click.alibaba.com Open in urlscan Pro
198.11.132.198 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://spykemedia.go2cloud.org/aff_c?offer_id=113926&aff_id=4031&ios_ifa=00000000-0000-0000-0000-000000000000&aff_sub=new_06cc1...
Effective URL:
https://click.alibaba.com/core/index.htm
Submission: On April 28 via manual (April 28th 2018, 1:48:54 am UTC) from US

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 9 domains to perform 6 HTTP transactions. The main IP is 198.11.132.198, located in San Mateo, United States and belongs to CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN. The main domain is click.alibaba.com.
TLS certificate: Issued by GlobalSign Organization Validation CA... on March 27th 2018. Valid for: 7 months.

This is the only time click.alibaba.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.208.190.55 52.208.190.55	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	35.164.214.196 35.164.214.196	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	52.44.170.144 52.44.170.144	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	52.3.138.38 52.3.138.38	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	34.206.235.182 34.206.235.182	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	188.42.162.193 188.42.162.193	35415 (WEBZILLA) (WEBZILLA)
1	18.195.197.187 18.195.197.187	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	52.48.217.7 52.48.217.7	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	185.49.145.177 185.49.145.177	35415 (WEBZILLA) (WEBZILLA)
1 2	198.11.132.198 198.11.132.198	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co.)
6	5

1 52.208.190.55 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-208-190-55.eu-west-1.compute.amazonaws.com

spykemedia.go2cloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.164.214.196 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-164-214-196.us-west-2.compute.amazonaws.com

newsbuzz.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.44.170.144 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-44-170-144.compute-1.amazonaws.com

sax.peakonspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.138.38 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-3-138-38.compute-1.amazonaws.com

sjs.perfonspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.235.182 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-206-235-182.compute-1.amazonaws.com

goto.peak-serving.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.42.162.193 (Luxembourg) 1 redirects

ASN35415 (WEBZILLA, NL)

bestadbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.197.187 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-197-187.eu-central-1.compute.amazonaws.com

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.217.7 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-48-217-7.eu-west-1.compute.amazonaws.com

ad.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.49.145.177 (Netherlands)

ASN35415 (WEBZILLA, NL)
PTR: v-6-16-22-d6317-177.webazilla.com

mt.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.11.132.198 (San Mateo, United States) 1 redirects

ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN)

click.alibaba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	rtmark.net my.rtmark.net mt.rtmark.net	708 B
2	alibaba.com 1 redirects click.alibaba.com	2 KB
2	bestadbid.com 1 redirects bestadbid.com	7 KB
2	peakonspot.com 1 redirects sax.peakonspot.com	7 KB
1	crwdcntrl.net 1 redirects ad.crwdcntrl.net	312 B
1	peak-serving.com 1 redirects goto.peak-serving.com	751 B
1	perfonspot.com 1 redirects sjs.perfonspot.com	463 B
1	newsbuzz.tv 1 redirects newsbuzz.tv	327 B
1	go2cloud.org 1 redirects spykemedia.go2cloud.org	460 B
6	9

	Domain	Requested by
2	click.alibaba.com	1 redirects
2	mt.rtmark.net	bestadbid.com
2	bestadbid.com	1 redirects
2	sax.peakonspot.com	1 redirects
1	ad.crwdcntrl.net	1 redirects
1	my.rtmark.net	bestadbid.com
1	goto.peak-serving.com	1 redirects
1	sjs.perfonspot.com	1 redirects
1	newsbuzz.tv	1 redirects
1	spykemedia.go2cloud.org	1 redirects
6	10

This site contains no links.

