urlscan.io logo urlscan.io
SecurityTrails logo

flare.fileplayflash.bid Open in urlscan Pro
18.209.83.12  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight...
Effective URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&ci...
Submission: On July 30 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 10 domains to perform 15 HTTP transactions. The main IP is 18.209.83.12, located in Cambridge, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is flare.fileplayflash.bid.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 16th 2018. Valid for: 3 months.
This is the only time flare.fileplayflash.bid was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple Software Update (Online)

Domain & IP information

IP Address AS Autonomous System
1 54.165.179.250 14618 (AMAZON-AES)
1 1 52.57.135.107 16509 (AMAZON-02)
1 1 67.228.247.10 36351 (SOFTLAYER)
1 67.205.136.74 14061 (DIGITALOC...)
1 2 109.123.118.201 13213 (UK2NET-AS)
1 212.32.250.1 60781 (LEASEWEB-...)
1 1 34.236.254.103 14618 (AMAZON-AES)
1 1 54.172.2.149 14618 (AMAZON-AES)
1 18.209.83.12 14618 (AMAZON-AES)
10 52.222.149.23 16509 (AMAZON-02)
15 6
1    54.165.179.250 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-165-179-250.compute-1.amazonaws.com
usd.gall-tarquin.com
1    52.57.135.107 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-57-135-107.eu-central-1.compute.amazonaws.com
scover-rolders.com
1    67.228.247.10 (Dallas, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: a.f7.e443.ip4.static.sl-reverse.com
ntysr1.com
1    67.205.136.74 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
trkzur.com
2    109.123.118.201 (United Kingdom)

ASN13213 (UK2NET-AS, GB)
PTR: uk.v24.rack101.net
tr4ck.brucelead.com
1    212.32.250.1 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
tracking.pluscpi.mobi
1    34.236.254.103 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-236-254-103.compute-1.amazonaws.com
vip.adpiano.com
1    54.172.2.149 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-172-2-149.compute-1.amazonaws.com
www.downloadcross.stream
1    18.209.83.12 (Cambridge, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-209-83-12.compute-1.amazonaws.com
flare.fileplayflash.bid
10    52.222.149.23 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-149-23.fra53.r.cloudfront.net
d34wvoo5bu1mcn.cloudfront.net
Domain Requested by
10 d34wvoo5bu1mcn.cloudfront.net flare.fileplayflash.bid
2 tr4ck.brucelead.com 1 redirects
1 flare.fileplayflash.bid
1 www.downloadcross.stream 1 redirects
1 vip.adpiano.com 1 redirects
1 tracking.pluscpi.mobi tr4ck.brucelead.com
1 trkzur.com usd.gall-tarquin.com
1 ntysr1.com 1 redirects
1 scover-rolders.com 1 redirects
1 usd.gall-tarquin.com
15 10

This site contains links to these domains. Also see Links.

Domain
static.updflashcycle.win
Subject Issuer Validity Valid
*.pluscpi.mobi
RapidSSL RSA CA 2018		 2018-06-28 -
2019-06-28		 a year crt.sh
flare.fileplayflash.bid
Let's Encrypt Authority X3		 2018-07-16 -
2018-10-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Frame ID: F369573CCF8AD6F15304C1DE1255C649
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidt... Page URL
  2. http://scover-rolders.com/zp-redirect?target=http%3A%2F%2Fntysr1.com%2F336555%2F18676%3Fs1%3Dw96GFO9GN... HTTP 302
    http://ntysr1.com/336555/18676?s1=w96GFO9GNJMPDENF1LC22HKO&s2=156.77.111.21 HTTP 302
    http://trkzur.com/?v=6&reason=country&rand= Page URL
  3. http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170 Page URL
  4. http://tr4ck.brucelead.com/ck_jump?id=cz01NDExMDgwNDYyMTUyODEmdD0xNTMyOTYwMTE2Jmg9NDQ4NTU1MDcx&__if=0&_... HTTP 302
    https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub... Page URL
  5. https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b5f1d749125fb0001a2... HTTP 302
    https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b5f1d749125fb0001a223... HTTP 302
    https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzop... Page URL

Detected technologies

Overall confidence: 50%
Detected patterns
  • env /^head$/i

Page Statistics

15
Requests

13 %
HTTPS

0 %
IPv6

10
Domains

10
Subdomains

6
IPs

4
Countries

285 kB
Transfer

350 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight=908&iframeDetected=false Page URL
  2. http://scover-rolders.com/zp-redirect?target=http%3A%2F%2Fntysr1.com%2F336555%2F18676%3Fs1%3Dw96GFO9GNJMPDENF1LC22HKO%26s2%3D156.77.111.21&caid=84287082-7680-4e33-aa46-013446d3334f&zpid=5e040f92-9402-11e8-925c-12e4d3501b0e&cid=w96GFO9GNJMPDENF1LC22HKO&rt=R HTTP 302
    http://ntysr1.com/336555/18676?s1=w96GFO9GNJMPDENF1LC22HKO&s2=156.77.111.21 HTTP 302
    http://trkzur.com/?v=6&reason=country&rand= Page URL
  3. http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170 Page URL
  4. http://tr4ck.brucelead.com/ck_jump?id=cz01NDExMDgwNDYyMTUyODEmdD0xNTMyOTYwMTE2Jmg9NDQ4NTU1MDcx&__if=0&__type=unknown&__deviceid= HTTP 302
    https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub1=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12 Page URL
  5. https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b5f1d749125fb0001a2230c&sid=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU= HTTP 302
    https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU= HTTP 302
    https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://scover-rolders.com/zp-redirect?target=http%3A%2F%2Fntysr1.com%2F336555%2F18676%3Fs1%3Dw96GFO9GNJMPDENF1LC22HKO%26s2%3D156.77.111.21&caid=84287082-7680-4e33-aa46-013446d3334f&zpid=5e040f92-9402-11e8-925c-12e4d3501b0e&cid=w96GFO9GNJMPDENF1LC22HKO&rt=R HTTP 302
  • http://ntysr1.com/336555/18676?s1=w96GFO9GNJMPDENF1LC22HKO&s2=156.77.111.21 HTTP 302
  • http://trkzur.com/?v=6&reason=country&rand=
Request Chain 3
  • http://tr4ck.brucelead.com/ck_jump?id=cz01NDExMDgwNDYyMTUyODEmdD0xNTMyOTYwMTE2Jmg9NDQ4NTU1MDcx&__if=0&__type=unknown&__deviceid= HTTP 302
  • https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub1=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
domredirect
usd.gall-tarquin.com/ 		694 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight=908&iframeDetected=false
Protocol
HTTP/1.1
Server
54.165.179.250 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-165-179-250.compute-1.amazonaws.com
Software
ZeroPark-Traffic /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host
usd.gall-tarquin.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F369573CCF8AD6F15304C1DE1255C649

Response headers

Cache-Control
no-store, no-cache, pre-check=0, post-check=0
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Type
text/html;charset=UTF-8
Date
Mon, 30 Jul 2018 14:15:14 GMT
redirected
JS
Server
ZeroPark-Traffic
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
transfer-encoding
chunked
Connection
keep-alive
/
trkzur.com/
Redirect Chain
  • http://scover-rolders.com/zp-redirect?target=http%3A%2F%2Fntysr1.com%2F336555%2F18676%3Fs1%3Dw96GFO9GNJMPDENF1LC22HKO%26s2%3D156.77.111.21&caid=84287082-7680-4e33-aa46-013446d3334f&zpid=5e040f92-94...
  • http://ntysr1.com/336555/18676?s1=w96GFO9GNJMPDENF1LC22HKO&s2=156.77.111.21
  • http://trkzur.com/?v=6&reason=country&rand=
180 B
377 B 		Document
General
Check archive.org
Download Go to
Full URL
http://trkzur.com/?v=6&reason=country&rand=
Requested by
Host: usd.gall-tarquin.com
URL: http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight=908&iframeDetected=false
Protocol
HTTP/1.1
Server
67.205.136.74 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
c71cd6a5dc1e7f585fc9a254df5de129235492fdc5816437ae03bf3a1e8e9e22

Request headers

Host
trkzur.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight=908&iframeDetected=false
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F369573CCF8AD6F15304C1DE1255C649
Referer
http://usd.gall-tarquin.com/domredirect?visitid=5e040f92-9402-11e8-925c-12e4d3501b0e&type=js&browserWidth=1811&browserHeight=908&iframeDetected=false

Response headers

Server
nginx/1.10.3 (Ubuntu)
Date
Mon, 30 Jul 2018 14:15:16 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Content-Encoding
gzip

Redirect headers

X-Powered-By
PHP/5.3.27
Content-Type
text/html; charset=utf-8
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Pragma
no-cache
location
http://trkzur.com/?v=6&reason=country&rand=
Content-Length
0
Date
Mon, 30 Jul 2018 14:15:16 GMT
Accept-Ranges
bytes
Server
LiteSpeed
Connection
close
Cookie set ck.php
tr4ck.brucelead.com/ 		977 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170
Protocol
HTTP/1.1
Server
109.123.118.201 , United Kingdom, ASN13213 (UK2NET-AS, GB),
Reverse DNS
uk.v24.rack101.net
Software
SpirooxPerformance-Server-1.0 /
Resource Hash
7da200f4d3695e8baebfaaa5a01b1f0dd438b550109af5935e8dda141fa996b2

Request headers

Host
tr4ck.brucelead.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://trkzur.com/?v=6&reason=country&rand=
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F369573CCF8AD6F15304C1DE1255C649
Referer
http://trkzur.com/?v=6&reason=country&rand=

Response headers

Date
Mon, 30 Jul 2018 14:15:16 GMT
Server
SpirooxPerformance-Server-1.0
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Expires
0
Pragma
no-cache
Content-Length
977
Connection
close
Content-Type
text/html; charset=utf-8
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie
session=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12%7C541108046215281%7C2018-07-30T14%3A15%3A16%2B0000%7C2921044%7CGermany%7C17530%7C%7C153950170%7C6673%7C4%7C4660%7C17530%7C2%7C4445%7C0%7C12657%7C10976%7C21975%7C6997%7C0%7C0%7C3%7C1%7CMac%7C67%7C%7C%7CChrome%7CHETZNER%7CWIFI%7C148.251.45.0%2F24%7C148.251.45.254%7C0%7C%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7C%7C0.0%7C0.0%7C0.0%7C0.0%7C0%7Ctrkzur.com%7C1532960116851%7C%7Cfalse%7Cfalse%7C52%7C0%7C43%7C%7C0%7C0%7C%7Ctr4ck.brucelead.com%7Cde%7C; domain=tr4ck.brucelead.com; path=/
Cookie set click
tracking.pluscpi.mobi/
Redirect Chain
  • http://tr4ck.brucelead.com/ck_jump?id=cz01NDExMDgwNDYyMTUyODEmdD0xNTMyOTYwMTE2Jmg9NDQ4NTU1MDcx&__if=0&__type=unknown&__deviceid=
  • https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub1=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12
267 B
526 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub1=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12
Requested by
Host: tr4ck.brucelead.com
URL: http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
24ee40c6ea74f019f60227d86fdee22ab645ddcbaafd3cd79cecddfe712225de

Request headers

Host
tracking.pluscpi.mobi
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F369573CCF8AD6F15304C1DE1255C649
Referer
http://tr4ck.brucelead.com/ck.php?line_item_id=17530&subid_spx=&clickid=153950170

Response headers

Server
nginx
Date
Mon, 30 Jul 2018 14:15:16 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
afclick=5b5f1d749125fb0001a2230c; Expires=Tue, 30 Jul 2019 14:15:16 GMT
Content-Encoding
gzip

