vipsupport.festivalmarqueecompany.cyou Open in urlscan Pro
2606:4700:3030::ac43:d302  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://goo.googoodee.com/metaref?tag_id=blitz.gg Page URL
2. https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	metaref Show response goo.googoodee.com/	222 B 407 B	116ms 36ms	Document text/html	208.85.23.154 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://goo.googoodee.com/metaref?tag_id=blitz.gg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.85.23.154 Madrid, Spain, ASN20473 (AS-CHOOPA, US), Reverse DNS 208.85.23.154.vultrusercontent.com Software nginx/1.18.0 (Ubuntu) / Resource Hash 01c5cd6a44958cfb062c99eb7741e6880bd9a559388eb64d1de161c8993169cd Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Sat, 27 May 2023 15:16:13 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H2	200	Primary Request index.html Show response vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	26 KB 7 KB	146ms 110ms	Document text/html	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f5cf5e7f9228e1b434fdbf0ce8860a3b33e9c754aebf8f7ceba2f2345a9e8839 Request headers Referer https://goo.googoodee.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7cdf37be6c7b37cc-FRA content-encoding br content-type text/html date Sat, 27 May 2023 15:16:13 GMT last-modified Wed, 08 Mar 2023 03:41:56 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RGvGwzZjcshX2yagcorQEFHFOWtzIAL8L%2BScw99YIX66Yn4z2moR%2FXX9EI6JG0517rFzLEtY6CeQMF1DETARrOqNEooyzjeRDy%2BQf68qq7lD4UQhHnoa3%2B%2BWez3OnERc0dap%2FRt6P5uPgareSSOHUcTFc6aKmgYZjCHhhpaJYSVqTRmVcw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	language-1.0.0.js Show response vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	160 KB 39 KB	22ms 20ms	Script application/javascript	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/language-1.0.0.js Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 536198292f4879073fade2e624e3e62d0991540d29b51441076efeeb4de51317 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 Mar 2023 08:53:44 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6553 etag W/"64084d18-27eb5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W4tx8Cp2zlY6FpKFsa6dzIBoplfM573W%2BbJX79%2FnamhGRgDSeM7mkS24pU5ow8x4HXgykgXTOp2l96IJzSjx1m3Dv1pWbxTLgaW0GjM5AZxcxIdWEWftlboZvfyXiMF7ExGAwSO5dzHXhfhvPIVlRWTRdYCQAiNcLEVTRuIr2WSsGvHXhQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=2592000 cf-ray 7cdf37bf2e1437cc-FRA alt-svc h3=":443"; ma=86400 expires Mon, 26 Jun 2023 13:27:00 GMT
GET H2	200	main.css vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	14 KB 3 KB	19ms 19ms	Stylesheet text/css	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/main.css Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 014b7fc01567794e161ee99ad65acb8e741d1027e38e8959af170b59799fddcd Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 Mar 2023 03:09:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6553 etag W/"6407fc50-3957" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KrTMZt2wR5bHzVo%2FtTJeuxUjMIw99huyruDCcTquC4LtxGaO7NIXNUgXow%2FDfm3m0jNvQciA3qpNZgC%2FQ3Zoi4mnb%2B6Qu%2BAUc9CPAbDtHFSylCrNvQ9stiBWlb8eqWR6okWQ2L2eyHuVGVkTu%2BdlqnJ6gGrD3wLS2GcPHPsHNcVrc6qlBw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=21600 cf-ray 7cdf37bf2e1637cc-FRA alt-svc h3=":443"; ma=86400 expires Sat, 27 May 2023 19:27:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	171 KB 63 KB	73ms 23ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-259459715-1 Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cd0a1ce0b86ea93c5eef1f4eed374bed619eba79ba6b8aad754feb5d2eda112f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 63833 x-xss-protection 0 last-modified Sat, 27 May 2023 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 27 May 2023 15:16:13 GMT
