-home.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/work-from-home.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f1f6631d3f6d2241580063f12bec821dce698df67f27e94240fe0dc0429bef3e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 05 Oct 2018 14:54:32 GMT
Via
1.1 0437902e99783229e3317bb4dfe27240.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:15 GMT
Server
AmazonS3
Age
50244
ETag
"522f9176f4302df099de78da51cf81bd"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11619
X-Amz-Cf-Id
m-9sRv6BjXcke0TCjfQ1FhyN0nlnxZwGabqiPsPTDL7NLAnzauKxKg==
new-used-cars.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/new-used-cars.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2b2dd410a3ad69da71b94b6788e897c80b3927f0ccf5310623c172463c06a17b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 24 Mar 2019 00:53:44 GMT
Via
1.1 63c6fe97aba90610d2a46b7713c49586.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:14 GMT
Server
AmazonS3
Age
19005
ETag
"eb14f60b2234dc7927481b96828d7a6c"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10201
X-Amz-Cf-Id
AgW2e5-4sDRMnpXl37dEnm7IMyz7iyRLnaaXWHTs8oK_5evGtdZbnA==
auto-loans.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/auto-loans.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
354d05aa3ddb98452a777c5d0e068be606e88c8b24d478ffdc4b9b122f04a2ea

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 06 Dec 2017 13:22:28 GMT
Via
1.1 c1b77f069e81fd54b56ee92a790a3e9b.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:14 GMT
Server
AmazonS3
Age
10775
ETag
"773f6f473ee7dbe637a55d7a376a4562"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11577
X-Amz-Cf-Id
1SmRMZV3v-NT_C4h8zDnZjvTnRJ-j8rZA772YXYwjHZ9GIP7ZHvx-A==
extra-cash.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/extra-cash.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bede37cc79efce6f3f3fdacebfbec753140cee4817a74f5f3f2abd5d40be6cb6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 05 Oct 2018 14:54:32 GMT
Via
1.1 63c6fe97aba90610d2a46b7713c49586.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:14 GMT
Server
AmazonS3
Age
19005
ETag
"c7f63a036008eacc750c26ea4439a0fb"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10119
X-Amz-Cf-Id
_3it-68AzLp8L7mfQC1Her8N9H-0wctmpAlzibbXL5MPYeMYXRoKnA==
jobs.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/jobs.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
245d7830826644fd8ab3d77a2e514343fddf7a9d4e7d2fa51ef3fb87eeb10e61

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 05 Oct 2018 14:54:32 GMT
Via
1.1 c1b77f069e81fd54b56ee92a790a3e9b.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:15 GMT
Server
AmazonS3
Age
77172
ETag
"bcc5556327dbe216629eaca1cc442bd1"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12692
X-Amz-Cf-Id
ZKRjF0aC19TLS0ydBDDAJLlEfUgoRlCeHBZyWJYIoQZZ7TgWWhs8oQ==
singles.png
cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdn.savings-galleria.com/global-redirects/assets/img/home/other-offers/v2/singles.png
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
54.230.95.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
51688b0cb2919df919669d543bb72cc05ac5855b834d4718f5ae392a503cb0a6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdn.savings-galleria.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://savings-galleria.com/assets/css/home.min.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://savings-galleria.com/assets/css/home.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 05 Oct 2018 14:54:32 GMT
Via
1.1 0437902e99783229e3317bb4dfe27240.cloudfront.net (CloudFront)
Last-Modified
Wed, 27 Jul 2016 17:57:15 GMT
Server
AmazonS3
Age
32962
ETag
"749b2f521bc2f27b9f3642fa13146d57"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11362
X-Amz-Cf-Id
_oBLx_9X5-pG9R_qSkHq8D2HQUvPE7IxkoB5yh19Vq0GZ_6-EMZM_g==
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
http://savings-galleria.com

Response headers

Date
Mon, 25 Mar 2019 20:24:12 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 25 Mar 2019 20:10:29 GMT
Server
sffe
Age
153256
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9132
X-XSS-Protection
1; mode=block
Expires
Tue, 24 Mar 2020 20:24:12 GMT
TK3iWkUHHAIjg752GT8Gl-1PKw.woff2
fonts.gstatic.com/s/oswald/v16/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/oswald/v16/TK3iWkUHHAIjg752GT8Gl-1PKw.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Oswald:400,700,300
Origin
http://savings-galleria.com

Response headers

Date
Sat, 09 Mar 2019 03:07:18 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 07 Nov 2017 15:18:49 GMT
Server
sffe
Age
1597870
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9324
X-XSS-Protection
1; mode=block
Expires
Sun, 08 Mar 2020 03:07:18 GMT
TK3hWkUHHAIjg75-ohoTus9CAZek1w.woff2
fonts.gstatic.com/s/oswald/v16/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/oswald/v16/TK3hWkUHHAIjg75-ohoTus9CAZek1w.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
19e1c4c97917724cacf9f2e3c544ed0925a14ef28a79565b7bae38fc70ac82f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Oswald:400,700,300
Origin
http://savings-galleria.com

Response headers

Date
Fri, 08 Mar 2019 23:31:51 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 07 Nov 2017 15:19:11 GMT
Server
sffe
Age
1610797
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9644
X-XSS-Protection
1; mode=block
Expires
Sat, 07 Mar 2020 23:31:51 GMT
JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v13/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/montserrat/v13/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Montserrat:400,700
Origin
http://savings-galleria.com

Response headers

Date
Mon, 25 Mar 2019 20:29:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 25 Mar 2019 20:07:24 GMT
Server
sffe
Age
152934
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13612
X-XSS-Protection
1; mode=block
Expires
Tue, 24 Mar 2020 20:29:34 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v16/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
http://savings-galleria.com

Response headers

Date
Mon, 25 Mar 2019 20:25:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 25 Mar 2019 20:12:28 GMT
Server
sffe
Age
153162
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9080
X-XSS-Protection
1; mode=block
Expires
Tue, 24 Mar 2020 20:25:46 GMT
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v13/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/montserrat/v13/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Montserrat:400,700
Origin
http://savings-galleria.com

Response headers

Date
Mon, 25 Mar 2019 20:29:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 25 Mar 2019 20:05:58 GMT
Server
sffe
Age
152934
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13708
X-XSS-Protection
1; mode=block
Expires
Tue, 24 Mar 2020 20:29:34 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v16/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
http://savings-galleria.com

Response headers

Date
Mon, 25 Mar 2019 20:28:35 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 25 Mar 2019 20:11:39 GMT
Server
sffe
Age
152993
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9180
X-XSS-Protection
1; mode=block
Expires
Tue, 24 Mar 2020 20:28:35 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • http://www.google-analytics.com/r/collect?v=1&_v=j73&a=446685892&t=pageview&_s=1&dl=http%3A%2F%2Fsavings-galleria.com%2Fhome%2Fb%2F%3Fio%3D1%26h%3D2%26agent_ID%3D4155%26campaign_ID%3D6225%26transac...
  • https://www.google-analytics.com/r/collect?v=1&_v=j73&a=446685892&t=pageview&_s=1&dl=http%3A%2F%2Fsavings-galleria.com%2Fhome%2Fb%2F%3Fio%3D1%26h%3D2%26agent_ID%3D4155%26campaign_ID%3D6225%26transa...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-57498108-1&cid=1513328629.1553698708&jid=844878089&_gid=585558424.1553698708&gjid=1835513482&_v=j73&z=705143980
35 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-57498108-1&cid=1513328629.1553698708&jid=844878089&_gid=585558424.1553698708&gjid=1835513482&_v=j73&z=705143980
Requested by
Host: savings-galleria.com
URL: http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://savings-galleria.com/home/b/?io=1&h=2&agent_ID=4155&campaign_ID=6225&transaction_id=102e401b093af92f27a922746a4d8e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
date
Wed, 27 Mar 2019 14:58:28 GMT
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 27 Mar 2019 14:58:28 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-57498108-1&cid=1513328629.1553698708&jid=844878089&_gid=585558424.1553698708&gjid=1835513482&_v=j73&z=705143980
content-type
text/html; charset=UTF-8
status
302
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
417
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
href.li
URL
https://href.li/?http://cliffzone.com/clicks?cid=23483&pub=201677&sid1=&sid2=&sid3=&sid4

