urlscan.io logo urlscan.io
SecurityTrails logo

nhsrv.cf Open in urlscan Pro
2606:4700:30::6818:6dcc  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://52.77.99.53/acs.php?sid=107431&adid=26891718&os=0&gaid=&pb=5bf8d00783a8f_c5c0eb51616fd7_MF_OTAS_107261358_10...
Effective URL: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735...
Submission: On December 11 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 8 domains to perform 19 HTTP transactions. The main IP is 2606:4700:30::6818:6dcc, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is nhsrv.cf.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 12th 2018. Valid for: a year.
This is the only time nhsrv.cf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 52.77.99.53 16509 (AMAZON-02)
1 1 52.34.91.15 16509 (AMAZON-02)
1 1 54.186.24.208 16509 (AMAZON-02)
1 1 52.21.123.124 14618 (AMAZON-AES)
1 1 52.73.61.40 14618 (AMAZON-AES)
5 2606:4700:30:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3 104.109.56.111 20940 (AKAMAI-ASN1)
1 69.89.74.102 558 (NNEXT)
19 7
1    52.77.99.53 (Singapore, Singapore)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-77-99-53.ap-southeast-1.compute.amazonaws.com
52.77.99.53
1    52.34.91.15 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-34-91-15.us-west-2.compute.amazonaws.com
a.nbt.ren
1    54.186.24.208 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-186-24-208.us-west-2.compute.amazonaws.com
c.snnd.co
1    52.21.123.124 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-21-123-124.compute-1.amazonaws.com
sax.perfonspot.com
1    52.73.61.40 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-73-61-40.compute-1.amazonaws.com
beci.peakonsrv.com
5    2606:4700:30::6818:6dcc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nhsrv.cf
1    2a00:1450:4001:816::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2606:4700::6811:3c5b (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.engine.spotscenered.info
3    104.109.56.111 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-56-111.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
1    69.89.74.102 (El Segundo, United States)

ASN558 (NNEXT - NV Next LLC, US)
engine.spotscenered.info
Domain Requested by
5 nhsrv.cf nhsrv.cf
3 sb.scorecardresearch.com 1 redirects cdn.engine.spotscenered.info
nhsrv.cf
1 engine.spotscenered.info cdn.engine.spotscenered.info
1 cdn.engine.spotscenered.info nhsrv.cf
1 ajax.googleapis.com nhsrv.cf
1 beci.peakonsrv.com 1 redirects
1 sax.perfonspot.com 1 redirects
1 c.snnd.co 1 redirects
1 a.nbt.ren 1 redirects
19 9

This site contains links to these domains. Also see Links.

Domain
tr4ck.brucelead.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2018-11-12 -
2019-11-12		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-11-27 -
2019-02-19		 3 months crt.sh
spotscenered.info
CloudFlare Inc ECC CA-2		 2018-06-27 -
2019-06-27		 a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA		 2018-11-28 -
2019-12-26		 a year crt.sh
engine.spotscenered.info
Go Daddy Secure Certificate Authority - G2		 2017-07-27 -
2019-07-27		 2 years crt.sh

This page contains 2 frames:

Primary Page: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Frame ID: 992F0DF9DC92917D7A2A6E542C92FE32
Requests: 8 HTTP requests in this frame

Frame: https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Frame ID: 57B69A6C58F0AB5E8206AF59AAB723F2
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://52.77.99.53/acs.php?sid=107431&adid=26891718&os=0&gaid=&pb=5bf8d00783a8f_c5c0eb51616fd7_... Page URL
  2. http://a.nbt.ren/sm/v1/click?rule_id=17&publisher_slot=&pub_aid=&pub_idfa=&sub_1=&package_nam... HTTP 302
    http://c.snnd.co/api/v4/click?_castle_=fqIM48kxUZ469votdDxEdvdA-JgXRQq-Jefv1RJMWC8KhKJSl7Ha5c... HTTP 302
    http://sax.perfonspot.com/pops/dlink.php?pid=7083&format=POPUP&subid=p14331320&cid=e439a1bb-500c-46c9-... HTTP 302
    https://beci.peakonsrv.com/?&id=15445408923240124248899519&tid=7083&sr=ep HTTP 302
    https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • env /^_?COMSCORE$/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

