phpstack-681113-2242753.cloudwaysapps.com Open in urlscan Pro
128.199.195.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://phpstack-681113-2242753.cloudwaysapps.com/is/
Submission: On November 05 via api (November 5th 2021, 4:07:04 pm UTC) from US — Scanned from DE

Summary HTTP 28 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 28 HTTP transactions. The main IP is 128.199.195.30, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is phpstack-681113-2242753.cloudwaysapps.com.

This is the only time phpstack-681113-2242753.cloudwaysapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 5	128.199.195.30 128.199.195.30	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
9	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
2	23.79.156.23 23.79.156.23	16625 (AKAMAI-AS) (AKAMAI-AS)
28	10

5 128.199.195.30 (Singapore, Singapore) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 681113.cloudwaysapps.com

phpstack-681113-2242753.cloudwaysapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com.eg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.156.23 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-156-23.deploy.static.akamaitechnologies.com

www.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	doubleclick.net securepubads.g.doubleclick.net	625 KB
5	cloudwaysapps.com 1 redirects phpstack-681113-2242753.cloudwaysapps.com	45 KB
3	google.com adservice.google.com	879 B
3	google.com.eg adservice.google.com.eg	1 KB
2	googlesyndication.com tpc.googlesyndication.com
2	dhl.com www.dhl.com Failed	60 KB
2	googletagservices.com www.googletagservices.com	55 KB
1	googletagmanager.com www.googletagmanager.com	67 KB
1	google-analytics.com www.google-analytics.com	20 KB
28	9

	Domain	Requested by
9	securepubads.g.doubleclick.net	phpstack-681113-2242753.cloudwaysapps.com www.googletagservices.com securepubads.g.doubleclick.net
5	phpstack-681113-2242753.cloudwaysapps.com	1 redirects phpstack-681113-2242753.cloudwaysapps.com
3	adservice.google.com	phpstack-681113-2242753.cloudwaysapps.com
3	adservice.google.com.eg	phpstack-681113-2242753.cloudwaysapps.com
2	tpc.googlesyndication.com	phpstack-681113-2242753.cloudwaysapps.com
2	www.dhl.com	phpstack-681113-2242753.cloudwaysapps.com
2	www.googletagservices.com	phpstack-681113-2242753.cloudwaysapps.com
1	www.googletagmanager.com	phpstack-681113-2242753.cloudwaysapps.com
1	www.google-analytics.com	phpstack-681113-2242753.cloudwaysapps.com
28	9

This site contains links to these domains. Also see Links.

Domain
www.walla.co.il

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
*.google.com.eg GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
www.dhl.com DPDHL Global TLS CA - I5	`2021-06-21` - `2022-06-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Frame ID: 80E84DECFDFBF0AAECF54EA7067B24FE
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

עדכן את שיטת התשלום שלך

Page URL History Show full URLs

http://phpstack-681113-2242753.cloudwaysapps.com/is HTTP 301
http://phpstack-681113-2242753.cloudwaysapps.com/is/ Page URL

Page Statistics

28
Requests

79 %
HTTPS

67 %
IPv6

9
Domains

9
Subdomains

10
IPs

3
Countries

872 kB
Transfer

2595 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.walla.co.il/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://phpstack-681113-2242753.cloudwaysapps.com/is HTTP 301
http://phpstack-681113-2242753.cloudwaysapps.com/is/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
phpstack-681113-2242753.cloudwaysapps.com/is/
Redirect Chain

http://phpstack-681113-2242753.cloudwaysapps.com/is
http://phpstack-681113-2242753.cloudwaysapps.com/is/

181 KB
45 KB

185ms
178ms

Document
text/html

128.199.195.30
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: HTTP/1.1
Server: 128.199.195.30 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 681113.cloudwaysapps.com
Software: nginx /
Resource Hash: 2ab51f0920db31bf1ae6bc208370372b2f3a639df72da5d486862d72eb57e45c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Fri, 05 Nov 2021 16:06:56 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 45456
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
Age: 3811
X-Cache: HIT
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow

Redirect headers

Server: nginx
Date: Fri, 05 Nov 2021 16:06:56 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 367
Connection: keep-alive
Location: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Age: 7656
X-Cache: HIT
X-Robots-Tag: noindex, nofollow

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 46ms
10ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 26 Oct 2021 23:24:02 GMT
server: Golfe2
age: 350
date: Fri, 05 Nov 2021 16:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Fri, 05 Nov 2021 18:01:06 GMT

GET
H2 200 pubads_impl_rendering_2019070801.js Show response
securepubads.g.doubleclick.net/gpt/ 67 KB
26 KB 71ms
18ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019070801.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

0f5d6a89240be982d4543fcc3b47a049d3ed974efc2276c273eb172fe9176020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25860
x-xss-protection: 0
last-modified: Mon, 08 Jul 2019 13:05:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 57ms
18ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b99e493e3a911b536d1b06bf063e30b72c3cf8962ee6c40e720df46eb5d52440

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28113
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635939285527684"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 358 KB
67 KB 76ms
45ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T728TH

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a90930e27c6e4efe9d1fbb83545923543bc6d022fd4c37ee88853f7641ec5300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67685
x-xss-protection: 0
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 79 KB
27 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c84fddaad1099bd1d9cb1d8fce2d9dfcf7c039156ed9f50483b07a77d1e38bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1034 / 700 of 1000 / last-modified: 1636110698"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27055
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET glo-our-divisions-teaser-large.web.793.252.jpg
www.dhl.com/content/dam/dhl/global/core/images/teaser-large-2730x868/ 0
0

GET
H2 200 integrator.js Show response
adservice.google.com.eg/adsid/ 107 B
165 B 63ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.eg/adsid/integrator.js?domain=friends.walla.co.il

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 pubads_impl_2021102501.js Show response
securepubads.g.doubleclick.net/gpt/ 356 KB
120 KB 36ms
17ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

dcd346804a786db16b40af2672924a5b8787623f71d648a017da7e236e1b19b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122594
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 08:35:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 58ms
19ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=friends.walla.co.il

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 pubads_impl_2019070801.js Show response
securepubads.g.doubleclick.net/gpt/ 150 KB
55 KB 28ms
28ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019070801.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

710bb035af3b6a17b98e7a60f289cbda442b0160707bd4e6b02f9797acda1598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56394
x-xss-protection: 0
last-modified: Mon, 08 Jul 2019 13:05:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 integrator.js Show response
adservice.google.com.eg/adsid/ 107 B
792 B 62ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.eg/adsid/integrator.js?domain=localhost

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 57ms
18ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=localhost

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 pubads_impl_2021051201.js Show response
securepubads.g.doubleclick.net/gpt/ 306 KB
108 KB 22ms
21ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051201.js?31061154

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

320d8abc5842e93f8157f5b9f075ada2a06c239fb2038de60fff7461f3deb02f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110161
x-xss-protection: 0
last-modified: Wed, 12 May 2021 08:37:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H3 200 pubads_impl_2021032202.js Show response
securepubads.g.doubleclick.net/gpt/ 286 KB
100 KB 19ms
18ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021032202.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

783355ba48d24f37c27cafa383cef88a462f95b7fc65d4fdaf57a0bcca7f371c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102487
x-xss-protection: 0
last-modified: Thu, 25 Mar 2021 18:01:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H3 200 pubads_impl_2021031801.js Show response
securepubads.g.doubleclick.net/gpt/ 286 KB
100 KB 27ms
24ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031801.js

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

ecf0ffde6e56a2c058421a0ca1a3446a00d047de48239cd168f7eb93a07a9269

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102478
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 08:39:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 0
0 60ms
7ms Other
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by: Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 integrator.js Show response
adservice.google.com.eg/adsid/ 107 B
165 B 20ms
19ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.eg/adsid/integrator.js?domain=localhost

