message.readnewmessage.com Open in urlscan Pro
2606:4700:3036::6812:2d78 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gains-sfr.site/
Effective URL:
https://message.readnewmessage.com/js2/v/oscarsn/index.html
Submission Tags: 6778939
Submission: On September 22 via api (September 22nd 2020, 9:39:16 am UTC) from NL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3036::6812:2d78, located in United States and belongs to CLOUDFLARENET, US. The main domain is message.readnewmessage.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 15th 2020. Valid for: a year.

This is the only time message.readnewmessage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	31.170.100.125 31.170.100.125	201942 (SOLTIA) (SOLTIA)
1 3	67.212.173.78 67.212.173.78	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1 1	212.7.204.100 212.7.204.100	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	116.202.159.170 116.202.159.170	24940 (HETZNER-AS) (HETZNER-AS)
7	2606:4700:303... 2606:4700:3036::6812:2d78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	94.130.239.212 94.130.239.212	24940 (HETZNER-AS) (HETZNER-AS)
1	94.130.33.169 94.130.33.169	24940 (HETZNER-AS) (HETZNER-AS)
13	6

1 184.168.131.241 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

gains-sfr.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.170.100.125 (Spain)

ASN201942 (SOLTIA, ES)

mobi.billiwa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 67.212.173.78 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

bxt1.shaperal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.7.204.100 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

rdtrck2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.159.170 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.170.159.202.116.clients.your-server.de

4507510.catchtheclick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3036::6812:2d78 (United States)

ASN13335 (CLOUDFLARENET, US)

message.readnewmessage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.130.239.212 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.212.239.130.94.clients.your-server.de

specializedlink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.130.33.169 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.169.33.130.94.clients.your-server.de

bonga.onemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	readnewmessage.com message.readnewmessage.com	273 KB
3	shaperal.com 1 redirects bxt1.shaperal.com	7 KB
1	onemessages.com bonga.onemessages.com	525 B
1	specializedlink.com specializedlink.com	525 B
1	catchtheclick.com 4507510.catchtheclick.com	1 KB
1	rdtrck2.com 1 redirects rdtrck2.com	834 B
1	billiwa.com mobi.billiwa.com	452 B
1	gains-sfr.site 1 redirects gains-sfr.site	179 B
13	8

	Domain	Requested by
7	message.readnewmessage.com	4507510.catchtheclick.com message.readnewmessage.com
3	bxt1.shaperal.com	1 redirects bxt1.shaperal.com
1	bonga.onemessages.com	message.readnewmessage.com
1	specializedlink.com	message.readnewmessage.com
1	4507510.catchtheclick.com	bxt1.shaperal.com
1	rdtrck2.com	1 redirects
1	mobi.billiwa.com
1	gains-sfr.site	1 redirects
13	8

This site contains no links.

Subject Issuer	Validity	Valid
ads.conscier.com Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
bxt1.shaperal.com Let's Encrypt Authority X3	`2020-09-16` - `2020-12-15`	3 months	crt.sh
*.catchtheclick.com Let's Encrypt Authority X3	`2020-08-14` - `2020-11-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-09-15` - `2021-09-15`	a year	crt.sh
specializedlink.com Let's Encrypt Authority X3	`2020-08-12` - `2020-11-10`	3 months	crt.sh
bonga.onemessages.com Let's Encrypt Authority X3	`2020-07-27` - `2020-10-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Frame ID: 4ED12355137FF1580D5FEAF1615841DD
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://gains-sfr.site/ HTTP 301
https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e... Page URL
https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M... Page URL
https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
https://bxt1.shaperal.com/proc.php?5219a3a5c5c53a36b7ba34d352b9430842e78e39 HTTP 302
https://rdtrck2.com/5f5ca51746b628000140eb46?sub1=976&sub2=976-90c45c5z&ref_id=6875244228520181870 HTTP 302
https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2... Page URL
https://message.readnewmessage.com/js2/v/oscarsn/index.html Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

13 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

282 kB
Transfer

299 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gains-sfr.site/ HTTP 301
https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI Page URL
https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M Page URL
https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e Page URL
https://bxt1.shaperal.com/proc.php?5219a3a5c5c53a36b7ba34d352b9430842e78e39 HTTP 302
https://rdtrck2.com/5f5ca51746b628000140eb46?sub1=976&sub2=976-90c45c5z&ref_id=6875244228520181870 HTTP 302
https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e Page URL
https://message.readnewmessage.com/js2/v/oscarsn/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://gains-sfr.site/ HTTP 301
https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI

Request Chain 3

https://bxt1.shaperal.com/proc.php?5219a3a5c5c53a36b7ba34d352b9430842e78e39 HTTP 302
https://rdtrck2.com/5f5ca51746b628000140eb46?sub1=976&sub2=976-90c45c5z&ref_id=6875244228520181870 HTTP 302
https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5 Show response
mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/
Redirect Chain

https://gains-sfr.site/
https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI

244 B
452 B

388ms
143ms

Document
text/html

31.170.100.125
SOLTIA

General

Check archive.org

Show headers Download Go to

Full URL: https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 31.170.100.125 , Spain, ASN201942 (SOLTIA, ES),
Reverse DNS
Software: nginx /
Resource Hash: 4114b5b98a16bf210e0f88ed0ac06a03c9678b43887b24e358633c4ea226e5a2

Request headers

:method: GET
:authority: mobi.billiwa.com
:scheme: https
:path: /ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 22 Sep 2020 09:38:58 GMT
content-type: text/html; charset=UTF-8
content-length: 205
access-control-allow-origin: *
access-control-allow-headers: Content-Type
cache-control: no-cache, private
content-encoding: gzip
x-device: desktop
accept-ranges: bytes
age: 0
tp-cache: MISS
vary: Accept-Encoding

Redirect headers

status: 301
server: nginx/1.16.1
date: Tue, 22 Sep 2020 09:38:58 GMT
content-type: text/html; charset=utf-8
location: https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=GAINSSFR&externalid=LOTFI

GET
H2 200 / Show response
bxt1.shaperal.com/ 3 KB
2 KB 331ms
111ms Document
text/html 67.212.173.78
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.212.173.78 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.4.10

Resource Hash

85e42dcbc8c525589010620c104312682f63bbc00decb32e7edc4519cf760530

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: bxt1.shaperal.com
:scheme: https
:path: /?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 22 Sep 2020 09:38:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.4.10
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=7a6b9bc7def542d4cbc577332bce47c1; expires=Wed, 22-Sep-2021 09:38:59 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H2 200 / Show response
bxt1.shaperal.com/ 11 KB
5 KB 112ms
112ms Document
text/html 67.212.173.78
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e

Requested by

Host: bxt1.shaperal.com
URL: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.212.173.78 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.4.10

Resource Hash

81fa572c3081fde2bc63566790586e25f8b98f201efbba983d6e95a5720c318a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: bxt1.shaperal.com
:scheme: https
:path: /?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: u=7a6b9bc7def542d4cbc577332bce47c1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020092209-3fe2dafbcb8faefa053e58f3673bdcfb&kw1=M999M

Response headers

status: 200
server: nginx
date: Tue, 22 Sep 2020 09:38:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.4.10
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H/1.1

200
OK

/ Show response
4507510.catchtheclick.com/
Redirect Chain

https://bxt1.shaperal.com/proc.php?5219a3a5c5c53a36b7ba34d352b9430842e78e39
https://rdtrck2.com/5f5ca51746b628000140eb46?sub1=976&sub2=976-90c45c5z&ref_id=6875244228520181870
https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e

4 KB
1 KB

100ms
69ms

Document
text/html

116.202.159.170
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e
Requested by: Host: bxt1.shaperal.com
URL: https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.202.159.170 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.170.159.202.116.clients.your-server.de
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: 8c2d953f6d2364c019adc9f18f16b8a3bba6d6c947a07385390f0a9d20903624

Request headers

Host: 4507510.catchtheclick.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bxt1.shaperal.com/?utm_term=6875244228520181870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b78485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54e#

Response headers

Server: nginx/1.16.1 (Ubuntu)
Date: Tue, 22 Sep 2020 09:38:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 22 Sep 2020 09:38:59 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 185
Connection: keep-alive
Location: https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e
Set-Cookie: redhash=NWY2OWM2MzM1ZThhZjEwMDAxNDAxMDdlfDB8NWY1Y2E1MTc0NmI2MjgwMDAxNDBlYjQ2fHw0MDRmMzM2NS1iZTRmLTRhNzItOTFhNi1hZDBjYzM4OTc1Y2R8MTYwMDc2NzUzOQ==; Path=/; Domain=rdtrck2.com; Expires=Wed, 22 Sep 2021 09:38:59 GMT; SameSite=None; Secure
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Expose-Headers: Content-Length,Content-Range

GET
H2 200 Primary Request index.html Show response
message.readnewmessage.com/js2/v/oscarsn/ 7 KB
3 KB 48ms
24ms Document
text/html 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Requested by: Host: 4507510.catchtheclick.com
URL: https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9816dd31b433485870d464bbc8161f4739c5ed194803a3536c61fa139274ef87