Redirect headers

Date
Mon, 30 Jul 2018 14:15:16 GMT
Server
SpirooxPerformance-Server-1.0
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Expires
0
Pragma
no-cache
Connection
close
Location
https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU%3D&sub1=20180730_fbb3a55f-9402-11e8-b7ea-5d6741e38b12
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie
session=0; domain=tr4ck.brucelead.com; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT c21975=1 ; domain=tr4ck.brucelead.com; path=/; expires=Tue, 31 Jul 2018 14:15:16 GMT l17530=1 ; domain=tr4ck.brucelead.com; path=/; expires=Tue, 31 Jul 2018 14:15:16 GMT
Primary Request Cookie set /
flare.fileplayflash.bid/
Redirect Chain
  • https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b5f1d749125fb0001a2230c&sid=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=
  • https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=
  • https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5N...
218 KB
147 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.209.83.12 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-209-83-12.compute-1.amazonaws.com
Software
nginx/1.13.9 / PHP/7.0.30-0+deb9u1
Resource Hash
52881681cb53924a84bebb1a5c4fac7603b9aa63ac5aad92a73b4e8d4acc3a5b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Host
flare.fileplayflash.bid
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F369573CCF8AD6F15304C1DE1255C649

Response headers

Server
nginx/1.13.9
Date
Mon, 30 Jul 2018 14:15:18 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.0.30-0+deb9u1
Set-Cookie
channel=plus_mac2; expires=Mon, 30-Jul-2018 14:35:18 GMT; Max-Age=1200; path=/ dist_id=2610; expires=Mon, 30-Jul-2018 14:35:18 GMT; Max-Age=1200; path=/ lp_id=2314; expires=Mon, 30-Jul-2018 14:35:18 GMT; Max-Age=1200; path=/
Strict-Transport-Security
max-age=15768000
Content-Encoding
gzip

Redirect headers

Server
nginx/1.13.9
Date
Mon, 30 Jul 2018 14:15:17 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.0.30-0+deb9u1
Location
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Strict-Transport-Security
max-age=15768000
arrow__blue.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/arrow__blue.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2017-01-30T08:48:38.478Z
server
AmazonS3
age
70615
etag
"6d26faedbdd557f7dcd86e9060de347f"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 30 Jan 2017 13:50:57 GMT
accept-ranges
bytes
content-length
2266
x-amz-cf-id
GzNDy3zODfkFuKNGgj-Lvv84BAMRAdsFetNS_8bLoaiPC_N5w39skw==
pattern__safari1.jpg
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/pattern__safari1.jpg
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2017-01-31T09:32:59.097Z
server
AmazonS3
age
70615
etag
"918dfef192de7b99284e969e75d6cc29"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
last-modified
Thu, 15 Feb 2018 14:46:36 GMT
accept-ranges
bytes
content-length
25293
x-amz-cf-id
N2jLyTpqLmaBupPPRPVVbwPtrHYy8pgD_nG3Tj3fi0UGo9By0t7uTg==
pattern__safari-arrow.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/pattern__safari-arrow.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2017-01-30T12:13:47.914Z
server
AmazonS3
age
70616
etag
"496171f7f5272b0c3b8ae1d526110caf"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 30 Jan 2017 13:51:01 GMT
accept-ranges
bytes
content-length
3478
x-amz-cf-id
o_l04I-_HdJ35-jVX7_hfS70y8qoqvr3pLVdTG5_p4tlLRzByENm1A==
clean_k.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		67 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/clean_k.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c9c20ab54cfdf8ae89bcbec66fbdcd3b9a1427239da5b4db7c30577dbd21b95a

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2018-04-05T13:23:03.260Z
server
AmazonS3
age
70615
etag
"0f177416ac65c697b6bee20ef2ad5da7"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Thu, 05 Apr 2018 13:25:23 GMT
accept-ranges
bytes
content-length
68254
x-amz-cf-id
gMMQF6yBPZ16QNzbjYa8bT0nLhh3onr_wY7-V0YtYzRnSA-Yj3FDCg==
downloadgif.gif
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/downloadgif.gif
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d714e144f5890b10e5bfb765e0ea6c31737ee11031131a0c306cc2645ef7ba81

