pixel.show.co Open in urlscan Pro
2604:a880:800:c1::10b:a001  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://show.co/KzlMOXZ Page URL
2. https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	KzlMOXZ Show response show.co/	22 KB 8 KB	519ms 202ms	Document text/html	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Express Resource Hash babc928d300b31f05bef3b457d0af957435dd18a431ddcedbe831136c12873df Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubdomains; X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 12 Jul 2022 01:08:44 GMT etag W/"575d-w4srZTu13seOhkbFa5U1OW9/uiQ" expires Tue, 12 Jul 2022 01:08:43 GMT server nginx strict-transport-security max-age=15552000; includeSubdomains; vary Accept-Encoding x-content-type-options nosniff x-powered-by Express x-xss-protection 1; mode=block
GET H2	200	efd.a9a036b7.css dcxytnb1cgejb.cloudfront.net/css/	634 B 761 B	42ms 10ms	Stylesheet text/css	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/css/efd.a9a036b7.css Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ff629eeb9ece33e7ad7746a8cd152ea0ffc07b621b84484ded68895231b953b3 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 17 May 2022 02:21:15 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 4834049 etag W/"619c1de0-27a" vary Accept-Encoding x-cache Hit from cloudfront content-type text/css via 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront) cache-control max-age=31536000, public x-amz-cf-pop FRA50-C1 x-amz-cf-id Wj0ZlFrAHFvL9RIFpmO3ToPGR4ObnfNmj9NkPLBbatht031lzF3p4A== expires Wed, 17 May 2023 02:21:15 GMT
GET H2	200	css fonts.googleapis.com/	8 KB 1 KB	129ms 47ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400,700 Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f4ee745ddb73cf079c293a6aea2eac0fa10b70a47ccebc704d8aacaacc9bf8b0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 12 Jul 2022 00:02:41 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Tue, 12 Jul 2022 01:08:44 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 12 Jul 2022 01:08:44 GMT
GET H2	200	tracking-vendors.6891d86b.js Show response dcxytnb1cgejb.cloudfront.net/js/	247 KB 76 KB	41ms 9ms	Script application/javascript	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/js/tracking-vendors.6891d86b.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbefdf3131790f1f2e435906a821811dac272dcb69b2148c0bc74c6aa4283dd1 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 19 Dec 2021 08:54:08 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 17684076 etag W/"619c1de0-3ddf4" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront) cache-control max-age=31536000, public x-amz-cf-pop FRA50-C1 x-amz-cf-id mhYcQKRPW2hk3yh38vOiqjWXULQ4uwEj27klA7NG6WUGm9hVst4kMQ== expires Mon, 19 Dec 2022 08:54:08 GMT
GET H2	200	tracking.30a90c40.js Show response dcxytnb1cgejb.cloudfront.net/js/	22 KB 8 KB	41ms 9ms	Script application/javascript	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/js/tracking.30a90c40.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6801ac69ab210b33891adda1533b87717d9d4a232f2142fe03ecf2bf845daccc Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 23 Nov 2021 09:03:49 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 19929895 etag W/"619c1de0-58a5" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront) cache-control max-age=31536000, public x-amz-cf-pop FRA50-C1 x-amz-cf-id 6zQLH2_4V8v3UvNNzAx48N0n_v0hAFEAVcxtQSiwMfC3kF7WVmlSKA== expires Wed, 23 Nov 2022 09:03:49 GMT
GET H2	200	efd-vendors.621b203b.js Show response dcxytnb1cgejb.cloudfront.net/js/	127 KB 45 KB	55ms 23ms	Script application/javascript	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/js/efd-vendors.621b203b.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 77b4177733ef4191f755c4f722c7413e9266defccfea65d876132c7353c08db0 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 18 Jun 2022 07:11:03 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 2051861 etag W/"619c1de0-1fd29" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront) cache-control max-age=31536000, public x-amz-cf-pop FRA50-C1 x-amz-cf-id EOO3ae2xt8tj4edXN6ITrsg8WdS5G9-BH_c9-yoJ2vXqP4_J6Kv2OQ== expires Sun, 18 Jun 2023 07:11:03 GMT
GET H2	200	efd.30a90c40.js Show response dcxytnb1cgejb.cloudfront.net/js/	37 KB 12 KB	42ms 11ms	Script application/javascript	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/js/efd.30a90c40.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 97c520503fe6a7f9e8e6edacbfeceed1e132a9e9716062f5a56c5da013344ce2 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 18 May 2022 02:29:40 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 4747144 etag W/"619c1de0-926d" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront) cache-control max-age=31536000, public x-amz-cf-pop FRA50-C1 x-amz-cf-id sgiW4u3knUnNum40NrT6Yo_32sRhkISi8prz69GI01GC3Z2Sg9tqmg== expires Thu, 18 May 2023 02:29:40 GMT
GET H/1.1	200 OK	rollbar.min.js Show response cdn.rollbar.com/rollbarjs/refs/tags/v2.23.0/	76 KB 23 KB	64ms 9ms	Script application/javascript	143.204.89.104 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.rollbar.com/rollbarjs/refs/tags/v2.23.0/rollbar.min.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.204.89.104 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-89-104.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash c25355cf2e7bec93c43a0ab8bd19ba779ba9cc901924cbc9312d1c6de8c04c8e Request headers Referer https://show.co/ Origin https://show.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Sat, 16 Apr 2022 10:45:57 GMT Content-Encoding gzip Age 7482168 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Access-Control-Allow-Origin * Last-Modified Thu, 24 Jun 2021 16:41:52 GMT Server AmazonS3 ETag W/"fe7d90207ea344ae9d16f8cd5ba1e6ba" Vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method Access-Control-Allow-Methods GET Content-Type application/javascript Via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) Cache-Control max-age=30672000,public X-Amz-Cf-Pop FRA50-C1 X-Amz-Cf-Id R-tEFVlQ-LHUxCm5hX_g7hMmtd-d26FowFQ-Ec3NgQ_bl44XWkVSZQ==
GET H2	200	nr-1208.min.js Show response js-agent.newrelic.com/	31 KB 12 KB	28ms 7ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1208.min.js Requested by Host: show.co URL: https://show.co/KzlMOXZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4014ca31d3c8e768608a40ed160a405ae39836a5b2c43f256bee3bdf427dd67f Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-amz-version-id RGJXhnJ2IqU3nLrOoxetOoKLCG4kx4sX content-encoding gzip etag "1a71e4208296f97b465116492f59124d" x-amz-request-id 1F2P35EQW07JNF21 x-cache HIT cross-origin-resource-policy cross-origin content-length 11777 x-amz-id-2 waX6p24E76qNJxJjaBjqqEjMPbEgmcGhe7EWWH0qFyUsS11EgnnLqozosbRsZ/gh0bxV97Izbsw= x-served-by cache-hhn4068-HHN last-modified Wed, 10 Mar 2021 16:24:28 GMT server AmazonS3 x-timer S1657588124.416701,VS0,VE0 date Tue, 12 Jul 2022 01:08:44 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 24
GET H2	200	retargeting Show response pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/ Frame 6AA9	526 B 521 B	116ms 109ms	Document text/html	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Requested by Host: dcxytnb1cgejb.cloudfront.net URL: https://dcxytnb1cgejb.cloudfront.net/js/efd.30a90c40.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Express Resource Hash 424b04a2376482bcf1fb65aa3576e40410193cc357beb82b8acd6c66cd74286c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://show.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=300 content-encoding gzip content-type text/html; charset=utf-8 date Tue, 12 Jul 2022 01:08:44 GMT etag W/"20e-yQu5tsST570gxkZbR1MAjmZl3gE" expires Tue, 12 Jul 2022 01:13:44 GMT server nginx vary Accept-Encoding x-content-type-options nosniff x-powered-by Express x-xss-protection 1; mode=block
GET H2	200	location Show response api.show.co/	86 B 289 B	479ms 186ms	XHR application/json	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://api.show.co/location Requested by Host: cdn.rollbar.com URL: https://cdn.rollbar.com/rollbarjs/refs/tags/v2.23.0/rollbar.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Cowboy / Resource Hash 571bad8557be4700c6de3aaebb6b134bf276f4d1b26cada5e7f92483c0eaca23 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubdomains; Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:44 GMT server Cowboy vary origin content-type application/json access-control-allow-origin https://show.co access-control-expose-headers location strict-transport-security max-age=15552000; includeSubdomains; content-length 86
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v29/	44 KB 44 KB	122ms 39ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://show.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 23:32:09 GMT x-content-type-options nosniff age 5795 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44800 x-xss-protection 0 last-modified Wed, 11 May 2022 19:25:14 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 11 Jul 2023 23:32:09 GMT
GET H2	200	din-condensed-regular.cf01c250.woff dcxytnb1cgejb.cloudfront.net/media/	44 KB 45 KB	30ms 12ms	Font font/woff	2600:9000:2156:a00:1d:4f13:65c0:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dcxytnb1cgejb.cloudfront.net/media/din-condensed-regular.cf01c250.woff Requested by Host: dcxytnb1cgejb.cloudfront.net URL: https://dcxytnb1cgejb.cloudfront.net/css/efd.a9a036b7.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:a00:1d:4f13:65c0:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9e9b9d69e234382e07f0a320337c848b7af0b4f2c73303ea2410dc19462e8378 Request headers Referer https://dcxytnb1cgejb.cloudfront.net/css/efd.a9a036b7.css Origin https://show.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 30 Jun 2022 04:52:24 GMT via 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront) last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx age 1023380 etag "619c1de0-b1f4" x-cache Hit from cloudfront content-type font/woff access-control-allow-origin * cache-control max-age=2592000, public x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 45556 x-amz-cf-id tP9ShYo2p9xwMOP_gcgPF9r_TU1HiqDJGx2pQ_lyEKGrn6NltDkNxQ== expires Sat, 30 Jul 2022 04:52:24 GMT
GET H2	200	60UPZJgBS5MKEELeoHPKWc:5iaBd2NLQhQlyPj8moBA2Q media.show.co/images/	20 KB 20 KB	82ms 27ms	Image image/jpeg	2600:9000:2156:e400:17:20f9:a400:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://media.show.co/images/60UPZJgBS5MKEELeoHPKWc:5iaBd2NLQhQlyPj8moBA2Q?w=500&h=500&origin=https%3A%2F%2Fshow.co Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:e400:17:20f9:a400:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Cowboy / Resource Hash 9e9638c56cb7fcf1ea9a12ce4026d15d1362662a3c9521926428c0efc9dc8889 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers Referer https://show.co/ Origin https://show.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 19:56:17 GMT via 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront) server Cowboy age 18747 etag "954687587D6A154D5228ACD1C123BF46" strict-transport-security max-age=63072000 x-cache Hit from cloudfront content-type image/jpeg access-control-allow-origin https://show.co access-control-expose-headers location cache-control public,max-age=2592000 access-control-allow-credentials true x-amz-cf-pop FRA50-C1 content-length 20493 x-amz-cf-id g6CLv1wVXFjYXvwAzpT4UhD6k5oOzCGWJ97GTJqHZH13pV1R_DEAew==
GET H/1.1	200 OK	56aeabb3eb Show response bam.nr-data.net/1/	49 B 716 B	280ms 241ms	Script text/javascript	162.247.241.14 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/56aeabb3eb?a=5725889&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=745&ck=1&ref=https://show.co/KzlMOXZ&be=539&fe=709&dc=708&perf=%7B%22timing%22:%7B%22of%22:1657588123683,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:10,%22c%22:10,%22s%22:112,%22ce%22:317,%22rq%22:317,%22rp%22:520,%22rpe%22:521,%22dl%22:523,%22di%22:708,%22ds%22:708,%22de%22:709,%22dc%22:709,%22l%22:709,%22le%22:709%7D,%22navigation%22:%7B%7D%7D&fp=719&fcp=719&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1208.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash a83848cf5c3d96caefe490c19e41659609b3691dd4c531cf925016c084d8e1b0 Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 12 Jul 2022 01:08:44 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 7295e3b1fa219180-FRA
GET H2	200	showdotco-short.2e144416.svg show.co/media/	2 KB 1 KB	102ms 102ms	Image image/svg+xml	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://show.co/media/showdotco-short.2e144416.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash c84626224633f5f713acb284e070ece91e59517a4d344f9b7d921a3a87fb655f Request headers accept-language de-DE,de;q=0.9 Referer https://show.co/KzlMOXZ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:44 GMT content-encoding gzip last-modified Mon, 22 Nov 2021 22:46:56 GMT server nginx etag W/"619c1de0-9a3" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=2592000, public expires Thu, 11 Aug 2022 01:08:44 GMT
GET H2	200	/ whos.amung.us/pingjs/ Frame 6AA9	29 B 29 B	329ms 108ms	Image text/javascript	67.202.114.214 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=condios011&t=%F0%9F%92%B2%F0%9F%94%A5%F0%9F%98%BCquierofolla%F0%9F%98%BC%F0%9F%94%A5%F0%9F%92%B2&x=twitch.tv Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.214 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:44 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	/ whos.amung.us/pingjs/ Frame 6AA9	30 B 30 B	328ms 107ms	Image text/javascript	67.202.114.214 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=quierofolla&t=%F0%9F%92%B2%F0%9F%94%A5%F0%9F%98%BCquierofolla%F0%9F%98%BC%F0%9F%94%A5%F0%9F%92%B2&x=twitch.tv Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.214 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:44 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	fish2 Show response scriptfree.us/ Frame 6AA9	10 KB 5 KB	350ms 86ms	Script text/html	68.168.220.235 IS-AS-1