Request headers

:method: GET
:authority: message.readnewmessage.com
:scheme: https
:path: /js2/v/oscarsn/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://4507510.catchtheclick.com/?mob=dNg0yM7orh7w7FmfddpVRg08_HhpbNIqq7K27UEKILMDFVVz1-Uh0cA0IvAKYdcGHKZePq2lYxzxgBIkrpMzTg&clickid=5f69c6335e8af1000140107e

Response headers

status: 200
date: Tue, 22 Sep 2020 09:38:59 GMT
content-type: text/html
set-cookie: __cfduid=ddd134da9e8094d145fbc820c65e299fe1600767539; expires=Thu, 22-Oct-20 09:38:59 GMT; path=/; domain=.readnewmessage.com; HttpOnly; SameSite=Lax; Secure
last-modified: Thu, 21 May 2020 16:38:53 GMT
vary: Accept-Encoding
expires: Wed, 22 Sep 2021 09:38:59 GMT
cache-control: max-age=31536000
cf-cache-status: DYNAMIC
cf-request-id: 0556c751dd00002bb9ca0f5200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d6b0e62f8732bb9-FRA
content-encoding: br

GET
H2 200 inc.js Show response
message.readnewmessage.com/js2/v/oscarsn/ 7 KB
3 KB 15ms
14ms Script
application/javascript 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40e0f0bfcb23850755acc1405d595723324173dde0fdb2895b3cb922e82131af

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
content-encoding: br
cf-cache-status: HIT
age: 579884
cf-polished: origSize=12999
status: 200
cf-request-id: 0556c7520100002bb9ca0f8200000001
last-modified: Tue, 15 Sep 2020 15:16:09 GMT
server: cloudflare
etag: W/"5f60dab9-32c7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Wed, 15 Sep 2021 16:34:15 GMT
cache-control: max-age=31536000
cf-ray: 5d6b0e6339092bb9-FRA
cf-bgj: minify

GET
H2 200 play-01.png
message.readnewmessage.com/js2/v/oscarsn/imgs/ 5 KB
5 KB 11ms
11ms Image
image/png 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/imgs/play-01.png
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da5718ccece267af24556ccce3ca5909f9faf49401fc50d78edf4852129410b5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
cf-cache-status: HIT
age: 539255
status: 200
content-length: 4874
cf-request-id: 0556c7520200002bb9ca0f9200000001
last-modified: Thu, 21 May 2020 16:38:53 GMT
server: cloudflare
etag: "5ec6ae9d-130a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5d6b0e63390d2bb9-FRA
expires: Thu, 16 Sep 2021 03:51:24 GMT

GET
H2 200 logo.png
message.readnewmessage.com/js2/v/oscarsn/imgs/ 24 KB
24 KB 15ms
14ms Image
image/png 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/imgs/logo.png
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0379956497b4e0f893123db4496fb6aa6de1fe3ad33ea1afb09eed9183c33f60

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
cf-cache-status: HIT
age: 539255
status: 200
content-length: 24525
cf-request-id: 0556c7520e00002bb9ca0fa200000001
last-modified: Thu, 21 May 2020 16:38:53 GMT
server: cloudflare
etag: "5ec6ae9d-5fcd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5d6b0e63494c2bb9-FRA
expires: Thu, 16 Sep 2021 03:51:24 GMT

GET
H2 200 img1.png
message.readnewmessage.com/js2/v/oscarsn/imgs/ 77 KB
77 KB 19ms
19ms Image
image/png 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/imgs/img1.png
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50ef1db844237bf5687cf0269b7288430466cd358f6ff84a4603d3f47e037996

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
cf-cache-status: HIT
age: 539255
status: 200
content-length: 79033
cf-request-id: 0556c7521400002bb9ca0fc200000001
last-modified: Thu, 21 May 2020 16:38:53 GMT
server: cloudflare
etag: "5ec6ae9d-134b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5d6b0e6359622bb9-FRA
expires: Thu, 16 Sep 2021 03:51:24 GMT

GET
H2 200 img2.png
message.readnewmessage.com/js2/v/oscarsn/imgs/ 80 KB
80 KB 11ms
11ms Image
image/png 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/imgs/img2.png
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c5693fd09f54da312a6e8ab2adfc7360cb14d35f4efa53d601ed6a1b2027977