GET H3	200	arrow_animation.gif vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	8 KB 8 KB	27ms 18ms	Image image/gif	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/arrow_animation.gif Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b51195b8674efdfbf920a779f9eb0ab2761a44c1d634ac7fb5bb0a19800aaa5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 7944 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-1f08" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FViGrBjyMnk8Jeu5E0uVarkJk6CTsetfj4Pip12HVoZqbpLbkgyKXxM2PFexVzx5NBbzk0RXzuulUFabuxRw0gdVb4EoebnUwessJBI%2BEEI68VMHbBNH03bBBLLVUxUcl2ND0%2FOqfntbD1yXT4guF9KL%2Bz7oKeodELcp6DwmDhv2VNQkhQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf8d3f9b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	icon_saf.png vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	487 B 1015 B	43ms 30ms	Image image/png	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/icon_saf.png Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36f016b0cf55a9ec191762f78060fd203ee96aff86407e0612982f09a3b2faee Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 487 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-1e7" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Vp7feifgZXdXzlNNPp5o1g4HdUpMQT%2FagBRkXHV9S4JjfpzJ1V0ubSKLyWGGoqssKb3RsVftK%2BgUcfmx2IQnNfpGoutDxG1qgwSTPP9XYWCzWPP6y9o6MZFPStdjNvxq%2Fr%2FNhnlcAecolrtcitYrgi5QoyL2A775ezRHksI%2FMbebF1MTw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d549b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	arrow_animation2.gif vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	8 KB 8 KB	42ms 30ms	Image image/gif	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/arrow_animation2.gif Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3daba949a682d184ffb892cd8b1a1ce4e4e9b13cb8d8e70334110a3c62a142cd Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 7948 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-1f0c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uChAyApZbMcuu9gm%2FU%2Fn7kM%2FHRDVLGgtwtr5vmLxV42bDIvBLFS4P1kA3MB%2Bj036FMsT81PNxlDwhMDBoX1Z2fbxX4kgdemsOT3VNCNS81HXR4liZ%2BIFnfBHpki6bJ6OGWzlwYSYZz1xoxLuzaiw8pSZPNkZ6dvDYpdoHjxN%2Bp21HH4OLQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d599b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	header_w.png vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	44 KB 45 KB	26ms 16ms	Image image/png	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/header_w.png Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0006a2792440ad020ffbd13961b641c8ca2144812e0b27c56fd2e766edf3ab99 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 45210 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-b09a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6oS37T6mI2t8vmTHnVfd1LLZ%2BWKQCpAE647NrchM7g2dk3a8wA7LaMbqf27aqglzZN8Ma%2BpH6vx5dbkxj1yP%2B4Yn1RvmiE3w%2BWcDCZ1ZkW7CBzthvdeFI6E1YQbPd7yFmn23e9I1Vv8gp0Vpli8PCK8KsVB8G%2ByyBxqVEd%2BiNazTrOyIMA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d5c9b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	microsoft.jpeg vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	10 KB 10 KB	41ms 31ms	Image image/jpeg	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/microsoft.jpeg Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6d26708d427902b82f121730725daf3fc119b6e0a43e9615f9b247a7f38ed359 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 9883 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-269b" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p61q5SSuVy9B%2BLkLGeJbhfUb1g7qwDxlnCB9HfIsE0Ybe42TDF90fOWiLbAiTgy%2FS7Y9ayM3b7gSHeTauqIo1w7MezMNOnMgmq9M1%2Bq1V1pLWrYmndHRaKoBScueK%2FU4JChj4Lb7b8McZf02Z1b43Fl2aYn33j9QMkm5n4CCH85iLlTQhg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d609b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	ajax2.svg vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	3 KB 933 B	38ms 33ms	Image image/svg+xml	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/ajax2.svg Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4ad738321cad0b03983ba16220d04889539780210de03f1661c08f9adc9aad78 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 Mar 2023 03:09:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6534 etag W/"6407fc50-c00" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxXmpQEJ96POPjtMLticRKU2HWL5JwpnxqWxTZE0mlDsQxVQp7Usnp9IKqFkOIu6BwIVso1ZWisEiSRu20LKQREDqpKPllTeZLUuyHvmuGwhjGwBOxdm4UvcYgrVCcogWk21%2FOE1RdAQm%2B7ddFuydGV1TKPDv2FOh32WSuWE08sxLiFu1A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=2592000 cf-ray 7cdf37bf9d629b8c-FRA alt-svc h3=":443"; ma=86400 expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	dreq.png vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	720 B 1 KB	38ms 33ms	Image image/png	