urlscan.io logo urlscan.io
SecurityTrails logo

androidvirusdefend.com Open in urlscan Pro
2606:4700:3032::6815:1e67  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://informmedeliveryusps.com/
Effective URL: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6ats...
Submission: On March 15 via api from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3032::6815:1e67, located in United States and belongs to CLOUDFLARENET, US. The main domain is androidvirusdefend.com.
TLS certificate: Issued by GTS CA 1P5 on February 7th 2024. Valid for: 3 months.
This is the only time androidvirusdefend.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 167.172.228.26 14061 (DIGITALOC...)
1 2 52.117.247.211 36351 (SOFTLAYER)
1 1 18.158.88.249 16509 (AMAZON-02)
1 5 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
12 139.45.197.251 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
18 4
1    167.172.228.26 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
informmedeliveryusps.com
2    52.117.247.211 (United States)

ASN36351 (SOFTLAYER, US)
PTR: d3.f7.7534.ip4.static.sl-reverse.com
myckdom.com
p374591.myckdom.com
1    18.158.88.249 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-88-249.eu-central-1.compute.amazonaws.com
my.toruftuiov.com
5    2606:4700:3032::6815:1e67 (United States)

ASN13335 (CLOUDFLARENET, US)
androidvirusdefend.com
1    2606:4700:3033::ac43:acbe (United States)

ASN13335 (CLOUDFLARENET, US)
androidvirusdefend.com
12    139.45.197.251 (United Kingdom)

ASN9002 (RETN-AS, GB)
ahaurgoo.net
jouteetu.net
1    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
Apex Domain
Subdomains		 Transfer
9 jouteetu.net
jouteetu.net — Cisco Umbrella Rank: 35620
6 androidvirusdefend.com
androidvirusdefend.com
18 KB
3 ahaurgoo.net
ahaurgoo.net — Cisco Umbrella Rank: 547061
15 KB
2 myckdom.com
myckdom.com — Cisco Umbrella Rank: 402718
p374591.myckdom.com
2 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 14304
549 B
1 toruftuiov.com
my.toruftuiov.com — Cisco Umbrella Rank: 187550
2 KB
1 informmedeliveryusps.com
informmedeliveryusps.com
2 KB
18 7
Domain Requested by
9 jouteetu.net ahaurgoo.net
6 androidvirusdefend.com 2 redirects p374591.myckdom.com
androidvirusdefend.com
ahaurgoo.net
3 ahaurgoo.net androidvirusdefend.com
ahaurgoo.net
1 my.rtmark.net ahaurgoo.net
1 my.toruftuiov.com 1 redirects
1 p374591.myckdom.com
1 myckdom.com 1 redirects
1 informmedeliveryusps.com 1 redirects
18 8

This site contains links to these domains. Also see Links.

Domain
my.toruftuiov.com
Subject Issuer Validity Valid
*.myckdom.com
Sectigo RSA Domain Validation Secure Server CA		 2024-03-14 -
2025-03-20		 a year crt.sh
androidvirusdefend.com
GTS CA 1P5		 2024-02-07 -
2024-05-07		 3 months crt.sh
ahaurgoo.net
R3		 2024-01-26 -
2024-04-25		 3 months crt.sh
jouteetu.net
R3		 2024-03-13 -
2024-06-11		 3 months crt.sh
rtmark.net
R3		 2024-03-02 -
2024-05-31		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
Frame ID: BA71E43C3B0EBF4F8D3D9071C0BFB932
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Attention!

Page URL History Show full URLs

  1. http://informmedeliveryusps.com/ HTTP 302
    https://myckdom.com/aS/feedclick?s=IKaS41W5VyZ3B4od8oTtHemBtLq9i2aQkd1D9N_Ay2dKhuV_szM-pJ5tV7Jmg... HTTP 302
    https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65Gcj... Page URL
  2. https://my.toruftuiov.com/42741c3c-7033-411b-9d7d-aa6eccb8b43d?source=443895569&keyword=informmedelive... HTTP 302
    https://androidvirusdefend.com/imitate/en?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&... HTTP 301
    http://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k... HTTP 301
    https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k... Page URL

