v115323.pi6p.com Open in urlscan Pro
162.55.4.52 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://skywaysuae.com/
Effective URL:
https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7355799310291697671&pub=1314&pid=1314-24e31f9z&c=0&app=unkno...
Submission: On April 09 via manual (April 9th 2024, 9:38:14 am UTC) from IN — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 9 HTTP transactions. The main IP is 162.55.4.52, located in Bergen, Germany and belongs to HETZNER-AS, DE. The main domain is v115323.pi6p.com.
TLS certificate: Issued by R3 on March 7th 2024. Valid for: 3 months.

This is the only time v115323.pi6p.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	154.16.170.58 154.16.170.58	397423 (TIER-NET) (TIER-NET)
2	2606:4700:303... 2606:4700:3032::ac43:9c3b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	185.155.186.17 185.155.186.17	203639 (TEKNOLOGY) (TEKNOLOGY)
1 2	185.155.186.25 185.155.186.25	203639 (TEKNOLOGY) (TEKNOLOGY)
1	67.212.184.147 67.212.184.147	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	162.55.4.52 162.55.4.52	24940 (HETZNER-AS) (HETZNER-AS)
9	6

2 154.16.170.58 (Dallas, United States)

ASN397423 (TIER-NET, US)

skywaysuae.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3032::ac43:9c3b (United States)

ASN13335 (CLOUDFLARENET, US)

distie.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

radiant.growsier.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.155.186.17 (Switzerland)

ASN203639 (TEKNOLOGY, CH)

flirtfrenzy.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.155.186.25 (Switzerland) 1 redirects

ASN203639 (TEKNOLOGY, CH)

t06k1tb.hellsixfirm.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.212.184.147 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

take.bestdealfor8.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.55.4.52 (Bergen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.52.4.55.162.clients.your-server.de

v115323.pi6p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	hellsixfirm.live 1 redirects t06k1tb.hellsixfirm.live	2 KB
2	flirtfrenzy.life flirtfrenzy.life	62 KB
2	distie.shop distie.shop — Cisco Umbrella Rank: 976266	8 KB
2	skywaysuae.com skywaysuae.com	264 B
1	pi6p.com v115323.pi6p.com	159 KB
1	bestdealfor8.fun take.bestdealfor8.fun	2 KB
1	growsier.shop 1 redirects radiant.growsier.shop	763 B
9	7

	Domain	Requested by
2	t06k1tb.hellsixfirm.live	1 redirects flirtfrenzy.life
2	flirtfrenzy.life	distie.shop
2	distie.shop	skywaysuae.com distie.shop
2	skywaysuae.com
1	v115323.pi6p.com	take.bestdealfor8.fun
1	take.bestdealfor8.fun	t06k1tb.hellsixfirm.live
1	radiant.growsier.shop	1 redirects
9	7

This site contains no links.

Subject Issuer	Validity	Valid
*.skywaysuae.com R3	`2024-04-07` - `2024-07-06`	3 months	crt.sh
distie.shop GTS CA 1P5	`2024-03-26` - `2024-06-24`	3 months	crt.sh
flirtfrenzy.life R3	`2024-03-25` - `2024-06-23`	3 months	crt.sh
hellsixfirm.live R3	`2024-04-08` - `2024-07-07`	3 months	crt.sh
take.bestdealfor8.fun R3	`2024-03-31` - `2024-06-29`	3 months	crt.sh
v115323.pi6p.com R3	`2024-03-07` - `2024-06-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7355799310291697671&pub=1314&pid=1314-24e31f9z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
Frame ID: CA2CDBCA0BEAB0919237819DBAD78B3D
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

just have first they

Page URL History Show full URLs

http://skywaysuae.com/ HTTP 307
https://skywaysuae.com/ Page URL
https://radiant.growsier.shop/help/?30721707351057 HTTP 302
https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc Page URL
https://t06k1tb.hellsixfirm.live/fprcjwrq/?u=bt1k60t&o=xqt63qn&t=cid%3A10750&cid=10750-13926-202404091238066f... Page URL
https://t06k1tb.hellsixfirm.live/web/?sid=t3~dnhume1yzdgzhn35dimxsmzk HTTP 302
https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid... Page URL
https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7355799310291697671&pub=1314&pid=1314-24... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

233 kB
Transfer

250 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://skywaysuae.com/ HTTP 307
https://skywaysuae.com/ Page URL
https://radiant.growsier.shop/help/?30721707351057 HTTP 302
https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc Page URL
https://t06k1tb.hellsixfirm.live/fprcjwrq/?u=bt1k60t&o=xqt63qn&t=cid%3A10750&cid=10750-13926-202404091238066fbc&f=1&sid=t3~dnhume1yzdgzhn35dimxsmzk&fp=ewCR0IwUKVHyimepCOxPUg%3D%3D Page URL
https://t06k1tb.hellsixfirm.live/web/?sid=t3~dnhume1yzdgzhn35dimxsmzk HTTP 302
https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1 Page URL
https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7355799310291697671&pub=1314&pid=1314-24e31f9z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://skywaysuae.com/ HTTP 307
https://skywaysuae.com/

