redirect.giami.fr Open in urlscan Pro
2a00:1450:4001:824::2013 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://capitalonefcats.com/
Effective URL:
https://redirect.giami.fr/
Submission: On February 28 via api (February 28th 2020, 2:34:08 pm UTC) from US

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 12 domains to perform 15 HTTP transactions. The main IP is 2a00:1450:4001:824::2013, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is redirect.giami.fr.
TLS certificate: Issued by GTS CA 1D2 on February 26th 2020. Valid for: 3 months.

This is the only time redirect.giami.fr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.224.182.242 103.224.182.242	133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited)
1 4	103.224.182.206 103.224.182.206	() ()
1 2	116.202.81.140 116.202.81.140	24940 (HETZNER-AS) (HETZNER-AS)
2 3	198.143.165.219 198.143.165.219	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	205.147.93.131 205.147.93.131	393676 (ZENEDGE) (ZENEDGE)
1 2	35.168.149.183 35.168.149.183	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2a00:1450:400... 2a00:1450:4001:824::2013	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:816::2009	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::2009	15169 (GOOGLE) (GOOGLE)
1	35.190.50.89 35.190.50.89	15169 (GOOGLE) (GOOGLE)
15	11

1 103.224.182.242 (Australia) 1 redirects

ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: lb-182-242.above.com

capitalonefcats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 103.224.182.206 (Australia) 1 redirects

ASN- ()
PTR: bidr.trellian.com

bidr.trellian.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 116.202.81.140 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.140.81.202.116.clients.your-server.de

secure.clicktrkservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.click2partner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 198.143.165.219 (Chicago, United States) 2 redirects

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

click.amazingtechsavings.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.147.93.131 (United States)

ASN393676 (ZENEDGE, US)

yltenim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.168.149.183 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-149-183.compute-1.amazonaws.com

getad.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:824::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

redirect.giami.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

4.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.50.89 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 89.50.190.35.bc.googleusercontent.com

www.predictivdisplay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	trellian.com 1 redirects bidr.trellian.com	3 KB
3	giami.fr 1 redirects redirect.giami.fr	12 KB
3	amazingtechsavings.xyz 2 redirects click.amazingtechsavings.xyz	3 KB
2	blogger.com www.blogger.com	60 KB
2	getad.xyz getad.xyz Failed	719 B
1	predictivdisplay.com www.predictivdisplay.com
1	blogblog.com resources.blogblog.com	806 B
1	blogspot.com 4.bp.blogspot.com	1 KB
1	yltenim.com yltenim.com	4 KB
1	click2partner.com secure.click2partner.com	298 B
1	clicktrkservices.com 1 redirects secure.clicktrkservices.com	315 B
1	capitalonefcats.com 1 redirects capitalonefcats.com	1 KB
15	12

	Domain	Requested by
4	bidr.trellian.com	1 redirects bidr.trellian.com
3	redirect.giami.fr	1 redirects getad.xyz redirect.giami.fr
3	click.amazingtechsavings.xyz	2 redirects
2	www.blogger.com	redirect.giami.fr
2	getad.xyz	yltenim.com
1	www.predictivdisplay.com	bidr.trellian.com
1	resources.blogblog.com	redirect.giami.fr
1	4.bp.blogspot.com	redirect.giami.fr
1	yltenim.com	click.amazingtechsavings.xyz
1	secure.click2partner.com	bidr.trellian.com
1	secure.clicktrkservices.com	1 redirects
1	capitalonefcats.com	1 redirects
15	12

This site contains no links.

Subject Issuer	Validity	Valid
secure.click2partner.com Let's Encrypt Authority X3	`2020-02-08` - `2020-05-08`	3 months	crt.sh
click.amazingtechsavings.xyz Let's Encrypt Authority X3	`2020-01-15` - `2020-04-14`	3 months	crt.sh
yltenim.com Let's Encrypt Authority X3	`2020-02-21` - `2020-05-21`	3 months	crt.sh
redirect.giami.fr GTS CA 1D2	`2020-02-26` - `2020-05-26`	3 months	crt.sh
*.blogger.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh

This page contains 1 frames:

Frame: http://www.predictivdisplay.com/jump/next.php?r=2454059&sub1=4
Frame ID: D3836035237B39EC6F81D0B7C08CF21D
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://capitalonefcats.com/ HTTP 302
http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQu... Page URL
http://bidr.trellian.com/r.php?u=https%3A%2F%2Fsecure.clicktrkservices.com%2Findex.php%3Fkey%3Dz6lzic... HTTP 302
https://secure.clicktrkservices.com/index.php?key=z6lzicrucf3l6lfp558m&cpv=0.005&subid=770286803&sid=20200229013... HTTP 302
https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campai... Page URL
https://click.amazingtechsavings.xyz/?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2... HTTP 302
https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1 Page URL
https://click.amazingtechsavings.xyz/proc.php?7c4b2dd20fce969249888f43cdd6437182652371 HTTP 302
https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_... Page URL
http://getad.xyz/go/216668/456926 Page URL
http://getad.xyz/ad/ad?p=216668&w=456926&t=e70f6500d851f3a9&r=aHR0cHMlM0ElMkYlMkZ5bHRlbmltLmN... HTTP 303
http://redirect.giami.fr/ HTTP 301
https://redirect.giami.fr/ Page URL

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

15
Requests

60 %
HTTPS

36 %
IPv6

12
Domains

12
Subdomains

11
IPs

3
Countries

82 kB
Transfer

246 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://capitalonefcats.com/ HTTP 302
http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D Page URL
http://bidr.trellian.com/r.php?u=https%3A%2F%2Fsecure.clicktrkservices.com%2Findex.php%3Fkey%3Dz6lzicrucf3l6lfp558m%26cpv%3D0.005%26subid%3D770286803%26sid%3D20200229013331afbce7ee057c4bf8c8&s=j HTTP 302
https://secure.clicktrkservices.com/index.php?key=z6lzicrucf3l6lfp558m&cpv=0.005&subid=770286803&sid=20200229013331afbce7ee057c4bf8c8 HTTP 302
https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/ Page URL
https://click.amazingtechsavings.xyz/?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c HTTP 302
https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1 Page URL
https://click.amazingtechsavings.xyz/proc.php?7c4b2dd20fce969249888f43cdd6437182652371 HTTP 302
https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240 Page URL
http://getad.xyz/go/216668/456926 Page URL
http://getad.xyz/ad/ad?p=216668&w=456926&t=e70f6500d851f3a9&r=aHR0cHMlM0ElMkYlMkZ5bHRlbmltLmNvbSUyRg==&vw=1600&vh=1200 HTTP 303
http://redirect.giami.fr/ HTTP 301
https://redirect.giami.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://capitalonefcats.com/ HTTP 302
http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D

Request Chain 3

http://bidr.trellian.com/r.php?u=https%3A%2F%2Fsecure.clicktrkservices.com%2Findex.php%3Fkey%3Dz6lzicrucf3l6lfp558m%26cpv%3D0.005%26subid%3D770286803%26sid%3D20200229013331afbce7ee057c4bf8c8&s=j HTTP 302
https://secure.clicktrkservices.com/index.php?key=z6lzicrucf3l6lfp558m&cpv=0.005&subid=770286803&sid=20200229013331afbce7ee057c4bf8c8 HTTP 302
https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/

Request Chain 4

https://click.amazingtechsavings.xyz/?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c HTTP 302
https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1

Request Chain 5

https://click.amazingtechsavings.xyz/proc.php?7c4b2dd20fce969249888f43cdd6437182652371 HTTP 302
https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set r2.php Show response
bidr.trellian.com/
Redirect Chain

http://capitalonefcats.com/
http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3...

2 KB
2 KB

317ms
300ms

Document
text/html

103.224.182.206

General

Check archive.org

Show headers Download Go to

Full URL: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
Protocol: HTTP/1.1
Server: 103.224.182.206 , Australia, ASN (),
Reverse DNS: bidr.trellian.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: a07da411bb2f2ccf43a5f5e14de4e8e7153ac34a2b6cf4bc8d11d14d1ba2f602

Request headers

Host: bidr.trellian.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 14:33:31 GMT
Server: Apache/2.4.25 (Debian)
Set-Cookie: __dsnsid=20200229013331afbce7ee057c4bf8c8; expires=Sat, 27-Feb-2021 14:33:31 GMT; Max-Age=31536000; path=/; domain=bidr.trellian.com
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1260
Connection: close
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 28 Feb 2020 14:33:31 GMT
Server: Apache/2.4.25 (Debian)
Set-Cookie: __tad=1582900411.3602824; expires=Mon, 25-Feb-2030 14:33:31 GMT; Max-Age=315360000
Location: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jscheck.js Show response
bidr.trellian.com/javascript/ 858 B
701 B 311ms
297ms Script
application/javascript 103.224.182.206

General

Check archive.org

Show headers Download Go to

Full URL: http://bidr.trellian.com/javascript/jscheck.js
Requested by: Host: bidr.trellian.com
URL: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
Protocol: HTTP/1.1
Server: 103.224.182.206 , Australia, ASN (),
Reverse DNS: bidr.trellian.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 0766f527fcf931c99f93825401ea5d39f6cfe63b56bfd1050f9d1689a8266ab4

Request headers

Referer: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 14:33:32 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Dec 2018 05:31:22 GMT
Server: Apache/2.4.25 (Debian)
ETag: "35a-57ce09ffa182b-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 388