Page Statistics

18
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

8
Subdomains

4
IPs

3
Countries

31 kB
Transfer

57 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://informmedeliveryusps.com/ HTTP 302
    https://myckdom.com/aS/feedclick?s=IKaS41W5VyZ3B4od8oTtHemBtLq9i2aQkd1D9N_Ay2dKhuV_szM-pJ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT_4ZRcycYi4acAGaxa_0JGiB4UdU1tKahrGSBm-rZhsKqzntY9079EHuvVyfDHXZu_Vl4Mv8swIDVpd8lp5GkpN6qgJg06P3ROIM6wxf93i1rLSPBykuS0JRwfUS_Uy_VkJX7T8JOt4mlPr1IvESbXgp8U4v__YIajoOqwFV200M6jUMjeuah0CWMg9PCHmNur7wp35mgEMcH1aWZiiVn6dLRCm5aqdBmFBgWwMA5OedCR07sRiQCqecGkmzjwtR5E8fl9pn_5wJHM_OE2Wo5Ochb47-fSLvE12gIn3UO0LQkL80lw8jJG6EMSZ5Gir0j52bFDvAgkQm6EN43b9R7Itj-zbQyR_LF2Iqe25UNf0urdwOoqv4HHoif9ilotuqDhb4oZZHrnYZPkgJPxneDK3bXxFovgR1WMOPMCpR9Yewqwn7NajwYDHP5wKD6wA9_rpfvhS3wYZwu3CnU237R67lflhH2LhXqL-3fqpiU34HjNNfr_B7XTGZDa4DJbhN1ZeB07giPRkHksFUxsCFeIsC9uwzvVnavhWZ6ys8tUxOrlKMYiXt423iKzVFDksaX3cYt-dya8opK4hGF21u8DgyEVNneyrPMEjdoguWjQrzYw_mBFZKKlMpCv3vhNamm6DAuNAteWukFz34RIGrS3X5lONFcN8elufynulOJMWNAPzNRsPqBPOgZmJNVErkGo16saf6fjpkLhvi87c-2DKyzbUw8pzdLKuhMeHvseVftyCxNR0CtFIL8Axmmxs2XrObDFiZlEuN1202C92y8RcZ0V9_-59rSs9w0klb1zb9KTRxUhjjtwE1R-YSlIDCp-JN4LCu3Cn75ivf2NjfZ3Ao8M-tAqLGzu6VpZcBnVRmV8YJoUdyDc_kFNLUHsYiKAiWGmL89wQZlOd__t0XoLeks_R4KmmmFd90nU5Si5RlVsrHllsCunO6Ig06cQ2kDncvirW3HfvmKrJF4pkQi-6HqhJkCym6vSGmOi2MSGVjHS4VWfm-aGarpAG0wZ9h5jM1mYjynQxBzaZLXaLV-rxMcIMxGZ8Dd6khgw1xiwVT7I5Q2S4xDV8UQa3LJ3ZlreU4cSLooc0LaC0g_TUnpYbLumAvLluo3fu73izxkPSqISe3KRSZ7Z5ShFVA26ZOwuwcQx2KF93pZy54birllHtLJuK6p4r3ynD5UObBi7Sk09Or2uRPrxnxKgwn8aOMR0xBcno1gxbhzB_KUmbqOcQJInrkZyPysy0KwhE3F8lO7oBdjPsrjna5wrAjSmVQJxcD8tIx1dFMb0IV_8bfOnq3YN_0ZLz2JcILhesmiPaWYqUpkUGOfRR5JugWxqn7voDC4rz6k8 HTTP 302
    https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhxtCR_XryofFEOcZ_KtfrrZhsbKydzzPNTbxZkv7EJ8xQviaeyZeB4t_suqwm3apsrzxIzV8UQa3LJ3ZlreU4cSLooeVsUcPwTh0ww8B78vhYDGtMDuPZRhDTbTSk09Or2uRPr3E8dMnwCMKLs8J_wrqcqkA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufotEUrL_rQMw&ui=IKaS41W5VyZ3B4od8oTtHVp70TebSTTq5BqBrDJxXOHQotXFja_w-_8Te1QUoYPL46n43Cojjn97LbprzL2xm5-AO7qpJZQ1ZJCo0WFiowIGDcPZgTihbw&si=1&oref=67b6f2b461ceea8bdbbf0e8d9148d983&optunit=OdrnCsCNKZVAnFwPy0jHV0UxvQhX_xt8ZZJCxAdeOqU&rb=nmu0EXDzm40&rr=1&isco=t&abtg=0 Page URL
  2. https://my.toruftuiov.com/42741c3c-7033-411b-9d7d-aa6eccb8b43d?source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=@@CREATIVE-ID@@&bid=0.0035&clickid=90802764667 HTTP 302
