popblockergold.info - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3032::6815:1173, located in United States and belongs to CLOUDFLARENET, US. The main domain is popblockergold.info.
TLS certificate: Issued by GTS CA 1P5 on February 13th 2023. Valid for: 3 months.

This is the only time popblockergold.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	35.190.43.140 35.190.43.140	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3032::6815:1173	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

3 35.190.43.140 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.43.190.35.bc.googleusercontent.com

predictiondexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3032::6815:1173 (United States)

ASN13335 (CLOUDFLARENET, US)

popblockergold.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	popblockergold.info popblockergold.info	65 KB
3	predictiondexchange.com 2 redirects predictiondexchange.com — Cisco Umbrella Rank: 105033	4 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 339	25 KB
6	3

	Domain	Requested by
4	popblockergold.info	predictiondexchange.com popblockergold.info
3	predictiondexchange.com	2 redirects
1	cdn.jsdelivr.net	popblockergold.info
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.popblockergold.info GTS CA 1P5	`2023-02-13` - `2023-05-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
Frame ID: B7CC12FB8F953E64ADBDFC0DFC809F08
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Popup Blocker Gold

Page URL History Show full URLs

http://predictiondexchange.com/jump/next.php?r=3893051 Page URL
https://predictiondexchange.com/jump/next.php?stamat=m%257C%252Ck93LiIjdrB1dwP0dEdHP3xP.1fb%252C2t5FkDDYpjxJ... HTTP 302
https://predictiondexchange.com/script/i.php?t=1&stamat=m%257C%252C%252Cw3FmI2KqoGU3BP-GH0dEdHP3xP.fb6%252CG... HTTP 302
https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV43117783... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

6
Requests

83 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

93 kB
Transfer

229 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://predictiondexchange.com/jump/next.php?r=3893051 Page URL
https://predictiondexchange.com/jump/next.php?stamat=m%257C%252Ck93LiIjdrB1dwP0dEdHP3xP.1fb%252C2t5FkDDYpjxJXsMWHSh7wKsTFo_9DWdVnHcBDLzDvAXJz59NBF_4R7IFVb-p1PTn&cbpage=http://predictiondexchange.com/jump/next.php?r=3893051&cbur=0.36273904812172986&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref= HTTP 302
https://predictiondexchange.com/script/i.php?t=1&stamat=m%257C%252C%252Cw3FmI2KqoGU3BP-GH0dEdHP3xP.fb6%252CGBX8tvtxyygpH1ttzcqegxjgJ9Bz4C6mQ3FIMA5VPgYQQJS099HJfYL9J1W7fL-lI3Dl34wyBfsAEWv-iNlE-2cbDfGWqAC_7rrvoiqENJMTh_OSqvG19Kiw7aC5DIVySeo1CemyU5YeMIIcyhXPyWrOSY7tNuqgwAswtv5_dO97AgrI_YUDP5WFHUY9gwAdlyuWwo6ODUrp8_ZCIwlUE7on5qoSQH3PSl-Qa-YPGCdw0D_KWTC4xxqCmTJOCyuaC-_Ikq83P0GNrsyODENDmUVCfxQY1LDlXTkHE-GX6iz1BJx6piMoqWplnbpwlq73KiaccfhqTj32L1YHMH04-CgZsY3QyyXmgnPKd8d3Cta0jIEPbv1BSgHcwl8WRT4PZdkEjvKezNb5oVNKHekoQuOQZdG3MVe0gmb44B024UGE20ZQ3V1v6smDWpPSn_kFuOWm5m5f1p-_iURElTQQjHPnOkK0OPgxJQmMK0PrpGI62wLtGIJP54xqMvMc6LpW5ftDLEXlm2azmHTloAPNEAuT1Uc3O9r8ecMZnqzgncLTOGh4Iy1ftISp7EHKyOTv3jc4U_6H6Z11Yluoel97lEjWLCUzHck7YeWo9vh9eD1o-ewB9Phe0GlGs8Lc1G7W HTTP 302
https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK next.php
predictiondexchange.com/jump/ 7 KB
3 KB 168ms
140ms Document
text/html 35.190.43.140
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://predictiondexchange.com/jump/next.php?r=3893051
Protocol: HTTP/1.1
Server: 35.190.43.140 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 140.43.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 01 Mar 2023 16:28:04 GMT
Server: openresty
Transfer-Encoding: chunked
Via: 1.1 google

GET
H2

200

Primary Request discover.php Show response
popblockergold.info/
Redirect Chain

https://predictiondexchange.com/jump/next.php?stamat=m%257C%252Ck93LiIjdrB1dwP0dEdHP3xP.1fb%252C2t5FkDDYpjxJXsMWHSh7wKsTFo_9DWdVnHcBDLzDvAXJz59NBF_4R7IFVb-p1PTn&cbpage=http://predictiondexchange.co...
https://predictiondexchange.com/script/i.php?t=1&stamat=m%257C%252C%252Cw3FmI2KqoGU3BP-GH0dEdHP3xP.fb6%252CGBX8tvtxyygpH1ttzcqegxjgJ9Bz4C6mQ3FIMA5VPgYQQJS099HJfYL9J1W7fL-lI3Dl34wyBfsAEWv-iNlE-2cbDf...
https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac

9 KB
4 KB

591ms
67ms

Document
text/html

2606:4700:3032::6815:1173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
Requested by: Host: predictiondexchange.com
URL: http://predictiondexchange.com/jump/next.php?r=3893051
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:1173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12539a693bc38f098401152c129e43239411e9e573361f763b64bf8163d7b16d

Request headers

Referer: http://predictiondexchange.com/jump/next.php?r=3893051
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7a12c566ffd8bbd1-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 01 Mar 2023 16:28:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SGjm%2BtYMDi2TRQ%2F%2BwPggwfCyIC5wFAn6jMy%2Fdhk3eGU62awDQ8kbMaHnX%2F1Xtg%2F6fN%2FlwsYJwRtcvkMPRccN9Df06iTlilsk55zMDkkIAUf7SHwAaVf8Dzqp38TYgciwBehA0frpz3XtAvfKz63BNala"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=utf-8
date: Wed, 01 Mar 2023 16:28:05 GMT
location: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
server: openresty
via: 1.1 google

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ 152 KB
25 KB 73ms
28ms Stylesheet
text/css 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

Requested by

Host: popblockergold.info
URL: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://popblockergold.info/
Origin: https://popblockergold.info
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 16:28:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 633266
x-jsd-version: 5.0.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230097-FRA, cache-yyz4521-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QloF%2FRjqxR9u7PhQE8yPq5axLTlOBF7gPWnB8NDMLY8DeyWzIPzeRir4oQIQEh7A4aiE0qtEIg8QfdNcpSS1MpxYcg4XqJ3iypomo08C7q8M8mkSwEoXMuUa4L31ZwbchiH%2BqIyO1rfrWP7a4qY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 7a12c567bcad3606-FRA

GET
H2 200 logo.png
popblockergold.info/images/ 56 KB
56 KB 18ms
18ms Image
image/png 2606:4700:3032::6815:1173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://popblockergold.info/images/logo.png
Requested by: Host: popblockergold.info
URL: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:1173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b654762e71ccfd5841df7e4ebb1e5a983ec211d5194054c9936986d14027ff9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 16:28:05 GMT
cf-cache-status: HIT
last-modified: Mon, 12 Dec 2022 12:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1269
etag: "63971b7c-e03d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tGUy6DljOXHlKRmQ9Fs8e8A6F0FwZz4bVYms8s7upn%2Fs1%2Bo2dlrVJq2JYilZ4x6pxJv%2FA777sfA1WDboGeTO%2FxbGumsJShgia02NpJG80hg0lkouHGRjoAJoC1tHKG8K7DS8OBAypqf%2BZu2owiJGo7eU"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=1200
accept-ranges: bytes
cf-ray: 7a12c56768aabbd1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 57405

GET
H2 200 chromewebstore.png
popblockergold.info/ 3 KB
4 KB 20ms
18ms Image
image/png 2606:4700:3032::6815:1173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://popblockergold.info/chromewebstore.png
Requested by: Host: popblockergold.info
URL: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:1173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b74fcd6c38eb603d9c86cd1c8cb97ba423d200d7e3e555cbc5a704ac456e00f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 16:28:05 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Dec 2022 14:49:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7197
etag: "6391f97b-d6b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o97Qy4L0czcmaOiEh8t8qXS5NokNF2pfRXeUdlfEHCHpkt7C8751We9e7hTeFgabJn5iVaWH2QZNjIHL4t%2F1Zat7au8%2BkI2IFypaOPCAZs%2FEh%2Bln8F8bKH7Cvyb4e%2BexpcGD4NCc0rxSHl2ctMV8lTh7"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=1200
accept-ranges: bytes
cf-ray: 7a12c56788dbbbd1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3435

GET
H2 200 email-decode.min.js Show response
popblockergold.info/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 10ms
8ms Script
application/javascript 2606:4700:3032::6815:1173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://popblockergold.info/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: popblockergold.info
URL: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6815:1173 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://popblockergold.info/discover.php?fr=bsac40GiU9d3&_d=3&fy=3893051&fu=167768808410000TDETV431177839704V59&ft=ac
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 16:28:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 27 Feb 2023 12:06:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63fc9cbe-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtqRcoB3OG%2F%2FRo96xAMzI6VnhYvEOTsYgu83m6sN%2BYmOHm%2BBL9cVA7y%2Bkic875KRrQXHsoYiZVKunXOrI9djyHmTLYsUdbfOoQ1ogeqO9M%2BPc550u5I1XYd%2F0yITkfKNo4DZAd%2BCiYFNvaauGIu%2BasZm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7a12c56788d7bbd1-FRA
expires: Fri, 03 Mar 2023 16:28:05 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
popblockergold.info
predictiondexchange.com
2606:4700:3032::6815:1173
2606:4700::6810:5714
35.190.43.140
12539a693bc38f098401152c129e43239411e9e573361f763b64bf8163d7b16d
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2b74fcd6c38eb603d9c86cd1c8cb97ba423d200d7e3e555cbc5a704ac456e00f
4b654762e71ccfd5841df7e4ebb1e5a983ec211d5194054c9936986d14027ff9
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

popblockergold.info Open in urlscan Pro 2606:4700:3032::6815:1173 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

93 kBTransfer

229 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

popblockergold.info Open in urlscan Pro
2606:4700:3032::6815:1173 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

93 kB
Transfer

229 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions