popunder.bid - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 72.167.252.76, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is popunder.bid.

This is the only time popunder.bid was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	198.134.116.19 198.134.116.19	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1	72.167.252.76 72.167.252.76	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2

1 198.134.116.19 (Solana Beach, United States) 1 redirects

ASN27257 (WEBAIR-INTERNET, US)

xml.fstsrv1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.167.252.76 (United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 76.252.167.72.host.secureserver.net

popunder.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	bootstrapcdn.com netdna.bootstrapcdn.com — Cisco Umbrella Rank: 3338	18 KB
1	popunder.bid popunder.bid	852 B
1	fstsrv1.com 1 redirects xml.fstsrv1.com	148 B
2	3

	Domain	Requested by
1	netdna.bootstrapcdn.com	popunder.bid
1	popunder.bid
1	xml.fstsrv1.com	1 redirects
2	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://popunder.bid/
Frame ID: AEC404437F95AC67B16ED6786D4E05BA
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

popunder.bid

Page URL History Show full URLs

http://xml.fstsrv1.com/ HTTP 302
http://popunder.bid/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

2
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

19 kB
Transfer

100 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xml.fstsrv1.com/ HTTP 302
http://popunder.bid/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css HTTP 307
https://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
popunder.bid/
Redirect Chain

http://xml.fstsrv1.com/
http://popunder.bid/

824 B
852 B

1377ms
177ms

Document
text/html

72.167.252.76
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://popunder.bid/
Protocol: HTTP/1.1
Server: 72.167.252.76 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 76.252.167.72.host.secureserver.net
Software: Apache /
Resource Hash: e174b1c1ba782f11bc8c90b7f1ede589ef76cf108064ea91be54f1fc3a1b4f53

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 506
Content-Type: text/html
Date: Wed, 05 Apr 2023 14:04:52 GMT
ETag: "3f00ab0-338-5e2913e9a7b00-gzip"
Keep-Alive: timeout=5
Last-Modified: Wed, 29 Jun 2022 07:38:52 GMT
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding

Redirect headers

Age: 0
Cache-Control: no-store
Connection: keep-alive
Content-Length: 0
Location: http://popunder.bid/
Pragma: no-cache

GET
H2

200

bootstrap.min.css
netdna.bootstrapcdn.com/bootstrap/3.1.0/css/
Redirect Chain

http://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css
https://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css

99 KB
18 KB

97ms
34ms

Stylesheet
text/css

2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css

Requested by

Host: popunder.bid
URL: http://popunder.bid/

Protocol

H2

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11c74aed50911d54c04455fe1d9c04f42c5f6cf438a94976f890f25f2a59f699

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://popunder.bid/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 14:04:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 865
age: 24734879
cdn-cachedat: 05/04/2022 09:17:24
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:56 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: W/"937876bacfefa6ad4b64756b3834d94c"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 8b20c8365c651adcc09df1cb9fa6a776
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 7b3257bd7ed0bba3-FRA
cdn-requestpullsuccess: True

Redirect headers

Location: https://netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

netdna.bootstrapcdn.com
popunder.bid
xml.fstsrv1.com
198.134.116.19
2606:4700::6812:bcf
72.167.252.76
11c74aed50911d54c04455fe1d9c04f42c5f6cf438a94976f890f25f2a59f699
e174b1c1ba782f11bc8c90b7f1ede589ef76cf108064ea91be54f1fc3a1b4f53

popunder.bid Open in urlscan Pro 72.167.252.76 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

0 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

19 kBTransfer

100 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

popunder.bid Open in urlscan Pro
72.167.252.76 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

19 kB
Transfer

100 kB
Size

0
Cookies

2 HTTP transactions
0 data transactions