newsoft2update.goodplaceforgetcontentfree.icu Open in urlscan Pro
212.83.134.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.consair.com/
Effective URL:
http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&...
Submission: On December 17 via manual (December 17th 2018, 1:10:14 pm UTC) from US

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 9 domains to perform 16 HTTP transactions. The main IP is 212.83.134.40, located in France and belongs to AS12876, FR. The main domain is newsoft2update.goodplaceforgetcontentfree.icu.

This is the only time newsoft2update.goodplaceforgetcontentfree.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Adobe Update Apple Software Update (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	85.17.25.215 85.17.25.215	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1 2	209.15.13.136 209.15.13.136	13768 (COGECO-PEER1) (COGECO-PEER1 - Cogeco Peer 1)
2	34.193.215.101 34.193.215.101	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	18.195.174.160 18.195.174.160	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	18.184.38.55 18.184.38.55	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	195.154.41.240 195.154.41.240	12876 (AS12876) (AS12876)
1 1	163.172.125.151 163.172.125.151	12876 (AS12876) (AS12876)
1	212.83.134.40 212.83.134.40	12876 (AS12876) (AS12876)
8	2600:9000:204... 2600:9000:2047:1400:0:1c7c:cc80:21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
16	7

1 85.17.25.215 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

www.consair.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.15.13.136 (Atlanta, United States) 1 redirects

ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA)

dprtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.193.215.101 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-193-215-101.compute-1.amazonaws.com

use.xanthos-alf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.174.160 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com

wait.contenthostload.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.38.55 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com

pereams-pubstees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 195.154.41.240 (France) 2 redirects

ASN12876 (AS12876, FR)
PTR: 195-154-41-240.rev.poneytelecom.eu

redirect8.admedit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.172.125.151 (United Kingdom) 1 redirects

ASN12876 (AS12876, FR)
PTR: 163-172-125-151.rev.poneytelecom.eu

www.getgreatandsecurelinking.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.83.134.40 (France)

ASN12876 (AS12876, FR)
PTR: 212-83-134-40.rev.poneytelecom.eu

newsoft2update.goodplaceforgetcontentfree.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2047:1400:0:1c7c:cc80:21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

d3pkjdk5khxwdu.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	cloudfront.net d3pkjdk5khxwdu.cloudfront.net	97 KB
2	admedit.net redirect8.admedit.net Failed	715 B
2	xanthos-alf.com use.xanthos-alf.com	3 KB
2	dprtb.com 1 redirects dprtb.com	3 KB
1	goodplaceforgetcontentfree.icu newsoft2update.goodplaceforgetcontentfree.icu	7 KB
1	getgreatandsecurelinking.club 1 redirects www.getgreatandsecurelinking.club	470 B
1	pereams-pubstees.com pereams-pubstees.com Failed	885 B
1	contenthostload.com wait.contenthostload.com	2 KB
1	consair.com 1 redirects www.consair.com	540 B
16	9

	Domain	Requested by
8	d3pkjdk5khxwdu.cloudfront.net	newsoft2update.goodplaceforgetcontentfree.icu
2	redirect8.admedit.net
2	use.xanthos-alf.com	dprtb.com use.xanthos-alf.com
2	dprtb.com	1 redirects
1	newsoft2update.goodplaceforgetcontentfree.icu	pereams-pubstees.com
1	www.getgreatandsecurelinking.club	1 redirects
1	pereams-pubstees.com	wait.contenthostload.com
1	wait.contenthostload.com	use.xanthos-alf.com
1	www.consair.com	1 redirects
16	9

This site contains no links.

Subject Issuer	Validity	Valid
*.cloudfront.net DigiCert Global CA G2	`2018-10-08` - `2019-10-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Frame ID: 3CA5D38F42A09FDC5DB058FBB431FF23
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.consair.com/ HTTP 302
http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOT... Page URL
http://dprtb.com/Redirect/ HTTP 302
http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8... Page URL
http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth... Page URL
http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadow... Page URL
http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz... Page URL
https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w60OKCVLNSN9CD0J18F82EF6&ptrack=950d4c9... HTTP 302
https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew... HTTP 302
http://www.getgreatandsecurelinking.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w60OKCVLNSN9CD0J18F8... HTTP 302
http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91T... Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