Request Chain 4

https://radiant.growsier.shop/help/?30721707351057 HTTP 302
https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc

Request Chain 7

https://t06k1tb.hellsixfirm.live/web/?sid=t3~dnhume1yzdgzhn35dimxsmzk HTTP 302
https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
skywaysuae.com/
Redirect Chain

http://skywaysuae.com/
https://skywaysuae.com/

74 B
167 B

401ms
134ms

Document
text/html

154.16.170.58
TIER-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://skywaysuae.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.16.170.58 Dallas, United States, ASN397423 (TIER-NET, US),
Reverse DNS
Software: Apache / PHP/7.4.33
Resource Hash: 704b6efe567169febb7fcf0df956c118fb88c7ed4980353c8f0eb6d22e7e1128

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 09 Apr 2024 09:38:06 GMT
server: Apache
x-powered-by: PHP/7.4.33

Redirect headers

Location: https://skywaysuae.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 custom.js Show response
distie.shop/ 21 KB
7 KB 54ms
18ms Script
application/javascript 2606:4700:3032::ac43:9c3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://distie.shop/custom.js?query=30721707351057
Requested by: Host: skywaysuae.com
URL: https://skywaysuae.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:9c3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fea930684c61249d1a3cb518669ebe6c7dd088c8d446c44cc1515182f21856bc

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://skywaysuae.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 09:38:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Dec 2023 05:17:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3737
etag: W/"65700401-55f4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CwthW1vIwRX6CpI6%2F28kcmeZ6OrZgtaqesWiV9kL5jhjj7lF5t3uVCz9Afapw%2BMrJYDcP3eO4S0fwwd2Pk2ZPVx2exC4HxN3%2FsLYRaZeDllpbRE%2FHjVf1UoPe32MOwc%2FT5m8vyuEYognQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 871985b389fc3631-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 / Show response
distie.shop/ 52 B
524 B 338ms
320ms Fetch
text/html 2606:4700:3032::ac43:9c3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://distie.shop/?t=json
Requested by: Host: distie.shop
URL: https://distie.shop/custom.js?query=30721707351057
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:9c3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.18
Resource Hash: fb8f071561c23d4a58fd935a7a896e28a42f970ef680c7bc459fde74c0d73e24

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://skywaysuae.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 09:38:06 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.2.18
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IfgJDlGkj1KVyXjdlIY%2Fm1lEcyippAUhWozZMSfOsQvwFGiOBbeqBtQTu06TIOA5b9kbw7iws6lWxf89zQlMwZJfCA4g3DPY4wIUazaN7ec5N0aWM3G6mXYf2e2jqRRWw8nJOnN%2Fzm%2B33w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cf-ray: 871985b3ee18901c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 favicon.ico
skywaysuae.com/ 74 B
97 B 133ms
133ms Other
text/html 154.16.170.58
TIER-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://skywaysuae.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.16.170.58 Dallas, United States, ASN397423 (TIER-NET, US),
Reverse DNS
Software: Apache / PHP/7.4.33
Resource Hash: 704b6efe567169febb7fcf0df956c118fb88c7ed4980353c8f0eb6d22e7e1128

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://skywaysuae.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 09:38:06 GMT
server: Apache
x-powered-by: PHP/7.4.33
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

/
flirtfrenzy.life//
Redirect Chain

https://radiant.growsier.shop/help/?30721707351057
https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc

61 KB
62 KB

169ms
104ms

Document
text/html

185.155.186.17
TEKNOLOGY

General

Check archive.org

Show headers Download Go to

Full URL: https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc
Requested by: Host: distie.shop
URL: https://distie.shop/custom.js?query=30721707351057
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.186.17 , Switzerland, ASN203639 (TEKNOLOGY, CH),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://skywaysuae.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Length: 62695
Content-Type: text/html
Date: Tue, 09 Apr 2024 09:38:07 GMT
Server: nginx
cache-control: private

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 871985b61c3b4dbd-FRA
content-type: text/html; charset=utf-8
date: Tue, 09 Apr 2024 09:38:06 GMT
expires: Thu, 21 Jul 1977 07:30:00 GMT
last-modified: Tue, 09 Apr 2024 09:38:06 GMT
location: https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pj35k8%2F35sMjCQLBEvCz%2Fnxk9VayE%2Fy%2F%2F5VjwGGEYgQ1f1gGR1PTZLq226MO6SCz1dvtuM0sZvUQClZ8vbH5Lp3u%2BqgUzhAt54p98NPFMqNLrIfieRKCfs8QFHlwCO6w3rEy5CdZ2RIlp0fJM836J6qO0pU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.0.33

GET
H/1.1 200
OK /
t06k1tb.hellsixfirm.live/fprcjwrq/ 2 KB
2 KB 176ms
103ms Document
text/html 185.155.186.25
TEKNOLOGY

General

Check archive.org

Show headers Download Go to

Full URL: https://t06k1tb.hellsixfirm.live/fprcjwrq/?u=bt1k60t&o=xqt63qn&t=cid%3A10750&cid=10750-13926-202404091238066fbc&f=1&sid=t3~dnhume1yzdgzhn35dimxsmzk&fp=ewCR0IwUKVHyimepCOxPUg%3D%3D
Requested by: Host: flirtfrenzy.life
URL: https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server: 185.155.186.25 , Switzerland, ASN203639 (TEKNOLOGY, CH),
Reverse DNS
Software: openresty /
Resource Hash

Request headers

Referer: https://flirtfrenzy.life/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Length: 1624
Content-Type: text/html
Date: Tue, 09 Apr 2024 09:38:07 GMT
Server: openresty
cache-control: private

GET
H/1.1 204
No Content favicon.ico
flirtfrenzy.life/ 0
132 B 23ms
23ms Other
text/plain 185.155.186.17
TEKNOLOGY

General

Check archive.org

Show headers Download Go to

Full URL: https://flirtfrenzy.life/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.186.17 , Switzerland, ASN203639 (TEKNOLOGY, CH),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://flirtfrenzy.life//?u=bt1k60t&o=xqt63qn&t=cid:10750&cid=10750-13926-202404091238066fbc
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 09 Apr 2024 09:38:07 GMT
Cache-Control: no-transform
Server: nginx
Connection: keep-alive

GET
H2

200

/
take.bestdealfor8.fun/
Redirect Chain

https://t06k1tb.hellsixfirm.live/web/?sid=t3~dnhume1yzdgzhn35dimxsmzk
https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1

7 KB
2 KB

478ms
121ms

Document
text/html

67.212.184.147
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1

Requested by

Host: t06k1tb.hellsixfirm.live
URL: https://t06k1tb.hellsixfirm.live/fprcjwrq/?u=bt1k60t&o=xqt63qn&t=cid%3A10750&cid=10750-13926-202404091238066fbc&f=1&sid=t3~dnhume1yzdgzhn35dimxsmzk&fp=ewCR0IwUKVHyimepCOxPUg%3D%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.212.184.147 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://t06k1tb.hellsixfirm.live/fprcjwrq/?u=bt1k60t&o=xqt63qn&t=cid%3A10750&cid=10750-13926-202404091238066fbc&f=1&sid=t3~dnhume1yzdgzhn35dimxsmzk&fp=ewCR0IwUKVHyimepCOxPUg%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
alt-svc: h3=":443"; ma=604800; persist=1
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 09 Apr 2024 09:38:08 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 277
Content-Type: text/html; charset=utf-8
Date: Tue, 09 Apr 2024 09:38:07 GMT
Server: openresty
location: https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1
referrer-policy: no-referrer

GET
H/1.1 302
Found Primary Request go.php Show response
v115323.pi6p.com/ 158 KB
159 KB 349ms
321ms Document
text/html 162.55.4.52
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7355799310291697671&pub=1314&pid=1314-24e31f9z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0

Requested by

Host: take.bestdealfor8.fun
URL: https://take.bestdealfor8.fun/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=cab5242e-efe4-4d61-9c11-13e57526e610&np=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

162.55.4.52 Bergen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.52.4.55.162.clients.your-server.de

Software

nginx/1.24.0 /

Resource Hash

15ea0bee333540e60d718c937e66c01c6162acd457ec9f8e352d3aaf4f942e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://take.bestdealfor8.fun/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Apr 2024 09:38:08 GMT
Server: nginx/1.24.0
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.radiant.growsier.shop/	1970-01-20 20:28:53	Name: 00831 Value: %7B%22streams%22%3A%7B%2213926%22%3A1712655486%7D%2C%22campaigns%22%3A%7B%2210750%22%3A1712655486%7D%2C%22time%22%3A1712655486%7D
flirtfrenzy.life/	1969-12-31 23:59:59	Name: sid Value: t3~dnhume1yzdgzhn35dimxsmzk
flirtfrenzy.life/	1969-12-31 23:59:59	Name: p1 Value: https://hellsixfirm.live/fprcjwrq/
flirtfrenzy.life/	1969-12-31 23:59:59	Name: s1 Value: nhqtmtkkas8gw3nb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

distie.shop
flirtfrenzy.life
radiant.growsier.shop
skywaysuae.com
t06k1tb.hellsixfirm.live
take.bestdealfor8.fun
v115323.pi6p.com
154.16.170.58
162.55.4.52
185.155.186.17
185.155.186.25
2606:4700:3032::ac43:9c3b
2a06:98c1:3121::3
67.212.184.147
15ea0bee333540e60d718c937e66c01c6162acd457ec9f8e352d3aaf4f942e78
704b6efe567169febb7fcf0df956c118fb88c7ed4980353c8f0eb6d22e7e1128
fb8f071561c23d4a58fd935a7a896e28a42f970ef680c7bc459fde74c0d73e24
fea930684c61249d1a3cb518669ebe6c7dd088c8d446c44cc1515182f21856bc

v115323.pi6p.com Open in urlscan Pro 162.55.4.52 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

29 %IPv6

7 Domains

7 Subdomains

6 IPs

3 Countries

233 kBTransfer

250 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

4 Cookies

Indicators

v115323.pi6p.com Open in urlscan Pro
162.55.4.52 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

233 kB
Transfer

250 kB
Size

4
Cookies

9 HTTP transactions
0 data transactions