6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com Open in urlscan Pro
2001:bc8:6010:20b:ec4:7aff:fe09:670e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
Submission: On September 27 via manual (September 27th 2019, 1:45:41 am UTC) from US

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 5 countries across 9 domains to perform 16 HTTP transactions. The main IP is 2001:bc8:6010:20b:ec4:7aff:fe09:670e, located in France and belongs to AS12876, FR. The main domain is 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on February 20th 2018. Valid for: 3 years.

This is the only time 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2001:bc8:6010... 2001:bc8:6010:20b:ec4:7aff:fe09:670e	12876 (AS12876) (AS12876)
5	2606:4700:30:... 2606:4700:30::681b:bafd	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	173.192.101.24 173.192.101.24	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
2	108.168.193.183 108.168.193.183	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
1 2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:4001:821::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
5	94.31.29.128 94.31.29.128	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
16	6

2 2001:bc8:6010:20b:ec4:7aff:fe09:670e (France)

ASN12876 (AS12876, FR)

6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:30::681b:bafd (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ccd.abcddfhvffddcddfrewsd.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.192.101.24 (Dallas, United States) 1 redirects

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 18.65.c0ad.ip4.static.sl-reverse.com

p257699.clksite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.168.193.183 (Dallas, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: b7.c1.a86c.ip4.static.sl-reverse.com

mybestdc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 94.31.29.128 (United Kingdom)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
PTR: 94.31.29.128.IPYX-077437-ZYO.above.net

p257699.mycdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	mycdn.co p257699.mycdn.co	85 KB
5	abcddfhvffddcddfrewsd.tk ccd.abcddfhvffddcddfrewsd.tk	14 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	mybestdc.com mybestdc.com	14 KB
2	htmlpasta.com 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com	2 KB
1	google.de www.google.de	109 B
1	google.com 1 redirects www.google.com	192 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net	160 B
1	clksite.com 1 redirects p257699.clksite.com	275 B
16	9

	Domain	Requested by
5	p257699.mycdn.co	mybestdc.com p257699.mycdn.co
5	ccd.abcddfhvffddcddfrewsd.tk	6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
2	www.google-analytics.com	1 redirects 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
2	mybestdc.com	6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com p257699.mycdn.co
2	6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com	6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
1	www.google.de	6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	p257699.clksite.com	1 redirects
16	9

This site contains links to these domains. Also see Links.

Domain
app.appsflyer.com

Subject Issuer	Validity	Valid
*.htmlpasta.com COMODO RSA Domain Validation Secure Server CA	`2018-02-20` - `2021-02-19`	3 years	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-09-02` - `2020-09-01`	a year	crt.sh
*.mybestdc.com Sectigo RSA Domain Validation Secure Server CA	`2019-07-11` - `2020-07-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
www.google.de GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.mycdn.co COMODO RSA Domain Validation Secure Server CA	`2018-10-15` - `2019-10-22`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
Frame ID: 69E147C4CDC31C5C9056D8B91F113365
Requests: 14 HTTP requests in this frame

Frame: https://p257699.mycdn.co/uicomp/styles/dist/80.2-1/it-banner-frame.css
Frame ID: 6ECEA4E958CE676860DD2546F49572AD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

9
Domains

9
Subdomains

6
IPs

5
Countries

133 kB
Transfer

324 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://app.appsflyer.com/id1471120312?https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/&pid=voluumtracker_int&af_sub1=adextra
Title: Remove Virus

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://p257699.clksite.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6 HTTP 301
https://mybestdc.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6

Request Chain 8

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1993305362&t=pageview&_s=1&dl=https%3A%2F%2F6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com%2F&dp=%2F6a1a012f-0f67-4e33-8e33-fb962666f17d.html&ul=en-us&de=UTF-8&dt=Your%20iPhone%20Has%20Been%20Compromised&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1879933159&gjid=900590182&cid=69885462.1569548725&tid=UA-75065234-3&_gid=2071213546.1569548725&_r=1&z=2092885470 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_gid=2071213546.1569548725&gjid=900590182&_v=j79&z=2092885470 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470&slf_rd=1&random=2599529735

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/ 3 KB
2 KB 116ms
23ms Document
text/html 2001:bc8:6010:20b:ec4:7aff:fe09:670e
AS12876

General

Check archive.org

Show headers Download Go to

Full URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:bc8:6010:20b:ec4:7aff:fe09:670e , France, ASN12876 (AS12876, FR),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: ea53acd995ef3ff3cb4dd4abb4b6ee4f1a8694f78f655e142647e19e1a3b2cbc

Request headers

:method: GET
:authority: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx/1.14.0 (Ubuntu)
date: Fri, 27 Sep 2019 01:45:24 GMT
content-type: text/html
content-length: 1499
content-encoding: gzip

GET
H2 404 css
6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/files/ 0
0 22ms
21ms Stylesheet
text/html 2001:bc8:6010:20b:ec4:7aff:fe09:670e
AS12876

General

Check archive.org

Show headers Download Go to

Full URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/files/css
Requested by: Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:bc8:6010:20b:ec4:7aff:fe09:670e , France, ASN12876 (AS12876, FR),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Fri, 27 Sep 2019 01:45:25 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
content-type: text/html

GET
H2 200 style.css
ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/ 1 KB
475 B 105ms
51ms Stylesheet
text/css 2606:4700:30::681b:bafd
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/style.css

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:bafd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

274869b42aba7fedba04e7a59db5b7c3ff17d9cf3fa06128a1e33f8ffd7e2120

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:25 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 11 Jul 2019 13:12:00 GMT
server: cloudflare
age: 892
etag: W/"5d2735a0-560"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
strict-transport-security: max-age=15552000
cf-ray: 51c9cc4b9ff6cba4-VIE
expires: Fri, 27 Sep 2019 05:45:25 GMT

GET
H2 200 logo-icon.png
ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/ 1 KB
1 KB 103ms
49ms Image
image/png 2606:4700:30::681b:bafd
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/logo-icon.png

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:bafd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8d811b3b6d97551696f0571954790fb92d684b38760ad5b329e2dcb9b31c33f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:25 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 892
status: 200
content-length: 1396
last-modified: Thu, 11 Jul 2019 13:11:59 GMT
server: cloudflare
etag: "5d27359f-574"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 51c9cc4b9ff8cba4-VIE
expires: Fri, 27 Sep 2019 05:45:25 GMT

GET
H2 200 menu-icon.png
ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/ 1 KB
2 KB 102ms
49ms Image
image/png 2606:4700:30::681b:bafd
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/menu-icon.png

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:bafd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3744968f4bc2e9ccc552b5b74861c31cea8366624e171b574cbebf72f63878d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:25 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 892
status: 200
content-length: 1144
last-modified: Thu, 11 Jul 2019 13:12:00 GMT
server: cloudflare
etag: "5d2735a0-478"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 51c9cc4b9ff9cba4-VIE
expires: Fri, 27 Sep 2019 05:45:25 GMT

GET
H2 200 search-icon.png
ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/ 2 KB
2 KB 18ms
18ms Image
image/png 2606:4700:30::681b:bafd
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/search-icon.png

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:bafd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb3b95094dda1fbc686910da26984c4f1fe5e98b810be81e7f744deccc3de2f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:25 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 891
status: 200
content-length: 1602
last-modified: Thu, 11 Jul 2019 13:12:01 GMT
server: cloudflare
etag: "5d2735a1-642"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 51c9cc4be859cba4-VIE
expires: Fri, 27 Sep 2019 05:45:25 GMT

GET
H2 200 store-icon.png
ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/ 9 KB
9 KB 19ms
18ms Image
image/png 2606:4700:30::681b:bafd
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ccd.abcddfhvffddcddfrewsd.tk/blocker/v4/files/store-icon.png

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:bafd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfe21f4e8036f693acfcdd102cf2f00ecaac3077c4ea87f9bcc369bcc35b1d31

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:25 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 891
status: 200
content-length: 9480
last-modified: Thu, 11 Jul 2019 13:12:00 GMT
server: cloudflare
etag: "5d2735a0-2508"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 51c9cc4be863cba4-VIE
expires: Fri, 27 Sep 2019 05:45:25 GMT

GET
H/1.1

200

banners Show response
mybestdc.com/adServe/
Redirect Chain

https://p257699.clksite.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6
https://mybestdc.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6

34 KB
13 KB

523ms
132ms

Script
text/javascript

108.168.193.183
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://mybestdc.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6
Requested by: Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.168.193.183 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: b7.c1.a86c.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash: 962b56010ef1b8363db57faf93698d26a1c22de866f8b21d2f88ec9c2eb139b2

Request headers

Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 27 Sep 2019 01:45:26 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=5
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://mybestdc.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6
Date: Fri, 27 Sep 2019 01:45:25 GMT
Server: nginx
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 178
Content-Type: text/html

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 4767
date: Fri, 27 Sep 2019 00:25:58 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Fri, 27 Sep 2019 02:25:58 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1993305362&t=pageview&_s=1&dl=https%3A%2F%2F6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com%2F&dp=%2F6a1a012f-0f67-4e33-8e33-fb962666f17d....
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_gid=2071213546.1569548725&gjid=900590182&_v=j79&z=2092885470
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470&slf_rd=1&random=2599529735

42 B
109 B

18ms
18ms

Image
image/gif

2a00:1450:4001:81c::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470&slf_rd=1&random=2599529735

Requested by

Host: 6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
URL: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Sep 2019 01:45:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 27 Sep 2019 01:45:25 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=69885462.1569548725&jid=1879933159&_v=j79&z=2092885470&slf_rd=1&random=2599529735
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ui_tag_80.2-1.js Show response
p257699.mycdn.co/banners/script/ 176 KB
53 KB 29ms
5ms Script
application/javascript 94.31.29.128
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://p257699.mycdn.co/banners/script/ui_tag_80.2-1.js
Requested by: Host: mybestdc.com
URL: https://mybestdc.com/adServe/banners?tid=257699_495604_7&type=floating_banner&size=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 8a1e59ae28b7169b8dd533eab297b904d2417a1cba84e57be30d71e7bd717feb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:26 GMT
content-encoding: gzip
last-modified: Mon, 24 Jun 2019 11:33:16 GMT
server: NetDNA-cache/2.2
etag: W/"5d10b4fc-2c04a"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
expires: Mon, 21 Sep 2020 01:45:26 GMT

GET
H2 200 it-ui-comp-6.css
p257699.mycdn.co/uicomp/styles/dist/80.2-1/ 23 KB
5 KB 6ms
5ms Stylesheet
text/css 94.31.29.128
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://p257699.mycdn.co/uicomp/styles/dist/80.2-1/it-ui-comp-6.css
Requested by: Host: p257699.mycdn.co
URL: https://p257699.mycdn.co/banners/script/ui_tag_80.2-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 62bf1e377405eb3b64149506aa8814cbbfa7ac2503be1771ff26e249e396c356

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:26 GMT
content-encoding: gzip
last-modified: Mon, 24 Jun 2019 11:33:23 GMT
server: NetDNA-cache/2.2
etag: W/"5d10b503-5da0"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=31104000
expires: Mon, 21 Sep 2020 01:45:26 GMT

GET
H/1.1 200 findBanner Show response
mybestdc.com/adServe/banners/ 797 B
1 KB 133ms
132ms Script
text/javascript 108.168.193.183
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://mybestdc.com/adServe/banners/findBanner?num=1&keyword=Your%20iPhone%20Has%20Been%20Compromised&tid=257699_495604_7&type=js&ar=b&ts=c&ito=https%3A%2F%2Fp257699.mycdn.co&bs=6&referrer=https%3A%2F%2F6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com%2F&ap=cmp%3DFLOATING_BANNER%26evp%3D1WyriM1HbTubjINtbkukIfbWwvziNp_1QR22JeacVpHlZAA6Sd2vgMuFr7qk8jCN%26sjv%3D86.0%26ctid%3D0%26th%3D1200%26tw%3D1600%26inco%3D1%26tip%3DYour%2520iPhone%2520Has%2520Been%2520Compromised&pid=257699&popeye=bXg9bnVsbCZteT1udWxsJmN4PW51bGwmY3k9bnVsbCZ3PTE2MDAmaD0xMjAwJmM9MSZzPTEmdD0xJmk9MCZvPS0xMjAmc29fZmI9LTEmc29fZ289LTEmc29fZ3A9LTEmc29fdHc9LTEmc3A9MDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAmbW1fbW49MCZtbV9hcz0wJm1tX2FkPTAmbW1fbXQ9MCZtbV9zYz0wJm1tX3NkYz0wJm5jcnM9MTY%3D&olive=1&callback=ITC0qdgsrwmmg1
Requested by: Host: p257699.mycdn.co
URL: https://p257699.mycdn.co/banners/script/ui_tag_80.2-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.168.193.183 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: b7.c1.a86c.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash: 57dc66422df7008421c91bff3a8315bdea27bbbcb40c7bf02a78226db4c487a5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 27 Sep 2019 01:45:26 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: no-cache
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Keep-Alive: timeout=5
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 it-banner-frame.css
p257699.mycdn.co/uicomp/styles/dist/80.2-1/ Frame 6ECE 2 KB
924 B 5ms
5ms Stylesheet
text/css 94.31.29.128
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://p257699.mycdn.co/uicomp/styles/dist/80.2-1/it-banner-frame.css
Requested by: Host: p257699.mycdn.co
URL: https://p257699.mycdn.co/banners/script/ui_tag_80.2-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: f5cee4255bdd9370d50ce0499da2cea95831d5f39eb7a90461a83798d414ad51

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:26 GMT
content-encoding: gzip
last-modified: Mon, 24 Jun 2019 11:33:23 GMT
server: NetDNA-cache/2.2
etag: W/"5d10b503-858"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=31104000
expires: Mon, 21 Sep 2020 01:45:26 GMT

GET
H2 200 ot_mu_6x.gif
p257699.mycdn.co/ext/onn/flo/ Frame 6ECE 25 KB
25 KB 6ms
5ms Image
image/gif 94.31.29.128
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p257699.mycdn.co/ext/onn/flo/ot_mu_6x.gif
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: ab54238133b9ea1127cffa88ae21dd282d193698ad84caf46720f50da001e8c6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:26 GMT
last-modified: Mon, 05 Feb 2018 08:26:33 GMT
server: NetDNA-cache/2.2
etag: "5a781539-647a"
x-cache: HIT
content-type: image/gif
status: 200
cache-control: max-age=31104000
accept-ranges: bytes
content-length: 25722
expires: Mon, 21 Sep 2020 01:45:26 GMT

GET
H2 200 top-close-2.png
p257699.mycdn.co/img/new-comp/ 1 KB
1 KB 5ms
5ms Image
image/png 94.31.29.128
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p257699.mycdn.co/img/new-comp/top-close-2.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 7a6d609e14ad86ba11813176879c5aafe5cfabc3b7c9f2d8e260c9176b9260b9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://p257699.mycdn.co/uicomp/styles/dist/80.2-1/it-ui-comp-6.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Sep 2019 01:45:27 GMT
last-modified: Mon, 14 Nov 2016 16:35:00 GMT
server: NetDNA-cache/2.2
etag: "5829e7b4-464"
x-cache: HIT
content-type: image/png
status: 200
cache-control: max-age=31104000
accept-ranges: bytes
content-length: 1124
expires: Mon, 21 Sep 2020 01:45:27 GMT

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.htmlpasta.com/	1970-01-19 03:59:08	Name: _gat Value: 1
6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com/	1969-12-31 23:59:59	Name: rhid_c Value: 0
.htmlpasta.com/	1970-01-19 04:00:35	Name: _gid Value: GA1.2.2071213546.1569548725
.htmlpasta.com/	1970-01-19 21:30:20	Name: _ga Value: GA1.2.69885462.1569548725

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com
ccd.abcddfhvffddcddfrewsd.tk
mybestdc.com
p257699.clksite.com
p257699.mycdn.co
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
108.168.193.183
173.192.101.24
2001:bc8:6010:20b:ec4:7aff:fe09:670e
2606:4700:30::681b:bafd
2a00:1450:4001:814::200e
2a00:1450:4001:81c::2003
2a00:1450:4001:821::2004
2a00:1450:400c:c00::9a
94.31.29.128
274869b42aba7fedba04e7a59db5b7c3ff17d9cf3fa06128a1e33f8ffd7e2120
57dc66422df7008421c91bff3a8315bdea27bbbcb40c7bf02a78226db4c487a5
62bf1e377405eb3b64149506aa8814cbbfa7ac2503be1771ff26e249e396c356
7a6d609e14ad86ba11813176879c5aafe5cfabc3b7c9f2d8e260c9176b9260b9
8a1e59ae28b7169b8dd533eab297b904d2417a1cba84e57be30d71e7bd717feb
962b56010ef1b8363db57faf93698d26a1c22de866f8b21d2f88ec9c2eb139b2
ab54238133b9ea1127cffa88ae21dd282d193698ad84caf46720f50da001e8c6
bfe21f4e8036f693acfcdd102cf2f00ecaac3077c4ea87f9bcc369bcc35b1d31
d3744968f4bc2e9ccc552b5b74861c31cea8366624e171b574cbebf72f63878d
d8d811b3b6d97551696f0571954790fb92d684b38760ad5b329e2dcb9b31c33f
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
ea53acd995ef3ff3cb4dd4abb4b6ee4f1a8694f78f655e142647e19e1a3b2cbc
eb3b95094dda1fbc686910da26984c4f1fe5e98b810be81e7f744deccc3de2f6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5cee4255bdd9370d50ce0499da2cea95831d5f39eb7a90461a83798d414ad51

6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com Open in urlscan Pro 2001:bc8:6010:20b:ec4:7aff:fe09:670e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

67 %IPv6

9 Domains

9 Subdomains

6 IPs

5 Countries

133 kBTransfer

324 kBSize

4 Cookies

1 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

4 Cookies

Indicators

6a1a012f-0f67-4e33-8e33-fb962666f17d.htmlpasta.com Open in urlscan Pro
2001:bc8:6010:20b:ec4:7aff:fe09:670e Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

67 %
IPv6

9
Domains

9
Subdomains

6
IPs

5
Countries

133 kB
Transfer

324 kB
Size

4
Cookies

16 HTTP transactions
0 data transactions