a.realsrv.com Open in urlscan Pro
2a02:6ea0:c700::11 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://brostraffic.com/51.html
Effective URL:
https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250
Submission: On January 14 via api (January 14th 2024, 6:33:40 am UTC) from LU — Scanned from NL

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a02:6ea0:c700::11, located in Frankfurt am Main, Germany and belongs to CDN77 ^_^, GB. The main domain is a.realsrv.com. The Cisco Umbrella rank of the primary domain is 39553.
TLS certificate: Issued by R3 on December 18th 2023. Valid for: 3 months.

This is the only time a.realsrv.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	109.206.161.73 109.206.161.73	50245 (SERVEREL-AS) (SERVEREL-AS)
5	2a02:6ea0:c70... 2a02:6ea0:c700::11	60068 (CDN77 ^_^) (CDN77 ^_^)
1	95.211.229.247 95.211.229.247	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
2	109.206.161.83 109.206.161.83	50245 (SERVEREL-AS) (SERVEREL-AS)
8	3

1 109.206.161.73 (Amsterdam, Netherlands) 1 redirects

ASN50245 (SERVEREL-AS, US)
PTR: 73.161.serverel.net

brostraffic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6ea0:c700::11 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

a.realsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.211.229.247 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

syndication.realsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 109.206.161.83 (Amsterdam, Netherlands)

ASN50245 (SERVEREL-AS, US)

www.gangstacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	realsrv.com a.realsrv.com — Cisco Umbrella Rank: 39553 syndication.realsrv.com — Cisco Umbrella Rank: 32888	39 KB
2	gangstacdn.com www.gangstacdn.com	5 KB
1	brostraffic.com 1 redirects brostraffic.com	371 B
8	3

	Domain	Requested by
5	a.realsrv.com	a.realsrv.com
2	www.gangstacdn.com	a.realsrv.com www.gangstacdn.com
1	syndication.realsrv.com	a.realsrv.com
1	brostraffic.com	1 redirects
8	4

This site contains no links.

Subject Issuer	Validity	Valid
realsrv.com R3	`2023-12-18` - `2024-03-17`	3 months	crt.sh
cdn.gangstacdn.com R3	`2023-11-21` - `2024-02-19`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250
Frame ID: 8C5BF9EE2E16B9F6B568FB65EE9580A0
Requests: 6 HTTP requests in this frame

Frame: https://www.gangstacdn.com/new/lq/thelq.php
Frame ID: 64DB134A923CDA7B2CF19A1CAFEBEB12
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://brostraffic.com/51.html HTTP 302
https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

