1t.click Open in urlscan Pro
2606:4700:3031::681b:a7a2  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://yth99.net/ Page URL
2. https://www.ddos4.com:3601/?u=http://yth99.net/ Page URL
3. http://206sss.com/ Page URL
4. http://1t.click/asAM Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response yth99.net/	372 B 501 B	970ms 176ms	Document text/html	23.224.106.30 CNSERVERS LLC
General Check archive.org Show headers Download Go to Full URL http://yth99.net/ Protocol HTTP/1.1 Server 23.224.106.30 Los Angeles, United States, ASN40065 (CNSERVERS - CNSERVERS LLC, US), Reverse DNS Software / Resource Hash 8473e4001a174dbba060ca3d3658c5dbea99cd374981cb7bd7953d70a8127292 Request headers Host yth99.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Connection close Cache-Control max-age=259200 Content-Type text/html;charset=utf-8 Content-Length 372
GET H/1.1	403 Forbidden	/ Show response www.ddos4.com/	800 B 759 B	841ms 187ms	Document text/html	156.238.187.72 Internet Keeper G...
General Check archive.org Show headers Download Go to Full URL https://www.ddos4.com:3601/?u=http://yth99.net/ Requested by Host: yth99.net URL: http://yth99.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 156.238.187.72 , United States, ASN26484 (IKGUL-26484 - Internet Keeper Global, US), Reverse DNS Software ONEX / Resource Hash fe5144f77808e2572e8c04a4e9077594f12350c50f355a360e6db84f5ea34c44 Request headers Host www.ddos4.com:3601 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer http://yth99.net/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer http://yth99.net/ Response headers Server ONEX Date Fri, 17 Jan 2020 12:33:48 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Cache-Contro private Content-Encoding gzip
GET H/1.1	200 OK	/ Show response 206sss.com/	161 B 391 B	529ms 502ms	Document text/html	43.255.158.95 FHNC-HK Speed Net...
General Check archive.org Show headers Download Go to Full URL http://206sss.com/ Requested by Host: www.ddos4.com URL: https://www.ddos4.com:3601/?u=http://yth99.net/ Protocol HTTP/1.1 Server 43.255.158.95 , Hong Kong, ASN58985 (FHNC-HK Speed Network (Hong Kong) Ltd., HK), Reverse DNS Software nginx / Resource Hash e2d98d2536fc60d810022b1338ee2da0eb974d8075700655183f3fe85fc1fb12 Request headers Host 206sss.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Server nginx Date Fri, 17 Jan 2020 12:28:33 GMT Content-Type text/html Content-Length 161 Last-Modified Sat, 21 Sep 2019 06:18:45 GMT Connection keep-alive ETag "5d85c0c5-a1" Accept-Ranges bytes
GET H/1.1	200 OK	Primary Request Cookie set asAM Show response 1t.click/	3 KB 2 KB	382ms 26ms	Document text/html	2606:4700:3031::681b:a7a2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://1t.click/asAM Protocol HTTP/1.1 Server 2606:4700:3031::681b:a7a2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / ASP.NET Resource Hash f3a87d252a4f48ef748c36200c36118181596d422c8ebee14856f360770627a4 Request headers Host 1t.click Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Referer http://206sss.com/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer http://206sss.com/ Response headers Date Fri, 17 Jan 2020 12:34:38 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d4ecb083125ac3c4ac1bdabc199f4cfe91579264478; expires=Sun, 16-Feb-20 12:34:38 GMT; path=/; domain=.1t.click; HttpOnly; SameSite=Lax X-Powered-By ASP.NET X-Powered-By-Z KS4C2 Cache-Control max-age=43200 CF-Cache-Status HIT Age 2785 Vary Accept-Encoding Server cloudflare CF-RAY 55685d4c590c6455-FRA Content-Encoding gzip
GET H/1.1	200 OK	bootstrap-3.3.4.min.css 1t.click/css/	115 KB 19 KB	16ms 16ms	Stylesheet text/css	2606:4700:3031::681b:a7a2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://1t.click/css/bootstrap-3.3.4.min.css Requested by Host: 1t.click URL: http://1t.click/asAM Protocol HTTP/1.1 Server 2606:4700:3031::681b:a7a2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / ASP.NET Resource Hash f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5 Request headers Referer http://1t.click/asAM User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Fri, 17 Jan 2020 12:34:38 GMT Content-Encoding gzip ETag W/"5d1b804b-1ca39" CF-Cache-Status HIT Last-Modified Tue, 02 Jul 2019 16:03:23 GMT Server cloudflare Age 5081 X-Powered-By-Z KS4C2 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive CF-RAY 55685d4d19cc6455-FRA

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1t.click
206sss.com
www.ddos4.com
yth99.net
156.238.187.72
23.224.106.30
2606:4700:3031::681b:a7a2
43.255.158.95
8473e4001a174dbba060ca3d3658c5dbea99cd374981cb7bd7953d70a8127292
e2d98d2536fc60d810022b1338ee2da0eb974d8075700655183f3fe85fc1fb12
f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5
f3a87d252a4f48ef748c36200c36118181596d422c8ebee14856f360770627a4
fe5144f77808e2572e8c04a4e9077594f12350c50f355a360e6db84f5ea34c44