GET
H/1.1 200
OK jscheck.php
bidr.trellian.com/ 0
166 B 322ms
308ms XHR
text/html 103.224.182.206

General

Check archive.org

Show headers Download Go to

Full URL: http://bidr.trellian.com/jscheck.php?enc=cF8L0S4UvzZFbF2sJTBoT0csGBK3ku1DbPGRBffKHRE%2Fajhmp1dwiMszezPm%2FhLw%2Bohtjm3m2zV8y6gZMFf544fZXvh4gKuGhEgiQl%2F60aTM7lTLE0mWWTLzvCqP6QnWTNdZyWkm7kuExTUhh5pXaNF2tDKYpWkRYSS%2BSoet0LdmSiDmQIDpUJAzmzmzaUpjxY6W%2Fd%2FjPM0juADAJ3DKPpldYWRn0cv9PdyafGI9igoxAy%2FxVQuwbpMOuTemSGWoeZddfnq805kK%2Bvxk2HlnaE2bxb8CVtO9K8q76avETqodrb9SpMzw7a539mhIRxBdzfyUQNN465zzBGnQQPLZe7EMO9OO7iYwDg1Finu5yi2xqyGXCzO%2FLXC6M4OkT%2FXpVv%2FAEl6KnSCjnKvqRJ05q7xwqNOYYZdv46NRlpOtkol0G%2F03i2xXy5Y0X9kLKjAAelUEh%2Ba%2BrRVDzdf7ZnySQnr07PCLBhTeuTgP8LzAqLmb4%2FWpjV65oEmu1B8cvlCp2ASYKny%2BDuPi2lpcz2V%2FY%2BZWb7GcvtaFX9f%2F%2B5a8nPq2DBZIANS3Ts5L4W2oX5ZeND4Js%2FgW%2B%2BddVvqPp%2FQORSxs6LHDyS46VRYbLlRGzIW0B%2BsFKw9iIkwzwDtAPsAV9EG2iZMXZuUxsTazQTECD13%2FqyqzQlPE5XgIoAFKcnFVnOfjfsgt6WJPQBx2VSyAuq%2FvJQv8ZBIBoF0wxu%2F8BzzC6Cl%2BwV7PF0a7Qd5G1Xbyh3PYit3BXXCgu5ig9Dck3p9v1xjpJ1SMb3yIqqeVsK6VkNJlwudvjV6%2FmEdur%2FXfDNGQNemlWOTVTQKOu8g2ai6gkkseiPqHZzcw3eHzC5nHt%2BM0pQI%2Fug6MlBl%2BaVtXMHFw%2Blk8OV6lXYCHLGK0jZ2LcjfEwm0qAVb72Nv9uHp78kxkmlOESAO0ROh9FDxegDXEUcHFcPFAaPDY6EL6qZClKA8QOMtTBxlYmgpgdQ%3D%3D&rand=0.41554095677783276
Requested by: Host: bidr.trellian.com
URL: http://bidr.trellian.com/javascript/jscheck.js
Protocol: HTTP/1.1
Server: 103.224.182.206 , Australia, ASN (),
Reverse DNS: bidr.trellian.com
Software: Apache/2.4.25 (Debian) /
Resource Hash

Request headers

Referer: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 14:33:32 GMT
Server: Apache/2.4.25 (Debian)
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

index.php Show response
secure.click2partner.com/nlp/
Redirect Chain

http://bidr.trellian.com/r.php?u=https%3A%2F%2Fsecure.clicktrkservices.com%2Findex.php%3Fkey%3Dz6lzicrucf3l6lfp558m%26cpv%3D0.005%26subid%3D770286803%26sid%3D20200229013331afbce7ee057c4bf8c8&s=j
https://secure.clicktrkservices.com/index.php?key=z6lzicrucf3l6lfp558m&cpv=0.005&subid=770286803&sid=20200229013331afbce7ee057c4bf8c8
https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/

179 B
298 B

365ms
28ms

Document
text/html

116.202.81.140
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/

Requested by

Host: bidr.trellian.com
URL: http://bidr.trellian.com/javascript/jscheck.js

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

116.202.81.140 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.140.81.202.116.clients.your-server.de

Software

nginx/1.16.1 /

Resource Hash

76eee51fea3fcc326939293d281cb49923b484ea5644eac3a98e2e568b40f700

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: secure.click2partner.com
:scheme: https
:path: /nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D

Response headers

status: 200
server: nginx/1.16.1
date: Fri, 28 Feb 2020 14:33:33 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
content-encoding: gzip

Redirect headers

status: 302
server: nginx/1.16.1
date: Fri, 28 Feb 2020 14:33:33 GMT
content-type: text/html; charset=UTF-8
location: https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/
set-cookie: uclick=irmyhqh9; expires=Sat, 29-Feb-2020 14:33:33 GMT; Max-Age=86400; path=/
strict-transport-security: max-age=31536000

GET
H2

200

/ Show response
click.amazingtechsavings.xyz/
Redirect Chain

https://click.amazingtechsavings.xyz/?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c
https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1

5 KB
2 KB

117ms
117ms

Document
text/html

198.143.165.219
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

198.143.165.219 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

6752a4772ea90b2f941a133702f7ca8bff7386e7ec83855bfd8e447d88431709

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: click.amazingtechsavings.xyz
:scheme: https
:path: /?utm_term=6798505506710225049&clickverify=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: u=1343413b7eb7eb009c4c8e082c2b984f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://secure.click2partner.com/nlp/index.php?utm_medium=ded4240ced7be1491cb7a15d25000683ea21df45&utm_campaign=smartlink2&cid=e797eirmyhqh9d9c&url_bnm_redirect=https://click.amazingtechsavings.xyz/

Response headers

status: 200
server: nginx
date: Fri, 28 Feb 2020 14:33:34 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Fri, 28 Feb 2020 14:33:33 GMT
content-type: text/html; charset=UTF-8
location: https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=1343413b7eb7eb009c4c8e082c2b984f; expires=Sat, 27-Feb-2021 14:33:33 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;

GET
H2

200

JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m Show response
yltenim.com/nh4ea/ciqM/fC6c/
Redirect Chain

https://click.amazingtechsavings.xyz/proc.php?7c4b2dd20fce969249888f43cdd6437182652371
https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240

4 KB
4 KB

264ms
205ms

Document
text/html

205.147.93.131
ZENEDGE

General

Check archive.org

Show headers Download Go to

Full URL

https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240

Requested by

Host: click.amazingtechsavings.xyz
URL: https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.147.93.131 , United States, ASN393676 (ZENEDGE, US),

Reverse DNS

Software

ZENEDGE /

Resource Hash

9695840b681297b458f3011dde56e75956567494e018b7fe4acf33c168a18926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

:method: GET
:authority: yltenim.com
:scheme: https
:path: /nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://click.amazingtechsavings.xyz/?utm_term=6798505506710225049&clickverify=1#

