www.zoeytad.com Open in urlscan Pro
103.211.219.34  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.zoeytad.com/is/	126 KB 33 KB	820ms 249ms	Document text/html	103.211.219.34 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://www.zoeytad.com/is/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.211.219.34 , Seychelles, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS Software Apache / Resource Hash 9dec076f49f240fe92dc2555b93a100132457e7840e1fcc4e97ab320369d499a Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host www.zoeytad.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 29 Mar 2021 05:03:44 GMT Server Apache Vary Accept-Encoding X-Mod-Pagespeed 1.13.35.2-0 Content-Encoding gzip Referrer-Policy no-referrer-when-downgrade X-XSS-Protection 1; mode=block X-Frame-Options SAMEORIGIN X-Content-Type-Options nosniff Cache-Control max-age=0, no-cache, s-maxage=10 Content-Length 33671 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	integrator.js Show response adservice.google.com.eg/adsid/	107 B 799 B	46ms 14ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com.eg/adsid/integrator.js?domain=friends.walla.co.il Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 165 B	16ms 15ms	Script application/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=friends.walla.co.il Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Feb 2021 21:33:27 GMT server Golfe2 age 2918 date Mon, 29 Mar 2021 04:15:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18980 expires Mon, 29 Mar 2021 06:15:07 GMT
GET H2	200	pubads_impl_rendering_2019070801.js Show response securepubads.g.doubleclick.net/gpt/	67 KB 25 KB	17ms 16ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019070801.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software sffe / Resource Hash 0f5d6a89240be982d4543fcc3b47a049d3ed974efc2276c273eb172fe9176020 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 08 Jul 2019 13:05:49 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 25860 x-xss-protection 0 expires Mon, 29 Mar 2021 05:03:45 GMT
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 28 KB	13ms 12ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cac02e231c61068da6a4e6c177f2ccd14a5360aa3509af3be992bfbbad0c127b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1616585787019197" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28245 x-xss-protection 0 expires Mon, 29 Mar 2021 05:03:45 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	356 KB 55 KB	44ms 43ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-T728TH Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9ecf2021c583db79f1d8a7bf83aa0accb88665ddd17de578ad2a507cd33d4756 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 56548 x-xss-protection 0 last-modified Mon, 29 Mar 2021 03:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 29 Mar 2021 05:03:45 GMT
GET H3-Q050	200	gpt.js Show response www.googletagservices.com/tag/js/	56 KB 19 KB	44ms 28ms	Script text/javascript	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b5bd5138ba1a13dfc425ace284d5661d18f3d1209601a99f4ce12f526d119fc7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "826 / 576 of 1000 / last-modified: 1616795453" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19584 x-xss-protection 0 expires Mon, 29 Mar 2021 05:03:45 GMT
GET		glo-our-divisions-teaser-large.web.793.252.jpg www.dhl.com/content/dam/dhl/global/core/images/teaser-large-2730x868/	0 0
GET H3-Q050	200	pubads_impl_2019070801.js Show response securepubads.g.doubleclick.net/gpt/	150 KB 55 KB	44ms 30ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019070801.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software sffe / Resource Hash 710bb035af3b6a17b98e7a60f289cbda442b0160707bd4e6b02f9797acda1598 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 08 Jul 2019 13:05:49 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 56394 x-xss-protection 0 expires Mon, 29 Mar 2021 05:03:45 GMT
