Submitted URL: http://epsn.com/
Effective URL: http://d-h.st/afu.php
Submission: On March 15 via manual from SG

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 6 HTTP transactions. The main IP is 2606:4700:30::6812:2840, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is d-h.st.
This is the only time d-h.st was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 209.15.13.134 13768 (COGECO-PEER1)
1 2 209.15.13.136 13768 (COGECO-PEER1)
1 1 108.168.193.183 36351 (SOFTLAYER)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
1 2a00:1450:401... 15169 (GOOGLE)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
6 4
Apex Domain
Subdomains
Transfer
4 d-h.st
d-h.st
4 KB
2 btpnative.com
btpnative.com
4 KB
1 google.com
www.google.com
58 KB
1 mybestdc.com
mybestdc.com
284 B
1 epsn.com
epsn.com
549 B
6 5
Domain Requested by
4 d-h.st btpnative.com
d-h.st
2 btpnative.com 1 redirects
1 www.google.com d-h.st
1 mybestdc.com 1 redirects
1 epsn.com 1 redirects
6 5

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://d-h.st/afu.php
Frame ID: A2F8E1B21FC189CFA1209481A5D6AFE2
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://epsn.com/ HTTP 302
    http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5N... Page URL
  2. http://btpnative.com/Redirect/ HTTP 302
    http://mybestdc.com/aS/feedclick?s=tmxvfbadWlmnV9wsjSDGX48uDhK_8R6j8R2yTC9SpbjHQlesq8ByebUC6hWIe... HTTP 302
    http://d-h.st/afu.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

64 kB
Transfer

174 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://epsn.com/ HTTP 302
    http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be Page URL
  2. http://btpnative.com/Redirect/ HTTP 302
    http://mybestdc.com/aS/feedclick?s=tmxvfbadWlmnV9wsjSDGX48uDhK_8R6j8R2yTC9SpbjHQlesq8ByebUC6hWIeTga6IkCbg7sKEuYDMm3vSUGcFiEu4ekA4JUGl5HFVujlf28gOQ_9NuRZrCyP0WpYsxEJnFYxcsUig_ZjafmTRh4cJ8CYR4m9oFOc9CvmheQjCVVVKNq5PN11GPeP34X5uMGofbfd-R69It4oiWLuWCQGNjQL6FBUyiwRA_w9xVg3tS6HomcYR9hsTdoRAgA6QY94N1TAVpCCoAfEVaWjWp-cOf1uTVorXRo08vV_1RzvmIz71osnc0ypoMZNiJGw705Zk4A-He5GgWKI4Ragr80nbr3iYPzKLZmDtV0U-iG9H6hdN8rFvM-vrw0MxLKdCTZ2bikPjMyvsl-rprqUHYUNoH89KE3w9sk48N-NHBo5V3MSYAwSGyr2FiHbFMnDLrSDVCHzxpk_u93NCBxwc-gKWUv4LA6oOOiXgEVJXfktpVbKWgd_ki5Esos2DVgpgqXlyEeIJeKK_06gJyAg1Sxp3Pl3F343O83N0rwpIQJqLAjvhVQvXdufT_kzrzCyYMJWimDqlonY_T6KpHINXaUnd6qdg2SYLYNYZVa5MjRJpNbLQnVPeS3dg_8xum8RGayITG39bAP3-rXRZVSaJTvHT0wVUjuJuQ-gdQsoV81VP8GyeQkIiHUVi2kYs7pcAIB6bs9ckvePE1p1WCo8_TcuDZdt8ZE7EMfOKd-hWbfIjeicSQTHFtAxO_5cZ2sSfPwSbzMg9sqPJphtU5__ZyH3ZC1PRiXKyz64VKbxM5v-AzL8BLAOsoo_cxIihqx5s5Qk64FNL1AuvDZes5sMWJmUS43XbTYL3bLxSsABYJaIqfmUOQHSIH6DrL4FTxOpYzmkWtzn0Nb161wSWoopFdL_xbmMtKcxBobR0CabMsVe5uDEV36nPbmS_Lzujg1Sl9fVyki64V77o8UGU2-p4E2UqbRyESp45xdVvobiyXgt3tRlVsrHllsCunO6Ig06cQ2kDncvirW3HfvmKrJF4pkQi-6HqhJkCym6vSGmOi2MSGVjHS4VWfm-WxbWXFpeqWVTP-R6zzgAeQLu4ZMhasMgTWxta8M5_ibPV1Q5rSA_39pb_vUK1ucLcRoAg5_wzeOjaWt9xYwH294B8WKlO-Ec9RiKyP88Jaqlof6FGzOr5AC0hfD3TOqos8mZuC_DrMktVff46twPHJ-7rl8dD1MHTmMMKiT1gysL3RbXJY_T2DbEItyw-irrg HTTP 302
    http://d-h.st/afu.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://epsn.com/ HTTP 302
  • http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set click
btpnative.com/
Redirect Chain
  • http://epsn.com/
  • http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U...
5 KB
2 KB
Document
General
Full URL
http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be
Protocol
HTTP/1.1
Server
209.15.13.136 Atlanta, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
e4bb5f2710744596b07894599f86ecbf94b57127a1c2fb570c467e7ba7214593

Request headers

Host
btpnative.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/8.5
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
Set-Cookie
gtgCqGsaTXdBkcG=gtgCqGsaTXdBkcG; path=/
X-Server
web02
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
Content-Type
Date
Fri, 15 Mar 2019 00:35:20 GMT
Content-Length
2120

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Location
http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be
Server
Microsoft-IIS/8.5
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
X-Server
web01
Date
Fri, 15 Mar 2019 00:35:19 GMT
Connection
close
Content-Length
396
Primary Request Cookie set afu.php
d-h.st/
Redirect Chain
  • http://btpnative.com/Redirect/
  • http://mybestdc.com/aS/feedclick?s=tmxvfbadWlmnV9wsjSDGX48uDhK_8R6j8R2yTC9SpbjHQlesq8ByebUC6hWIeTga6IkCbg7sKEuYDMm3vSUGcFiEu4ekA4JUGl5HFVujlf28gOQ_9NuRZrCyP0WpYsxEJnFYxcsUig_ZjafmTRh4cJ8CYR4m9oFOc9...
  • http://d-h.st/afu.php
4 KB
2 KB
Document
General
Full URL
http://d-h.st/afu.php
Requested by
Host: btpnative.com
URL: http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be
Protocol
HTTP/1.1
Server
2606:4700:30::6812:2840 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a2fbe774fd896e51c3b59282a9aa8c39a29ad83e10c2b606e6f4c005c912e59

Request headers

Host
d-h.st
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be
Accept-Encoding
gzip, deflate
Origin
http://btpnative.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://btpnative.com/click?data=RUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2&id=ae0c7b51-3ece-47ad-9764-1ccdc0d5d3be

Response headers

Date
Fri, 15 Mar 2019 00:35:21 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d22b67aeb433fff0f670eecb9095d354b1552610121; expires=Sat, 14-Mar-20 00:35:21 GMT; path=/; domain=.d-h.st; HttpOnly
X-Adblock-Key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GN2OMrUc1N3G5sfsMyBTLiY4ZOtwe8r+S+MC3ddQlrsfHh9VviIv5zqtcHc4n+TYkjwZ6Cc6Ni2crer1pBYfSA==
Server
cloudflare
CF-RAY
4b7a682979e897b6-FRA
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Fri, 15 Mar 2019 00:35:21 GMT
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=5
Set-Cookie
rhid=63561900536; Max-Age=15552000; Expires=Wed, 11-Sep-2019 00:35:21 GMT; Domain=mybestdc.com; Path=/
Location
http://d-h.st/afu.php
caf.js
www.google.com/adsense/domains/
164 KB
58 KB
Script
General
Full URL
http://www.google.com/adsense/domains/caf.js
Requested by
Host: d-h.st
URL: http://d-h.st/afu.php
Protocol
HTTP/1.1
Server
2a00:1450:4016:80a::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8bdf0b621de896390012da5e29cc790862b39bdab78dbe0bfbb8e2093604ed4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://d-h.st/afu.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 00:35:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"5247639385832145074"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Cache-Control
private, max-age=3600
Transfer-Encoding
chunked
Accept-Ranges
bytes
X-XSS-Protection
1; mode=block
Expires
Fri, 15 Mar 2019 00:35:21 GMT
px.gif
d-h.st/
42 B
430 B
Image
General
Full URL
http://d-h.st/px.gif?ch=1&rn=6.615758800771328
Requested by
Host: d-h.st
URL: http://d-h.st/afu.php
Protocol
HTTP/1.1
Server
2606:4700:30::6812:2840 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
d-h.st
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://d-h.st/afu.php
Cookie
__cfduid=d22b67aeb433fff0f670eecb9095d354b1552610121
Connection
keep-alive
Cache-Control
no-cache
Referer
http://d-h.st/afu.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 00:35:21 GMT
CF-Cache-Status
MISS
Last-Modified
Mon, 04 Mar 2019 11:21:36 GMT
Server
cloudflare
ETag
"5c7d0a40-2a"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4b7a682bdb9197b6-FRA
Content-Length
42
Expires
Fri, 15 Mar 2019 04:35:21 GMT
px.gif
d-h.st/
42 B
430 B
Image
General
Full URL
http://d-h.st/px.gif?ch=2&rn=6.615758800771328
Requested by
Host: d-h.st
URL: http://d-h.st/afu.php
Protocol
HTTP/1.1
Server
2606:4700:30::6812:2940 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
d-h.st
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://d-h.st/afu.php
Cookie
__cfduid=d22b67aeb433fff0f670eecb9095d354b1552610121
Connection
keep-alive
Cache-Control
no-cache
Referer
http://d-h.st/afu.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 00:35:21 GMT
CF-Cache-Status
MISS
Last-Modified
Mon, 04 Mar 2019 11:21:31 GMT
Server
cloudflare
ETag
"5c7d0a3b-2a"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4b7a682bd8da2384-FRA
Content-Length
42
Expires
Fri, 15 Mar 2019 04:35:21 GMT
glp
d-h.st/
7 B
423 B
Script
General
Full URL
http://d-h.st/glp?r=http%3A%2F%2Fbtpnative.com%2Fclick%3Fdata%3DRUNmZ050WG5mY2Y3dmI4alR4Z3NTWHlYSHFaQzhQOU10Qlk1dUxPX3ZUUmhjRWV5NEN0WERCTmNsYjB2SHA4a2g5d0RteHpNdVJiUmNiUXB1cDFsYTFlOUpxME1UN25rWVN5TzVockNUN0p1VUQ1MWw3clVxZGFOWnY5U2FyRXRhSDFLN1ByVE9Ya292U2x1YjN3ZXFnMg2%26id%3Dae0c7b51-3ece-47&u=http%3A%2F%2Fd-h.st%2Fafu.php&rw=1600&rh=1200&ww=1600&wh=1200
Requested by
Host: d-h.st
URL: http://d-h.st/afu.php
Protocol
HTTP/1.1
Server
2606:4700:30::6812:2940 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ee01cc6701e8bfb4d21161c9e414870dbb33e9d515e4015dbb85b719d9d1efc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
d-h.st
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://d-h.st/afu.php
Cookie
__cfduid=d22b67aeb433fff0f670eecb9095d354b1552610121
Connection
keep-alive
Cache-Control
no-cache
Referer
http://d-h.st/afu.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 15 Mar 2019 00:35:21 GMT
Content-Encoding
gzip
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection
keep-alive
CF-RAY
4b7a682d092e2384-FRA
Expires
Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| g_pb object| g_pd object| g_pc number| googleNDT_ number| googleAltLoader object| google

1 Cookies

Domain/Path Name / Value
.d-h.st/ Name: __cfduid
Value: d22b67aeb433fff0f670eecb9095d354b1552610121