Response headers

status: 200
content-type: text/html;charset=utf-8
expires: Sat, 26 Jul 1997 05:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains;
date: Fri, 28 Feb 2020 14:33:34 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
x-cache-status: NOTCACHED
x-zen-fury: 06a5f858f217d50f6795985e115098b233a03a92
set-cookie: TR7A3jMiISYwstsFmTB2nnIHQbldWUy4oIejVz55dlg%3D=595e768c752fcd697e49d699f0a84d76_1582900414.2666; domain=yltenim.com; path=/; expires=Mon, 25-Feb-2030 14:33:34 UTC; Secure b5lq9eygwZllzl4luI4VBgQgNE5fCh5dQrQRotUx370%3D=1582900414.2693; domain=yltenim.com; path=/; expires=Mon, 25-Feb-2030 14:33:34 UTC; Secure vHgNpuORtFmyejMz%2Fu4SCq%2BJuUygP9Fo7yvtcHxZqjM%3D=WHlvZ1RKeTY5eW1UQkpKSmh1Sjl3Wkt1SEpETFlXdzMrTFpBMHVxSVplM1I2LzVKeGZSRG9ldEVaV1ZpWGEvLw%3D%3D; domain=yltenim.com; path=/; expires=Mon, 25-Feb-2030 14:33:34 UTC; Secure 595e768c752fcd697e49d699f0a84d76_1582900414.2666_ck=ck1JbktjM2d5ZHdqZ0pMbmNTTC83bDFxSmdQaVRNRkJMVEpDZ01Cclk0UElIdkt6dGhLZjhqdjJ3bjFPUWl5VUVqaGJEVVZTNnhGb0owem54OTFpRkFoUU84ZHhYUjlOY1ZGd01JbVcxUWJpeXFGczlTVlF5MjlaRUo1YXJOMytqVzliTVRtamdobHRGRXBWQ2EyY0N5WHZpUGx1anJWS0FuWUQ4V29QOE9xMy81SWtCT0x1enV0L0hCdjVMUFdmWHVuMkxlVy9STUpwQXRyenIyakEwYzZ6bGdpeEtNMUZ0eENJR1VnTWN5Um5rT1hieGFWK21nK2hsQ3hrL0RpZWFwUmxYaXVQeHRPUUFXUHpPUUpzWXc4Z1JsWm44S3NQdFVOdndKVWl3Y3ZVV3lTWjB6ckFDTXhIYUpZRGE5UTZDWU9WUDRnYmQxVkJTcnpCbjlsZ1E5VU5YbE5lTVhXWlM3M09HTHQzSzZ1S2dydnFJbjB4RXN6RGJ2OTAybTRsUk0xckZHS1IwVnowVnRvWVBEUWNoRGlOVjEyakJ6bHJFV2p0T1RIZHN1MHpoeVMyOW1iMVU0ek9aRHFWY3JCTUpRTFFVcWFBL0ZGaVQwaVpYZGZOYWZhUzZYSDVkWC9acTRtUWVNSHRxSk9BRUhGNkFWRFppVjNyMGsyRDNBSkRXSUJ0YUFaOGNKSXBKNWIvK0tYUXhwUVgxaWZ5Qkh3U1pOenFUMTUrTjJGMXA5b0RPSldQbXZwVWRGQU5QMU1QdjVaUTJNZ25mZW83MzdvaWJ5b2l1d0k3WUxwaFpyb1hzME5qbXArdTRQeGE4YzA0UFduM0VwbGNXd1U4ZHR4QnUxb0MwL0FFaFNYczlPZ00wb3pnMmt0V3VqR3JzRzU0U1FRVWFYTFZhRHlRSHR3cCtsY0NvMTdpeTcwMTdvTDdWOTRzSUFHTW9LQzJpT1gyeS9GNnZ5Y2l1TVFzOU81clBWdXIyUmh5eUNuVDE0dGt1cmd3MHlHZm1ZMjFqeDZVNEYwZFdONkUwSndWRFozSW0xaTByU0FvOXhMZWhjYzVzTjdLa3F6MjFXMWVsblhpdDlMZkJDWWlHWlgyYVZZeWdEc2VCd0I4RVZhQVB4ZHg1a2dTNjZoZVFBNnZLb1BpQ2VaNFB1VytvUTNHdGFhUHJGYmJDM1BUYXJpWjhkSTlNRjhQRDhxbWg4b3JJdDZxQ0pRYm1sSVhwNzlXZFZqVlBCUnY0Z24wRHBCMHlDR0Q2OVRjRXJ4c1R4WHNBZ0duMGdQallCaGpLSllvcml2NTl1S0g0QmMzNXNsbVlUQlZKaEJFdE5SN1RIY3hGbWdUeXgwUWtGYUlZTXlxaXJKVQ%3D%3D; domain=yltenim.com; path=/; expires=Mon, 25-Feb-2030 14:33:34 UTC; Secure f%2BNxABd9BuS%2BD6mZ%2FBtNNoR%2BezmypWHgySeOvF3EM0s%3D=OCs1azlIMWpCbXFhQU1HMGtxMjJ1dUxtU2RIY044SUF0R0dPaTRUSkZGOEhKSGYreE9sZVl2WXoxeXd0UEFDemU0YU1KQ1ZRU2huL0w1b2dCUC9GUU53SWlLeW1ibjBIUEZTWnNjNTcweUE9; domain=yltenim.com; path=/; expires=Fri, 28-Feb-2020 15:38:34 UTC; Secure SERVERID=sfc58; path=/
server: ZENEDGE
x-cdn: Served-By-Zenedge

Redirect headers

status: 302
server: nginx
date: Fri, 28 Feb 2020 14:33:34 GMT
content-type: text/html; charset=UTF-8
location: https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;

GET 456926
getad.xyz/go/216668/ 0
0

GET
H/1.1 200
OK 456926 Show response
getad.xyz/go/216668/ 466 B
521 B 207ms
193ms Document
text/html 35.168.149.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://getad.xyz/go/216668/456926
Requested by: Host: yltenim.com
URL: https://yltenim.com/nh4ea/ciqM/fC6c/JGLJgY-JXI7dCF0hEEPEzsWwHNQ4sNfptIX6cqz9_8IvUF2vJ91m?diM=WW_MS_Feb20&subid=6798505506710225049&ext1=240
Protocol: HTTP/1.1
Server: 35.168.149.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-149-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6a7d9aeea8b8f321518866beb152a105ebc74fc1ab09a4601e590be19a7a8a69

Request headers

Host: getad.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://yltenim.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://yltenim.com/

Response headers

Date: Fri, 28 Feb 2020 14:33:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
Content-Encoding: gzip

GET
H2

200

Primary Request / Show response
redirect.giami.fr/
Redirect Chain

http://getad.xyz/ad/ad?p=216668&w=456926&t=e70f6500d851f3a9&r=aHR0cHMlM0ElMkYlMkZ5bHRlbmltLmNvbSUyRg==&vw=1600&vh=1200
http://redirect.giami.fr/
https://redirect.giami.fr/

49 KB
10 KB

212ms
180ms

Document
text/html

2a00:1450:4001:824::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://redirect.giami.fr/

Requested by

Host: getad.xyz
URL: http://getad.xyz/go/216668/456926

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d235738aac5e21fd3f0f5e304ca2f2d5e7ad8753ff120675b589a2c9f41a4af9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: redirect.giami.fr
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://getad.xyz/go/216668/456926
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://getad.xyz/go/216668/456926

Response headers

status: 200
x-robots-tag: noindex, nofollow
content-type: text/html; charset=UTF-8
expires: Fri, 28 Feb 2020 14:33:35 GMT
date: Fri, 28 Feb 2020 14:33:35 GMT
cache-control: private, max-age=0
last-modified: Fri, 28 Feb 2020 00:58:04 GMT
etag: W/"49330e7d1ad85e07505a2b582171504057fc246d27fbaf0b1ff595620848cc3b"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 9771
server: GSE

Redirect headers

X-Robots-Tag: noindex, nofollow
Location: https://redirect.giami.fr/
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Date: Fri, 28 Feb 2020 14:33:35 GMT
Expires: Fri, 28 Feb 2020 14:33:35 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
Content-Length: 174
Server: GSE

GET
H2 200 3597120983-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 36 KB
8 KB 26ms
6ms Stylesheet
text/css 2a00:1450:4001:816::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3597120983-css_bundle_v2.css

Requested by

Host: redirect.giami.fr
URL: https://redirect.giami.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

869176cab64c36f92c6c1f8ffbe85919575d6b9995a54850e5925289f3a75078

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redirect.giami.fr/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 27 Feb 2020 14:57:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 27 Feb 2020 12:09:30 GMT
server: sffe
age: 84971
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7979
x-xss-protection: 0
expires: Fri, 26 Feb 2021 14:57:24 GMT

GET
H2 200 Untitled.jpg
4.bp.blogspot.com/-AIosjtVL6Aw/XkW2QX5XLUI/AAAAAAAAARM/dgrB0jzwdDQ9I1tsh6DiTxeFjrp_FKkZACK4BGAYYCw/s1600/ 727 B
1 KB 45ms
7ms Image
image/jpeg 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-AIosjtVL6Aw/XkW2QX5XLUI/AAAAAAAAARM/dgrB0jzwdDQ9I1tsh6DiTxeFjrp_FKkZACK4BGAYYCw/s1600/Untitled.jpg

Requested by

Host: redirect.giami.fr
URL: https://redirect.giami.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a1a2b0d8164cc6c0cae4a0cead7d566097446b97f4acee3101d1c66f21c7c7e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 12:02:56 GMT
x-content-type-options: nosniff
age: 9039
status: 200
content-disposition: inline;filename="Untitled.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 727
x-xss-protection: 0
server: fife
etag: "v114"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 28 Feb 2020 23:22:29 GMT

GET
H2 200 icon18_wrench_allbkg.png
resources.blogblog.com/img/ 475 B
806 B 30ms
6ms Image
image/png 2a00:1450:4001:820::2009
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

Requested by

Host: redirect.giami.fr
URL: https://redirect.giami.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 25 Feb 2020 10:36:06 GMT
x-content-type-options: nosniff
last-modified: Mon, 24 Feb 2020 16:22:46 GMT
server: sffe
age: 273449
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 475
x-xss-protection: 0
expires: Tue, 03 Mar 2020 10:36:06 GMT

GET
H2 200 cookienotice.js Show response
redirect.giami.fr/js/ 6 KB
2 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:824::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://redirect.giami.fr/js/cookienotice.js

Requested by

Host: redirect.giami.fr
URL: https://redirect.giami.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 14:33:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 28 Feb 2020 13:15:15 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2026
x-xss-protection: 0
expires: Fri, 06 Mar 2020 14:33:35 GMT

GET
H2 200 3236635003-widgets.js Show response
www.blogger.com/static/v1/widgets/ 140 KB
52 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:816::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3236635003-widgets.js

Requested by

Host: redirect.giami.fr
URL: https://redirect.giami.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d766ec18d8c2f6f7ce42549b2926b1041f9c54acc748603a4652e4a47d1e375

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 27 Feb 2020 14:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 26 Feb 2020 23:58:33 GMT
server: sffe
age: 84959
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 52800
x-xss-protection: 0
expires: Fri, 26 Feb 2021 14:57:36 GMT

GET
H/1.1 204
No Content next.php
www.predictivdisplay.com/jump/ 0
0 182ms
149ms Document
text/plain 35.190.50.89
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://www.predictivdisplay.com/jump/next.php?r=2454059&sub1=4
Requested by: Host: bidr.trellian.com
URL: http://bidr.trellian.com/r2.php?e=qzBy2CbrFCx2iAr9Vom1yJWvf68bZnA5Oeo4m1RBDWYBV9svJ8Jt9M5Z860x%2BJiQutjeljSHh6p8Nz64vcr4Nw3kpIiuFBS6Dec95%2FUne6wdFw%2F4M4%2Fa1YyHsyoQR%2BbFHhwu7hI9xGxx%2BNb5fL0fLF3Ngs6oONhy1Eh%2BXkSWwA4Xsyc9I2JFfcrwAWYH5g0ekU%2Ba3NkUOdAMHFgkf1KJbEoH3d7dfYiTkcbmj2L7nzAacqQaGoAyHcVJx8cLJy20bHb94KfSXEcy71H5jPDB6krCogDHqKu8iIKPgvPYsvs%2FQClrhk%2B%2Fiv4H28pxVprBiQrBfD87bEsKgeoCt800bxHAoq1nK1%2FMXnzhB%2BByI3rDiamyIcHTNUSWJySLbU7xfmIacHcOvkJHoTyFb1pW%2BxDozwV1%2F2vneM%2Bz8WceHtA2N0eC2rW8KUsKuisTnBW%2F3C%2FyBPxOIYvI6t02R6K9oWQLY67O5HLraXrkbpNa3sVA29Ke8KCxiGZ6wqg5VuIfOfS5a2YqWsV615bmQsDHFtadc6WKw7uVRjMdQXKZES%2B4Nlkf59%2BdEfmBH7iG2qMgNDA6CbjjDXATW8ab6iiD%2FtYEMNuNV3usyTIg33%2BMSpUfJkZQSSJzrN4lDRK9rm7HK1KcV0Q52hhEs14scr9jK2KZPBJI1lzLYMf2nQHi53dJOBUzntCx%2FF6Agxv4YMJB8KNPjwLtwUQxmk7KFo%2FgOPCf1gvl%2Bw0%2F0KKacpRkvkX2op03r1RqjNVy3HgOF6CDdv9K05wGTQxvY3J6nFgHQlURSDRwZkmI%2BoFinU8Q4wqt%2BY7uPTWyTlz60cBjInzQ4Bkc40YIbksyCdsCXH3KHoKpecBI7gK4qWuClsIz0%2BQ%3D
Protocol: HTTP/1.1
Server: 35.190.50.89 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 89.50.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash

Request headers

Host: www.predictivdisplay.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: openresty
Date: Fri, 28 Feb 2020 14:33:35 GMT
Access-Control-Allow-Origin: *
Referrer-Policy: no-referrer
Via: 1.1 google

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: getad.xyz
URL: http://getad.xyz/go/216668/456926?

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
yltenim.com/	1969-12-31 23:59:59	Name: SERVERID Value: sfc58
.yltenim.com/	1970-01-22 23:17:40	Name: TR7A3jMiISYwstsFmTB2nnIHQbldWUy4oIejVz55dlg%3D Value: 595e768c752fcd697e49d699f0a84d76_1582900414.2666
.yltenim.com/	1970-01-22 23:17:40	Name: vHgNpuORtFmyejMz%2Fu4SCq%2BJuUygP9Fo7yvtcHxZqjM%3D Value: WHlvZ1RKeTY5eW1UQkpKSmh1Sjl3Wkt1SEpETFlXdzMrTFpBMHVxSVplM1I2LzVKeGZSRG9ldEVaV1ZpWGEvLw%3D%3D
.yltenim.com/	1970-01-22 23:17:40	Name: b5lq9eygwZllzl4luI4VBgQgNE5fCh5dQrQRotUx370%3D Value: 1582900414.2693
.yltenim.com/	1970-01-19 07:41:44	Name: f%2BNxABd9BuS%2BD6mZ%2FBtNNoR%2BezmypWHgySeOvF3EM0s%3D Value: OCs1azlIMWpCbXFhQU1HMGtxMjJ1dUxtU2RIY044SUF0R0dPaTRUSkZGOEhKSGYreE9sZVl2WXoxeXd0UEFDemU0YU1KQ1ZRU2huL0w1b2dCUC9GUU53SWlLeW1ibjBIUEZTWnNjNTcweUE9
.yltenim.com/	1970-01-22 23:17:40	Name: 595e768c752fcd697e49d699f0a84d76_1582900414.2666_ck Value: ck1JbktjM2d5ZHdqZ0pMbmNTTC83bDFxSmdQaVRNRkJMVEpDZ01Cclk0UElIdkt6dGhLZjhqdjJ3bjFPUWl5VUVqaGJEVVZTNnhGb0owem54OTFpRkFoUU84ZHhYUjlOY1ZGd01JbVcxUWJpeXFGczlTVlF5MjlaRUo1YXJOMytqVzliTVRtamdobHRGRXBWQ2EyY0N5WHZpUGx1anJWS0FuWUQ4V29QOE9xMy81SWtCT0x1enV0L0hCdjVMUFdmWHVuMkxlVy9STUpwQXRyenIyakEwYzZ6bGdpeEtNMUZ0eENJR1VnTWN5Um5rT1hieGFWK21nK2hsQ3hrL0RpZWFwUmxYaXVQeHRPUUFXUHpPUUpzWXc4Z1JsWm44S3NQdFVOdndKVWl3Y3ZVV3lTWjB6ckFDTXhIYUpZRGE5UTZDWU9WUDRnYmQxVkJTcnpCbjlsZ1E5VU5YbE5lTVhXWlM3M09HTHQzSzZ1S2dydnFJbjB4RXN6RGJ2OTAybTRsUk0xckZHS1IwVnowVnRvWVBEUWNoRGlOVjEyakJ6bHJFV2p0T1RIZHN1MHpoeVMyOW1iMVU0ek9aRHFWY3JCTUpRTFFVcWFBL0ZGaVQwaVpYZGZOYWZhUzZYSDVkWC9acTRtUWVNSHRxSk9BRUhGNkFWRFppVjNyMGsyRDNBSkRXSUJ0YUFaOGNKSXBKNWIvK0tYUXhwUVgxaWZ5Qkh3U1pOenFUMTUrTjJGMXA5b0RPSldQbXZwVWRGQU5QMU1QdjVaUTJNZ25mZW83MzdvaWJ5b2l1d0k3WUxwaFpyb1hzME5qbXArdTRQeGE4YzA0UFduM0VwbGNXd1U4ZHR4QnUxb0MwL0FFaFNYczlPZ00wb3pnMmt0V3VqR3JzRzU0U1FRVWFYTFZhRHlRSHR3cCtsY0NvMTdpeTcwMTdvTDdWOTRzSUFHTW9LQzJpT1gyeS9GNnZ5Y2l1TVFzOU81clBWdXIyUmh5eUNuVDE0dGt1cmd3MHlHZm1ZMjFqeDZVNEYwZFdONkUwSndWRFozSW0xaTByU0FvOXhMZWhjYzVzTjdLa3F6MjFXMWVsblhpdDlMZkJDWWlHWlgyYVZZeWdEc2VCd0I4RVZhQVB4ZHg1a2dTNjZoZVFBNnZLb1BpQ2VaNFB1VytvUTNHdGFhUHJGYmJDM1BUYXJpWjhkSTlNRjhQRDhxbWg4b3JJdDZxQ0pRYm1sSVhwNzlXZFZqVlBCUnY0Z24wRHBCMHlDR0Q2OVRjRXJ4c1R4WHNBZ0duMGdQallCaGpLSllvcml2NTl1S0g0QmMzNXNsbVlUQlZKaEJFdE5SN1RIY3hGbWdUeXgwUWtGYUlZTXlxaXJKVQ%3D%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4.bp.blogspot.com
bidr.trellian.com
capitalonefcats.com
click.amazingtechsavings.xyz
getad.xyz
redirect.giami.fr
resources.blogblog.com
secure.click2partner.com
secure.clicktrkservices.com
www.blogger.com
www.predictivdisplay.com
yltenim.com
getad.xyz
103.224.182.206
103.224.182.242
116.202.81.140
198.143.165.219
205.147.93.131
2a00:1450:4001:816::2009
2a00:1450:4001:820::2009
2a00:1450:4001:824::2001
2a00:1450:4001:824::2013
35.168.149.183
35.190.50.89
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
0766f527fcf931c99f93825401ea5d39f6cfe63b56bfd1050f9d1689a8266ab4
3d766ec18d8c2f6f7ce42549b2926b1041f9c54acc748603a4652e4a47d1e375
6752a4772ea90b2f941a133702f7ca8bff7386e7ec83855bfd8e447d88431709
6a7d9aeea8b8f321518866beb152a105ebc74fc1ab09a4601e590be19a7a8a69
76eee51fea3fcc326939293d281cb49923b484ea5644eac3a98e2e568b40f700
869176cab64c36f92c6c1f8ffbe85919575d6b9995a54850e5925289f3a75078
9695840b681297b458f3011dde56e75956567494e018b7fe4acf33c168a18926
a07da411bb2f2ccf43a5f5e14de4e8e7153ac34a2b6cf4bc8d11d14d1ba2f602
a1a2b0d8164cc6c0cae4a0cead7d566097446b97f4acee3101d1c66f21c7c7e6
d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b
d235738aac5e21fd3f0f5e304ca2f2d5e7ad8753ff120675b589a2c9f41a4af9

redirect.giami.fr Open in urlscan Pro 2a00:1450:4001:824::2013 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

60 %HTTPS

36 %IPv6

12 Domains

12 Subdomains

11 IPs

3 Countries

82 kBTransfer

246 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

6 Cookies

Indicators

redirect.giami.fr Open in urlscan Pro
2a00:1450:4001:824::2013 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

60 %
HTTPS

36 %
IPv6

12
Domains

12
Subdomains

11
IPs

3
Countries

82 kB
Transfer

246 kB
Size

6
Cookies

15 HTTP transactions
0 data transactions