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
cf-cache-status: HIT
age: 539255
status: 200
content-length: 81894
cf-request-id: 0556c7521400002bb9ca0fd200000001
last-modified: Thu, 21 May 2020 16:38:53 GMT
server: cloudflare
etag: "5ec6ae9d-13fe6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5d6b0e6359642bb9-FRA
expires: Thu, 16 Sep 2021 03:51:24 GMT

GET
H/1.1 200
OK c.php Show response
specializedlink.com/ 0
525 B 44ms
11ms Fetch
text/html 94.130.239.212
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://specializedlink.com/c.php
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.239.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.212.239.130.94.clients.your-server.de
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 09:38:59 GMT
Server: nginx/1.14.0 (Ubuntu)
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/octet-stream, text/html
Access-Control-Allow-Origin: https://message.readnewmessage.com
Access-Control-Expose-Headers: Content-Length,Content-Range
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

GET
H2 200 back.jpg
message.readnewmessage.com/js2/v/oscarsn/imgs/ 81 KB
81 KB 14ms
14ms Image
image/jpeg 2606:4700:3036::6812:2d78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.readnewmessage.com/js2/v/oscarsn/imgs/back.jpg
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6812:2d78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8011eb35c6a9164f83149a71d38313e050a2d3cca5733f21810ea9f3967f2f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 09:38:59 GMT
cf-cache-status: HIT
age: 539255
status: 200
content-length: 83039
cf-request-id: 0556c7521600002bb9ca0fe200000001
last-modified: Thu, 21 May 2020 16:38:53 GMT
server: cloudflare
etag: "5ec6ae9d-1445f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5d6b0e63596b2bb9-FRA
expires: Thu, 16 Sep 2021 03:51:24 GMT

GET
H/1.1 200
OK c.php Show response
bonga.onemessages.com/ 0
525 B 41ms
11ms Fetch
text/html 94.130.33.169
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bonga.onemessages.com/c.php
Requested by: Host: message.readnewmessage.com
URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 94.130.33.169 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.169.33.130.94.clients.your-server.de
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 09:38:59 GMT
Server: nginx/1.14.0 (Ubuntu)
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/octet-stream, text/html
Access-Control-Allow-Origin: https://message.readnewmessage.com
Access-Control-Expose-Headers: Content-Length,Content-Range
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.readnewmessage.com/	1970-01-20 12:38:01	Name: jjj Value: 0
			.readnewmessage.com/	1970-01-19 13:22:39	Name: __cfduid Value: ddd134da9e8094d145fbc820c65e299fe1600767539

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js(Line 17) Message:
console-api	log	URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js(Line 18) Message: undefined
console-api	log	URL: https://message.readnewmessage.com/js2/v/oscarsn/inc.js(Line 18) Message: new c 31x6639x15435f69c63397a19

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4507510.catchtheclick.com
bonga.onemessages.com
bxt1.shaperal.com
gains-sfr.site
message.readnewmessage.com
mobi.billiwa.com
rdtrck2.com
specializedlink.com
116.202.159.170
184.168.131.241
212.7.204.100
2606:4700:3036::6812:2d78
31.170.100.125
67.212.173.78
94.130.239.212
94.130.33.169
0379956497b4e0f893123db4496fb6aa6de1fe3ad33ea1afb09eed9183c33f60
40e0f0bfcb23850755acc1405d595723324173dde0fdb2895b3cb922e82131af
4114b5b98a16bf210e0f88ed0ac06a03c9678b43887b24e358633c4ea226e5a2
50ef1db844237bf5687cf0269b7288430466cd358f6ff84a4603d3f47e037996
7c5693fd09f54da312a6e8ab2adfc7360cb14d35f4efa53d601ed6a1b2027977
81fa572c3081fde2bc63566790586e25f8b98f201efbba983d6e95a5720c318a
85e42dcbc8c525589010620c104312682f63bbc00decb32e7edc4519cf760530
8c2d953f6d2364c019adc9f18f16b8a3bba6d6c947a07385390f0a9d20903624
9816dd31b433485870d464bbc8161f4739c5ed194803a3536c61fa139274ef87
d8011eb35c6a9164f83149a71d38313e050a2d3cca5733f21810ea9f3967f2f4
da5718ccece267af24556ccce3ca5909f9faf49401fc50d78edf4852129410b5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

message.readnewmessage.com Open in urlscan Pro 2606:4700:3036::6812:2d78 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

13 %IPv6

8 Domains

8 Subdomains

6 IPs

4 Countries

282 kBTransfer

299 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

2 Cookies

3 Console Messages

Indicators

message.readnewmessage.com Open in urlscan Pro
2606:4700:3036::6812:2d78 Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

13 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

282 kB
Transfer

299 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions