urlscan.io logo urlscan.io
SecurityTrails logo

downgradepc.trafficsourceoftoplevelcontentsubmit.stream Open in urlscan Pro
51.15.157.171  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.newwayofpromoitonyourbloghover.stream/?pcl=Edehs7EEwqGOAip1gPrHe9BrDVQYMcukr4Un9lY9HyA.&cid=wIVMCPTBPVNER90F1T5BJG9A
Effective URL: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&ci...
Submission: On June 29 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 51.15.157.171, located in France and belongs to AS12876, FR. The main domain is downgradepc.trafficsourceoftoplevelcontentsubmit.stream.
This is the only time downgradepc.trafficsourceoftoplevelcontentsubmit.stream was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 54.89.93.105 14618 (AMAZON-AES)
1 51.15.157.171 12876 (AS12876)
2 52.85.177.218 16509 (AMAZON-02)
2 13.32.8.167 16509 (AMAZON-02)
5 3
1    54.89.93.105 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-89-93-105.compute-1.amazonaws.com
www.newwayofpromoitonyourbloghover.stream
1    51.15.157.171 (France)

ASN12876 (AS12876, FR)
PTR: 51-15-157-171.rev.poneytelecom.eu
downgradepc.trafficsourceoftoplevelcontentsubmit.stream
2    52.85.177.218 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-177-218.fra6.r.cloudfront.net
js.bestquickcontentfiles.com
2    13.32.8.167 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-8-167.muc51.r.cloudfront.net
d3m3gcujfz8vgg.cloudfront.net
Domain Requested by
2 d3m3gcujfz8vgg.cloudfront.net downgradepc.trafficsourceoftoplevelcontentsubmit.stream
2 js.bestquickcontentfiles.com downgradepc.trafficsourceoftoplevelcontentsubmit.stream
1 downgradepc.trafficsourceoftoplevelcontentsubmit.stream
1 www.newwayofpromoitonyourbloghover.stream 1 redirects
5 4

This site contains links to these domains. Also see Links.

Domain
www.nonetingel.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Frame ID: BE5981957DC0D17D836C7D24A3AB2FBE
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.newwayofpromoitonyourbloghover.stream/?pcl=Edehs7EEwqGOAip1gPrHe9BrDVQYMcukr4Un9lY9HyA.&cid=wIVMCPTBPVNER90F1T5BJG9A HTTP 302
    http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • env /^List$/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

20 kB
Transfer

21 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.newwayofpromoitonyourbloghover.stream/?pcl=Edehs7EEwqGOAip1gPrHe9BrDVQYMcukr4Un9lY9HyA.&cid=wIVMCPTBPVNER90F1T5BJG9A HTTP 302
    http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
downgradepc.trafficsourceoftoplevelcontentsubmit.stream/
Redirect Chain
  • http://www.newwayofpromoitonyourbloghover.stream/?pcl=Edehs7EEwqGOAip1gPrHe9BrDVQYMcukr4Un9lY9HyA.&cid=wIVMCPTBPVNER90F1T5BJG9A
  • http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdz...
8 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Protocol
HTTP/1.1
Server
51.15.157.171 , France, ASN12876 (AS12876, FR),
Reverse DNS
51-15-157-171.rev.poneytelecom.eu
Software
nginx/1.13.9 / PHP/7.0.27-0+deb9u1
Resource Hash
11bff1817dd85acdb8964e2d1e5b98d7957f5f03575fcd24f7be44d50850de2d

Request headers

Host
downgradepc.trafficsourceoftoplevelcontentsubmit.stream
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
BE5981957DC0D17D836C7D24A3AB2FBE

Response headers

Server
nginx/1.13.9
Date
Fri, 29 Jun 2018 17:07:56 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.0.27-0+deb9u1
Set-Cookie
channel=peh_winCH_usuk; expires=Fri, 29-Jun-2018 17:27:56 GMT; Max-Age=1200; path=/ dist_id=2497; expires=Fri, 29-Jun-2018 17:27:56 GMT; Max-Age=1200; path=/ lp_id=1826; expires=Fri, 29-Jun-2018 17:27:56 GMT; Max-Age=1200; path=/
Content-Encoding
gzip

Redirect headers

Server
nginx/1.8.0
Date
Fri, 29 Jun 2018 17:07:56 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.5.9-1ubuntu4.14
Location
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
dl.min.js
js.bestquickcontentfiles.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://js.bestquickcontentfiles.com/dl.min.js
Requested by
Host: downgradepc.trafficsourceoftoplevelcontentsubmit.stream
URL: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Protocol
HTTP/1.1
Server
52.85.177.218 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-177-218.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1bcbdee1992f8dbbc4c7f0254dad16177c9b55b61362a526bc195021dcc6b43c

Request headers

Referer
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 10 Apr 2018 17:29:53 GMT
Via
1.1 5d53a1d9ef3a6f7480785993c37a7ad5.cloudfront.net (CloudFront)
Last-Modified
Tue, 10 Apr 2018 05:12:15 GMT
Server
AmazonS3
Age
84925
ETag
"d28c723c4d3857cac4ec0071afd843c8"
X-Cache
Hit from cloudfront
x-amz-version-id
H5OfjQy3fzxA6DeObHxfWFZbL_n_0a9n
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
1836
X-Amz-Cf-Id
MnfhksVC9K3gI3y52b5unTL0vidBlkyiEayczUjUkg_GNOi8of6Inw==
close.png
d3m3gcujfz8vgg.cloudfront.net/lps/win_mac/images/ 		533 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://d3m3gcujfz8vgg.cloudfront.net/lps/win_mac/images/close.png
Requested by
Host: downgradepc.trafficsourceoftoplevelcontentsubmit.stream
URL: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Protocol
HTTP/1.1
Server
13.32.8.167 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-8-167.muc51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3e03449bbf32dec478799e6af580f8e3b1eaec2c1ea1ea5531328d56f74925e1

Request headers

Referer
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 23 Jun 2018 21:50:32 GMT
Via
1.1 895ea63810330b0a5a4927c6d9d1f23f.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2015-11-13T13:21:57.206Z
Server
AmazonS3
Age
60265
ETag
"2214ba44436a0b924a13056365fe99af"
X-Cache
Hit from cloudfront
Content-Type
image/png
Last-Modified
Mon, 06 Jun 2016 13:29:37 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
533
X-Amz-Cf-Id
Ay55-2mrSmGbPi4z67ubLhNgDxk5fhZJx3uyHU0Ei5nVQcUzDN5eMg==
d.min.js
js.bestquickcontentfiles.com/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://js.bestquickcontentfiles.com/d.min.js
Requested by
Host: downgradepc.trafficsourceoftoplevelcontentsubmit.stream
URL: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Protocol
HTTP/1.1
Server
52.85.177.218 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-177-218.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5851c6ce0f1a72400ab4707a69ba52250f5d1121bb67906035b583dbdfb488b6

Request headers

Referer
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 20 Nov 2017 07:52:53 GMT
Via
1.1 fc8079312db6046d812ded83f2668ac6.cloudfront.net (CloudFront)
Last-Modified
Sun, 05 Nov 2017 09:39:10 GMT
Server
AmazonS3
Age
50427
ETag
"076327acad248ed10948c6accd370b0d"
X-Cache
Hit from cloudfront
x-amz-version-id
NE6VH5YJ8JvSaFOGN4nGek8SP4bXMoRc
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
1410
X-Amz-Cf-Id
DgyX40HbQOjxHLLkWYiTXUZlG9vpDm5QLyKQvhn_DQl8L8yepm2yeA==
popup2.png
d3m3gcujfz8vgg.cloudfront.net/lps/flashwin10/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://d3m3gcujfz8vgg.cloudfront.net/lps/flashwin10/images/popup2.png
Requested by
Host: downgradepc.trafficsourceoftoplevelcontentsubmit.stream
URL: http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
Protocol
HTTP/1.1
Server
13.32.8.167 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-8-167.muc51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
07f36323827ff6beb11920fa95b7cb3fae693e60253180e128d7e5e9db5256f6

Request headers

Referer
http://downgradepc.trafficsourceoftoplevelcontentsubmit.stream/?pcl=qUv_lElhbWoXcDTU5BPkoZcPu6T4q-MIro10A_u_Ue6v2TblvJYRj1MJ2eFag0VwHB4XwE4ofvhKInpZiXQvsA..&cid=wIVMCPTBPVNER90F1T5BJG9A&v_id=pl_tdzfNjJdXDxq5btuqCj0E3kxlIStDFuQn4I2eF8g.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 23 Jun 2018 21:50:32 GMT
Via
1.1 895ea63810330b0a5a4927c6d9d1f23f.cloudfront.net (CloudFront)
x-amz-meta-crossftp-original-file-date-iso8601
2016-05-16T07:51:51.523Z
Server
AmazonS3
Age
60264
ETag
"0cb26ddb0a15b8c2f74d8160d3379e4d"
X-Cache
Hit from cloudfront
Content-Type
image/png
Last-Modified
Mon, 06 Jun 2016 13:29:09 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9789
X-Amz-Cf-Id
2Y1W8IWpkVp9D6WSIlFURPZSImRvEdHURrBzPK8gTW-7NIO6xe8GJQ==

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| hidePopup object| dlobj function| dlfunc boolean| has_class object| list object| children number| j

3 Cookies

Domain/Path Name / Value
downgradepc.trafficsourceoftoplevelcontentsubmit.stream/ Name: lp_id
Value: 1826
downgradepc.trafficsourceoftoplevelcontentsubmit.stream/ Name: dist_id
Value: 2497
downgradepc.trafficsourceoftoplevelcontentsubmit.stream/ Name: channel
Value: peh_winCH_usuk