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 20ms
20ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=localhost

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 pubads_impl_2021110201.js Show response
securepubads.g.doubleclick.net/gpt/ 346 KB
116 KB 29ms
26ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021110201.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

50ad3a273dd7803066fae0fb2e4eec57cdfb969f449d86309527578d7e08d249

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118932
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 08:34:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 259 B
178 B 38ms
20ms XHR
application/json 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=phpstack-681113-2242753.cloudwaysapps.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

3927ddfd9a1dd0ec891485c7aa55404b1102848d29b86cb2a0bd11cb3c8fe0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 153
x-xss-protection: 0
expires: Fri, 05 Nov 2021 16:06:56 GMT

GET
H/1.1 200
OK container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 0
0 24ms
13ms Other
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by: Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: HTTP/1.1
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 dhl-logo.svg
www.dhl.com//content/dam/dhl/global/core/images/logos/ 2 KB
2 KB 24ms
20ms Image
image/svg+xml 23.79.156.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com//content/dam/dhl/global/core/images/logos/dhl-logo.svg

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.79.156.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-79-156-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Security Headers

Name	Value
Content-Security-Policy	default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Security-Policy	default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
content-encoding: gzip
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 722
x-xss-protection: 1; mode=block
last-modified: Sun, 19 Sep 2021 08:26:04 GMT
x-frame-options: DENY
date: Fri, 05 Nov 2021 16:06:56 GMT
strict-transport-security: max-age=31536000
content-type: image/svg+xml
expires: Fri, 05 Nov 2021 16:06:56 GMT
cache-control: public, max-age=0
etag: "643-5cc54ea587584-gzip"
accept-ranges: bytes
x-webkit-csp: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
x-content-security-policy: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:

GET
H/1.1 404
Not Found inline.b30c555ec93d5e8b24c8.bundle.js
phpstack-681113-2242753.cloudwaysapps.com/ 0
0 187ms
182ms Script
text/html 128.199.195.30
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://phpstack-681113-2242753.cloudwaysapps.com/inline.b30c555ec93d5e8b24c8.bundle.js
Requested by: Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: HTTP/1.1
Server: 128.199.195.30 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 681113.cloudwaysapps.com
Software: nginx /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/is/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 05 Nov 2021 16:06:56 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
Vary: Accept-Encoding
X-Cache: MISS
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=1440
Transfer-Encoding: chunked
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Expires: 1440

GET
H/1.1 404
Not Found scripts.eb27010e332a0e01cebe.bundle.js
phpstack-681113-2242753.cloudwaysapps.com/ 0
0 362ms
343ms Script
text/html 128.199.195.30
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://phpstack-681113-2242753.cloudwaysapps.com/scripts.eb27010e332a0e01cebe.bundle.js
Requested by: Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: HTTP/1.1
Server: 128.199.195.30 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 681113.cloudwaysapps.com
Software: nginx /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/is/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 05 Nov 2021 16:06:57 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
Vary: Accept-Encoding
X-Cache: MISS
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=1440
Transfer-Encoding: chunked
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Expires: 1440

GET
H/1.1 404
Not Found main.2135d531eeae70d97ef1.bundle.js
phpstack-681113-2242753.cloudwaysapps.com/ 0
0 361ms
344ms Script
text/html 128.199.195.30
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://phpstack-681113-2242753.cloudwaysapps.com/main.2135d531eeae70d97ef1.bundle.js
Requested by: Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/
Protocol: HTTP/1.1
Server: 128.199.195.30 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 681113.cloudwaysapps.com
Software: nginx /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/is/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 05 Nov 2021 16:06:57 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
Vary: Accept-Encoding
X-Cache: MISS
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=1440
Transfer-Encoding: chunked
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Expires: 1440

GET
H3 403 ads Show response
securepubads.g.doubleclick.net/gampad/ 203 B
149 B 18ms
17ms XHR
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1542202525863716&correlator=1639280710656598&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&vrg=2019070801&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=0&sfv=1-0-35&ecs=20211105&iu_parts=43010785%2Cwalla%2Cfriends%2Cskyscrapper_desktop%2Ctop_desktop&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4&prev_iu_szs=300x600%2C120x600%7C160x600%2C970x90%7C970x250&prev_scp=exclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dtop_desktop&cookie_enabled=1&bc=23&abxe=1&lmt=1636128416&dt=1636128416951&dlt=1636128416547&idt=291&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C0%2C-9&adys=0%2C0%2C-9&adks=979713698%2C933772751%2C1581205155&ucis=1%7C2%7C3&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&u_sd=1&flash=0&url=http%3A%2F%2Fphpstack-681113-2242753.cloudwaysapps.com%2Fis%2F&dssz=39&icsg=2852685781576362&std=0&csl=69&vis=1&scr_x=0&scr_y=0&psz=1584x0%7C1584x0%7C0x-1&msz=0x0%7C0x0%7C0x-1&ga_vid=811758918.1636128417&ga_sid=1636128417&ga_hid=202216759&fws=128%2C128%2C2&ohw=0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019070801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

1bd05e125ef3d7c1b11e6a2bd07459ef0dbeede76af3184812d9c3e34b10c27d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 05 Nov 2021 16:06:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: http://phpstack-681113-2242753.cloudwaysapps.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125
x-xss-protection: 0

GET
H2 200 us-core-pr-10162019.web.796.448.jpg
www.dhl.com/content/dam/dhl/local/us/core/images/text-generic-1592x896/ 57 KB
58 KB 17ms
16ms Image
image/jpeg 23.79.156.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/local/us/core/images/text-generic-1592x896/us-core-pr-10162019.web.796.448.jpg

Requested by

Host: phpstack-681113-2242753.cloudwaysapps.com
URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.79.156.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-79-156-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

3ae1cd57d404aea90890b033e719c37c051c3d2dff10fa65b3ba3def0739663d

Security Headers

Name	Value
Content-Security-Policy	default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Security-Policy	default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://phpstack-681113-2242753.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 58359
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Sep 2021 22:30:21 GMT
x-frame-options: DENY
date: Fri, 05 Nov 2021 16:06:57 GMT
strict-transport-security: max-age=31536000
content-type: image/jpeg
expires: Mon, 08 Nov 2021 16:11:14 GMT
cache-control: public, max-age=259457
etag: "e3f7-5cd15c24b3b1c"
accept-ranges: bytes
x-webkit-csp: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:
x-content-security-policy: default-src data: https: blob: http: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443; script-src 'unsafe-inline' 'unsafe-eval' https: http: blob:; style-src 'unsafe-inline' https: http: blob:; media-src 'unsafe-inline' https: http: blob:

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.dhl.com
URL: https://www.dhl.com/content/dam/dhl/global/core/images/teaser-large-2730x868/glo-our-divisions-teaser-large.web.793.252.jpg?ver=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cloudwaysapps.com/	1970-01-20 16:00:00	Name: _ga Value: GA1.2.811758918.1636128417
.cloudwaysapps.com/	1970-01-19 22:30:14	Name: _gid Value: GA1.2.2011411937.1636128417
.doubleclick.net/	1970-01-19 22:28:49	Name: test_cookie Value: CheckForPermission

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: http://phpstack-681113-2242753.cloudwaysapps.com/is/ Message: Refused to apply style from 'https://www.dhl.com/content/dam/dhl/global/core/images/teaser-large-2730x868/glo-our-divisions-teaser-large.web.793.252.jpg?ver=1' because its MIME type ('image/jpeg') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1542202525863716&correlator=1639280710656598&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&vrg=2019070801&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=0&sfv=1-0-35&ecs=20211105&iu_parts=43010785%2Cwalla%2Cfriends%2Cskyscrapper_desktop%2Ctop_desktop&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4&prev_iu_szs=300x600%2C120x600%7C160x600%2C970x90%7C970x250&prev_scp=exclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dskyscraper_desktop%7Cexclusive%3Dnot%26slot_name%3Dtop_desktop&cookie_enabled=1&bc=23&abxe=1&lmt=1636128416&dt=1636128416951&dlt=1636128416547&idt=291&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C0%2C-9&adys=0%2C0%2C-9&adks=979713698%2C933772751%2C1581205155&ucis=1%7C2%7C3&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&u_sd=1&flash=0&url=http%3A%2F%2Fphpstack-681113-2242753.cloudwaysapps.com%2Fis%2F&dssz=39&icsg=2852685781576362&std=0&csl=69&vis=1&scr_x=0&scr_y=0&psz=1584x0%7C1584x0%7C0x-1&msz=0x0%7C0x0%7C0x-1&ga_vid=811758918.1636128417&ga_sid=1636128417&ga_hid=202216759&fws=128%2C128%2C2&ohw=0%2C0%2C0 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: http://phpstack-681113-2242753.cloudwaysapps.com/inline.b30c555ec93d5e8b24c8.bundle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://phpstack-681113-2242753.cloudwaysapps.com/scripts.eb27010e332a0e01cebe.bundle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://phpstack-681113-2242753.cloudwaysapps.com/main.2135d531eeae70d97ef1.bundle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.com.eg
phpstack-681113-2242753.cloudwaysapps.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.dhl.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.dhl.com
128.199.195.30
142.250.186.130
23.79.156.23
2a00:1450:4001:802::200e
2a00:1450:4001:803::2002
2a00:1450:4001:808::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2008
0c84fddaad1099bd1d9cb1d8fce2d9dfcf7c039156ed9f50483b07a77d1e38bf
0f5d6a89240be982d4543fcc3b47a049d3ed974efc2276c273eb172fe9176020
1bd05e125ef3d7c1b11e6a2bd07459ef0dbeede76af3184812d9c3e34b10c27d
2ab51f0920db31bf1ae6bc208370372b2f3a639df72da5d486862d72eb57e45c
320d8abc5842e93f8157f5b9f075ada2a06c239fb2038de60fff7461f3deb02f
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
3927ddfd9a1dd0ec891485c7aa55404b1102848d29b86cb2a0bd11cb3c8fe0b5
3ae1cd57d404aea90890b033e719c37c051c3d2dff10fa65b3ba3def0739663d
50ad3a273dd7803066fae0fb2e4eec57cdfb969f449d86309527578d7e08d249
710bb035af3b6a17b98e7a60f289cbda442b0160707bd4e6b02f9797acda1598
783355ba48d24f37c27cafa383cef88a462f95b7fc65d4fdaf57a0bcca7f371c
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a90930e27c6e4efe9d1fbb83545923543bc6d022fd4c37ee88853f7641ec5300
b99e493e3a911b536d1b06bf063e30b72c3cf8962ee6c40e720df46eb5d52440
dcd346804a786db16b40af2672924a5b8787623f71d648a017da7e236e1b19b4
ecf0ffde6e56a2c058421a0ca1a3446a00d047de48239cd168f7eb93a07a9269
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

phpstack-681113-2242753.cloudwaysapps.com Open in urlscan Pro 128.199.195.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

28 Requests

79 %HTTPS

67 %IPv6

9 Domains

9 Subdomains

10 IPs

3 Countries

872 kBTransfer

2595 kBSize

3 Cookies

1 Outgoing links

Page URL History

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

phpstack-681113-2242753.cloudwaysapps.com Open in urlscan Pro
128.199.195.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

79 %
HTTPS

67 %
IPv6

9
Domains

9
Subdomains

10
IPs

3
Countries

872 kB
Transfer

2595 kB
Size

3
Cookies

28 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!