44 kB
Transfer

130 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://brostraffic.com/51.html HTTP 302
https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request iframe.php Show response a.realsrv.com/ Redirect Chain http://brostraffic.com/51.html https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250	277 B 593 B	76ms 20ms	Document text/html	2a02:6ea0:c700::11 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `8af2d0f700749b704de821c9519bb898cc5f9f94208883de74d3e5f8615e7bad` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b accept-language nl-NL,nl;q=0.9 Response headers accept-ch access-control-allow-origin * cache-control max-age=10800 content-encoding gzip content-type text/html; charset=UTF-8 date Sun, 14 Jan 2024 06:33:26 GMT expires Sun, 14 Jan 2024 07:29:24 GMT server CDN77-Turbo vary Accept-Encoding x-77-age 7442 x-77-cache HIT x-77-nzt EgwBw7WvJwH3Bh0AAAwBJRPCLgH3DAAAAA x-77-nzt-ray 25b02131b438942e3680a36517710d2b x-77-pop frankfurtDE x-accel-date 1705206576 x-accel-expires @1705217364 x-age-lb 7430 x-cache-lb HIT x-robots-tag noindex, follow Redirect headers Connection keep-alive Content-Length 313 Content-Type text/html; charset=iso-8859-1 Date Sun, 14 Jan 2024 06:33:26 GMT Location https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Server nginx
GET H2	200	build-iframe-js-url.js Show response a.realsrv.com/	760 B 1002 B	20ms 20ms	Script application/javascript	2a02:6ea0:c700::11 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/build-iframe-js-url.js?idzone=5031910 Requested by Host: a.realsrv.com URL: https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `bc09c5f6e0e1a2a19e1dd40aa256f974fe68f69835a42453bcbbeff31241d782` Request headers accept-language nl-NL,nl;q=0.9 Referer https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Response headers x-77-pop frankfurtDE date Sun, 14 Jan 2024 06:33:26 GMT content-encoding gzip x-age-lb 2360 x-77-cache HIT x-accel-date 1705211646 x-77-nzt EgwBw7WvJwH3OAkAAAwBnJIhHwH3kwAAAA x-accel-expires @1705222417 x-77-age 2507 x-cache-lb HIT accept-ch Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version server CDN77-Turbo etag W/"98a269e6dd88d709e30e41e7c76" x-77-nzt-ray 25b02131b438942e3680a36500ca682c vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=10800 x-robots-tag noindex, follow expires Thu, 11 Jan 2024 14:53:11 GMT
GET H2	200	ad-provider.js Show response a.realsrv.com/	121 KB 33 KB	28ms 28ms	Script application/javascript	2a02:6ea0:c700::11 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/ad-provider.js Requested by Host: a.realsrv.com URL: https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `4d87ff3cd1e3a454f2755c9c1ac91e634245cbb7b75cbc41735a8f95ec7cb913` Request headers accept-language nl-NL,nl;q=0.9 Referer https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Response headers x-77-pop frankfurtDE date Sun, 14 Jan 2024 06:33:26 GMT content-encoding gzip x-age-lb 2400 x-77-cache HIT x-accel-date 1705211606 x-77-nzt EgwBw7WvJwH3YAkAAAwBnJIhHwH3CgAAAA x-accel-expires @1705222406 x-77-age 2410 x-cache-lb HIT accept-ch server CDN77-Turbo etag W/"9252d534220fbfdb57517c15a8a" x-77-nzt-ray 25b02131b438942e3680a36502686e2c vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=10800 x-robots-tag noindex, follow expires Thu, 11 Jan 2024 14:53:04 GMT
GET H2	200	iframe.js Show response a.realsrv.com/	2 KB 2 KB	24ms 24ms	Script application/javascript	2a02:6ea0:c700::11 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/iframe.js?idzone=5031910&size=300x250 Requested by Host: a.realsrv.com URL: https://a.realsrv.com/build-iframe-js-url.js?idzone=5031910 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `1bef5e3b2077f5a4f1cd243366ee815b83211fdbb31466de0c6e6f6e7cd1d8fc` Request headers accept-language nl-NL,nl;q=0.9 Referer https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Response headers x-77-pop frankfurtDE date Sun, 14 Jan 2024 06:33:26 GMT content-encoding gzip x-age-lb 2360 x-77-cache HIT x-accel-date 1705211646 x-77-nzt EgwBw7WvJwH3OAkAAAwBnJIhJwH3rgAAAA x-accel-expires @1705222415 x-77-age 2534 x-cache-lb HIT accept-ch Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version server CDN77-Turbo etag W/"f16606da826ce198c5a52d82be5" x-77-nzt-ray 25b02131b438942e3680a3653d58b32d vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=10800 x-robots-tag noindex, follow expires Thu, 11 Jan 2024 14:53:11 GMT
POST H/1.1	200 OK	api.php Show response syndication.realsrv.com/v1/	495 B 1 KB	84ms 53ms	XHR application/json	95.211.229.247 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://syndication.realsrv.com/v1/api.php Requested by Host: a.realsrv.com URL: https://a.realsrv.com/ad-provider.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.211.229.247 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS Software nginx / Resource Hash `4ea7378692c40faa1529f604945487bdc7423a71ed22cc445addd0d6c17a1875` Request headers Referer https://a.realsrv.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Content-Type text/plain Response headers Date Sun, 14 Jan 2024 06:33:26 GMT Access-Control-Request-Method POST Content-Encoding gzip Server nginx Accept-CH Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version Transfer-Encoding chunked Content-Type application/json Access-Control-Allow-Origin https://a.realsrv.com Access-Control-Allow-Credentials true Connection keep-alive X-Robots-Tag noindex, follow Access-Control-Allow-Headers Authorization, Content-Type
GET H/1.1	200 OK	thelq.php Show response www.gangstacdn.com/new/lq/ Frame 64DB	321 B 522 B	72ms 13ms	Document text/html	109.206.161.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Full URL https://www.gangstacdn.com/new/lq/thelq.php Requested by Host: a.realsrv.com URL: https://a.realsrv.com/ad-provider.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.206.161.83 Amsterdam, Netherlands, ASN50245 (SERVEREL-AS, US), Reverse DNS Software nginx / PHP/5.6.31 Resource Hash `a752a5c00b253c50e48b71c69e5f027922c9fcf3ace288504f58d8b56d0203aa` Request headers Referer https://a.realsrv.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b accept-language nl-NL,nl;q=0.9 Response headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Sun, 14 Jan 2024 06:33:26 GMT Server nginx Transfer-Encoding chunked X-Powered-By PHP/5.6.31
GET H2	404	undefined Show response a.realsrv.com/	548 B 930 B	20ms 20ms	XHR text/html	2a02:6ea0:c700::11 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/undefined Requested by Host: a.realsrv.com URL: https://a.realsrv.com/ad-provider.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090` Request headers accept-language nl-NL,nl;q=0.9 Referer https://a.realsrv.com/iframe.php?idzone=5031910&size=300x250 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Response headers x-77-nzt EgwBw7WvJwH3LwAAAAwBisclxAH3AAAAAA x-accel-expires @1705214019 date Sun, 14 Jan 2024 06:33:26 GMT x-cache-lb HIT x-77-age 47 x-age-lb 47 accept-ch Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version server CDN77-Turbo x-77-pop frankfurtDE x-77-nzt-ray 25b02131b438942e3680a365e4b87a35 x-77-cache HIT content-type text/html x-accel-date 1705213959 content-length 548
GET H/1.1	200 OK	11.gif www.gangstacdn.com/new/lq/ Frame 64DB	4 KB 5 KB	13ms 13ms	Image image/gif	109.206.161.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.gangstacdn.com/new/lq/11.gif Requested by Host: www.gangstacdn.com URL: https://www.gangstacdn.com/new/lq/thelq.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.206.161.83 Amsterdam, Netherlands, ASN50245 (SERVEREL-AS, US), Reverse DNS Software nginx / Resource Hash `ce916e5f63d7d0a5a32369cade46882d8a60d05e93e9a322d326a4406e6e969a` Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.gangstacdn.com/new/lq/thelq.php User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b Response headers Date Sun, 14 Jan 2024 06:33:26 GMT Last-Modified Thu, 07 Apr 2016 07:02:13 GMT Server nginx ETag "570605f5-116f" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 4463

