admin.freewebstore.org Open in urlscan Pro
52.48.27.208  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://speedflow.io/adult/?a=rr Page URL
2. https://traffdaq.com/delivery/dl/47382?category=teen Page URL
3. https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Page URL
4. https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response speedflow.io/adult/	982 B 1 KB	326ms 313ms	Document text/html	198.54.116.135 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://speedflow.io/adult/?a=rr Protocol HTTP/1.1 Server 198.54.116.135 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server193-5.web-hosting.com Software Apache / PHP/7.1.33 Resource Hash 93843ec5d164f6834bf7c8b0203e97459277958476df1dcce17f1b61b96c04cb Request headers Host speedflow.io Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 07:45:40 GMT server Apache x-powered-by PHP/7.1.33 set-cookie visits_todaya=1; expires=Fri, 06-Nov-2020 22:59:00 GMT; Max-Age=54800; path=/ time_start=1604648740.1046; expires=Fri, 06-Nov-2020 22:59:00 GMT; Max-Age=54800; path=/ ip=185.212.171.75 mobile=0 country=++ visits_todayi=0; expires=Fri, 06-Nov-2020 22:59:00 GMT; Max-Age=54800; path=/ accept-ranges none vary Accept-Encoding content-encoding gzip content-length 515 content-type text/html; charset=UTF-8
GET H/1.1	200 OK	ads.js Show response a.realsrv.com/	2 KB 1 KB	19ms 8ms	Script application/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://a.realsrv.com/ads.js Requested by Host: speedflow.io URL: http://speedflow.io/adult/?a=rr Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash d3f814d49049b29143de2fccdbd97d0a1f0739e2554c482684c7c906b535ea43 Request headers Referer http://speedflow.io/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 06 Nov 2020 07:45:40 GMT Content-Encoding gzip X-HW 1604648740.dop128.fr8.shc,1604648740.dop128.fr8.t,1604648740.cds129.fr8.c Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=10800 Connection Keep-Alive Accept-Ranges bytes Content-Length 928
GET H/1.1	200 OK	Cookie set ads-iframe-display.php syndication.realsrv.com/ Frame 91B8	0 0	40ms 27ms	Document text/html	95.211.229.247 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL http://syndication.realsrv.com/ads-iframe-display.php?idzone=4053336&type=900x250&p=http%3A//speedflow.io/adult/%3Fa%3Drr&dt=1604648740206&sub=&tags=&screen_resolution=1600x1200&el=%22 Requested by Host: a.realsrv.com URL: https://a.realsrv.com/ads.js Protocol HTTP/1.1 Server 95.211.229.247 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS Software nginx / Resource Hash Request headers Host syndication.realsrv.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://speedflow.io/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://speedflow.io/ Response headers Server nginx Date Fri, 06 Nov 2020 07:45:40 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Expires Mon, 26 Jul 1997 05:00:00 GMT Cache-Control no-cache, must-revalidate Pragma no-cache P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%225fa4ff2439c985.391840773828880697%22%3B%7D; expires=Sun, 06 Nov 2022 07:45:40 GMT; path=; domain=.realsrv.com; Content-Encoding gzip
GET H/1.1	404 Not Found	%3C speedflow.io/adult/ Frame 5142	315 B 460 B	167ms 166ms	Document text/html	198.54.116.135 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://speedflow.io/adult/%3C?echo%20$mh;?%3E Requested by Host: speedflow.io URL: http://speedflow.io/adult/?a=rr Protocol HTTP/1.1 Server 198.54.116.135 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server193-5.web-hosting.com Software Apache / Resource Hash Request headers Host speedflow.io Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://speedflow.io/ Accept-Encoding gzip, deflate Accept-Language en-US Cookie ip=185.212.171.75; mobile=0; country=++; visits_todaya=1; time_start=1604648740.1046; visits_todayi=0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://speedflow.io/ Response headers date Fri, 06 Nov 2020 07:45:40 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H/1.1	200 OK	47382 Show response traffdaq.com/delivery/dl/	3 KB 2 KB	603ms 409ms	Document text/html	107.170.39.103 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://traffdaq.com/delivery/dl/47382?category=teen Requested by Host: speedflow.io URL: http://speedflow.io/adult/?a=rr Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.16.1 (Ubuntu) / Resource Hash 08f427bde4b808872ef4b712b198edaa5f7706adc66973dcf72ea4ac4afd08b5 Request headers Host traffdaq.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer http://speedflow.io/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://speedflow.io/ Response headers Server nginx/1.16.1 (Ubuntu) Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection close Cache-Control no-cache Date Fri, 06 Nov 2020 07:45:40 GMT Content-Encoding gzip
GET H/1.1	200 OK	eyJpdiI6IjhYNkJVbTRKMllHQTQ5NCtJM1VVZnc9PSIsInZhbHVlIjoiMDZRamM2eXNvM05HZUc5NFd5QXZyQVRncHJ4eEVlTXFETmwySzUreUZkV2JPQkRKSENoTDZVNloySWdKdW1BajhoWjRCRFRnMXJXT0RubFNqRmtVbFE9PSIsIm1hYyI6IjZhMjQ4ODhjM... traffdaq.com/users/track/	0 886 B	379ms 196ms	Image text/html	107.170.39.103 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://traffdaq.com/users/track/eyJpdiI6IjhYNkJVbTRKMllHQTQ5NCtJM1VVZnc9PSIsInZhbHVlIjoiMDZRamM2eXNvM05HZUc5NFd5QXZyQVRncHJ4eEVlTXFETmwySzUreUZkV2JPQkRKSENoTDZVNloySWdKdW1BajhoWjRCRFRnMXJXT0RubFNqRmtVbFE9PSIsIm1hYyI6IjZhMjQ4ODhjMGFmYmQ5OGIxZmRlNzNiZGJmNGZmMDg5N2EzMDUxMWJiMTExNTVhMTBjOTllMjUzYjNjOTYzZmIifQ%3D%3D Requested by Host: traffdaq.com URL: https://traffdaq.com/delivery/dl/47382?category=teen Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.16.1 (Ubuntu) / Resource Hash Request headers Referer https://traffdaq.com/delivery/dl/47382?category=teen User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 06 Nov 2020 07:45:41 GMT Cache-Control no-cache Server nginx/1.16.1 (Ubuntu) Connection close Content-Length 0 Content-Type text/html; charset=UTF-8
GET H2	401	implement.js c.securepaths.com/js/	0 0	38ms 37ms	Script application/javascript	35.190.72.161 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.securepaths.com/js/implement.js?org=FziBhN0qA1aE5tBQrQLl&s=5fa4ff2474a13&p=TDQ47382&a=47382&cmp=47382&rd=http%3A%2F%2Fspeedflow.io%2F&rt=click&sl=0&stId=0&ty=l Requested by Host: traffdaq.com URL: https://traffdaq.com/delivery/dl/47382?category=teen Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.72.161 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 161.72.190.35.bc.googleusercontent.com Software / Resource Hash Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://traffdaq.com/delivery/dl/47382?category=teen User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 06 Nov 2020 07:45:40 GMT via 1.1 google status 401 content-type application/javascript access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 x-xss-protection 0 expires 0
GET H2	200	fingerprint2.min.js Show response cdn.jsdelivr.net/fingerprintjs2/1.4.0/	33 KB 10 KB	6ms 6ms	Script application/javascript	2a04:4e42:1b::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/fingerprintjs2/1.4.0/fingerprint2.min.js Requested by Host: traffdaq.com URL: https://traffdaq.com/delivery/dl/47382?category=teen Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://traffdaq.com/delivery/dl/47382?category=teen User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 732729 x-cache HIT, HIT status 200 cross-origin-resource-policy cross-origin content-length 10191 etag W/"83f3-ijg3WuTgKQH1Hch06eHdIajrA24" x-served-by cache-fra19149-FRA, cache-hhn4076-HHN date Fri, 06 Nov 2020 07:45:40 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H/1.1	200 OK	47382 traffdaq.com/delivery/directlink/	2 KB 1 KB	5957ms 5779ms	Document text/html	107.170.39.103 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Requested by Host: traffdaq.com URL: https://traffdaq.com/delivery/dl/47382?category=teen Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.16.1 (Ubuntu) / Resource Hash Request headers Host traffdaq.