Subject Issuer	Validity	Valid
bestadbid.com RapidSSL RSA CA 2018	`2018-01-25` - `2019-02-24`	a year	crt.sh
*.alibaba.com GlobalSign Organization Validation CA - SHA256 - G2	`2018-03-27` - `2018-11-04`	7 months	crt.sh

This page contains 1 frames:

Primary Page: https://click.alibaba.com/core/index.htm
Frame ID: 18CD1D6CA1DB959D630D128840325576
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://spykemedia.go2cloud.org/aff_c?offer_id=113926&aff_id=4031&ios_ifa=00000000-0000-0000-0000-0000000000... HTTP 302
http://newsbuzz.tv/tanal?aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711& HTTP 302
http://sax.peakonspot.com/pops/dlink.php?pid=4132&format=POPUP&subid=155_AF_aff_sub2{aff_sub1}&aff_sub... HTTP 302
http://sjs.perfonspot.com/pops/dlink.php?pid=4247&format=POPUP&subid=155_AF_aff_sub2{aff_sub1} HTTP 302
http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848... Page URL
http://goto.peak-serving.com/?&id=15248801238988880404736848&tid=4247&sr=ep&filter=1&ftype=js&trs=1524880... HTTP 302
https://bestadbid.com/afu.php?zoneid=1648676&var=4247 Page URL
https://bestadbid.com/?r=%2Fmb%2Fhan&zoneid=1648676&pbk3=ca3bd180e78b171686044abbd1552ecf654931026... HTTP 302
http://click.alibaba.com/rd/kdopppr6?pid=1648676&tp1=461822182161&cv=1724500&cn=DE HTTP 302
https://click.alibaba.com/core/index.htm Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

33 %
HTTPS

0 %
IPv6

9
Domains

10
Subdomains

5
IPs

4
Countries

14 kB
Transfer

20 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://spykemedia.go2cloud.org/aff_c?offer_id=113926&aff_id=4031&ios_ifa=00000000-0000-0000-0000-000000000000&aff_sub=new_06cc1b95b7a9b644b62e7f89552e6de3-5-6221287-560-644-6221287-514-113&source=5_5453 HTTP 302
http://newsbuzz.tv/tanal?aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711& HTTP 302
http://sax.peakonspot.com/pops/dlink.php?pid=4132&format=POPUP&subid=155_AF_aff_sub2{aff_sub1}&aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711& HTTP 302
http://sjs.perfonspot.com/pops/dlink.php?pid=4247&format=POPUP&subid=155_AF_aff_sub2{aff_sub1} HTTP 302
http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247 Page URL
http://goto.peak-serving.com/?&id=15248801238988880404736848&tid=4247&sr=ep&filter=1&ftype=js&trs=15248801239472002&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined HTTP 302
https://bestadbid.com/afu.php?zoneid=1648676&var=4247 Page URL
https://bestadbid.com/?r=%2Fmb%2Fhan&zoneid=1648676&pbk3=ca3bd180e78b171686044abbd1552ecf6549310265030186683&empty=0&var=4247&uuid=74e94622-e24d-424d-9759-2d67fca20a72&ad_scheme=1&rotation_type=22&ppucounter=0&first_visit=0&on_test=0&offer_views=0&ab_test=1357&adparams=bm9qcz0wJnNhdmVkX3JlZmVyZXI9aHR0cCUzQSUyRiUyRnNheC5wZWFrb25zcG90LmNvbSUyRnBvcHMlMkZmaWx0ZXIucGhwJTNGcmQlM0Rnb3RvLnBlYWstc2VydmluZy5jb20lMjZzciUzRGVwJTI2aWQlM0QxNTI0ODgwMTIzODk4ODg4MDQwNDczNjg0OCUyNnRpZCUzRDQyNDc%3D&ip=65a89d51a74c843ac913134976da73e8&x=1600&y=1200&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=0&pl=https%3A%2F%2Fbestadbid.com%2Fafu.php%3Fzoneid%3D1407888%26var%3D1648676&drf=http%3A%2F%2Fsax.peakonspot.com%2Fpops%2Ffilter.php%3Frd%3Dgoto.peak-serving.com%26sr%3Dep%26id%3D15248801238988880404736848%26tid%3D4247&np=0&pt=0&nb=1&ng=1&dm=undefined&cf=0&nw=1&id=b02077b899571ab66eadb050d41d70b1&co=1&rf=1&hs=d01d492f13aec958676a3d4656a2a36c&ix=0&fs=0&timeout=0 HTTP 302
http://click.alibaba.com/rd/kdopppr6?pid=1648676&tp1=461822182161&cv=1724500&cn=DE HTTP 302
https://click.alibaba.com/core/index.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://spykemedia.go2cloud.org/aff_c?offer_id=113926&aff_id=4031&ios_ifa=00000000-0000-0000-0000-000000000000&aff_sub=new_06cc1b95b7a9b644b62e7f89552e6de3-5-6221287-560-644-6221287-514-113&source=5_5453 HTTP 302
http://newsbuzz.tv/tanal?aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711& HTTP 302
http://sax.peakonspot.com/pops/dlink.php?pid=4132&format=POPUP&subid=155_AF_aff_sub2{aff_sub1}&aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711& HTTP 302
http://sjs.perfonspot.com/pops/dlink.php?pid=4247&format=POPUP&subid=155_AF_aff_sub2{aff_sub1} HTTP 302
http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247