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/dreq.png Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b62f1a81bfc0d281c853d7d1169c8866e33b58c7a990734cb6d6d91b2dbaf49a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 720 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-2d0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULdc7V703q6EPpinSU9dXc1nLQqMPJPx7cj1rOZ7%2BE6NsxuWUW%2BbOgazvUcPsHJGcbGSy7svc%2FMOJCVy%2BHXy3SK8jSRntcE3LiMblTSDfMbHRzUBNQxmTcEOXtDaVfph1z%2FN4Wj1LqRFP%2FEl2U6VXtdqrzuStgEf7zvjI0aGRttjFptkTg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d669b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	cross.png vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	344 B 875 B	38ms 33ms	Image image/png	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/cross.png Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b1192a77adc835c1665f249fd08384d10a447271925e6d81fcdc8fdfba7771e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 344 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-158" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mOivL5ev7CUULwmWlL8rNAb45fkO6A%2FlT0ZztkPAX8n7hnVAPEbVBR3XSL2djcHl23XCsAz8yecoO6s7q1s8y2Yf%2BKa5BEuUbyOP6ypV%2FvWxuGvPcGOQCj3qw5XR9h6FV94%2BiUBbcGbqpkG2NTO9ShK96ob1xcf4AzPYeQIOvhH%2BJ%2BwkGA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d6c9b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H3	200	tick.png vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	381 B 913 B	39ms 35ms	Image image/png	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/tick.png Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 562b29e08c7d623d3604b9fce91a6715c5f3d14ce62fee4e3c806b72528402ce Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6534 alt-svc h3=":443"; ma=86400 content-length 381 last-modified Wed, 08 Mar 2023 03:09:04 GMT server cloudflare etag "6407fc50-17d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w6V0hsoMU5u%2BgDCpdauriv%2BvNnlkxjo%2BCrARytM51Xu77WNNIDTKWS8Jcqwm7KL3MURvZqUGFntw4fPoRTKENvUid0%2FMSLaB3U6STbyr3DGqNnO1MUvDwDeWpWMJjJZDpDgeqBA6Ocr0NzBL5nLwR3p%2BBVgBU4P8vqNvxZC3MplZWvAQUg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=2592000 accept-ranges bytes cf-ray 7cdf37bf9d719b8c-FRA expires Mon, 26 Jun 2023 13:27:19 GMT
GET H2	200	moment-with-locales.min.js Show response vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/	361 KB 73 KB	23ms 22ms	Script application/javascript	2606:4700:3030::ac43:d302 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/moment-with-locales.min.js Requested by Host: vipsupport.festivalmarqueecompany.cyou URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:d302 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1374a7c31e85e2dec3880fcbdc380f93a227d8cd7be3b2526aefb73d68ed4b92 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 Mar 2023 03:09:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6553 etag W/"6407fc50-5a218" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xD6dNe7JWl0kpeJ7AxhDPjNbENBPwX%2Bcds3T52OaZOlBVSPa353E2BPR6NbI7arF%2BudJs34Re70bwkjEWUHZDHXgvRMFvrzkDDJVXo6nobdCgXBJ%2BzrSBHPtjF2gH%2F7q5JrdwmdbuQjSqhbhz%2BMXePasZmYKzUzkU6jrinGADSJ8NO29TA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=2592000 cf-ray 7cdf37bf5e8737cc-FRA alt-svc h3=":443"; ma=86400 expires Mon, 26 Jun 2023 13:27:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	203 KB 73 KB	16ms 16ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-N6K3DQ9QRS&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-259459715-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d8db22e6540cfc4977674bd9cc21390dceeca5d6a453b233dd6d7cf0a5ab6ed8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 15:16:13 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 74784 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Sat, 27 May 2023 15:16:13 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 21 KB	36ms 6ms	Script text/javascript	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-259459715-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sat, 27 May 2023 14:35:34 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 2439 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Sat, 27 May 2023 16:35:34 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 261 B	46ms 14ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-N6K3DQ9QRS&gtm=45je35o0&_p=2024607838&cid=1441790697.1685200574&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1685200573&sct=1&seg=0&dl=https%3A%2F%2Fvipsupport.festivalmarqueecompany.cyou%2Fmacfeeus%2Fmcafeewint1%2Findex.html%3Finfo%3D%26crid%3Dblitz.gg%26uid%3D40a6b15f-6fe9-46a3-a32d-d13e4a3100a4&dr=https%3A%2F%2Fgoo.googoodee.com%2F&dt=Virus%20Found%20-%20Windows&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-N6K3DQ9QRS&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Sat, 27 May 2023 15:16:13 GMT server Golfe2 content-type text/plain access-control-allow-origin https://vipsupport.festivalmarqueecompany.cyou cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 222 B	14ms 13ms	XHR text/plain	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j100&a=2024607838&t=pageview&_s=1&dl=https%3A%2F%2Fvipsupport.festivalmarqueecompany.cyou%2Fmacfeeus%2Fmcafeewint1%2Findex.html%3Finfo%3D%26crid%3Dblitz.gg%26uid%3D40a6b15f-6fe9-46a3-a32d-d13e4a3100a4&dr=https%3A%2F%2Fgoo.googoodee.com%2F&ul=en-us&de=UTF-8&dt=Virus%20Found%20-%20Windows&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1802344531&gjid=1515381526&cid=1441790697.1685200574&tid=UA-259459715-1&_gid=819280310.1685200574&_r=1&gtm=457e35o0&jsscut=1&z=1430471516 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 27 May 2023 15:16:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://vipsupport.festivalmarqueecompany.cyou cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| i18nUpdate object| params string| prod object| userLanguages string| useLanguage object| supportedLangauges object| esmxMapping object| zhtwMapping number| alertDelay boolean| redirect string| url string| product function| next_step function| goto function| setredirect function| getredirect function| gtag object| dataLayer function| moment function| beep function| countdown object| audioCtx number| x object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaGlobal object| gaplugins object| gaData number| volume number| duration string| type number| frequency number| nmins number| nsecs

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.festivalmarqueecompany.cyou/	1970-01-20 21:42:40	Name: _ga_N6K3DQ9QRS Value: GS1.1.1685200573.1.0.1685200573.0.0.0
			.festivalmarqueecompany.cyou/	1970-01-20 21:42:40	Name: _ga Value: GA1.2.1441790697.1685200574
			.festivalmarqueecompany.cyou/	1970-01-20 12:08:06	Name: _gid Value: GA1.2.819280310.1685200574
			.festivalmarqueecompany.cyou/	1970-01-20 12:06:40	Name: _gat_gtag_UA_259459715_1 Value: 1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4(Line 302) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4(Line 315) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://vipsupport.festivalmarqueecompany.cyou/macfeeus/mcafeewint1/index.html?info=&crid=blitz.gg&uid=40a6b15f-6fe9-46a3-a32d-d13e4a3100a4(Line 315) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

goo.googoodee.com
region1.google-analytics.com
vipsupport.festivalmarqueecompany.cyou
www.google-analytics.com
www.googletagmanager.com
2001:4860:4802:32::178
2001:4860:4802:34::36
208.85.23.154
2606:4700:3030::ac43:d302
2a00:1450:4001:809::2008
0006a2792440ad020ffbd13961b641c8ca2144812e0b27c56fd2e766edf3ab99
014b7fc01567794e161ee99ad65acb8e741d1027e38e8959af170b59799fddcd
01c5cd6a44958cfb062c99eb7741e6880bd9a559388eb64d1de161c8993169cd
1374a7c31e85e2dec3880fcbdc380f93a227d8cd7be3b2526aefb73d68ed4b92
36f016b0cf55a9ec191762f78060fd203ee96aff86407e0612982f09a3b2faee
3daba949a682d184ffb892cd8b1a1ce4e4e9b13cb8d8e70334110a3c62a142cd
4ad738321cad0b03983ba16220d04889539780210de03f1661c08f9adc9aad78
536198292f4879073fade2e624e3e62d0991540d29b51441076efeeb4de51317
562b29e08c7d623d3604b9fce91a6715c5f3d14ce62fee4e3c806b72528402ce
5b51195b8674efdfbf920a779f9eb0ab2761a44c1d634ac7fb5bb0a19800aaa5
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d26708d427902b82f121730725daf3fc119b6e0a43e9615f9b247a7f38ed359
9b1192a77adc835c1665f249fd08384d10a447271925e6d81fcdc8fdfba7771e
b62f1a81bfc0d281c853d7d1169c8866e33b58c7a990734cb6d6d91b2dbaf49a
cd0a1ce0b86ea93c5eef1f4eed374bed619eba79ba6b8aad754feb5d2eda112f
d8db22e6540cfc4977674bd9cc21390dceeca5d6a453b233dd6d7cf0a5ab6ed8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
f5cf5e7f9228e1b434fdbf0ce8860a3b33e9c754aebf8f7ceba2f2345a9e8839