19
Requests

53 %
HTTPS

30 %
IPv6

8
Domains

9
Subdomains

7
IPs

4
Countries

165 kB
Transfer

416 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://52.77.99.53/acs.php?sid=107431&adid=26891718&os=0&gaid=&pb=5bf8d00783a8f_c5c0eb51616fd7_MF_OTAS_107261358_10a04115-1b96-428d-896f-80b40936f476-1544467732674_5423_ms_T00T_eyJpcDJsb25nIjozMjIyNzM4NjIzLCJjdXJyZW50X3ByaWNlIjoiMC41MTAwIiwic3ViX2lkIjoiMTMxM19UXzE2M19UXzU0MjNfNTk2MDg1NjgyIiwiZnVsbF9zdWJfaWQiOiIxMzEzX1RfMTYzX1RfNTQyM181OTYwODU2ODIiLCJjX3QiOiI1NDQyMSJ9&idfa={idfa} Page URL
  2. http://a.nbt.ren/sm/v1/click?rule_id=17&publisher_slot=&pub_aid=&pub_idfa=&sub_1=&package_name=1379007494&pub_gaid= HTTP 302
    http://c.snnd.co/api/v4/click?_castle_=fqIM48kxUZ469votdDxEdvdA-JgXRQq-Jefv1RJMWC8KhKJSl7Ha5cZn9I2duuY_emy3H9G6QWJHDPnYuHWLIfPhIGo6jSO6YmxCsQq5P8lNc09UkxbhoMYiKS0BGzMS2OcmlS3pM-QoXxUPRbsEqLqp8O0iSDBr29Upmzxbv5IcTVGF0JPcjcMOJboMHwyxf4urQbCLLNfqd4a_nCe2TZ0XzA5w7REGHFlHm_AGQCKv1EfK-Md0hOUgcqEv4CuJsu54gcMd74f9MzMTkvEQf5kgFirIg079kX0ypMlt15z98Y-eEjxld_2swlou3s4-Mi0J1rNgimXZDaQwxxDJ31CyIPvUk8EF6-SP4QMW1fKTZN5cliKlqyc0RiQ16ghZkrZbl1x9aI21Cosej4qK545PSGloBDVI680zDiG3Iz2whIlkApAhUWbjKxna1J6XZDqUtYV9-2k-3_EmWnOWcvz79HTem480U7e6Abl3EpxXm_93EDIYEaPefeX37Fq9GpQuJEOI3uuNUFc_TDQnOAzV0DVQL5gfbSkeEqPdb_F1-NvwRlwA1P8XfEl5FMqDUdP9TNi5nXbjpucg1qIyixYuJpo_aJqqP4apaxgMUGoGJ9eibSrZYg%3D%3D HTTP 302
    http://sax.perfonspot.com/pops/dlink.php?pid=7083&format=POPUP&subid=p14331320&cid=e439a1bb-500c-46c9-a5a8-11e4f6d41ba9__pspm HTTP 302
    https://beci.peakonsrv.com/?&id=15445408923240124248899519&tid=7083&sr=ep HTTP 302
    https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://sb.scorecardresearch.com/b?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI1495c0fd2dca735171480776%26url%3Dhttp%253A%252F%252Ftr4ck.brucelead.com%252Fck.php%253Fline_item_id%253D6626%2526subid1%253DEI1495c0fd2dca735171480776%2526subid_spx%253DJHC7083_p14331320&c3=1&c4=&c5=&c6=&c10=&c15=&c16=&c8=Please%20wait...&c9=&cv=1.8 HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI1495c0fd2dca735171480776%26url%3Dhttp%253A%252F%252Ftr4ck.brucelead.com%252Fck.php%253Fline_item_id%253D6626%2526subid1%253DEI1495c0fd2dca735171480776%2526subid_spx%253DJHC7083_p14331320&c3=1&c4=&c5=&c6=&c10=&c15=&c16=&c8=Please%20wait...&c9=&cv=1.8

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
acs.php
52.77.99.53/ 		411 B
710 B 		Document
General
Check archive.org
Download Go to
Full URL
http://52.77.99.53/acs.php?sid=107431&adid=26891718&os=0&gaid=&pb=5bf8d00783a8f_c5c0eb51616fd7_MF_OTAS_107261358_10a04115-1b96-428d-896f-80b40936f476-1544467732674_5423_ms_T00T_eyJpcDJsb25nIjozMjIyNzM4NjIzLCJjdXJyZW50X3ByaWNlIjoiMC41MTAwIiwic3ViX2lkIjoiMTMxM19UXzE2M19UXzU0MjNfNTk2MDg1NjgyIiwiZnVsbF9zdWJfaWQiOiIxMzEzX1RfMTYzX1RfNTQyM181OTYwODU2ODIiLCJjX3QiOiI1NDQyMSJ9&idfa={idfa}
Protocol
HTTP/1.1
Server
52.77.99.53 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-77-99-53.ap-southeast-1.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash

Request headers

Host
52.77.99.53
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx/1.7.9
Date
Tue, 11 Dec 2018 15:08:09 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified
Tue Dec 11 15:08:10 2018
Cache-Control
post-check=0, pre-check=0
Pragma
no-cache
Primary Request a387bbc53b4cdb10392087576bfb16d2.php
nhsrv.cf/url/
Redirect Chain
  • http://a.nbt.ren/sm/v1/click?rule_id=17&publisher_slot=&pub_aid=&pub_idfa=&sub_1=&package_name=1379007494&pub_gaid=
  • http://c.snnd.co/api/v4/click?_castle_=fqIM48kxUZ469votdDxEdvdA-JgXRQq-Jefv1RJMWC8KhKJSl7Ha5cZn9I2duuY_emy3H9G6QWJHDPnYuHWLIfPhIGo6jSO6YmxCsQq5P8lNc09UkxbhoMYiKS0BGzMS2OcmlS3pM-QoXxUPRbsEqLqp8O0iSD...
  • http://sax.perfonspot.com/pops/dlink.php?pid=7083&format=POPUP&subid=p14331320&cid=e439a1bb-500c-46c9-a5a8-11e4f6d41ba9__pspm
  • https://beci.peakonsrv.com/?&id=15445408923240124248899519&tid=7083&sr=ep
  • https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subi...
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6dcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.5.10
Resource Hash
e3c6f5b8a9a8b2b5f59d0ac34f7e9025e95a3a4015848a730d601b0816e3cd10

Request headers

:method
GET
:authority
nhsrv.cf
:scheme
https
:path
/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Tue, 11 Dec 2018 15:08:12 GMT
content-type
text/html
set-cookie
__cfduid=d45154fbbdafbf739652f3be388c352341544540892; expires=Wed, 11-Dec-19 15:08:12 GMT; path=/; domain=.nhsrv.cf; HttpOnly
x-powered-by
PHP/5.5.10
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4878dd83dc636451-FRA
content-encoding
br

Redirect headers

Content-Type
text/html; charset=UTF-8
Date
Tue, 11 Dec 2018 15:08:12 GMT
Location
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Server
nginx
Set-Cookie
ctxfeed_media-serving=%7B%22ctxpop_uuid%22%3A%2261133934073150161544540892%22%7D; expires=Wed, 31-Dec-2098 23:00:00 GMT; Max-Age=2526364308 ep_587495d8fc6c37556d802f72a85c838b=20181211%7C6746%7CEI1495c0fd2dca735171480776%7C; expires=Thu, 10-Jan-2019 15:08:12 GMT; Max-Age=2592000; path=/; domain=.peak-serving.com eprt_bf486f3aba4c432632bded0f99a7bd42=20181211%7C6746%7CEI1495c0fd2dca735171480776%7C; expires=Thu, 10-Jan-2019 15:08:12 GMT; Max-Age=2592000; path=/; domain=.peak-serving.com
Content-Length
0
Connection
keep-alive
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 		90 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 11 Dec 2018 04:31:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38229
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
33018
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 11 Dec 2019 04:31:03 GMT
/
nhsrv.cf/srv/ 		2 KB
842 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nhsrv.cf/srv/?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6dcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.5.10
Resource Hash
a83755a58feee523d40f1f24369d3540498e5d4b97334bc0b441299e1a8e54e7

Request headers

:path
/srv/?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
pragma
no-cache
cookie
__cfduid=d45154fbbdafbf739652f3be388c352341544540892
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
nhsrv.cf
referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
:scheme
https
:method
GET
Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 11 Dec 2018 15:08:12 GMT
content-encoding
br
server
cloudflare
x-powered-by
PHP/5.5.10
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
status
200
cf-ray
4878dd840c7b6451-FRA
infinity.js.aspx
cdn.engine.spotscenered.info/Scripts/ 		162 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.engine.spotscenered.info/Scripts/infinity.js.aspx?guid=0584ef34-e232-47d7-a1f2-c6aa0495ca0a
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:3c5b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7982fabb5b9b1ddcf5b6108ee1b7076eefac3b31f4e650fd072340d9c2af1f00