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.brostraffic.com/	1970-01-21 02:25:50	Name: jdvsl Value: wrwcADUxAAIABwA2gKNl__82gKNlQAABAAAANoCjZQA-
			.realsrv.com/	1970-01-21 03:16:14	Name: __uvt Value: a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265a38036ca0af6.51697236466449274%22%3B%7D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://a.realsrv.com/ad-provider.js(Line 3) Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://a.realsrv.com/undefined Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.realsrv.com
brostraffic.com
syndication.realsrv.com
www.gangstacdn.com
109.206.161.73
109.206.161.83
2a02:6ea0:c700::11
95.211.229.247
1bef5e3b2077f5a4f1cd243366ee815b83211fdbb31466de0c6e6f6e7cd1d8fc
4d87ff3cd1e3a454f2755c9c1ac91e634245cbb7b75cbc41735a8f95ec7cb913
4ea7378692c40faa1529f604945487bdc7423a71ed22cc445addd0d6c17a1875
8af2d0f700749b704de821c9519bb898cc5f9f94208883de74d3e5f8615e7bad
a752a5c00b253c50e48b71c69e5f027922c9fcf3ace288504f58d8b56d0203aa
bc09c5f6e0e1a2a19e1dd40aa256f974fe68f69835a42453bcbbeff31241d782
ce916e5f63d7d0a5a32369cade46882d8a60d05e93e9a322d326a4406e6e969a
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

a.realsrv.com Open in urlscan Pro 2a02:6ea0:c700::11 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

25 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

44 kBTransfer

130 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

a.realsrv.com Open in urlscan Pro
2a02:6ea0:c700::11 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

44 kB
Transfer

130 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions