Submitted URL: https://www.pornhubdownload.com/initdownload/aHR0cHM6Ly9ldi5waG5jZG4uY29tL3ZpZGVvcy8yMDE4MDIvMTAvMTU0MTMxMjcyLzIwMDcyNF8xNDExXzE...
Effective URL: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Submission Tags: falconsandbox
Submission: On December 13 via api from US

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3033::681b:b6f9, located in United States and belongs to CLOUDFLARENET, US. The main domain is ezsleeptime.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 9th 2020. Valid for: a year.
This is the only time ezsleeptime.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 5 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
8 3
Apex Domain
Subdomains
Transfer
5 ezsleeptime.com
ezsleeptime.com
98 KB
3 gstatic.com
fonts.gstatic.com
41 KB
1 googleapis.com
fonts.googleapis.com
534 B
1 pornhubdownload.com
www.pornhubdownload.com
1016 B
8 4
Domain Requested by
5 ezsleeptime.com 1 redirects ezsleeptime.com
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com ezsleeptime.com
1 www.pornhubdownload.com 1 redirects
8 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-07-09 -
2021-07-09
a year crt.sh
upload.video.google.com
GTS CA 1O1
2020-11-10 -
2021-02-02
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2020-11-10 -
2021-02-02
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Frame ID: 383EA84E527FB5239794B5EDAA0DD5B3
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.pornhubdownload.com/initdownload/aHR0cHM6Ly9ldi5waG5jZG4uY29tL3ZpZGVvcy8yMDE4MDIvMTAvMTU0MTMxMjc... HTTP 302
    https://ezsleeptime.com/linker/init.php/Jf34XcC8/en/ HTTP 301
    https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

139 kB
Transfer

471 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.pornhubdownload.com/initdownload/aHR0cHM6Ly9ldi5waG5jZG4uY29tL3ZpZGVvcy8yMDE4MDIvMTAvMTU0MTMxMjcyLzIwMDcyNF8xNDExXzEwODBQXzgwMDBLXzE1NDEzMTI3Mi5tcDQ_dmFsaWRmcm9tPTE2MDMzODcxMjcmdmFsaWR0bz0xNjAzMzk0MzI3JnJhdGU9NTAwayZidXJzdD0yMDAwayZoYXNoPXJsZXMlMkY3S0syb1FJaUhHdWpCZmJ5JTJGRGQwcDglM0Q/ HTTP 302
    https://ezsleeptime.com/linker/init.php/Jf34XcC8/en/ HTTP 301
    https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request start.php
ezsleeptime.com/linker/
Redirect Chain
  • https://www.pornhubdownload.com/initdownload/aHR0cHM6Ly9ldi5waG5jZG4uY29tL3ZpZGVvcy8yMDE4MDIvMTAvMTU0MTMxMjcyLzIwMDcyNF8xNDExXzEwODBQXzgwMDBLXzE1NDEzMTI3Mi5tcDQ_dmFsaWRmcm9tPTE2MDMzODcxMjcmdmFsaWR0...
  • https://ezsleeptime.com/linker/init.php/Jf34XcC8/en/
  • https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
10 KB
4 KB
Document
General
Full URL
https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681b:b6f9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4656b94c1c874ccddacea4c351f1a43319ba926cf37bfd0aba2232721c434491

Request headers

:method
GET
:authority
ezsleeptime.com
:scheme
https
:path
/linker/start.php?id=Jf34XcC8&lang=en
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d280efc08f75bedae9329da26d2d6c7151607876860
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 16:27:40 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
06fe86f2bb0000176a768c3000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VRmogso7SDivDKSdqn05Awr3raEwMoB3A58%2FqnTIMONmy7hthJuCgr79xlcvBnlH%2FUB33axkP%2FQ3Q25Mr3EO1HVGPVSg3rUCaO3dyu5WJAcHLV3C4gfNDyjl3yE%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
60110dcacaba176a-FRA
content-encoding
gzip

Redirect headers

date
Sun, 13 Dec 2020 16:27:40 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d280efc08f75bedae9329da26d2d6c7151607876860; expires=Tue, 12-Jan-21 16:27:40 GMT; path=/; domain=.ezsleeptime.com; HttpOnly; SameSite=Lax
location
/linker/start.php?id=Jf34XcC8&lang=en
cf-cache-status
DYNAMIC
cf-request-id
06fe86f28b0000176af7bf5000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cU%2FlpWZO%2F8tHepzb0pznsEdEX17HqwfOUK13ksQILdjzeB1BE18bJKRgSsA5cS310c9TGXZS3ixTgrck2X%2FDeE37KfNpKsaWA5p4IZ0nIUXX9MEZFjugMnT2s8U%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
60110dca7a18176a-FRA
css
fonts.googleapis.com/
3 KB
534 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:300,400,700,900
Requested by
Host: ezsleeptime.com
URL: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e38b4085919e456f5f9861ba323952f1478e9dac662a3377c51db8f35fa894cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 13 Dec 2020 16:16:43 GMT
server
ESF
date
Sun, 13 Dec 2020 16:27:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 13 Dec 2020 16:27:40 GMT
styles.min.css
ezsleeptime.com/link/cloud_theme/build/css/
222 KB
35 KB
Stylesheet
General
Full URL
https://ezsleeptime.com/link/cloud_theme/build/css/styles.min.css?ver=5.3.0
Requested by
Host: ezsleeptime.com
URL: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681b:b6f9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7cea4dce37d7f3591afda8a6d0c7fff440597812ca558a0dd3fdfe64cd2c8fa6

Request headers

Referer
https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 16:27:40 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7048
content-length
35350
cf-request-id
06fe86f3030000176a0b9d9000000001
last-modified
Thu, 07 Jun 2018 09:33:52 GMT
server
cloudflare
etag
"3797a-5b18fc00-460d3b;gz"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GmeRqbiJKLCsDMBIOZzNXuXSjeRlnK0%2B9Vx%2FWsI8AaFJQ2tV5SmBeA7whjmCKyUJNoGhLSIAf11me5drepQVy6XsoehfMf5urh57uiBGvrhn2KhV1sPkoXfH9ec%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
60110dcb2ba7176a-FRA
expires
Fri, 11 Dec 2020 19:56:05 GMT
ads.js
ezsleeptime.com/link/js/
106 B
460 B
Script
General
Full URL
https://ezsleeptime.com/link/js/ads.js
Requested by
Host: ezsleeptime.com
URL: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681b:b6f9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42deff51f77c2fad8526f708bf57a4300ecc3fd926c9df055962dc2cdca00cee

Request headers

Referer
https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 16:27:40 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7048
cf-request-id
06fe86f3010000176a1d23e000000001
last-modified
Sat, 10 Feb 2018 22:01:21 GMT
server
cloudflare
etag
W/"6a-5a7f6bb1-460db8;;;"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=x8bUAvlNcU%2FSlPDFfx%2FuTqIDdPn0ZZnKWoyrsxLP9pkw36sEnvcRXauWe%2Ff8hkaeTooqoMVqlGW0kscd5Wpsh0N4F9xaIjIjqGrWbw0icH7STn5Rva5KMjL%2Fvos%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
public, max-age=604800
cf-ray
60110dcb2bac176a-FRA
expires
Fri, 11 Dec 2020 19:55:10 GMT
script.min.js
ezsleeptime.com/link/cloud_theme/build/js/
195 KB
58 KB
Script
General
Full URL
https://ezsleeptime.com/link/cloud_theme/build/js/script.min.js?ver=5.3.0
Requested by
Host: ezsleeptime.com
URL: https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681b:b6f9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62eb8c55e05f53ef96a7daaec19f0b9bf2beee9846b83368ac423fb3297d80b4

Request headers

Referer
https://ezsleeptime.com/linker/start.php?id=Jf34XcC8&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 16:27:40 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7048
content-length
58465
cf-request-id
06fe86f2ff0000176a031bb000000001
last-modified
Thu, 07 Jun 2018 10:04:43 GMT
server
cloudflare
etag
"30c56-5b19033b-460d3d;gz"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EOwinj9h93vMTvppByG5pbU07IxxerMRCvYkd02xYkuLQvwzwrpu7MkFitb5Zqkabp0CjnuNJOEb%2FRZHGvRCqIkXcSndL1ss%2F2boFI31rnIc7L2bo73PQtU5TRs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
60110dcb2bb0176a-FRA
expires
Fri, 11 Dec 2020 19:56:05 GMT
S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/
13 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
973ebbead06df6ace22a88d2856663d37845792bdf1b40ff69df2e20912fedef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ezsleeptime.com
Referer
https://fonts.googleapis.com/css?family=Lato:300,400,700,900
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 18:36:59 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:30 GMT
server
sffe
age
78641
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13732
x-xss-protection
0
expires
Sun, 12 Dec 2021 18:36:59 GMT
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ezsleeptime.com
Referer
https://fonts.googleapis.com/css?family=Lato:300,400,700,900
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 18:04:14 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:12:59 GMT
server
sffe
age
339806
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14044
x-xss-protection
0
expires
Thu, 09 Dec 2021 18:04:14 GMT
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ezsleeptime.com
Referer
https://fonts.googleapis.com/css?family=Lato:300,400,700,900
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 20:51:21 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:12:25 GMT
server
sffe
age
70579
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14176
x-xss-protection
0
expires
Sun, 12 Dec 2021 20:51:21 GMT

Verdicts & Comments Add Verdict or Comment

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| e object| wow function| fixHeight undefined| captchaShort undefined| captchaContact undefined| captchaSignin undefined| captchaSignup undefined| captchaForgotpassword undefined| captchaShortlink undefined| invisibleCaptchaShort undefined| invisibleCaptchaContact undefined| invisibleCaptchaSignin undefined| invisibleCaptchaSignup undefined| invisibleCaptchaForgotpassword undefined| invisibleCaptchaShortlink function| onloadRecaptchaCallback function| coinhive_captcha_build function| coinhive_captcha_render function| myCaptchaCallback function| setCookie function| getCookie undefined| go_popup function| checkAdblockUser function| checkAdsbypasserUser function| checkPrivateMode undefined| body undefined| ad_type undefined| counter_start_object undefined| selectedTab undefined| clipboard function| setTooltip function| cookie_accept function| $ function| jQuery function| WOW

1 Cookies

Domain/Path Name / Value
.ezsleeptime.com/ Name: __cfduid
Value: d280efc08f75bedae9329da26d2d6c7151607876860