Request headers

Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 11 Dec 2018 15:08:12 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
access-control-allow-origin
*
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="CAO PSA OUR IND"
status
200
cache-control
public, max-age=1200
cf-ray
4878dd847859c2e7-FRA
content-type
application/x-javascript; charset=utf-8
expires
Tue, 11 Dec 2018 15:28:12 GMT
serve.php
nhsrv.cf/srv/ Frame 57B6 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/srv/?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6dcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.5.10
Resource Hash
150ab4326fad8cd26df2c023e92fd3f28e3f84dc5ee577d77b9a4cd548423346

Request headers

:method
GET
:authority
nhsrv.cf
:scheme
https
:path
/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
accept-encoding
gzip, deflate, br
cookie
__cfduid=d45154fbbdafbf739652f3be388c352341544540892
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320

Response headers

status
200
date
Tue, 11 Dec 2018 15:08:12 GMT
content-type
text/html
x-powered-by
PHP/5.5.10
set-cookie
nhthrottle=10; expires=Wed, 12-Dec-2018 15:08:12 GMT; Max-Age=86400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4878dd843c9f6451-FRA
content-encoding
br
nhm.min.js
nhsrv.cf/srv/ Frame 57B6 		151 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nhsrv.cf/srv/nhm.min.js?v1-0-12-2
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6dcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e72adb0e2343c341ca583e48fbb3d87006eeed1a298492fa9dad412dc972eb8

Request headers

:path
/srv/nhm.min.js?v1-0-12-2
pragma
no-cache
cookie
nhthrottle=10; __cfduid=d45154fbbdafbf739652f3be388c352341544540892
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
nhsrv.cf
referer
https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
:scheme
https
:method
GET
Referer
https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 11 Dec 2018 15:08:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 06 Dec 2018 16:55:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
public, max-age=14400
cf-ray
4878dd845cb56451-FRA
expires
Tue, 11 Dec 2018 19:08:12 GMT
sendbeacon.js
nhsrv.cf/srv/ Frame 57B6 		1 KB
660 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nhsrv.cf/srv/sendbeacon.js
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6dcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a64ed8d221ff116a4f722114a06966d940ecdde18dc25d008492e8da6dff83e

Request headers

:path
/srv/sendbeacon.js
pragma
no-cache
cookie
nhthrottle=10; __cfduid=d45154fbbdafbf739652f3be388c352341544540892
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
nhsrv.cf
referer
https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
:scheme
https
:method
GET
Referer
https://nhsrv.cf/srv/serve.php?key=a387bbc53b4cdb10392087576bfb16d2|||636841237c3cfbf5e82993d701b9c7fe
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 11 Dec 2018 15:08:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 12 Nov 2018 16:20:18 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
public, max-age=14400
cf-ray
4878dd845cb66451-FRA
expires
Tue, 11 Dec 2018 19:08:12 GMT
beacon.js
sb.scorecardresearch.com/ 		1 KB
989 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js?c1=8&c2=18203330&c3=1
Requested by
Host: cdn.engine.spotscenered.info
URL: https://cdn.engine.spotscenered.info/Scripts/infinity.js.aspx?guid=0584ef34-e232-47d7-a1f2-c6aa0495ca0a
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.56.111 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-56-111.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f22320501f74c0109a7a36061b237f0f0dc3f5d61c3aa99e6e9846f29b52a845

Request headers

Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 11 Dec 2018 15:08:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
708
Expires
Wed, 12 Dec 2018 15:08:12 GMT
Tag.engine
engine.spotscenered.info/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://engine.spotscenered.info/Tag.engine?time=0&id=0584ef34-e232-47d7-a1f2-c6aa0495ca0a&rand=91497&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=0&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI1495c0fd2dca735171480776%26url%3Dhttp%253A%252F%252Ftr4ck.brucelead.com%252Fck.php%253Fline_item_id%253D6626%2526subid1%253DEI1495c0fd2dca735171480776%2526subid_spx%253DJHC7083_p14331320&kw=
Requested by
Host: cdn.engine.spotscenered.info
URL: https://cdn.engine.spotscenered.info/Scripts/infinity.js.aspx?guid=0584ef34-e232-47d7-a1f2-c6aa0495ca0a
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.89.74.102 El Segundo, United States, ASN558 (NNEXT - NV Next LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
503
date
Tue, 11 Dec 2018 15:05:33 GMT
content-length
0
content-type
text/plain
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI149...
  • https://sb.scorecardresearch.com/b2?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI14...
0
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI1495c0fd2dca735171480776%26url%3Dhttp%253A%252F%252Ftr4ck.brucelead.com%252Fck.php%253Fline_item_id%253D6626%2526subid1%253DEI1495c0fd2dca735171480776%2526subid_spx%253DJHC7083_p14331320&c3=1&c4=&c5=&c6=&c10=&c15=&c16=&c8=Please%20wait...&c9=&cv=1.8
Requested by
Host: nhsrv.cf
URL: https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.56.111 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-56-111.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://nhsrv.cf/url/a387bbc53b4cdb10392087576bfb16d2.php?s=636841237c3cfbf5e82993d701b9c7fe&cb=EI1495c0fd2dca735171480776&url=http%3A%2F%2Ftr4ck.brucelead.com%2Fck.php%3Fline_item_id%3D6626%26subid1%3DEI1495c0fd2dca735171480776%26subid_spx%3DJHC7083_p14331320
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Dec 2018 15:08:12 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=8&c2=18203330&rn=0.27340018696457524&c7=https%3A%2F%2Fnhsrv.cf%2Furl%2Fa387bbc53b4cdb10392087576bfb16d2.php%3Fs%3D636841237c3cfbf5e82993d701b9c7fe%26cb%3DEI1495c0fd2dca735171480776%26url%3Dhttp%253A%252F%252Ftr4ck.brucelead.com%252Fck.php%253Fline_item_id%253D6626%2526subid1%253DEI1495c0fd2dca735171480776%2526subid_spx%253DJHC7083_p14331320&c3=1&c4=&c5=&c6=&c10=&c15=&c16=&c8=Please%20wait...&c9=&cv=1.8
Pragma
no-cache
Date
Tue, 11 Dec 2018 15:08:12 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
92e93c2c-4e36-4945-bdcd-51e21a717b3d
https://nhsrv.cf/ Frame 57B6 		0
0
70a8284c-dceb-449a-8db7-bc59030d56f7
https://nhsrv.cf/ Frame 57B6 		0
0
a6c0ed16-8aaa-4f94-b88e-095df860cd05
https://nhsrv.cf/ Frame 57B6 		0
0
2aff404f-9e16-4835-a6a2-6ba568f65ecc
https://nhsrv.cf/ Frame 57B6 		0
0
2136d106-e2a2-494e-abf9-132cd8f1152c
https://nhsrv.cf/ Frame 57B6 		0
0
b673f341-3dfd-4018-8134-7e05ce0e2c6e
https://nhsrv.cf/ Frame 57B6 		0
0
ab28b8e9-6f45-4aae-ad84-71d24b17f2d0
https://nhsrv.cf/ Frame 57B6 		0
0
2bf45802-98af-4585-800f-de2f2d892d21
https://nhsrv.cf/ Frame 57B6 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/92e93c2c-4e36-4945-bdcd-51e21a717b3d
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/70a8284c-dceb-449a-8db7-bc59030d56f7
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/a6c0ed16-8aaa-4f94-b88e-095df860cd05
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/2aff404f-9e16-4835-a6a2-6ba568f65ecc
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/2136d106-e2a2-494e-abf9-132cd8f1152c
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/b673f341-3dfd-4018-8134-7e05ce0e2c6e
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/ab28b8e9-6f45-4aae-ad84-71d24b17f2d0
Domain
nhsrv.cf
URL
blob:https://nhsrv.cf/2bf45802-98af-4585-800f-de2f2d892d21

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery number| tmr number| dots number| terv object| jQuery19109260603043069455 string| NHkey function| _0x53cdfb function| _0x527148 object| nhfr string| nhexist object| g367CB268B1094004A3689751E7AC568F function| UAParser object| COMSCORE object| _comscore

2 Cookies

Domain/Path Name / Value
nhsrv.cf/srv Name: nhthrottle
Value: 10
.nhsrv.cf/ Name: __cfduid
Value: d45154fbbdafbf739652f3be388c352341544540892