Page Statistics

16
Requests

50 %
HTTPS

11 %
IPv6

9
Domains

9
Subdomains

7
IPs

4
Countries

112 kB
Transfer

142 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.consair.com/ HTTP 302
http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c Page URL
http://dprtb.com/Redirect/ HTTP 302
http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962 Page URL
http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false Page URL
http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw60OKCVLNSN9CD0J18F82EF6%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=0de536b3-01fd-11e9-acad-06f92de4597e&cid=w60OKCVLNSN9CD0J18F82EF6&rt=DJ Page URL
http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ Page URL
https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w60OKCVLNSN9CD0J18F82EF6&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6 HTTP 302
https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&ctrack=w60OKCVLNSN9CD0J18F82EF6&cmp=576&t=1545052200&rh=9&avs=avs4&utm_src=9&sids=7 HTTP 302
http://www.getgreatandsecurelinking.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6 HTTP 302
http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.consair.com/ HTTP 302
http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c

Request Chain 1

http://dprtb.com/Redirect/ HTTP 302
http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set click Show response
dprtb.com/
Redirect Chain

http://www.consair.com/
http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfa...

5 KB
3 KB

227ms
101ms

Document
text/html

209.15.13.136
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to

Full URL: http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c
Protocol: HTTP/1.1
Server: 209.15.13.136 Atlanta, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash: 8576ad64e223dafc036f8be6aeec11aec5a64c0ff94296ab9e336f4d999858d0

Request headers

Host: dprtb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
Set-Cookie: KoDJufxzGjyprJq=KoDJufxzGjyprJq; path=/
X-Server: web01
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Date: Mon, 17 Dec 2018 13:09:58 GMT
Content-Length: 2147

Redirect headers

server: nginx
date: Mon, 17 Dec 2018 13:09:58 GMT
content-length: 11
set-cookie: sid=0dd48568-01fd-11e9-8e4d-aae16ab6b872; path=/; domain=consair.com; HttpOnly
cache-control: max-age=0, private, must-revalidate
connection: close
location: http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c

GET
H/1.1

200
OK

0de536b3-01fd-11e9-acad-06f92de4597e
use.xanthos-alf.com/zcvisitor/
Redirect Chain

http://dprtb.com/Redirect/
http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

1008 B
2 KB

221ms
99ms

Document
text/html

34.193.215.101
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

Requested by

Host: dprtb.com
URL: http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c

Protocol

HTTP/1.1

Server

34.193.215.101 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-193-215-101.compute-1.amazonaws.com

Software

ZeroPark-Traffic /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host: use.xanthos-alf.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c
Accept-Encoding: gzip, deflate
Origin: http://dprtb.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://dprtb.com/click?data=TktUbHR1YzlTQ2F0elNGTkNWOHFWT2xLZVh2X1drekltT1hBMlJBV2lONllBRldOTkl2QkRwY0VuOHlScHpYSkFCdGRPdkJCN3ByTmhCd0VuZW9iSzBXbU5RTEh5OUtMenhUUGRqN0hqTjZvbGQ3cUdFMVd2bHZOOG1xTFFfanZ4WkwwSVNQcHE3OEZBQjV6aDRscktnMg2&id=bdc3d529-1200-4527-931b-28a4cb14199c

Response headers

Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Type: text/html;charset=UTF-8
Date: Mon, 17 Dec 2018 13:09:59 GMT
Server: ZeroPark-Traffic
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
transfer-encoding: chunked
Connection: keep-alive

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Server: web01
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Date: Mon, 17 Dec 2018 13:09:58 GMT
Content-Length: 238

GET
H/1.1 200
OK zcredirect
use.xanthos-alf.com/ 892 B
2 KB 101ms
100ms Document
text/html 34.193.215.101
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false

Requested by

Host: use.xanthos-alf.com
URL: http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

Protocol

HTTP/1.1

Server

34.193.215.101 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-193-215-101.compute-1.amazonaws.com

Software

ZeroPark-Traffic /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host: use.xanthos-alf.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://use.xanthos-alf.com/zcvisitor/0de536b3-01fd-11e9-acad-06f92de4597e?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