Request Chain 1

http://goto.peak-serving.com/?&id=15248801238988880404736848&tid=4247&sr=ep&filter=1&ftype=js&trs=15248801239472002&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined HTTP 302
https://bestadbid.com/afu.php?zoneid=1648676&var=4247

Request Chain 3

https://ad.crwdcntrl.net/5/c=10546/pe=y?https%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3Dfc37487a0106e4b1e293539dc5f0a384%26sg%3D%24%7Baud_ids%7D HTTP 302
https://mt.rtmark.net/ltm.gif?id=fc37487a0106e4b1e293539dc5f0a384&sg=

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

filter.php Show response
sax.peakonspot.com/pops/
Redirect Chain

http://spykemedia.go2cloud.org/aff_c?offer_id=113926&aff_id=4031&ios_ifa=00000000-0000-0000-0000-000000000000&aff_sub=new_06cc1b95b7a9b644b62e7f89552e6de3-5-6221287-560-644-6221287-514-113&source=5...
http://newsbuzz.tv/tanal?aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711&
http://sax.peakonspot.com/pops/dlink.php?pid=4132&format=POPUP&subid=155_AF_aff_sub2{aff_sub1}&aff_sub1=4031&source=4031&source2=113926&ecid=113926&track=4711&
http://sjs.perfonspot.com/pops/dlink.php?pid=4247&format=POPUP&subid=155_AF_aff_sub2{aff_sub1}
http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247

7 KB
7 KB

108ms
108ms

Document
text/html

52.44.170.144
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247
Protocol: HTTP/1.1
Server: 52.44.170.144 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-44-170-144.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b39ea335e59e516f9062f5e06a9c8c385437ce27db9ceca5d981d42bf1b9c9f9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sax.peakonspot.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Cookie: uuid=15248801225631717924494297
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Sat, 28 Apr 2018 01:48:43 GMT
Cache-Control: no-store, no-cache, must-revalidate
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 6833
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sat, 28 Apr 2018 01:48:43 GMT
Server: nginx
Content-Type: text/html; charset=UTF-8
Location: http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247
Set-Cookie: uuid=15248801239657129680272193; expires=Mon, 28-May-2018 01:48:43 GMT; Max-Age=2592000
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

Cookie set afu.php Show response
bestadbid.com/
Redirect Chain

http://goto.peak-serving.com/?&id=15248801238988880404736848&tid=4247&sr=ep&filter=1&ftype=js&trs=15248801239472002&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined
https://bestadbid.com/afu.php?zoneid=1648676&var=4247

13 KB
6 KB

135ms
95ms

Document
text/html

188.42.162.193
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

https://bestadbid.com/afu.php?zoneid=1648676&var=4247

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

188.42.162.193 , Luxembourg, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

1fb3bbebeb7ebfb072989f75e90081f178785899019165ebf20ad3ff07f2e4ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: bestadbid.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sax.peakonspot.com/pops/filter.php?rd=goto.peak-serving.com&sr=ep&id=15248801238988880404736848&tid=4247
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 28 Apr 2018 01:48:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Timing-Allow-Origin: * *
X-FRAME-OPTIONS: DENY
Connection: keep-alive
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: SeenToday=1; expires=Sun, 29-Apr-2018 01:48:44 GMT; Max-Age=86400; path=/ OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Sun, 29-Apr-2018 01:48:44 GMT; Max-Age=86400; path=/ oaidts=1524880124; expires=Sun, 28-Apr-2019 01:48:44 GMT; Max-Age=31536000; path=/ OAID=fc37487a0106e4b1e293539dc5f0a384; expires=Sun, 28-Apr-2019 01:48:44 GMT; Max-Age=31536000; path=/ OXVAR=4247; expires=Sun, 29-Apr-2018 01:48:44 GMT; Max-Age=86400; path=/ OAID=fc37487a0106e4b1e293539dc5f0a384; expires=Sun, 28-Apr-2019 01:48:44 GMT; Max-Age=31536000; path=/ exsdsf=1524880124 pbk3=ca3bd180e78b171686044abbd1552ecf6549310265030186683; expires=Sat, 28-Apr-2018 01:58:44 GMT; Max-Age=600 ltm_afu=1; expires=Sun, 29-Apr-2018 01:48:44 GMT; Max-Age=86400; path=/
Cache-Control: private, max-age=0, no-cache
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=1
Content-Type: text/html; charset=UTF-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://bestadbid.com/afu.php?zoneid=1648676&var=4247
Set-Cookie: ctxfeed_media-serving=%7B%22ctxpop_uuid%22%3A%2277523742411285651524880124%22%7D; expires=Wed, 31-Dec-2098 23:00:00 GMT; Max-Age=2546025076 ep_662d74500eb4219839195c62a8ed8de4=20180428%7C1818%7CEI1545ae3d2fcab52746870097%7C; expires=Mon, 28-May-2018 01:48:44 GMT; Max-Age=2592000; path=/; domain=.peak-serving.com eprt_5eb8f0bcc36a277f46591dee92b31a95=20180428%7C1818%7CEI1545ae3d2fcab52746870097%7C; expires=Mon, 28-May-2018 01:48:44 GMT; Max-Age=2592000; path=/; domain=.peak-serving.com
Date: Sat, 28 Apr 2018 01:48:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H/1.1 200
OK img.gif
my.rtmark.net/ 43 B
278 B 28ms
7ms Other
image/gif 18.195.197.187
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://my.rtmark.net/img.gif?f=merge&userId=fc37487a0106e4b1e293539dc5f0a384
Requested by: Host: bestadbid.com
URL: https://bestadbid.com/afu.php?zoneid=1407888&var=1648676
Protocol: HTTP/1.1
Server: 18.195.197.187 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-197-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.10.1 /
Resource Hash

Request headers

Cache-Control: max-age=0
Origin: https://bestadbid.com
Referer: https://bestadbid.com/afu.php?zoneid=1407888&var=1648676
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 28 Apr 2018 01:48:44 GMT
Server: nginx/1.10.1
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

ltm.gif
mt.rtmark.net/
Redirect Chain

https://ad.crwdcntrl.net/5/c=10546/pe=y?https%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3Dfc37487a0106e4b1e293539dc5f0a384%26sg%3D%24%7Baud_ids%7D
https://mt.rtmark.net/ltm.gif?id=fc37487a0106e4b1e293539dc5f0a384&sg=

43 B
215 B

13ms
13ms

Other
image/gif

185.49.145.177
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: https://mt.rtmark.net/ltm.gif?id=fc37487a0106e4b1e293539dc5f0a384&sg=
Protocol: HTTP/1.1
Server: 185.49.145.177 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-6-16-22-d6317-177.webazilla.com
Software: nginx /
Resource Hash