    https://androidvirusdefend.com/imitate/en?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667 HTTP 301
    http://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667 HTTP 301
    https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://informmedeliveryusps.com/ HTTP 302
  • https://myckdom.com/aS/feedclick?s=IKaS41W5VyZ3B4od8oTtHemBtLq9i2aQkd1D9N_Ay2dKhuV_szM-pJ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT_4ZRcycYi4acAGaxa_0JGiB4UdU1tKahrGSBm-rZhsKqzntY9079EHuvVyfDHXZu_Vl4Mv8swIDVpd8lp5GkpN6qgJg06P3ROIM6wxf93i1rLSPBykuS0JRwfUS_Uy_VkJX7T8JOt4mlPr1IvESbXgp8U4v__YIajoOqwFV200M6jUMjeuah0CWMg9PCHmNur7wp35mgEMcH1aWZiiVn6dLRCm5aqdBmFBgWwMA5OedCR07sRiQCqecGkmzjwtR5E8fl9pn_5wJHM_OE2Wo5Ochb47-fSLvE12gIn3UO0LQkL80lw8jJG6EMSZ5Gir0j52bFDvAgkQm6EN43b9R7Itj-zbQyR_LF2Iqe25UNf0urdwOoqv4HHoif9ilotuqDhb4oZZHrnYZPkgJPxneDK3bXxFovgR1WMOPMCpR9Yewqwn7NajwYDHP5wKD6wA9_rpfvhS3wYZwu3CnU237R67lflhH2LhXqL-3fqpiU34HjNNfr_B7XTGZDa4DJbhN1ZeB07giPRkHksFUxsCFeIsC9uwzvVnavhWZ6ys8tUxOrlKMYiXt423iKzVFDksaX3cYt-dya8opK4hGF21u8DgyEVNneyrPMEjdoguWjQrzYw_mBFZKKlMpCv3vhNamm6DAuNAteWukFz34RIGrS3X5lONFcN8elufynulOJMWNAPzNRsPqBPOgZmJNVErkGo16saf6fjpkLhvi87c-2DKyzbUw8pzdLKuhMeHvseVftyCxNR0CtFIL8Axmmxs2XrObDFiZlEuN1202C92y8RcZ0V9_-59rSs9w0klb1zb9KTRxUhjjtwE1R-YSlIDCp-JN4LCu3Cn75ivf2NjfZ3Ao8M-tAqLGzu6VpZcBnVRmV8YJoUdyDc_kFNLUHsYiKAiWGmL89wQZlOd__t0XoLeks_R4KmmmFd90nU5Si5RlVsrHllsCunO6Ig06cQ2kDncvirW3HfvmKrJF4pkQi-6HqhJkCym6vSGmOi2MSGVjHS4VWfm-aGarpAG0wZ9h5jM1mYjynQxBzaZLXaLV-rxMcIMxGZ8Dd6khgw1xiwVT7I5Q2S4xDV8UQa3LJ3ZlreU4cSLooc0LaC0g_TUnpYbLumAvLluo3fu73izxkPSqISe3KRSZ7Z5ShFVA26ZOwuwcQx2KF93pZy54birllHtLJuK6p4r3ynD5UObBi7Sk09Or2uRPrxnxKgwn8aOMR0xBcno1gxbhzB_KUmbqOcQJInrkZyPysy0KwhE3F8lO7oBdjPsrjna5wrAjSmVQJxcD8tIx1dFMb0IV_8bfOnq3YN_0ZLz2JcILhesmiPaWYqUpkUGOfRR5JugWxqn7voDC4rz6k8 HTTP 302
  • https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhxtCR_XryofFEOcZ_KtfrrZhsbKydzzPNTbxZkv7EJ8xQviaeyZeB4t_suqwm3apsrzxIzV8UQa3LJ3ZlreU4cSLooeVsUcPwTh0ww8B78vhYDGtMDuPZRhDTbTSk09Or2uRPr3E8dMnwCMKLs8J_wrqcqkA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufotEUrL_rQMw&ui=IKaS41W5VyZ3B4od8oTtHVp70TebSTTq5BqBrDJxXOHQotXFja_w-_8Te1QUoYPL46n43Cojjn97LbprzL2xm5-AO7qpJZQ1ZJCo0WFiowIGDcPZgTihbw&si=1&oref=67b6f2b461ceea8bdbbf0e8d9148d983&optunit=OdrnCsCNKZVAnFwPy0jHV0UxvQhX_xt8ZZJCxAdeOqU&rb=nmu0EXDzm40&rr=1&isco=t&abtg=0

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
domainClick
p374591.myckdom.com/adServe/
Redirect Chain
  • http://informmedeliveryusps.com/
  • https://myckdom.com/aS/feedclick?s=IKaS41W5VyZ3B4od8oTtHemBtLq9i2aQkd1D9N_Ay2dKhuV_szM-pJ5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UG37q4Cgpg75MByokIpjiFKluxNC_VCHffxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT...
  • https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhx...
517 B
973 B 		Document
General
Check archive.org
Download Go to
Full URL
https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhxtCR_XryofFEOcZ_KtfrrZhsbKydzzPNTbxZkv7EJ8xQviaeyZeB4t_suqwm3apsrzxIzV8UQa3LJ3ZlreU4cSLooeVsUcPwTh0ww8B78vhYDGtMDuPZRhDTbTSk09Or2uRPr3E8dMnwCMKLs8J_wrqcqkA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufotEUrL_rQMw&ui=IKaS41W5VyZ3B4od8oTtHVp70TebSTTq5BqBrDJxXOHQotXFja_w-_8Te1QUoYPL46n43Cojjn97LbprzL2xm5-AO7qpJZQ1ZJCo0WFiowIGDcPZgTihbw&si=1&oref=67b6f2b461ceea8bdbbf0e8d9148d983&optunit=OdrnCsCNKZVAnFwPy0jHV0UxvQhX_xt8ZZJCxAdeOqU&rb=nmu0EXDzm40&rr=1&isco=t&abtg=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.117.247.211 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
d3.f7.7534.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
accept-language
en-GB,en;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html;charset=ISO-8859-1
Date
Fri, 15 Mar 2024 21:17:03 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Fri, 15 Mar 2024 21:17:03 GMT
Location
https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhxtCR_XryofFEOcZ_KtfrrZhsbKydzzPNTbxZkv7EJ8xQviaeyZeB4t_suqwm3apsrzxIzV8UQa3LJ3ZlreU4cSLooeVsUcPwTh0ww8B78vhYDGtMDuPZRhDTbTSk09Or2uRPr3E8dMnwCMKLs8J_wrqcqkA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufotEUrL_rQMw&ui=IKaS41W5VyZ3B4od8oTtHVp70TebSTTq5BqBrDJxXOHQotXFja_w-_8Te1QUoYPL46n43Cojjn97LbprzL2xm5-AO7qpJZQ1ZJCo0WFiowIGDcPZgTihbw&si=1&oref=67b6f2b461ceea8bdbbf0e8d9148d983&optunit=OdrnCsCNKZVAnFwPy0jHV0UxvQhX_xt8ZZJCxAdeOqU&rb=nmu0EXDzm40&rr=1&isco=t&abtg=0
Server
nginx
Primary Request /
androidvirusdefend.com/imitate/en/
Redirect Chain
  • https://my.toruftuiov.com/42741c3c-7033-411b-9d7d-aa6eccb8b43d?source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device...
  • https://androidvirusdefend.com/imitate/en?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx...
  • http://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx...
  • https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsC...
13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
Requested by
Host: p374591.myckdom.com
URL: https://p374591.myckdom.com/adServe/domainClick?ai=J3F4Iyh18u2FFumE8e4MRzEdMQXJ6NYMW4cwfylJm6jnECSJ65GcjwiXH4MPb3lP_Ou1IY0Ct5fTn5vTRqNUTzScp2NspAPN-wZysUmPSygGnw3UKqTcaWqAQTR_kWOHxecuIWlWALwG9_hEhxtCR_XryofFEOcZ_KtfrrZhsbKydzzPNTbxZkv7EJ8xQviaeyZeB4t_suqwm3apsrzxIzV8UQa3LJ3ZlreU4cSLooeVsUcPwTh0ww8B78vhYDGtMDuPZRhDTbTSk09Or2uRPr3E8dMnwCMKLs8J_wrqcqkA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufotEUrL_rQMw&ui=IKaS41W5VyZ3B4od8oTtHVp70TebSTTq5BqBrDJxXOHQotXFja_w-_8Te1QUoYPL46n43Cojjn97LbprzL2xm5-AO7qpJZQ1ZJCo0WFiowIGDcPZgTihbw&si=1&oref=67b6f2b461ceea8bdbbf0e8d9148d983&optunit=OdrnCsCNKZVAnFwPy0jHV0UxvQhX_xt8ZZJCxAdeOqU&rb=nmu0EXDzm40&rr=1&isco=t&abtg=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:1e67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a14bdc62c1eb80bc15a8f474a9605e4f407d0d0b871b888a82a5632ba2c00081
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://p374591.myckdom.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
864f8735eebe732a-LHR
content-encoding
gzip
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-type
text/html
date
Fri, 15 Mar 2024 21:17:04 GMT
last-modified
Thu, 23 Nov 2023 12:50:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMQEBVhQGvEdPRcGYb7SXD1z7MxoN24nucfqewPpW55zFBdL0Ug0U1CmSPN6k8SOqvsvV2kwpXPmTYeUkz02dG547fQ1Ef87eUn%2BBIQ5qNjk9SarIin40DVf0iuSt8Szk6TlL68Qb%2BqxUDJk916kUiAvsg5n"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
sameorigin
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block