Response headers

Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Type: text/html;charset=UTF-8
Date: Mon, 17 Dec 2018 13:09:59 GMT
redirected: JS
Server: ZeroPark-Traffic
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
transfer-encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK Cookie set zp-redirect Show response
wait.contenthostload.com/ 966 B
2 KB 192ms
8ms Document
text/html 18.195.174.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw60OKCVLNSN9CD0J18F82EF6%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=0de536b3-01fd-11e9-acad-06f92de4597e&cid=w60OKCVLNSN9CD0J18F82EF6&rt=DJ
Requested by: Host: use.xanthos-alf.com
URL: http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Protocol: HTTP/1.1
Server: 18.195.174.160 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 74684af0684f5d674b74f934443f9cbd12ce799ff81d78c68c6852d0557c64b2

Request headers

Host: wait.contenthostload.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://use.xanthos-alf.com/zcredirect?visitid=0de536b3-01fd-11e9-acad-06f92de4597e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false

Response headers

Server: nginx
Date: Mon, 17 Dec 2018 13:09:59 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 966
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Set-Cookie: 8a613fbc-7f0f-4b03-969d-daba3b5e84ee-v4=8a613fbc-7f0f-4b03-969d-daba3b5e84ee;domain=wait.contenthostload.com;path=/;HttpOnly cc-v4=PsL7%2BbFY8bh0TYlMxIS6SyDxHBww09VUJ63Vm8vJ%2Fa8NksO1S%2BiF%2FOHX%2FdtRSLDd69Z08Co3K5nwo2Dqnkp4WUekA8Q7sprbFSBrRa5OnDdkRHsFZstgysqwXUHXb4EMxzCX7%2FFFIdHofL4X3LXe%2BA%3D%3D;Max-Age=31536000;Expires=Tue, 17-Dec-2019 13:09:59 GMT;domain=wait.contenthostload.com;path=/;HttpOnly

GET redirect
pereams-pubstees.com/ 0
0

GET
H/1.1 200
OK redirect Show response
pereams-pubstees.com/ 610 B
885 B 47ms
8ms Document
text/html 18.184.38.55
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ
Requested by: Host: wait.contenthostload.com
URL: http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw60OKCVLNSN9CD0J18F82EF6%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=0de536b3-01fd-11e9-acad-06f92de4597e&cid=w60OKCVLNSN9CD0J18F82EF6&rt=DJ
Protocol: HTTP/1.1
Server: 18.184.38.55 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5761ce0679d70423bdfd9b164e4a4fec907e4da4a27d073c95d59e09b7be31fa

Request headers

Host: pereams-pubstees.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw60OKCVLNSN9CD0J18F82EF6%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=0de536b3-01fd-11e9-acad-06f92de4597e&cid=w60OKCVLNSN9CD0J18F82EF6&rt=DJ
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw60OKCVLNSN9CD0J18F82EF6%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=0de536b3-01fd-11e9-acad-06f92de4597e&cid=w60OKCVLNSN9CD0J18F82EF6&rt=DJ

Response headers

Server: nginx
Date: Mon, 17 Dec 2018 13:09:59 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 610
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

GET /
redirect8.admedit.net/advertise/ 0
0

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
newsoft2update.goodplaceforgetcontentfree.icu/
Redirect Chain

https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w60OKCVLNSN9CD0J18F82EF6&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6
https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&ctrack=w60OKCVLNSN9CD0J18F82EF6&cmp=576&t=1545052200&rh=9&avs=avs4&...
http://www.getgreatandsecurelinking.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6
http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-4...

39 KB
7 KB

108ms
23ms

Document
text/html

212.83.134.40
AS12876

General

Check archive.org

Show headers Download Go to

Full URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Requested by: Host: pereams-pubstees.com
URL: http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ
Protocol: HTTP/1.1
Server: 212.83.134.40 , France, ASN12876 (AS12876, FR),
Reverse DNS: 212-83-134-40.rev.poneytelecom.eu
Software: nginx /
Resource Hash: 9bf5106b9fbc4b6504577fca57ed612c191e6971643b314a74ca5b316e074f60

Request headers

Host: newsoft2update.goodplaceforgetcontentfree.icu
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ

Response headers

Server: nginx
Date: Mon, 17 Dec 2018 13:10:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: channel=sofi2_mac_soupertrouper; expires=Mon, 17-Dec-2018 13:30:00 GMT; Max-Age=1200; path=/ dist_id=7090; expires=Mon, 17-Dec-2018 13:30:00 GMT; Max-Age=1200; path=/ lp_id=2733; expires=Mon, 17-Dec-2018 13:30:00 GMT; Max-Age=1200; path=/
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 17 Dec 2018 13:10:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.

GET
H2 200 flash_circle.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_worldcup/ 17 KB
18 KB 73ms
24ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_worldcup/flash_circle.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 74942ecaad9f6671c7243934b3a2027834e777d361a136550aee3195e0606f3c

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 21:43:54 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Sun, 24 Jun 2018 19:45:06 GMT
server: AmazonS3
age: 43913
etag: "2874daca7db827df1e95a589c3985c88"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 17639
x-amz-cf-id: 1nX659WjStFyIoubqBhQpro32u7mytqZffmFyIda498Kh4fZqX1qZg==

GET
H2 200 commands_3.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 14 KB
15 KB 66ms
17ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/commands_3.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5377ef31bb10d31f7c6d96dd13f32bcdef03e1fb41f81f3eb3a73808d94d9842

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 10:48:32 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Tue, 03 Jul 2018 12:08:19 GMT
server: AmazonS3
age: 52850
etag: "ccf7c636dc17d4e8adcbbf78e72e13d4"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 14740
x-amz-cf-id: S6nhAL3sTesx5fIhsS1ZhUJvUTmC9WiZhCzRQCdB6Xl4_JHn_TeBWg==

GET
H2 200 logo_f.png
d3pkjdk5khxwdu.cloudfront.net/lps/fadein_f/ 7 KB
7 KB 67ms
24ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/fadein_f/logo_f.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f4c14d0156315e5c1655e51cf2478e5e350772b1bf3ec62f17e01fe18ea01cbe

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 21:43:54 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 04 Jul 2018 09:21:40 GMT
server: AmazonS3
age: 56387
etag: "089384438a3c66815ea1d30edf2d282a"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 7308
x-amz-cf-id: OTl3jUVM3C4Un28xffWJd1NRd0XV-CWqmOIFwjPEsz74r32E_Yzf_w==

GET
H2 200 arrow__blue.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 2 KB
3 KB 60ms
17ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/arrow__blue.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 10:48:32 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 30 May 2018 18:11:30 GMT
server: AmazonS3
age: 52850
etag: "6d26faedbdd557f7dcd86e9060de347f"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 2266
x-amz-cf-id: i6_96KBESUJj_vYLG_xRqrm_Kggt9cLfCLveYbtuqdjbH4iGE8yDkA==

GET
H2 200 pattern__safari1.jpg
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 25 KB
25 KB 64ms
22ms Image
image/jpeg 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/pattern__safari1.jpg
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 15 Oct 2018 12:41:48 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 30 May 2018 18:11:28 GMT
server: AmazonS3
age: 56765
etag: "918dfef192de7b99284e969e75d6cc29"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
accept-ranges: bytes
content-length: 25293
x-amz-cf-id: uhGYx91UnOyCj7Ic28e8B28hrtNq0895OeBaWhM6-rqLYg6U1qmp8w==

GET
H2 200 pattern__safari-arrow.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 3 KB
4 KB 66ms
24ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/pattern__safari-arrow.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 10:48:32 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 30 May 2018 18:10:05 GMT
server: AmazonS3
age: 52850
etag: "496171f7f5272b0c3b8ae1d526110caf"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 3478
x-amz-cf-id: 0ELTfsxkntZTkwebsDgpNkd7JGdQPQkThiAzCyo_5lwqcmcr8BNTxg==

GET
H2 200 chrome.png
d3pkjdk5khxwdu.cloudfront.net/lps/FlashPlayer2_T/images/ 16 KB
16 KB 44ms
27ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/FlashPlayer2_T/images/chrome.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e81b841678d4407b3c7f41c00b6c0bec3a21484adef370a6a3deefb0da1c95a

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 16 Dec 2018 15:54:09 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 30 May 2018 18:15:13 GMT
server: AmazonS3
age: 76552
etag: "bd91b66f4a6fe261c321eab7b694054a"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 15912
x-amz-cf-id: 8w5EssFTuRofOavHbAq0Ck8O2IISPZJ9jSgy6ZNOZzVMVI4ZLb2m5A==