Request headers

Referer: https://bestadbid.com/afu.php?zoneid=1407888&var=1648676
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 28 Apr 2018 01:48:45 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Sat, 28 Apr 2018 01:48:45 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://mt.rtmark.net/ltm.gif?id=fc37487a0106e4b1e293539dc5f0a384&sg=
Cache-Control: no-cache
X-Server: 10.26.5.211
Connection: keep-alive
Content-Length: 0
Expires: 0

POST
H/1.1 200
OK omr.gif
mt.rtmark.net/ 43 B
215 B 97ms
12ms Other
image/gif 185.49.145.177
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: https://mt.rtmark.net/omr.gif?s=afu&geo=DE&p=5%2C101&zoneid=1648676&oaid=fc37487a0106e4b1e293539dc5f0a384
Requested by: Host: bestadbid.com
URL: https://bestadbid.com/afu.php?zoneid=1407888&var=1648676
Protocol: HTTP/1.1
Server: 185.49.145.177 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-6-16-22-d6317-177.webazilla.com
Software: nginx /
Resource Hash

Request headers

Cache-Control: max-age=0
Origin: https://bestadbid.com
Referer: https://bestadbid.com/afu.php?zoneid=1407888&var=1648676
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 28 Apr 2018 01:48:45 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

Primary Request index.htm Show response
click.alibaba.com/core/
Redirect Chain

https://bestadbid.com/?r=%2Fmb%2Fhan&zoneid=1648676&pbk3=ca3bd180e78b171686044abbd1552ecf6549310265030186683&empty=0&var=4247&uuid=74e94622-e24d-424d-9759-2d67fca20a72&ad_scheme=1&rotation_type=22&...
http://click.alibaba.com/rd/kdopppr6?pid=1648676&tp1=461822182161&cv=1724500&cn=DE
https://click.alibaba.com/core/index.htm

360 B
566 B

476ms
158ms

Document
text/html

198.11.132.198
CNNIC-ALIBABA-CN-...

General

Check archive.org

Show headers Download Go to

Full URL

https://click.alibaba.com/core/index.htm

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

bc1d26c92550dbdcba166b1ae7fe77b68886c9948c72eb7240197c0a8e7b4d9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

:path: /core/index.htm
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: click.alibaba.com
cookie: ali_apache_id=10.182.213.65.1524880125263.268931.7; JSESSIONID=A37BDCC5716101A6FBADF96D721BB181; ali_apache_track=; ali_apache_tracktmp=; xman_us_f=x_l=0; acs_usuc_t=acs_rt=aa8644a2316e436ebe5fe4655680ae24; xman_t=uQM8McS9bZPFzKwf1Hk2OcfwbiBIusPRLwffVufVYgP50kCs4xHHLD+eAhEuKlVz; xman_f=Y3TOtRbvtdahH+7itPuR5PRURHGPiZucy6nYsr/TQBF9+XlX9OknBAkcTdoXXkyKS9X3Q/4TC5YSEYTcVNMUKIGPBQ6+h6/eMXzs2sDQODgbTfhnc4hDMw==
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Sat, 28 Apr 2018 01:48:45 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/html;charset=UTF-8
server: Apache-Coyote/1.1
p3p: CP="CAO PSA OUR"
strict-transport-security: max-age=0
content-language: zh-CN
status: 200
set-cookie: JSESSIONID=AA74932CD3C544A1F2178500AC484D4D; Path=/; HttpOnly ali_apache_track=; Domain=.alibaba.com; Expires=Thu, 16-May-2086 05:02:52 GMT; Path=/ ali_apache_tracktmp=; Domain=.alibaba.com; Path=/
timing-allow-origin: *