GET H2	200	integrator.js Show response adservice.google.com.eg/adsid/	107 B 165 B	15ms 14ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com.eg/adsid/integrator.js?domain=localhost Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3-Q050	200	integrator.js Show response adservice.google.com/adsid/	107 B 531 B	36ms 21ms	Script application/javascript	2a00:1450:4001:801::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=localhost Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3-Q050	200	pubads_impl_2021031801.js Show response securepubads.g.doubleclick.net/gpt/	286 KB 100 KB	36ms 29ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031801.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software sffe / Resource Hash ecf0ffde6e56a2c058421a0ca1a3446a00d047de48239cd168f7eb93a07a9269 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 18 Mar 2021 08:39:05 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 102478 x-xss-protection 0 expires Mon, 29 Mar 2021 05:03:45 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-35/html/	0 0	7ms 6ms	Other text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H3-Q050	200	integrator.js Show response adservice.google.com.eg/adsid/	107 B 777 B	35ms 22ms	Script application/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com.eg/adsid/integrator.js?domain=localhost Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3-Q050	200	integrator.js Show response adservice.google.com/adsid/	107 B 123 B	14ms 14ms	Script application/javascript	2a00:1450:4001:801::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=localhost Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	dhl-logo.svg www.dhl.com//content/dam/dhl/global/core/images/logos/	2 KB 1 KB	13ms 12ms	Image image/svg+xml	23.79.151.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.dhl.com//content/dam/dhl/global/core/images/logos/dhl-logo.svg Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.79.151.108 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-79-151-108.deploy.static.akamaitechnologies.com Software / Resource Hash 362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419 Security Headers Name Value Content-Security-Policy default-src data: https: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http:; style-src 'unsafe-inline' https: http: blob: Strict-Transport-Security max-age=31536000 X-Content-Security-Policy default-src data: https: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http:; style-src 'unsafe-inline' https: http: blob: X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src data: https: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http:; style-src 'unsafe-inline' https: http: blob: content-encoding gzip x-content-type-options nosniff server-timing cdn-cache; desc=HIT, edge; dur=1 vary Accept-Encoding content-length 722 x-xss-protection 1; mode=block last-modified Thu, 25 Feb 2021 17:25:20 GMT x-frame-options DENY date Mon, 29 Mar 2021 05:03:45 GMT strict-transport-security max-age=31536000 content-type image/svg+xml expires Mon, 29 Mar 2021 05:03:45 GMT cache-control public, max-age=0 etag W/"643-5bc2c6f9fc901-gzip" accept-ranges bytes x-webkit-csp default-src data: https: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http:; style-src 'unsafe-inline' https: http: blob: x-content-security-policy default-src data: https: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http:; style-src 'unsafe-inline' https: http: blob:
GET H/1.1	404 Not Found	inline.b30c555ec93d5e8b24c8.bundle.js www.zoeytad.com/	0 0	1126ms 1126ms	Script text/html	103.211.219.34 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://www.zoeytad.com/inline.b30c555ec93d5e8b24c8.bundle.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.211.219.34 , Seychelles, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS Software Apache / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 29 Mar 2021 05:03:45 GMT Content-Encoding gzip X-Content-Type-Options nosniff Transfer-Encoding chunked Connection Keep-Alive X-XSS-Protection 1; mode=block Link <https://www.zoeytad.com/wp-json/>; rel="https://api.w.org/" Referrer-Policy no-referrer-when-downgrade Server Apache X-Frame-Options SAMEORIGIN Vary Accept-Encoding Strict-Transport-Security max-age=63072000 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Keep-Alive timeout=5, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	scripts.eb27010e332a0e01cebe.bundle.js www.zoeytad.com/	0 0	1397ms 1123ms	Script text/html	103.211.219.34 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://www.zoeytad.com/scripts.eb27010e332a0e01cebe.bundle.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.211.219.34 , Seychelles, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS Software Apache / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 29 Mar 2021 05:03:45 GMT Content-Encoding gzip X-Content-Type-Options nosniff Transfer-Encoding chunked Connection Keep-Alive X-XSS-Protection 1; mode=block Link <https://www.zoeytad.com/wp-json/>; rel="https://api.w.org/" Referrer-Policy no-referrer-when-downgrade Server Apache X-Frame-Options SAMEORIGIN Vary Accept-Encoding Strict-Transport-Security max-age=63072000 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	main.2135d531eeae70d97ef1.bundle.js www.zoeytad.com/	0 0	1397ms 1117ms	Script text/html	103.211.219.34 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://www.zoeytad.com/main.2135d531eeae70d97ef1.bundle.js Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.211.219.34 , Seychelles, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS Software Apache / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 29 Mar 2021 05:03:45 GMT Content-Encoding gzip X-Content-Type-Options nosniff Transfer-Encoding chunked Connection Keep-Alive X-XSS-Protection 1; mode=block Link <https://www.zoeytad.com/wp-json/>; rel="https://api.w.org/" Referrer-Policy no-referrer-when-downgrade Server Apache X-Frame-Options SAMEORIGIN Vary Accept-Encoding Strict-Transport-Security max-age=63072000 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	403	hhsH2h8wS7e755P3VB0d3g.png image.prntscr.com/image/	0 0	155ms 111ms	Image text/html	104.23.140.12 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image.prntscr.com/image/hhsH2h8wS7e755P3VB0d3g.png Requested by Host: www.zoeytad.com URL: https://www.zoeytad.com/is/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H3-Q050	403	ads Show response securepubads.g.doubleclick.net/gampad/	203 B 450 B	16ms 16ms	XHR text/html	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3220940261253161&correlator=1734830534491792&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=21064370%2C31060367%2C44739387&vrg=2019070801&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20210329&iu_parts=43010785%2Cwalla%2Cfriends%2Cskyscrapper_desktop%2Ctop_desktop&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4&prev_iu_szs=300x600%2C120x600%7C160x600%2C970x90%7C970x250&prev_scp=exclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dtop_desktop&cookie_enabled=1&bc=31&abxe=1&lmt=1616994225&dt=1616994225378&dlt=1616994225168&idt=197&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C0%2C-9&adys=0%2C0%2C-9&adks=979713698%2C933772751%2C1581205155&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zoeytad.com%2Fis%2F&dssz=33&icsg=2430092675033771&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1584x0%7C1584x0%7C0x-1&msz=0x0%7C0x0%7C0x-1&ga_vid=913994644.1616994225&ga_sid=1616994225&ga_hid=826008400&fws=128%2C128%2C2&ohw=0%2C0%2C0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019070801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash 1bd05e125ef3d7c1b11e6a2bd07459ef0dbeede76af3184812d9c3e34b10c27d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Mon, 29 Mar 2021 05:03:45 GMT content-encoding br x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin https://www.zoeytad.com access-control-allow-credentials true cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 125 x-xss-protection 0
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-35/html/	0 0	16ms 5ms	Other text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019070801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zoeytad.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.dhl.com

URL

https://www.dhl.com/content/dam/dhl/global/core/images/teaser-large-2730x868/glo-our-divisions-teaser-large.web.793.252.jpg?ver=1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.zoeytad.com/	1970-01-19 17:11:20	Name: _gid Value: GA1.2.795649575.1616994225
			.zoeytad.com/	1970-01-20 10:41:06	Name: _ga Value: GA1.2.913994644.1616994225

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.com.eg
image.prntscr.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.dhl.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.zoeytad.com
www.dhl.com
103.211.219.34
104.23.140.12
142.250.186.98
23.79.151.108
2a00:1450:4001:801::2002
2a00:1450:4001:802::200e
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2002
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0f5d6a89240be982d4543fcc3b47a049d3ed974efc2276c273eb172fe9176020
1bd05e125ef3d7c1b11e6a2bd07459ef0dbeede76af3184812d9c3e34b10c27d
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
710bb035af3b6a17b98e7a60f289cbda442b0160707bd4e6b02f9797acda1598
9dec076f49f240fe92dc2555b93a100132457e7840e1fcc4e97ab320369d499a
9ecf2021c583db79f1d8a7bf83aa0accb88665ddd17de578ad2a507cd33d4756
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b5bd5138ba1a13dfc425ace284d5661d18f3d1209601a99f4ce12f526d119fc7
cac02e231c61068da6a4e6c177f2ccd14a5360aa3509af3be992bfbbad0c127b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecf0ffde6e56a2c058421a0ca1a3446a00d047de48239cd168f7eb93a07a9269