urlscan.io logo urlscan.io
SecurityTrails logo

message.freshnewmessage.com Open in urlscan Pro
2606:4700:3035::6815:2703  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://azure.microsofct.com/
Effective URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Submission Tags: @phishunt_io
Submission: On February 03 via api from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 13 domains to perform 22 HTTP transactions. The main IP is 2606:4700:3035::6815:2703, located in United States and belongs to CLOUDFLARENET, US. The main domain is message.freshnewmessage.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 11th 2021. Valid for: a year.
This is the only time message.freshnewmessage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 159.69.83.207 24940 (HETZNER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
4 167.233.8.197 24940 (HETZNER-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 78.46.155.196 24940 (HETZNER-AS)
1 2 204.155.145.103 40824 (WZCOM-)
1 116.202.159.170 24940 (HETZNER-AS)
3 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 52.218.97.96 16509 (AMAZON-02)
1 46.4.25.9 24940 (HETZNER-AS)
1 2606:4700:303... 13335 (CLOUDFLAR...)
22 13
2    159.69.83.207 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.207.83.69.159.clients.your-server.de
azure.microsofct.com
1    2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    167.233.8.197 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.197.8.233.167.clients.your-server.de
track.vcdc.com
2    2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    78.46.155.196 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: dedi3962.your-server.de
sylverlight.net
04102.de
2    204.155.145.103 (Dallas, United States)

ASN40824 (WZCOM-, US)
PTR: proven.masterliberty.com
mixupdef.com
1    116.202.159.170 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.170.159.202.116.clients.your-server.de
4500797.catchtheclick.com
3    2606:4700:3035::6815:2703 (United States)

ASN13335 (CLOUDFLARENET, US)
message.freshnewmessage.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    52.218.97.96 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1-r-w.amazonaws.com
mainstreamlp.s3-eu-west-1.amazonaws.com
1    46.4.25.9 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.9.25.4.46.clients.your-server.de
specializedlink.com
1    2606:4700:3037::ac43:a5b9 (United States)

ASN13335 (CLOUDFLARENET, US)
bonga.liveplayingnow.com
Domain Requested by
4 track.vcdc.com azure.microsofct.com
track.vcdc.com
3 message.freshnewmessage.com 4500797.catchtheclick.com
message.freshnewmessage.com
3 www.google-analytics.com azure.microsofct.com
www.google-analytics.com
2 mainstreamlp.s3-eu-west-1.amazonaws.com message.freshnewmessage.com
2 mixupdef.com 1 redirects 04102.de
2 azure.microsofct.com azure.microsofct.com
1 bonga.liveplayingnow.com message.freshnewmessage.com
1 specializedlink.com message.freshnewmessage.com
1 ajax.googleapis.com message.freshnewmessage.com
1 cdnjs.cloudflare.com message.freshnewmessage.com
1 4500797.catchtheclick.com
1 04102.de
1 sylverlight.net track.vcdc.com
22 13

This site contains no links.

Subject Issuer Validity Valid
azure.microsofct.com
R3		 2021-02-03 -
2021-05-04		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
track.vcdc.com
GlobeSSL DV CA		 2020-10-28 -
2021-10-28		 a year crt.sh
sylverlight.net
Encryption Everywhere DV TLS CA - G1		 2021-01-13 -
2022-01-13		 a year crt.sh
mixupdef.com
R3		 2021-01-13 -
2021-04-13		 3 months crt.sh
*.catchtheclick.com
Let's Encrypt Authority X3		 2020-11-11 -
2021-02-09		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-01-11 -
2022-01-10		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.s3-eu-west-1.amazonaws.com
DigiCert Baltimore CA-2 G2		 2020-08-04 -
2021-08-09		 a year crt.sh
specializedlink.com
R3		 2020-12-16 -
2021-03-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://message.freshnewmessage.com/js2/t/video2/index.html
Frame ID: A143919CF56FF93A947D06CA3C1C3414
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://azure.microsofct.com/ Page URL
  2. https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com Page URL
  3. https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/ Page URL
  4. https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcm... Page URL
  5. https://track.vcdc.com/helper/forward.php Page URL
  6. https://sylverlight.net/?action=redirect&target=aHR0cDovLzA0MTAyLmRl&hash=b92b58625be5c8295be90dd24a... Page URL
  7. http://04102.de/ Page URL
  8. https://mixupdef.com/i/9135?nsid={pubid}&partner_subid={click_id} Page URL
  9. https://mixupdef.com/d/9135/1612348670011569-LwvKua?nsid={pubid}&partner_subid={click_id} HTTP 302
    https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2... Page URL
  10. https://message.freshnewmessage.com/js2/t/video2/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

22
Requests

95 %
HTTPS

46 %
IPv6

13
Domains

13
Subdomains

13
IPs

3
Countries

154 kB
Transfer

292 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://azure.microsofct.com/ Page URL
  2. https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com Page URL
  3. https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/ Page URL
  4. https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551 Page URL
  5. https://track.vcdc.com/helper/forward.php Page URL
  6. https://sylverlight.net/?action=redirect&target=aHR0cDovLzA0MTAyLmRl&hash=b92b58625be5c8295be90dd24ab4c2ac Page URL
  7. http://04102.de/ Page URL
  8. https://mixupdef.com/i/9135?nsid={pubid}&partner_subid={click_id} Page URL
  9. https://mixupdef.com/d/9135/1612348670011569-LwvKua?nsid={pubid}&partner_subid={click_id} HTTP 302
    https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838 Page URL
  10. https://message.freshnewmessage.com/js2/t/video2/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • https://mixupdef.com/d/9135/1612348670011569-LwvKua?nsid={pubid}&partner_subid={click_id} HTTP 302
  • https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
azure.microsofct.com/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://azure.microsofct.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
159.69.83.207 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.207.83.69.159.clients.your-server.de
Software
openresty /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
azure.microsofct.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
openresty
date
Wed, 03 Feb 2021 10:31:32 GMT
content-type
text/html; charset=utf8
set-cookie
ndsp=eyJkb21haW5OYW1lIjoibWljcm9zb2ZjdC5jb20iLCJtZW1iZXIiOiIxMSIsInRlbXBsYXRlIjoic3BsaXR0ZXIiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhXC81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXRcLzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZVwvODMuMC40MTAzLjYxIFNhZmFyaVwvNTM3LjM2Iiwic2Vzc2lvbiI6IjlmZWYwYzg0MmVmOGE5MWEyNjU0YzQ4OGQyZWY1MTU0IiwidGltZV9pbml0IjoxNjEyMzQ4MjkyfQ%3D%3D; expires=Wed, 03-Feb-2021 22:59:59 GMT; Max-Age=44907; path=/
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
banner_ads.js
azure.microsofct.com/ 		111 B
326 B 		Script
General
Check archive.org
Download Go to
Full URL
https://azure.microsofct.com/banner_ads.js
Requested by
Host: azure.microsofct.com
URL: https://azure.microsofct.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
159.69.83.207 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.207.83.69.159.clients.your-server.de
Software
openresty /
Resource Hash

Request headers

Referer
https://azure.microsofct.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
public
date
Wed, 03 Feb 2021 10:31:32 GMT
last-modified
Thu, 26 Sep 2019 08:13:05 GMT
server
openresty
etag
"5d8c7311-6f"
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
111
expires
Fri, 05 Mar 2021 10:31:32 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: azure.microsofct.com
URL: https://azure.microsofct.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://azure.microsofct.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
5025
date
Wed, 03 Feb 2021 09:14:03 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Wed, 03 Feb 2021 11:14:03 GMT
/
track.vcdc.com/ 		731 B
636 B 		Document
General
Check archive.org
Download Go to
Full URL
https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com
Requested by
Host: azure.microsofct.com
URL: https://azure.microsofct.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.233.8.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.197.8.233.167.clients.your-server.de
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
track.vcdc.com
:scheme
https
:path
/?mid=108&f=108&domain=microsofct.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://azure.microsofct.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://azure.microsofct.com/

Response headers

server
nginx
date
Wed, 03 Feb 2021 10:37:48 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
collect
www.google-analytics.com/j/ 		2 B
129 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=275096765&t=event&ni=1&_s=1&dl=https%3A%2F%2Fazure.microsofct.com%2F&ul=en-us&de=UTF-8&dt=microsofct.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Blocking%20Ads&ea=No&_u=YEBAAEABAAAAAC~&jid=948875325&gjid=615702808&cid=2056953810.1612348669&tid=UA-43967021-7&_gid=878969479.1612348669&_r=1&_slc=1&cd1=splitter&cd2=11&cd3=yes&z=1476221311
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://azure.microsofct.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 03 Feb 2021 10:37:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://azure.microsofct.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=275096765&t=pageview&_s=2&dl=https%3A%2F%2Fazure.microsofct.com%2F&ul=en-us&de=UTF-8&dt=microsofct.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=&gjid=&cid=2056953810.1612348669&tid=UA-43967021-7&_gid=878969479.1612348669&cd1=splitter&cd2=11&cd3=yes&z=1373138797
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://azure.microsofct.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 03 Feb 2021 07:49:56 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
10072
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
go.php
track.vcdc.com/ 		775 B
852 B 		Document
General
Check archive.org
Download Go to
Full URL
https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/
Requested by
Host: track.vcdc.com
URL: https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.233.8.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.197.8.233.167.clients.your-server.de
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
track.vcdc.com
:scheme
https
:path
/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://track.vcdc.com/?mid=108&f=108&domain=microsofct.com

Response headers

server
nginx
date
Wed, 03 Feb 2021 10:37:49 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
set-cookie
XID=n6nq58s9rosm13p9oa26qbp7km; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
forward.php
track.vcdc.com/helper/ 		129 B
494 B 		Document
General
Check archive.org
Download Go to
Full URL
https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551
Requested by
Host: track.vcdc.com
URL: https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.233.8.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.197.8.233.167.clients.your-server.de
Software
nginx / PHP/5.3.10-1ubuntu3.25
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
track.vcdc.com
:scheme
https
:path
/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
XID=n6nq58s9rosm13p9oa26qbp7km
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://track.vcdc.com/go.php?mid=108&f=108&domain=microsofct.com&ref=https://azure.microsofct.com/

Response headers

server
nginx
date
Wed, 03 Feb 2021 10:37:49 GMT
content-type
text/html
x-powered-by
PHP/5.3.10-1ubuntu3.25
set-cookie
kkl6hi=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw%3D%3D; expires=Wed, 03-Feb-2021 10:37:59 GMT
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
forward.php
track.vcdc.com/helper/ 		216 B
477 B 		Document
General
Check archive.org
Download Go to
Full URL
https://track.vcdc.com/helper/forward.php
Requested by
Host: track.vcdc.com
URL: https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.233.8.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.197.8.233.167.clients.your-server.de
Software
nginx / PHP/5.3.10-1ubuntu3.25
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
track.vcdc.com
:scheme
https
:path
/helper/forward.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
kkl6hi=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw%3D%3D; XID=n6nq58s9rosm13p9oa26qbp7km
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://track.vcdc.com/helper/forward.php?target=aHR0cHM6Ly9zeWx2ZXJsaWdodC5uZXQvP2FjdGlvbj1yZWRpcmVjdCZ0YXJnZXQ9YUhSMGNEb3ZMekEwTVRBeUxtUmwmaGFzaD1iOTJiNTg2MjViZTVjODI5NWJlOTBkZDI0YWI0YzJhYw==&hash=903cf4fbd5c3339eaea4ba1047d8a551

Response headers

server
nginx
date
Wed, 03 Feb 2021 10:37:49 GMT
content-type
text/html
x-powered-by
PHP/5.3.10-1ubuntu3.25
set-cookie
kkl6hi=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT tc_rvs=1; expires=Wed, 03-Feb-2021 10:37:52 GMT
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
/
sylverlight.net/ 		827 B
449 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sylverlight.net/?action=redirect&target=aHR0cDovLzA0MTAyLmRl&hash=b92b58625be5c8295be90dd24ab4c2ac
Requested by
Host: track.vcdc.com
URL: https://track.vcdc.com/helper/forward.php
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
78.46.155.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
dedi3962.your-server.de
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
sylverlight.net
:scheme
https
:path
/?action=redirect&target=aHR0cDovLzA0MTAyLmRl&hash=b92b58625be5c8295be90dd24ab4c2ac
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://track.vcdc.com/helper/forward.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://track.vcdc.com/helper/forward.php

Response headers

date
Wed, 03 Feb 2021 10:37:49 GMT
server
Apache
referrer-policy
no-referrer
x-mod-pagespeed
1.13.35.2-0
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=0, no-cache, s-maxage=10
content-length
284
content-type
text/html;charset=utf-8
Cookie set /
04102.de/ 		517 B
840 B 		Document
General
Check archive.org
Download Go to
Full URL
http://04102.de/
Protocol
HTTP/1.1
Server
78.46.155.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
dedi3962.your-server.de
Software
Apache /
Resource Hash

Request headers

Host
04102.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Feb 2021 10:37:49 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Content-Encoding
gzip
Vary
Accept-Encoding
Set-Cookie
XID=f72c1dda6f064138787bf7e6878e0e3b; path=/
Upgrade
h2c
Connection
Upgrade, Keep-Alive
Keep-Alive
timeout=15, max=100
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
9135
mixupdef.com/i/ 		15 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mixupdef.com/i/9135?nsid={pubid}&partner_subid={click_id}
Requested by
Host: 04102.de
URL: http://04102.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.155.145.103 Dallas, United States, ASN40824 (WZCOM-, US),
Reverse DNS
proven.masterliberty.com
Software
nginx-more /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Host
mixupdef.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
http://04102.de/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://04102.de/

Response headers

Date
Wed, 03 Feb 2021 10:37:50 GMT
Content-Type
text/html; charset=utf8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Server
nginx-more
Strict-Transport-Security
max-age=15768000
Content-Encoding
br
/
4500797.catchtheclick.com/
Redirect Chain
  • https://mixupdef.com/d/9135/1612348670011569-LwvKua?nsid={pubid}&partner_subid={click_id}
  • https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isub...
4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
116.202.159.170 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.170.159.202.116.clients.your-server.de
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash

Request headers

Host
4500797.catchtheclick.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
Origin
null
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx/1.16.1 (Ubuntu)
Date
Wed, 03 Feb 2021 10:37:50 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Content-Encoding
gzip

Redirect headers

Date
Wed, 03 Feb 2021 10:37:50 GMT
Content-Length
0
Connection
keep-alive
Location
https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838
Set-Cookie
ird9135=5838; path=/ ifd=[{"c":5838,"i":1,"e":1612435070}]; path=/
Server
nginx-more
Strict-Transport-Security
max-age=15768000
Primary Request index.html
message.freshnewmessage.com/js2/t/video2/ 		18 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://message.freshnewmessage.com/js2/t/video2/index.html
Requested by
Host: 4500797.catchtheclick.com
URL: https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:2703 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0de0c62384ae4332f004eb3726f281d343e167878b62c896ac37f2c6b3320ffe

Request headers

:method
GET
:authority
message.freshnewmessage.com
:scheme
https
:path
/js2/t/video2/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://4500797.catchtheclick.com/?mob=80yMngs2uBmv2h7NI8I4d8gYaG6YpDjuQhHM_TsiiKEDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&tid=1612348670011569-LwvKua-9135-5838&subid=e3B1YmlkfQ==_7497_9135&isubid=1612348670011569-LwvKua-9135-5838&icid=5838

Response headers

date
Wed, 03 Feb 2021 10:37:50 GMT
content-type
text/html
set-cookie
__cfduid=de7d2d5476004210ffc810e67711315291612348670; expires=Fri, 05-Mar-21 10:37:50 GMT; path=/; domain=.freshnewmessage.com; HttpOnly; SameSite=Lax
last-modified
Fri, 09 Oct 2020 15:22:15 GMT
vary
Accept-Encoding
expires
Tue, 18 Jan 2022 10:00:40 GMT
cache-control
max-age=31536000
cf-cache-status
HIT
age
1384630
cf-request-id
0809115adb0000c2ae691f0000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=td8%2BucL3AwesRFwWj5UmAVHgO1uwDa7XEGD0dTQNsVHePgMQ0kBVH0IMnxMiXv5U85K431%2FauVnSI%2B3jFuc3bXbEe598PogjOSXeI2bFlBTDDfF5L38F0x2xt%2BGsEx4LR0iu3AZM%2FYk%3D"}],"max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
cf-ray
61bb84d7c8b4c2ae-FRA
content-encoding
br
style.css
message.freshnewmessage.com/js2/t/video2/ 		1 KB
934 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://message.freshnewmessage.com/js2/t/video2/style.css
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:2703 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af9d3832b610af9a1ca7b5f1acd2af16f2c14d81881de6cabdfa2ee2eaaf33e

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 10:37:50 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1384609
cf-polished
origSize=1946
cf-bgj
minify
cf-request-id
0809115afa0000c2aef33ba000000001
last-modified
Thu, 21 May 2020 13:08:20 GMT
server
cloudflare
etag
W/"5ec67d44-79a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2ipcMGZliQ9waQDAKaP%2FhnmZ%2BdNqB9NJ9PBxloOJrahjethBQH1OxR3gw%2B6fDv90eIxsjHSmz6EGPm1%2BzXayeMO9Q%2B1v023nmP1GOuvaMt6bq%2F7%2Fl8zFvp%2FV3hnIb2ylZxtDAiuP2Rg%3D"}],"max_age":604800}
content-type
text/css
cache-control
max-age=31536000
cf-ray
61bb84d7f904c2ae-FRA
expires
Tue, 18 Jan 2022 10:01:01 GMT
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 10:37:50 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
564634
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5631
cf-request-id
0809115b0d00002bddfc091000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=t8pmL%2F3w2oCLn%2FNHT0jeTQCHOdQN4gX0jQgvUICfw6EdbU8Z%2Fe13TbTY4NwVFR2U%2F%2B8PkoffwXm7r5dhaTtNoha4LX46%2FiAiCDnOIY%2BTnQRxv1oD2U0EUNTtdOf1sqQeNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
61bb84d81f6d2bdd-FRA
expires
Mon, 24 Jan 2022 10:37:50 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 08:36:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7309
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Feb 2022 08:36:01 GMT
inc.js
message.freshnewmessage.com/js2/t/video2/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://message.freshnewmessage.com/js2/t/video2/inc.js
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:2703 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc666b8fcbf6c6636fcc9616b25d17c4af2113279c0ba28248b341e1c021851b

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 10:37:50 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1384609
cf-polished
origSize=13192
cf-bgj
minify
cf-request-id
0809115afb0000c2ae3aadc000000001
last-modified
Mon, 18 Jan 2021 09:58:54 GMT
server
cloudflare
etag
W/"60055bde-3388"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=w%2FsEWwufK3N6ly13TGKXWojdKr4hjy0ehGzG0N8LWUgyyjSYsiIJvvPrGAlHxTbgE2x3dSNiKwu%2Fv8T2pimbIhyMPbQtiEEzXJYfQDhNTyEvG8AB8oVs9NDxYNPnHPo1DSx9EUUWNS8%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=31536000
cf-ray
61bb84d7f907c2ae-FRA
expires
Tue, 18 Jan 2022 10:01:01 GMT
giphy.gif
mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/giphy.gif
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.97.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-eu-west-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b0f4b9ef95abb8ac47aeea2bedfbcd0df609b82a1c6cb4f73497a3b061929074

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Feb 2021 10:37:51 GMT
Last-Modified
Wed, 20 May 2020 16:30:23 GMT
Server
AmazonS3
x-amz-request-id
479636A5C533DCCC
ETag
"7e3fce0b52710d1cff60184ab6957570"
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
24722
x-amz-id-2
Rf2HsaytP9ibL7Q4RI735q17MxdVaRVOx3P+V3xmu+Q0c0HsbVLE5highneVSg73HvyOm3ePPhc=
unnamed.gif
mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/ 		54 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mainstreamlp.s3-eu-west-1.amazonaws.com/cassandra/unnamed.gif
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.97.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-eu-west-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
29439e6057faf7858a2ebb5844b6f2751386bd4c39648ea3c2c60d5e1a3f17f1

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Feb 2021 10:37:51 GMT
Last-Modified
Wed, 20 May 2020 16:12:00 GMT
Server
AmazonS3
x-amz-request-id
965626C8F08C2BB9
ETag
"426e71e4e8b69c27ca1530ad8ea0f337"
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
55495
x-amz-id-2
ZRvh+NTbuQWCOqNAMo5GWy0QyDGpq10erSnBruRKoL2FZx7ygKwwnsOBNRdPzg/HxNslCf6TJDw=
c.php
specializedlink.com/ 		0
526 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://specializedlink.com/c.php
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/inc.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
46.4.25.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.9.25.4.46.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Feb 2021 10:37:50 GMT
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/octet-stream, text/html
Access-Control-Allow-Origin
https://message.freshnewmessage.com
Access-Control-Expose-Headers
Content-Length,Content-Range
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length
0
c.php
bonga.liveplayingnow.com/ 		0
824 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://bonga.liveplayingnow.com/c.php?v1=2&va=2
Requested by
Host: message.freshnewmessage.com
URL: https://message.freshnewmessage.com/js2/t/video2/inc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a5b9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://message.freshnewmessage.com/js2/t/video2/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 10:37:51 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
https://message.freshnewmessage.com
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YA%2B9wJkVvf%2F1iSHm%2F9DdRXJNjAqOCEbhVVGNFe9bWw%2FzksW34zHtXFupKPwpszeKSL9fbtxDxwqP1gaItplZSMnt4h8hQo0X7daj6hoWYExr5wOZuPTC8ktI0ykjSwOr0rpG%2FQM%3D"}],"group":"cf-nel"}
access-control-expose-headers
Content-Length,Content-Range
access-control-allow-credentials
true
cf-ray
61bb84d97ea8dfbb-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
cf-request-id
0809115be90000dfbb2922e000000001

Verdicts & Comments Add Verdict or Comment

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| ggl_acct function| getpub string| maind function| getParameterByName function| getCookie object| MegaPush undefined| cinfo function| timeoutfn function| mfun object| idbKeyval function| gtag object| dataLayer function| loading string| dom_host string| href object| all_rs string| link object| domainarr function| setCookie number| jjj function| new_rand number| count function| trackOutboundLink string| next function| fine number| mg object| body function| FullScreen string| domain string| cur_lang string| newtext object| insideelement object| p

3 Cookies

Domain/Path Name / Value
.freshnewmessage.com/ Name: u
Value: 30x7314x1543601a7cfe9202e
.freshnewmessage.com/ Name: jjj
Value: 1
.freshnewmessage.com/ Name: __cfduid
Value: de7d2d5476004210ffc810e67711315291612348670

4 Console Messages

Source Level URL
Text
console-api log URL: https://message.freshnewmessage.com/js2/t/video2/inc.js(Line 18)
Message:
console-api log URL: https://message.freshnewmessage.com/js2/t/video2/inc.js(Line 19)
Message:
undefined
console-api log URL: https://message.freshnewmessage.com/js2/t/video2/inc.js(Line 20)
Message:
new c 30x7314x1543601a7cfe9202e
console-api log URL: https://message.freshnewmessage.com/js2/t/video2/index.html(Line 207)
Message:
CUR LANGen

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block