GET
H2 200 shadow.png
d3pkjdk5khxwdu.cloudfront.net/lps/newLPs/ 10 KB
10 KB 35ms
18ms Image
image/png 2600:9000:2047:1400:0:1c7c:cc80:21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3pkjdk5khxwdu.cloudfront.net/lps/newLPs/shadow.png
Requested by: Host: newsoft2update.goodplaceforgetcontentfree.icu
URL: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2047:1400:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 25b13e2e8af4969b966c36d6700b019e506dc5151ea6d63224e8827ac318de91

Request headers

Referer: http://newsoft2update.goodplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uStaXJCRPe8hKoyCC4lB-3-HX91TxTNFAxDQO9yBpfCVQ..&cid=w60OKCVLNSN9CD0J18F82EF6&sid=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6&v_id=VnATX5cGlrb03wbntcBEc5sFnK5ppa1Ejsh-2WYZ6gw.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 21:34:00 GMT
via: 1.1 ed0c487879f809919537bf00a2f2dc8f.cloudfront.net (CloudFront)
last-modified: Wed, 30 May 2018 18:02:31 GMT
server: AmazonS3
age: 8488
etag: "fdc87cbc7a3a305aae8ed3db8eee2488"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 10049
x-amz-cf-id: kZ_J-YT3zpRSusPq2KpNK3YUlmiFlCkO15Rym_JElvPhfFaJABd3lg==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pereams-pubstees.com
URL: http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXc2ME9LQ1ZMTlNOOUNEMEoxOEY4MkVGNiZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzYwT0tDVkxOU045Q0QwSjE4RjgyRUY2&ts=1545052199836&hash=ae468WLyKf291pyzwsGpejUNt4wBUsC-BkmBD2ILGoc&rm=DJ

Domain: redirect8.admedit.net
URL: https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w60OKCVLNSN9CD0J18F82EF6&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew60OKCVLNSN9CD0J18F82EF6

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Adobe Update Apple Software Update (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
newsoft2update.goodplaceforgetcontentfree.icu/	1970-01-18 21:10:53	Name: lp_id Value: 2733
newsoft2update.goodplaceforgetcontentfree.icu/	1970-01-18 21:10:53	Name: dist_id Value: 7090
newsoft2update.goodplaceforgetcontentfree.icu/	1970-01-18 21:10:53	Name: channel Value: sofi2_mac_soupertrouper

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d3pkjdk5khxwdu.cloudfront.net
dprtb.com
newsoft2update.goodplaceforgetcontentfree.icu
pereams-pubstees.com
redirect8.admedit.net
use.xanthos-alf.com
wait.contenthostload.com
www.consair.com
www.getgreatandsecurelinking.club
pereams-pubstees.com
redirect8.admedit.net
163.172.125.151
18.184.38.55
18.195.174.160
195.154.41.240
209.15.13.136
212.83.134.40
2600:9000:2047:1400:0:1c7c:cc80:21
34.193.215.101
85.17.25.215
25b13e2e8af4969b966c36d6700b019e506dc5151ea6d63224e8827ac318de91
3e81b841678d4407b3c7f41c00b6c0bec3a21484adef370a6a3deefb0da1c95a
5377ef31bb10d31f7c6d96dd13f32bcdef03e1fb41f81f3eb3a73808d94d9842
5761ce0679d70423bdfd9b164e4a4fec907e4da4a27d073c95d59e09b7be31fa
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a
74684af0684f5d674b74f934443f9cbd12ce799ff81d78c68c6852d0557c64b2
74942ecaad9f6671c7243934b3a2027834e777d361a136550aee3195e0606f3c
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12
8576ad64e223dafc036f8be6aeec11aec5a64c0ff94296ab9e336f4d999858d0
9bf5106b9fbc4b6504577fca57ed612c191e6971643b314a74ca5b316e074f60
f4c14d0156315e5c1655e51cf2478e5e350772b1bf3ec62f17e01fe18ea01cbe

newsoft2update.goodplaceforgetcontentfree.icu Open in urlscan Pro 212.83.134.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

50 %HTTPS

11 %IPv6

9 Domains

9 Subdomains

7 IPs

4 Countries

112 kBTransfer

142 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

3 Cookies

Indicators

newsoft2update.goodplaceforgetcontentfree.icu Open in urlscan Pro
212.83.134.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

50 %
HTTPS

11 %
IPv6

9
Domains

9
Subdomains

7
IPs

4
Countries

112 kB
Transfer

142 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!