Redirect headers

Date: Sat, 28 Apr 2018 01:48:45 GMT
Content-Type: text/html;charset=UTF-8
Server: Apache-Coyote/1.1
P3P: CP="CAO PSA OUR"
Content-Language: zh-CN
Location: https://click.alibaba.com/core/index.htm
Set-Cookie: ali_apache_id=10.182.213.65.1524880125263.268931.7; path=/; domain=.alibaba.com; expires=Wed, 30-Nov-2084 01:01:01 GMT JSESSIONID=A37BDCC5716101A6FBADF96D721BB181; Path=/; HttpOnly ali_apache_track=; Domain=.alibaba.com; Expires=Thu, 16-May-2086 05:02:52 GMT; Path=/ ali_apache_tracktmp=; Domain=.alibaba.com; Path=/ xman_us_f=x_l=0; Domain=.alibaba.com; Expires=Thu, 16-May-2086 05:02:52 GMT; Path=/ acs_usuc_t=acs_rt=aa8644a2316e436ebe5fe4655680ae24; Domain=.alibaba.com; Path=/ xman_t=uQM8McS9bZPFzKwf1Hk2OcfwbiBIusPRLwffVufVYgP50kCs4xHHLD+eAhEuKlVz; Domain=.alibaba.com; Path=/; HttpOnly xman_f=Y3TOtRbvtdahH+7itPuR5PRURHGPiZucy6nYsr/TQBF9+XlX9OknBAkcTdoXXkyKS9X3Q/4TC5YSEYTcVNMUKIGPBQ6+h6/eMXzs2sDQODgbTfhnc4hDMw==; Domain=.alibaba.com; Expires=Thu, 16-May-2086 05:02:52 GMT; Path=/; HttpOnly
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
click.alibaba.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: AA74932CD3C544A1F2178500AC484D4D
.alibaba.com/	1970-02-12 12:06:03	Name: xman_f Value: Y3TOtRbvtdahH+7itPuR5PRURHGPiZucy6nYsr/TQBF9+XlX9OknBAkcTdoXXkyKS9X3Q/4TC5YSEYTcVNMUKIGPBQ6+h6/eMXzs2sDQODgbTfhnc4hDMw==
.alibaba.com/	1969-12-31 23:59:59	Name: xman_t Value: uQM8McS9bZPFzKwf1Hk2OcfwbiBIusPRLwffVufVYgP50kCs4xHHLD+eAhEuKlVz
.alibaba.com/	1969-12-31 23:59:59	Name: acs_usuc_t Value: acs_rt=aa8644a2316e436ebe5fe4655680ae24
.alibaba.com/	1970-02-11 23:19:44	Name: ali_apache_id Value: 10.182.213.65.1524880125263.268931.7
.alibaba.com/	1970-02-12 12:06:03	Name: xman_us_f Value: x_l=0
.alibaba.com/	1969-12-31 23:59:59	Name: ali_apache_tracktmp Value:
.alibaba.com/	1970-02-12 12:06:03	Name: ali_apache_track Value:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.crwdcntrl.net
bestadbid.com
click.alibaba.com
goto.peak-serving.com
mt.rtmark.net
my.rtmark.net
newsbuzz.tv
sax.peakonspot.com
sjs.perfonspot.com
spykemedia.go2cloud.org
18.195.197.187
185.49.145.177
188.42.162.193
198.11.132.198
34.206.235.182
35.164.214.196
52.208.190.55
52.3.138.38
52.44.170.144
52.48.217.7
1fb3bbebeb7ebfb072989f75e90081f178785899019165ebf20ad3ff07f2e4ac
b39ea335e59e516f9062f5e06a9c8c385437ce27db9ceca5d981d42bf1b9c9f9
bc1d26c92550dbdcba166b1ae7fe77b68886c9948c72eb7240197c0a8e7b4d9c

click.alibaba.com Open in urlscan Pro 198.11.132.198 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

33 %HTTPS

0 %IPv6

9 Domains

10 Subdomains

5 IPs

4 Countries

14 kBTransfer

20 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

8 Cookies

Indicators

click.alibaba.com Open in urlscan Pro
198.11.132.198 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

0 %
IPv6

9
Domains

10
Subdomains

5
IPs

4
Countries

14 kB
Transfer

20 kB
Size

8
Cookies

6 HTTP transactions
0 data transactions