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.savings-galleria.com/ Name: _gat
Value: 1
.savings-galleria.com/ Name: _gid
Value: GA1.2.585558424.1553698708
.savings-galleria.com/ Name: _ga
Value: GA1.2.1513328629.1553698708

2 Console Messages

Source Level URL
Text
console-api log URL: http://hancockregional.org.msgread-cv.online/static/js/main.d09a9aee.chunk.js(Line 1)
Message:
-> r n scr
console-api log URL: http://hancockregional.org.msgread-cv.online/static/js/main.d09a9aee.chunk.js(Line 1)
Message:
-> r n scr

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

14536track.com
cdn.polyfill.io
cdn.savings-galleria.com
cliffzone.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
hancockregional.org.msgread-cv.online
href.li
savings-galleria.com
stats.g.doubleclick.net
track.jvckk.com
www.atrakr8.com
www.atrakr9.com
www.google-analytics.com
href.li
130.211.10.152
192.0.78.27
205.185.208.52
2a00:1450:4001:809::2003
2a00:1450:4001:814::200a
2a00:1450:400c:c00::8a
2a00:1450:400c:c0a::9b
2a04:4e42::621
40.71.168.185
45.33.12.116
45.72.11.136
52.59.80.8
54.230.95.222
54.76.212.172
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
19e1c4c97917724cacf9f2e3c544ed0925a14ef28a79565b7bae38fc70ac82f2
206e2a44f8b4a82443030ac92115a6ed50bf6d9f8a232e911cb373d1a7f7a32e
245d7830826644fd8ab3d77a2e514343fddf7a9d4e7d2fa51ef3fb87eeb10e61
2b2dd410a3ad69da71b94b6788e897c80b3927f0ccf5310623c172463c06a17b
354d05aa3ddb98452a777c5d0e068be606e88c8b24d478ffdc4b9b122f04a2ea
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4b0a710e2ac802677039fdb52acffee0d0251a6c0206e22895b11d258cb43edf
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
4e128ad54601308d32e3cc404ffffc35ace735a708806d34b50148b99c448138
51688b0cb2919df919669d543bb72cc05ac5855b834d4718f5ae392a503cb0a6
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
57a4a9a0e59a064353998744a266ab25033d91f8e0eedbe4f7a6430e7c8f4ad0
6b48fd4cb5c00e75144ca4f5073a466519c40850b3f85d129a42f8c4ec54c088
80cc71b176624f959c839900a945e13fd32c3f3d8cc5117bc34a660cef819537
81bec84ccec2e8737f9c03e857f71ada3b457301eee5a16c51a707083304f9d7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
9e860f881f88737a7b59c7818e791f1add809a003f747824675b0a0c62611392
a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
b4fe297d2d5264988610c521459f8246baf7748f5d0c94c0af21e2c2a3af9591
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bcbebaffc97deb427a4cda5d102d61d1ee513a72c23ec8559b6cd0b02b2a486c
bede37cc79efce6f3f3fdacebfbec753140cee4817a74f5f3f2abd5d40be6cb6
c8226316e965b18275f036029c56a27ee424ac54f347781b1e32253684c6f123
e0aecf11fc2573785cdd6a856571786112da4dabebb6d42e3a3e0c1a1897f631
e2696b261c74bcff6186e79f7eabffeacde3f1d07037094bce7f10c417761043
e8af73fa4560eec175777bb3599db76a417328e8b6a2efecb9f6c1629c7dc67b
ecc7ed52a5b011f5b9fe9074a7f5b83dcb43ebe50e73e8e698ff20698b345be0
f1f6631d3f6d2241580063f12bec821dce698df67f27e94240fe0dc0429bef3e