Redirect headers

CF-RAY
864f87359b3c76cf-LHR
Cache-Control
max-age=3600
Connection
keep-alive
Date
Fri, 15 Mar 2024 21:17:04 GMT
Expires
Fri, 15 Mar 2024 22:17:04 GMT
Location
https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7T2bhwRvHP104%2BK2fCiAB%2FmzVA4e7tlZc%2F2kpPcErVyzkC2x4ps5JtId4Xt3%2FfG1M8%2B%2BaQUyHTBcKDyqdgdA6KuGjH5sc9ol6wExVYkUAWtprxdQiGz%2BUeZnk8%2FJ4lBApCRK8lzDo%2BZHXzhu6O2kax1c2hRS"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
icon.png
androidvirusdefend.com/imitate/en/images/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://androidvirusdefend.com/imitate/en/images/icon.png
Requested by
Host: androidvirusdefend.com
URL: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:1e67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b4b554f43b00e9e849f657f13bddb78644df48deb2f8b96e6cbc7d4ac4dc05b
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

date
Fri, 15 Mar 2024 21:17:04 GMT
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies
none
age
6602
alt-svc
h3=":443"; ma=86400
content-length
8370
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 23 Nov 2023 12:50:33 GMT
server
cloudflare
etag
"655f4a99-20b2"
x-download-options
noopen
x-frame-options
sameorigin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4t%2BX3s7LFWghV1whOS2DnGMsKz3YAiQLLrtQsGQWCAYX16DiowfBLO3WFcOSbpqN7KPOKHPKG4%2BqBuFI3yqKYdEe%2FqAjg5uNqjlMPQpid%2B4gUh%2FSnxIJSdEtnRL7SPl5AaWExqKV9KkZ4%2Fc2zedYjzmfIL87"}],"group":"cf-nel","max_age":604800}
content-type
image/png
vary
Accept-Encoding
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
864f87367a573699-LHR
expires
Tue, 05 Mar 2024 15:24:56 GMT
micro.tag.min.js
ahaurgoo.net/pfe/current/ 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Requested by
Host: androidvirusdefend.com
URL: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ac659687f647d5e86d31f6d9e4be3cd6a5534d01532d1310e8ced114919e0afb

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

pragma
no-cache
date
Fri, 15 Mar 2024 21:17:04 GMT
content-encoding
gzip
last-modified
Tue, 12 Mar 2024 08:40:28 GMT
server
nginx
etag
W/"65f014fc-8a1a"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
alert.mp3
androidvirusdefend.com/imitate/en/sounds/ 		548 B
992 B 		Media
General
Check archive.org
Download Go to
Full URL
https://androidvirusdefend.com/imitate/en/sounds/alert.mp3
Requested by
Host: androidvirusdefend.com
URL: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:1e67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

