urlscan.io logo urlscan.io
SecurityTrails logo

t.vfgtc.com Open in urlscan Pro
107.178.242.109  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://getlaidtonight.appspot.com/u_YFPyaBmtJ0LwZ1LxYUzuZEjhWVPnZ03ja1PfWkvna0fjXA3gYUOtMEeuYxT4ZVOtbA7wJxjjLEOxMUWwJ0StaETyXVHdWV...
Effective URL: https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_su...
Submission: On July 11 via api from BE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 10 domains to perform 11 HTTP transactions. The main IP is 107.178.242.109, located in United States and belongs to GOOGLE - Google LLC, US. The main domain is t.vfgtc.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 28th 2019. Valid for: 3 months.
This is the only time t.vfgtc.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a00:1450:400... 15169 (GOOGLE)
1 35.197.52.214 15169 (GOOGLE)
2 52.14.194.249 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 107.178.242.109 15169 (GOOGLE)
1 205.185.216.10 20446 (HIGHWINDS3)
1 1 35.159.5.116 16509 (AMAZON-02)
11 7
1    2a00:1450:4001:818::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
getlaidtonight.appspot.com
1    35.197.52.214 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 214.52.197.35.bc.googleusercontent.com
crossimplicationestablished.bid
2    52.14.194.249 (Columbus, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-14-194-249.us-east-2.compute.amazonaws.com
onlythebest.email
1    2a00:1450:4001:825::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
2    2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    107.178.242.109 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 109.242.178.107.bc.googleusercontent.com
t.hrtyi.com
t.vfgtc.com
1    205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: map2.hwcdn.net
ckstatic.com
1    35.159.5.116 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-159-5-116.eu-central-1.compute.amazonaws.com
a.vfghc.com
Domain Requested by
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 onlythebest.email crossimplicationestablished.bid
onlythebest.email
1 t.vfgtc.com t.hrtyi.com
1 a.vfghc.com 1 redirects
1 ckstatic.com t.hrtyi.com
1 t.hrtyi.com onlythebest.email
1 www.googletagmanager.com onlythebest.email
1 crossimplicationestablished.bid
1 getlaidtonight.appspot.com 1 redirects
0 www.google.de Failed
11 10

This site contains no links.

Subject Issuer Validity Valid
*.google-analytics.com
Google Internet Authority G3		 2019-06-18 -
2019-09-10		 3 months crt.sh
t.frtyi.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-21 -
2019-09-22		 a year crt.sh
ckstatic.com
Let's Encrypt Authority X3		 2019-05-06 -
2019-08-04		 3 months crt.sh
t.vfgtc.com
Let's Encrypt Authority X3		 2019-06-28 -
2019-09-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo=2753,2754,2755,2756
Frame ID: 4DC4063EEE783E7D5C440A7C44C6681E
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://getlaidtonight.appspot.com/u_YFPyaBmtJ0LwZ1LxYUzuZEjhWVPnZ03ja1PfWkvna0fjXA3gYUOtMEeuYxT4ZVOtbA7wJxjjLE... HTTP 302
    http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182, Page URL
  2. http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612 Page URL
  3. http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F... Page URL
  4. https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM... Page URL
  5. https://a.vfghc.com/5ebaf2b6-842f-426b-ad3e-692b8b592f3a?subID1=12141475_xCxt33vDzvM33NGo9x4w7ou... HTTP 302
    https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&a... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

55 %
HTTPS

38 %
IPv6

10
Domains

10
Subdomains

7
IPs

3
Countries

102 kB
Transfer

181 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://getlaidtonight.appspot.com/u_YFPyaBmtJ0LwZ1LxYUzuZEjhWVPnZ03ja1PfWkvna0fjXA3gYUOtMEeuYxT4ZVOtbA7wJxjjLEOxMUWwJ0StaETyXVHdWVTjakHfW0fjai=mZ1PrWUjqJkLtZQ7xJxO2LhCwJSCuKBOzKRSvMBGq HTTP 302
    http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182, Page URL
  2. http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612 Page URL
  3. http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F%3Fbo%3D2753%2C2754%2C2755%2C2756%26aff_sub%3D12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn Page URL
  4. https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn Page URL
  5. https://a.vfghc.com/5ebaf2b6-842f-426b-ad3e-692b8b592f3a?subID1=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&affiliateID=74548&source=102ec88c5e50d691b9b3facc5c93ff&subID2=68574&Brn=%7Bbnr%7D HTTP 302
    https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo=2753,2754,2755,2756 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://getlaidtonight.appspot.com/u_YFPyaBmtJ0LwZ1LxYUzuZEjhWVPnZ03ja1PfWkvna0fjXA3gYUOtMEeuYxT4ZVOtbA7wJxjjLEOxMUWwJ0StaETyXVHdWVTjakHfW0fjai=mZ1PrWUjqJkLtZQ7xJxO2LhCwJSCuKBOzKRSvMBGq HTTP 302
  • http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
Request Chain 7
  • https://www.google-analytics.com/r/collect?v=1&_v=j77&a=204084344&t=pageview&_s=1&dl=http%3A%2F%2Fonlythebest.email%2Fclick.track%3FCID%3D383453%26AFID%3D21845%26ADID%3D1858153%26SID%3D48612&dr=http%3A%2F%2Fcrossimplicationestablished.bid%2F8h0k5zmt%2Ft%2Fr%2F9e4d39f2%2Fe%2Fpeter_auerbacher%40hotmail.com%2Fs%2F48612-A004515182%2C&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=oGBAAUAB~&jid=1634117864&gjid=1070891429&cid=554578647.1562841504&tid=UA-109215160-2&_gid=286983386.1562841504&_r=1&gtm=2ou6q1&z=950444533 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_gid=286983386.1562841504&gjid=1070891429&_v=j77&z=950444533 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_v=j77&z=950444533 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_v=j77&z=950444533&slf_rd=1&random=2864743822

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
48612-A004515182,
crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/
Redirect Chain
  • https://getlaidtonight.appspot.com/u_YFPyaBmtJ0LwZ1LxYUzuZEjhWVPnZ03ja1PfWkvna0fjXA3gYUOtMEeuYxT4ZVOtbA7wJxjjLEOxMUWwJ0StaETyXVHdWVTjakHfW0fjai=mZ1PrWUjqJkLtZQ7xJxO2LhCwJSCuKBOzKRSvMBGq
  • http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
44 KB
44 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
Protocol
HTTP/1.1
Server
35.197.52.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
214.52.197.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
22445b0cad41068ccc57ab8b473b9a02d4313313c7d8b43296dac90a48f3dc57

Request headers

Host
crossimplicationestablished.bid
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 11 Jul 2019 10:38:20 GMT
content-type
text/html; charset=UTF-8
content-length
44854
connection
close
server
Apache

Redirect headers

status
302
location
http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
content-type
text/html
x-cloud-trace-context
f94195803de62860308ad5aca24fb863
date
Thu, 11 Jul 2019 10:38:04 GMT
server
Google Frontend
content-length
0
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
fp.php
crossimplicationestablished.bid/images/ 		0
0
click.track
onlythebest.email/ 		868 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
Requested by
Host: crossimplicationestablished.bid
URL: http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
Protocol
HTTP/1.1
Server
52.14.194.249 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-14-194-249.us-east-2.compute.amazonaws.com
Software
Apache /
Resource Hash
5c3629add822d6e98bc1cbd83d9a9a14b08d4f837d1d40a0caeb0071d039cd60

Request headers

Host
onlythebest.email
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://crossimplicationestablished.bid/8h0k5zmt/t/r/9e4d39f2/e/peter_auerbacher@hotmail.com/s/48612-A004515182,

Response headers

Date
Thu, 11 Jul 2019 10:38:23 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
868
Connection
keep-alive
Server
Apache
js
www.googletagmanager.com/gtag/ 		65 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-109215160-2
Requested by
Host: onlythebest.email
URL: http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0dbbcd7b360c2a707356ac552c61914265c068a546f2fba561d756a0f65e2b52
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 11 Jul 2019 10:38:23 GMT
content-encoding
br
last-modified
Thu, 11 Jul 2019 09:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
25677
x-xss-protection
0
expires
Thu, 11 Jul 2019 10:38:23 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-109215160-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jun 2019 21:35:04 GMT
server
Golfe2
age
6675
date
Thu, 11 Jul 2019 08:47:08 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17707
expires
Thu, 11 Jul 2019 10:47:08 GMT
sanitize.go
onlythebest.email/ 		282 B
439 B 		Document
General
Check archive.org
Download Go to
Full URL
http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F%3Fbo%3D2753%2C2754%2C2755%2C2756%26aff_sub%3D12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
Requested by
Host: onlythebest.email
URL: http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
Protocol
HTTP/1.1
Server
52.14.194.249 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-14-194-249.us-east-2.compute.amazonaws.com
Software
Apache /
Resource Hash

Request headers

Host
onlythebest.email
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612

Response headers

Date
Thu, 11 Jul 2019 10:38:23 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
282
Connection
keep-alive
Server
Apache
collect
www.google-analytics.com/ 		35 B
158 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://onlythebest.email/click.track?CID=383453&AFID=21845&ADID=1858153&SID=48612
Origin
http://onlythebest.email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 11 Jul 2019 10:38:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
http://onlythebest.email
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j77&a=204084344&t=pageview&_s=1&dl=http%3A%2F%2Fonlythebest.email%2Fclick.track%3FCID%3D383453%26AFID%3D21845%26ADID%3D1858153%26SID%3D48612&dr=htt...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_gid=286983386.1562841504&gjid=1070891429&_v=j77&z=950444533
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_v=j77&z=950444533
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_v=j77&z=950444533&slf_rd=1&random=2864743822
0
0
/
t.hrtyi.com/np7rjk33gg/68574/5766/0/ 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
Requested by
Host: onlythebest.email
URL: http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F%3Fbo%3D2753%2C2754%2C2755%2C2756%26aff_sub%3D12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.242.109 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
109.242.178.107.bc.googleusercontent.com
Software
nginx/1.13.12 / Express
Resource Hash
50f167258967d2f82fe8b7eb7039e8efb7bd744c0921d9340be90ded515b3166

Request headers

:method
GET
:authority
t.hrtyi.com
:scheme
https
:path
/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F%3Fbo%3D2753%2C2754%2C2755%2C2756%26aff_sub%3D12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://onlythebest.email/sanitize.go?url=https%3A%2F%2Ft.hrtyi.com%2Fnp7rjk33gg%2F68574%2F5766%2F0%2F%3Fbo%3D2753%2C2754%2C2755%2C2756%26aff_sub%3D12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn

Response headers

status
200
x-powered-by
Express
actioncode
0
realaction
/aff_c
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=iso-8859-1
date
Thu, 11 Jul 2019 10:38:23 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
p3p
CP="NOI CUR OUR NOR INT"
pragma
no-cache
server
nginx/1.13.12
set-cookie
enc_aff_session_5766=ENC032ae8c43d45294abeabab4c6abea9da21c58b3875df7c1a9e30b1b112ddbaae4e8dea2f2969c93e5f5e84e4d570eb04b914ed59b8f206457e5fdeb50b390df19e1cd1c5ffd8b85ecf3f2fdbeace8b552ad2b1fc6a9f265f57c8ea05375990f653c83d963b7d1a35e51b4cbb48147c972723b3eb34f704e9a97936520e5fdd41ffce10c876a5a89d34e62b5cc79bd11b489b35559e42acbfdb4d1362e1ec095e9bed8a8c118bb0c7126641e4ea898679cab9838d816ed9ac19af148a340e4198c311d68d852a750e1860dc63288cf0e206086192ccc34761659e386cb61094b353e222b5551fcd1fccb5e43a901219eaad4f7e7b85e01052552cbf8a54b5ab2c830b6786017222ead424d722daf8e870daf79cca6fdcd089a829d6416f0a322b073ccb4ecc220d7a1f751ee565df5c35f725bfd53751ff180ce3237a648d9ad64914cb0b46; expires=Sat, 10 Jul 2021 10:38:23 GMT; path=/; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI3NC4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzE0XzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS83NC4wLjM3MjkuMTY5IFNhZmFyaS81MzcuMzYiLCJjb25uZWN0aW9uX3NwZWVkIjoiYnJvYWRiYW5kIn0=; expires=Sat, 04 Jun 2022 21:18:23 GMT; path=/;
tracking_id
102ec88c5e50d691b9b3facc5c93ff
x-robots-tag
noindex, nofollow
content-length
1891
access-control-allow-origin
*
etag
W/"763-TS10wgTh5M6mCL4KumpwrnLgwVs"
via
1.1 google
alt-svc
clear
history.js
ckstatic.com/js/historyjs/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ckstatic.com/js/historyjs/history.js
Requested by
Host: t.hrtyi.com
URL: https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
2324fa2acc1382ed8b1306e981e5c2273e57a0532efd1d6a5a0a4a0aab22d045

Request headers

Referer
https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 11 Jul 2019 10:38:23 GMT
Content-Encoding
gzip
Last-Modified
Thu, 04 Dec 2014 21:06:56 GMT
ETag
"1417727216"
X-HW
1562841503.dop027.fr8.t,1562841503.cds006.fr8.shn,1562841503.dop027.fr8.t,1562841503.cds105.fr8.c
Content-Type
text/javascript
Cache-Control
max-age=60869
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
6880
Primary Request /
t.vfgtc.com/5wszez6v7k/74548/3785/0/
Redirect Chain
  • https://a.vfghc.com/5ebaf2b6-842f-426b-ad3e-692b8b592f3a?subID1=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&affiliateID=74548&source=102ec88c5e50d691b9b3facc5c93ff&subID2=68574&Brn=%7Bbnr%7D
  • https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo...
2 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo=2753,2754,2755,2756
Requested by
Host: t.hrtyi.com
URL: https://t.hrtyi.com/np7rjk33gg/68574/5766/0/?bo=2753,2754,2755,2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.242.109 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
109.242.178.107.bc.googleusercontent.com
Software
nginx/1.13.12 / Express
Resource Hash

Request headers

:method
GET
:authority
t.vfgtc.com
:scheme
https
:path
/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo=2753,2754,2755,2756
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://t.hrtyi.com/nycplivmwx?nopop=1&bo=2754%2C2755%2C2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_id=68574&offer_id=5766&url_id=0&campaign_id=2753
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://t.hrtyi.com/nycplivmwx?nopop=1&bo=2754%2C2755%2C2756&aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_id=68574&offer_id=5766&url_id=0&campaign_id=2753

Response headers

status
200
x-powered-by
Express
actioncode
0
realaction
/aff_c
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=iso-8859-1
date
Thu, 11 Jul 2019 10:38:34 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
p3p
CP="NOI CUR OUR NOR INT"
pragma
no-cache
server
nginx/1.13.12
set-cookie
enc_aff_session_3785=ENC032d1d5a3e379cc8a12481c7cc54c220319fcbdd2f1c815e675cffdf0b6d0a283bb5296f62f916cdac066890f31cc513ef7dd03690517b446387ed9ad5ff5ebc61caec30482191d8454ce938d5a1b87bb3169f9bec298b3fc8b4970e6de56c999ae2d4c54d02e3bb91563ab6a670cb6deb2289072b13c19e8ee0291aad708dfb3b5d6fa7b70e6b3fed0b38bcbfe263aed4f2b50ceae92343f0f4627dfd638168c9efd4c5fff7d0aa1aeb028863867d93e65a8952325094c5349fa1d12d28ebeaba83f52d30abc867535d49b64cee278da17fbb5989f94345fa87067fdbcdd9cdc0569c31862a7b7416d2b646bfe7f0a53e4c3ef08d2840a5d714fbf14ebe58d59fb1ffb0bc5128a0b53353def23fce8f6ac782a3540534a8b0b5ec9a7d2a36fc0d0262b173a14c05122c9e98623c302a3563611e6ced0e748c2d8035ebc126be5b6393767da01772aac7e787c1bfe704419ec3403fb75b7fe4a0496ef74ebb56060c2eb8f0; expires=Sat, 10 Jul 2021 10:38:34 GMT; path=/; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI3NC4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzE0XzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS83NC4wLjM3MjkuMTY5IFNhZmFyaS81MzcuMzYiLCJjb25uZWN0aW9uX3NwZWVkIjoiYnJvYWRiYW5kIn0=; expires=Sat, 04 Jun 2022 21:18:34 GMT; path=/;
tracking_id
1024d86d33c4c6890b2a1e312c8f16
x-robots-tag
noindex, nofollow
content-length
2233
access-control-allow-origin
*
etag
W/"8b9-0TBraEJsMD4x7/2CwzCkc6BwuM4"
via
1.1 google
alt-svc
clear

Redirect headers

Server
nginx
Date
Thu, 11 Jul 2019 10:38:27 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://t.vfgtc.com/5wszez6v7k/74548/3785/0/?aff_sub=12141475_xCxt33vDzvM33NGo9x4w7ouhcfXg5Xfn&aff_sub2=68574&aff_sub3=w7G97QSSE5D8LQQN139ED4CI&source=102ec88c5e50d691b9b3facc5c93ff&nopop=1&bnr=&bo=2753,2754,2755,2756
Pragma
no-cache
Set-Cookie
5ebaf2b6-842f-426b-ad3e-692b8b592f3a-v4=5ebaf2b6-842f-426b-ad3e-692b8b592f3a;Max-Age=86400;Expires=Fri, 12-Jul-2019 10:38:27 GMT;domain=a.vfghc.com;path=/;HttpOnly cc-v4=jrC40p1JT858lHeny6SdY1FADuoG5t1cvZDAyWYh%2FrAFPiMSTjAxEdXNbfImuJoBUeAmBbO%2F3OxYQRuLt1u6weifLxpW6y2wPh6yPsQstAhD2e2%2FGe7D8QitjpU1SdVRaT3kyK2kErQQKAGczKyJEQ%3D%3D;Max-Age=31536000;Expires=Fri, 10-Jul-2020 10:38:27 GMT;domain=a.vfghc.com;path=/;HttpOnly

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
crossimplicationestablished.bid
URL
http://crossimplicationestablished.bid/images/fp.php?e=pTI0MKWsLKIypzWuL2uypxObo3EgLJyfYzAioD&p=f1439b81e3be8fb69f4190e8a272a827&r=006876f7
Domain
www.google.de
URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-109215160-2&cid=554578647.1562841504&jid=1634117864&_v=j77&z=950444533&slf_rd=1&random=2864743822

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

2 Cookies

Domain/Path Name / Value
t.hrtyi.com/ Name: ho_mob
Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI3NC4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzE0XzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS83NC4wLjM3MjkuMTY5IFNhZmFyaS81MzcuMzYiLCJjb25uZWN0aW9uX3NwZWVkIjoiYnJvYWRiYW5kIn0=
t.hrtyi.com/ Name: enc_aff_session_5766
Value: ENC032ae8c43d45294abeabab4c6abea9da21c58b3875df7c1a9e30b1b112ddbaae4e8dea2f2969c93e5f5e84e4d570eb04b914ed59b8f206457e5fdeb50b390df19e1cd1c5ffd8b85ecf3f2fdbeace8b552ad2b1fc6a9f265f57c8ea05375990f653c83d963b7d1a35e51b4cbb48147c972723b3eb34f704e9a97936520e5fdd41ffce10c876a5a89d34e62b5cc79bd11b489b35559e42acbfdb4d1362e1ec095e9bed8a8c118bb0c7126641e4ea898679cab9838d816ed9ac19af148a340e4198c311d68d852a750e1860dc63288cf0e206086192ccc34761659e386cb61094b353e222b5551fcd1fccb5e43a901219eaad4f7e7b85e01052552cbf8a54b5ab2c830b6786017222ead424d722daf8e870daf79cca6fdcd089a829d6416f0a322b073ccb4ecc220d7a1f751ee565df5c35f725bfd53751ff180ce3237a648d9ad64914cb0b46