General Check archive.org Show headers Download Go to Full URL https://scriptfree.us/fish2?name=manymc Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 68.168.220.235 , United States, ASN19318 (IS-AS-1, US), Reverse DNS dns3001a.trouble-free.net Software LiteSpeed / Resource Hash 65cd6a6d025ad87032d52c69293e4127a98fb74226003e2755800adb65d4ac1f Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Tue, 12 Jul 2022 01:08:44 GMT content-encoding br server LiteSpeed vary Accept-Encoding content-type text/html; charset=utf-8 cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET DATA	200 OK	truncated /	101 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5642c88794d21e91323d0de2b132026a29da6676a66934227111f8e9cc7ebc90 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Content-Type image/png
POST		series analytics.show.co/db/60UPZJgBS5MKEELeoHPKWc/	0 0
OPTIONS H2	200	series analytics.show.co/db/60UPZJgBS5MKEELeoHPKWc/ Frame	0 0	105ms 94ms	Preflight	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://analytics.show.co/db/60UPZJgBS5MKEELeoHPKWc/series?u=stage&p=60UPZJgBS5MKEELeoHPKWc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Cowboy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://show.co Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin https://show.co access-control-max-age 86400 content-length 0 date Tue, 12 Jul 2022 01:08:44 GMT server Cowboy strict-transport-security max-age=63072000 vary origin
GET H2	200	Primary Request retargeting Show response pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/	526 B 521 B	109ms 109ms	Document text/html	2604:a880:800:c1::10b:a001 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Requested by Host: scriptfree.us URL: https://scriptfree.us/fish2?name=manymc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2604:a880:800:c1::10b:a001 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Express Resource Hash 424b04a2376482bcf1fb65aa3576e40410193cc357beb82b8acd6c66cd74286c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=300 content-encoding gzip content-type text/html; charset=utf-8 date Tue, 12 Jul 2022 01:08:44 GMT etag W/"20e-yQu5tsST570gxkZbR1MAjmZl3gE" expires Tue, 12 Jul 2022 01:13:44 GMT server nginx vary Accept-Encoding x-content-type-options nosniff x-powered-by Express x-xss-protection 1; mode=block
POST		56aeabb3eb bam.nr-data.net/events/1/	0 0
GET H2	200	/ whos.amung.us/pingjs/	29 B 29 B	112ms 111ms	Image text/javascript	67.202.114.214 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=condios011&t=%F0%9F%92%B2%F0%9F%94%A5%F0%9F%98%BCquierofolla%F0%9F%98%BC%F0%9F%94%A5%F0%9F%92%B2&x=twitch.tv Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.214 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:45 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	/ whos.amung.us/pingjs/	30 B 30 B	112ms 112ms	Image text/javascript	67.202.114.214 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=quierofolla&t=%F0%9F%92%B2%F0%9F%94%A5%F0%9F%98%BCquierofolla%F0%9F%98%BC%F0%9F%94%A5%F0%9F%92%B2&x=twitch.tv Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.214 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 12 Jul 2022 01:08:45 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	fish2 Show response scriptfree.us/	10 KB 5 KB	94ms 93ms	Script text/html	68.168.220.235 IS-AS-1
General Check archive.org Show headers Download Go to Full URL https://scriptfree.us/fish2?name=manymc Requested by Host: pixel.show.co URL: https://pixel.show.co/email-for-download/60UPZJgBS5MKEELeoHPKWc/retargeting Protocol H2 Security TLS 1.3, , AES_128_GCM Server 68.168.220.235 , United States, ASN19318 (IS-AS-1, US), Reverse DNS dns3001a.trouble-free.net Software LiteSpeed / Resource Hash 65cd6a6d025ad87032d52c69293e4127a98fb74226003e2755800adb65d4ac1f Request headers accept-language de-DE,de;q=0.9 Referer https://pixel.show.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Tue, 12 Jul 2022 01:08:45 GMT content-encoding br server LiteSpeed cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 vary Accept-Encoding content-type text/html; charset=utf-8
GET DATA	200 OK	truncated /	512 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	160 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	875 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