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:38:13.325Z
server
AmazonS3
age
70615
etag
"71d508a5a418c2eab6ac59dab52e5f53"
x-cache
Hit from cloudfront
content-type
image/gif
status
200
last-modified
Mon, 06 Jun 2016 13:29:02 GMT
accept-ranges
bytes
content-length
11787
x-amz-cf-id
wEssM9psSvmjw0w5uJRPyBX9S7HfavVKO4PwiKE7nZWryeSefg3ElQ==
downloadactive.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/downloadactive.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
85ca0e8a71da7cb9f6da2faad0b491818b83b721a03dd71a9e6c1fd23cc355fe

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:30:35.401Z
server
AmazonS3
age
70615
etag
"759894fc31058cbee5c154ddf8109da6"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 06 Jun 2016 13:29:02 GMT
accept-ranges
bytes
content-length
4367
x-amz-cf-id
XwBDMWR_X8JagB0KePxTAAPG-LngK9Tm_Luqi_yqdPzgI7qpDC62GA==
ok.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ok.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
60bc686d0dbd4a721a5b96df034ac04067756297cf097ad6f4338b0e37c95af1

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:27:57.299Z
server
AmazonS3
age
70615
etag
"8735b3e852676168da0cb997fc397c4d"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 06 Jun 2016 13:29:04 GMT
accept-ranges
bytes
content-length
3387
x-amz-cf-id
Cn5-CTsCBjzoNa9OWUQ9RjpV1wYYQM8XeC5k9pabZgMWqxQJ-i3O6g==
okactive.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/okactive.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2755c2a109a7dc442afa20ab5ea319eca18f94a8ea7c05e2dddb6e1264501e23

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:29:12.912Z
server
AmazonS3
age
70615
etag
"2b9dd1759bf55999fc392c5dbb6bb6f7"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 06 Jun 2016 13:29:05 GMT
accept-ranges
bytes
content-length
3437
x-amz-cf-id
uAL1t2UfUSGFdLXy_vhDvJPXe53qETVflVDfhopl9HzzxZFCDDj28w==
okactive@2x.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/okactive@2x.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8b80ca1f74242b77cbf0ac6ec3e8076757aa54578434944a4e4df767c9cf6ad

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:42:33.705Z
server
AmazonS3
age
70615
etag
"370305f8f631cc0642d7bf0d8d7f51e2"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 06 Jun 2016 13:29:05 GMT
accept-ranges
bytes
content-length
4484
x-amz-cf-id
R3Kv32lQuptkkzWXSTxmf27ScuBpEfoORA3ikWtD3pUJEoODdYud2A==
downloadactive@2x.png
d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d34wvoo5bu1mcn.cloudfront.net/lps/flash_mac/images/downloadactive@2x.png
Requested by
Host: flare.fileplayflash.bid
URL: https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
Protocol
SPDY
Server
52.222.149.23 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-149-23.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
911a71457c0146a07bd5d48ef8556f7a802c9feddf63d59750453ff76a443484

Request headers

Referer
https://flare.fileplayflash.bid/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b5f1d749125fb0001a2230c&sub=1001_Uzo0NjYwLFNCOixMOjE3NTMwLEM6MjE5NzU=&v_id=WJv12RgemnNt72ymMGEu3k57yqHPByIpXBgOV48E2Bk.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 29 Jul 2018 18:38:24 GMT
via
1.1 4ba0e9deb9465045a3261b8712935964.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-03-09T08:39:32.396Z
server
AmazonS3
age
70615
etag
"1cd55b247bf699786c644652ea0d1973"
x-cache
Hit from cloudfront
content-type
image/png
status
200
last-modified
Mon, 06 Jun 2016 13:29:02 GMT
accept-ranges
bytes
content-length
6790
x-amz-cf-id
yPYmh1kae19cD6fdHySLUrHkX2kLS4Z1rHsabckiURsHDFTQYPDrDg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showStep object| head object| css object| adVars function| goToAd function| setFilterEffect function| close_modal_ad function| showModalAd object| dlobj function| redirectNotificationForce

3 Cookies

Domain/Path Name / Value
flare.fileplayflash.bid/ Name: lp_id
Value: 2314
flare.fileplayflash.bid/ Name: dist_id
Value: 2610
flare.fileplayflash.bid/ Name: channel
Value: plus_mac2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'