Referer
https://androidvirusdefend.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Range
bytes=0-

Response headers

date
Fri, 15 Mar 2024 21:17:04 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
168
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kAJlTbT9eY6ENZgO%2BSZz4KIuuTWEjCcEPhMQ2%2Foa6LFE%2F%2BV6bHl1xaxPyAGZADD4SNtBmnTVyG5u9%2F12i7j10Ja6o8R%2Bbqw1WQsMU8I5ybNFACPmkIa9xFz8kBgVG4rGWA%2Bf2kBq8epYQ%2FI1QMKfiBesOzOP"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
cf-ray
864f8736aa9a3699-LHR
alt-svc
h3=":443"; ma=86400
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
sw-check-permissions-e69f6.js
androidvirusdefend.com/ 		0
882 B 		Other
General
Check archive.org
Download Go to
Full URL
https://androidvirusdefend.com/sw-check-permissions-e69f6.js?var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&ymid=wjodcav7ced6atsv2ltu940k&zoneId=5776126
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:1e67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

date
Fri, 15 Mar 2024 21:17:04 GMT
content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies
none
content-encoding
gzip
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 23 Nov 2023 12:50:31 GMT
server
cloudflare
etag
W/"655f4a97-236"
x-download-options
noopen
x-frame-options
sameorigin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ds9QMduZHM6ttb3tSxBH8sXZI%2FpxRtfMRIb%2B7MUOcUhC5vT9oemetHi%2BGRo0YgJjosAaMTX85ElfgJAG%2B3rp%2Fv%2F5j9qo6JdbRAClJmzGl4pFjLq8pX2R8R9zMH8uM6u17USBKmpzg2eIWRXlh1CDLbiXLhql"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding
cache-control
max-age=14400
cf-ray
864f8737cd043699-LHR
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
zone
ahaurgoo.net/ 		0
263 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://ahaurgoo.net/zone?&pub=0&zone_id=5776126&is_mobile=true&domain=androidvirusdefend.com&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&ymid=wjodcav7ced6atsv2ltu940k&var_3=&var_4=&dsig=&tg=1&sw=3.1.496&trace_id=574faa88-95db-4ea9-bc08-bb63a89156a7&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

x-trace-id
62172414f28de40b2cf335651a6ed3b9
date
Fri, 15 Mar 2024 21:17:04 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-origin
https://androidvirusdefend.com
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
0
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
gid.js
my.rtmark.net/ 		65 B
549 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=5776126&checkDuplicate=true&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
c718f548d8eada193712831fd85edaca66aa79a762787b75f3f278326f988107
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

date
Fri, 15 Mar 2024 21:17:04 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://androidvirusdefend.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
zone
ahaurgoo.net/ 		831 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ahaurgoo.net/zone?&pub=0&zone_id=5776126&is_mobile=true&domain=androidvirusdefend.com&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&ymid=wjodcav7ced6atsv2ltu940k&var_3=&var_4=&dsig=&tg=1&sw=3.1.496&trace_id=574faa88-95db-4ea9-bc08-bb63a89156a7&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
a213238cc1963d408ad7cf11824ecf908f2e842e98803256738e9d556b29b333
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://androidvirusdefend.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

x-trace-id
998ffd9237e95a4d726cc5f8067278ce
date
Fri, 15 Mar 2024 21:17:04 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://androidvirusdefend.com
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
831
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: ahaurgoo.net
URL: https://ahaurgoo.net/pfe/current/micro.tag.min.js?z=5776126&ymid=wjodcav7ced6atsv2ltu940k&var=42741c3c-7033-411b-9d7d-aa6eccb8b43d&sw=/sw-check-permissions-e69f6.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://androidvirusdefend.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| contains function| getURLParameter string| alertText object| url string| pci string| ppi object| s object| zfgformats