analytics.show.co

URL

https://analytics.show.co/db/60UPZJgBS5MKEELeoHPKWc/series?u=stage&p=60UPZJgBS5MKEELeoHPKWc

Domain

bam.nr-data.net

URL

https://bam.nr-data.net/events/1/56aeabb3eb?a=5725889&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=1339&ck=1&ref=https://show.co/KzlMOXZ

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: f9871a95065b646b

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.show.co
api.show.co
bam.nr-data.net
cdn.rollbar.com
dcxytnb1cgejb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
js-agent.newrelic.com
media.show.co
pixel.show.co
scriptfree.us
show.co
whos.amung.us
analytics.show.co
bam.nr-data.net
143.204.89.104
151.101.2.137
162.247.241.14
2600:9000:2156:a00:1d:4f13:65c0:21
2600:9000:2156:e400:17:20f9:a400:93a1
2604:a880:800:c1::10b:a001
2a00:1450:4001:806::2003
2a00:1450:4001:810::200a
67.202.114.214
68.168.220.235
4014ca31d3c8e768608a40ed160a405ae39836a5b2c43f256bee3bdf427dd67f
424b04a2376482bcf1fb65aa3576e40410193cc357beb82b8acd6c66cd74286c
5642c88794d21e91323d0de2b132026a29da6676a66934227111f8e9cc7ebc90
571bad8557be4700c6de3aaebb6b134bf276f4d1b26cada5e7f92483c0eaca23
65cd6a6d025ad87032d52c69293e4127a98fb74226003e2755800adb65d4ac1f
6801ac69ab210b33891adda1533b87717d9d4a232f2142fe03ecf2bf845daccc
6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625
77b4177733ef4191f755c4f722c7413e9266defccfea65d876132c7353c08db0
97c520503fe6a7f9e8e6edacbfeceed1e132a9e9716062f5a56c5da013344ce2
9e9638c56cb7fcf1ea9a12ce4026d15d1362662a3c9521926428c0efc9dc8889
9e9b9d69e234382e07f0a320337c848b7af0b4f2c73303ea2410dc19462e8378
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
a83848cf5c3d96caefe490c19e41659609b3691dd4c531cf925016c084d8e1b0
babc928d300b31f05bef3b457d0af957435dd18a431ddcedbe831136c12873df
c25355cf2e7bec93c43a0ab8bd19ba779ba9cc901924cbc9312d1c6de8c04c8e
c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5
c84626224633f5f713acb284e070ece91e59517a4d344f9b7d921a3a87fb655f
dbefdf3131790f1f2e435906a821811dac272dcb69b2148c0bc74c6aa4283dd1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85
f4ee745ddb73cf079c293a6aea2eac0fa10b70a47ccebc704d8aacaacc9bf8b0
ff629eeb9ece33e7ad7746a8cd152ea0ffc07b621b84484ded68895231b953b3