5 Cookies

Domain/Path Name / Value
.myckdom.com/ Name: rhid
Value: 83740267363
.myckdom.com/ Name: loi
Value: ad_1828267_off_1270833_aff_88847_cid_374591-INFORMMEDELIVERYUSPS.COM_ts_1710537423
.my.toruftuiov.com/ Name: 42741c3c-7033-411b-9d7d-aa6eccb8b43d-v4
Value: ccn5YKs6b-P6jngv0yAUXJSMi0GjChr6DKyNapqRcTs
.my.toruftuiov.com/ Name: cep-v4
Value: 8448JCAMCEISB9i-uYBUjeBgcTAlUf2xCczGsGenNT5PhHpeImZ6UPh0Tv5djpFb7iAOjsIA2QqdWxCLF0-8B6M4O2Z0yJCTySS0OxAwBqHdZC2E9ynVkHVlrKAZ_1xznLMoCHJoWdv3BHFhjdTVHPSWNjm8Mi4w3O8ZA1DjCDv_Q445LgE1J5QkdNtuKN371I4aLPjC5IS6LEpxgRSy5O5g3WqmFJK7e1E9XsbKIBnej3RnWff8I5O7A5voV5l54M9vd7To-rj7H0NfvGK2zn-pZbEp2XVICKOhMtFN-M0S8YQ04SZJ2gTnEAKE827YuU3IFFWxs6eZ_CdZFPIPogZHlTivEx3x9vCzpXsonvhCIrcwAxnQXyVpYMuGxEJkd_FAS_YZE0x10TFSwnWNdxokJhm03SPbeDGc20i8-vZm_fdGqQjFrLyUL-3dvKuIlZ7b9iYI-4iLM4x7ERMIpJGouY8cJ1HCXiIdpO-jGGX7sgkheXnkMFrYF7QxdXGqz4JSU5gxNp1FkXc788za74LeXCu5028tJCB5D6Z6IQ9BsEXxKYgZ0Mb9H7967149DCmVOofXrjZXiZ6zEvhTiNFzyZz2Z6hFJWffDAlMega67oIYglKNwdjsQv2tpXdLkVehXOw4iEE4OGgdB_6saLfQ_3Z4-hZsVFmWIwFAeJU
my.rtmark.net/ Name: ID
Value: 637b9d655fe94476a1905cec330c2da5

2 Console Messages

Source Level URL
Text
network error URL: https://androidvirusdefend.com/imitate/en/sounds/alert.mp3
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://androidvirusdefend.com/imitate/en/?brand=Samsung&model=Galaxy%20A20&txn_id=wjodcav7ced6atsv2ltu940k&cid=wjodcav7ced6atsv2ltu940k&campaign.id=42741c3c-7033-411b-9d7d-aa6eccb8b43d&cep=UAGMmsCx0uRVfg-rZiO2WQREa9hhaiHwDE_4srXyz0LsLwMVZRWAh_G-YQhEjfZdYVSU1HEe5-D_anlTQXH2ucfErFLuRQP-4YEnbZLiBj2jxPIf42k4Dqm5io7GLhVHoqhpzpJ7s46TeP7eJJL7BTOYeFvKaawD1sQ7_IGWjALiBoud-cKO5uOMtadlewjTH7ytOqB_owBeSPubgyRIrxtFK1qEfN6o9PPkQXykufVdGr8Hc7I9oj-_IRLAB1FU38tCsbNi-NVMlw6_OP08sJDOd9I0mJHf38v2_XCmqj85L0A9LdQ4l-6HFBvZKW1srhnSWT87YOJd6CL6acojgfrdPFbG3t5koBF9GQkuJnD7r8dCgwpuhp8dhQr_4Mu6LkBIUTZkr5lXzMBc2Vylyxq22kI3z57bX-Di1a3gkwn8cWqLQjoGO8Z90y1vaE274sofhMZlMsgieLb8NSP0fsnJs0VQl2gk7ykjGWsORIzKGw8fXfsV03mhD3iikD7f65MPwQv8o6DyFwhyS1epN8fAtiLwztIknzXorl3dvcVjG7eZqoh2i5zgaj9M8xQX-8daU2YxozjPyhhnVQD1k6gbD_LK8gS84cpOHd3hDrb0yQusI_GuOkmEH3KE2pyRmyDCHki6DN0pSH9skkhat1cDN8dDk2_rYDD04_8jaqs&lptoken=1797105d53b9928f230f&source=443895569&keyword=informmedeliveryusps.com+RO&geo=GB&campaignname=United+States+-+Direct+-+Cleaner+-+Totalav+globalwhite&device=Mobile&os=Android+10.x+Mobile&browser=Chrome+116&carrier=UNKNOWN&CREATIVE-ID=%40%40CREATIVE-ID%40%40&bid=0.0035&clickid=90802764667#
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.