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://traffdaq.com/delivery/dl/47382?category=teen Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie tdqct=1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://traffdaq.com/delivery/dl/47382?category=teen Response headers Server nginx/1.16.1 (Ubuntu) Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection close Cache-Control no-cache Date Fri, 06 Nov 2020 07:45:47 GMT Content-Encoding gzip
GET H/1.1	200 OK	Primary Request Cookie set Activation.aspx Show response admin.freewebstore.org/	3 KB 2 KB	214ms 110ms	Document text/html	52.48.27.208 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Requested by Host: traffdaq.com URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.48.27.208 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-48-27-208.eu-west-1.compute.amazonaws.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 9c0800056ef53fada8c7fb18c8a19716a929b439c5ef4ce01134a94836177883 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Host admin.freewebstore.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Response headers Cache-Control private Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Fri, 06 Nov 2020 07:45:46 GMT Server Microsoft-IIS/8.5 Set-Cookie ASP.NET_SessionId=l3rssz4j5rzbu1c0mt1lgaio; path=/; HttpOnly Vary Accept-Encoding X-AspNet-Version 4.0.30319 X-Frame-Options SAMEORIGIN X-Powered-By ASP.NET Content-Length 1731 Connection keep-alive
GET H/1.1	200 OK	base.css admin.freewebstore.org/css/	47 KB 10 KB	42ms 41ms	Stylesheet text/css	52.48.27.208 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://admin.freewebstore.org/css/base.css?v=2.8.3 Requested by Host: admin.freewebstore.org URL: https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.48.27.208 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-48-27-208.eu-west-1.compute.amazonaws.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash d2fd5844f9197a209376ce1917d17e37c2f81c88989166280520022f91515c0d Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 06 Nov 2020 07:45:47 GMT Content-Encoding gzip ETag "806d9ce072b3d61:0" Last-Modified Thu, 05 Nov 2020 12:55:03 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET X-Frame-Options SAMEORIGIN Content-Type text/css Connection keep-alive Accept-Ranges bytes Vary Accept-Encoding Content-Length 10175
GET H/1.1	200 OK	logo_fwscpv2_inside.png admin.freewebstore.org/images/	13 KB 13 KB	79ms 36ms	Image image/png	52.48.27.208 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://admin.freewebstore.org/images/logo_fwscpv2_inside.png Requested by Host: admin.freewebstore.org URL: https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.48.27.208 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-48-27-208.eu-west-1.compute.amazonaws.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 4ac7de6ee8491dc3894a50f0956711db733233cfa476dd6cbc1e7e56a7b85c2a Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 06 Nov 2020 07:45:46 GMT Last-Modified Thu, 05 Nov 2020 12:51:40 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "0169d6772b3d61:0" X-Frame-Options SAMEORIGIN Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 13038
GET H2	200	prum.min.js Show response rum-static.pingdom.net/	6 KB 3 KB	36ms 18ms	Script application/javascript	2606:4700:10::6814:14ef CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rum-static.pingdom.net/prum.min.js Requested by Host: admin.freewebstore.org URL: https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:14ef , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0054cb907bee526169a8718932e3949ed5d5c6468342cf4daa7bd052c77b38c Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 07:45:47 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 13 May 2020 13:49:07 GMT server cloudflare age 2115 status 200 etag W/"5ebbfad3-1880" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=43200 cf-ray 5edd326eff5edffb-FRA cf-request-id 063e1dd9600000dffb2d964000000001
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: admin.freewebstore.org URL: https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 6701 date Fri, 06 Nov 2020 05:54:06 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17168 expires Fri, 06 Nov 2020 07:54:06 GMT
GET H3-Q050	200	__utm.gif ssl.google-analytics.com/r/	35 B 399 B	42ms 27ms	Image image/gif	2a00:1450:4001:821::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=20611270&utmhn=admin.freewebstore.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=freewebstore%20Account%20Activation&utmhid=1517689574&utmr=https%3A%2F%2Ftraffdaq.com%2Fdelivery%2Fdirectlink%2F47382%3Fhash%3DeyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%253D%253D%26fp%3D66abd220fd1aeed21a48c2d9b60f0bf8&utmp=%2FActivation.aspx%3Fclx%3D018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059&utmht=1604648747367&utmac=UA-4599046-1&utmcc=__utma%3D54270775.349566974.1604648747.1604648747.1604648747.1%3B%2B__utmz%3D54270775.1604648747.1.1.utmcsr%3Dtraffdaq.com%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2Fdelivery%2Fdirectlink%2F47382%3B&utmjid=945596927&utmredir=1&utmu=HBAAAAAAAAAAAAAAAAAAAAAE~ Requested by Host: admin.freewebstore.org URL: https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 06 Nov 2020 07:45:47 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	beacon.gif Show response rum-collector-2.pingdom.net/img/	0 213 B	132ms 34ms	XHR text/plain	52.212.22.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rum-collector-2.pingdom.net/img/beacon.gif?id=57e8e6ac7585f02abf539d09&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=10&cE=106&dLE=10&dLS=2&fS=1&hS=22&rE=-1&rS=-1&reS=106&resS=216&resE=217&uEE=-1&uES=-1&dL=220&dI=304&dCLES=304&dCLEE=304&dC=349&lES=349&lEE=350&s=nt&title=freewebstore%20Account%20Activation&path=https%3A%2F%2Fadmin.freewebstore.org%2FActivation.aspx&ref=https%3A%2F%2Ftraffdaq.com%2Fdelivery%2Fdirectlink%2F47382%3Fhash%3DeyJpdiI6IlR4WlREMlwvV1NWaWd0alRPdGQxUlR3PT0iLCJ2YWx1ZSI6IkxjcUpya0NtTFNGNDBWeUN3ZytDS1JrSWVMVm5TR0lDRlVIRTRadkdrbFBKclJHakhtRlJUYkY1YXU1MXpLMWJwdkVNZ2VGajFtdXdUZnc1TUNIenBPM2Q0b04zWkkwK2RlYXNvcU0yVGlsdStiMXpCd3J1NTE5b2R1dDNVZkJTbGlSaGxuQ1lsMUtjeEFlcHZIOUJRczFDUjlnQXFhWXlaaU5RSnJIRnlQQkFrZ2x6Yld3ZGVsY2lwWitWa2k1VEVDOUtGWDE4cHpSZysyTENrQWdoSkJNOExVbm1mN1ZTZ0NuUlRMbHErczRnTGNKYjBDcFVlWUx4bFQ1cWpTelVGMGNmMnRnYkpwbmdaQVg4VVVuR09ZKzRIalwvSHdvbWorV1lqSlZIcXBaVWpiM2ZmTjBKSUxZU1Eyc290eHNxNCIsIm1hYyI6IjAzMGU1NGJjNGYzNDkwZmU0MTBhNzQxOGZjNTE0ZWUyZDEzNDdmZTQ0MTE2N2QxNjhiOThlZDAxMjZmNzcyMmEifQ%253D%253D%26fp%3D66abd220fd1aeed21a48c2d9b60f0bf8&sId=5q7yjly1&sST=1604648747&sIS=1&rV=0&v=1.4.1 Requested by Host: rum-static.pingdom.net URL: https://rum-static.pingdom.net/prum.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.212.22.221 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-212-22-221.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://admin.freewebstore.org/Activation.aspx?clx=018090064245058054240251234128040225068170028163038198038146062032244004230117223085187005130059 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Pragma no-cache Date Fri, 06 Nov 2020 07:45:47 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 0 Expires 0

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.realsrv.com
admin.freewebstore.org
c.securepaths.com
cdn.jsdelivr.net
rum-collector-2.pingdom.net
rum-static.pingdom.net
speedflow.io
ssl.google-analytics.com
syndication.realsrv.com
traffdaq.com
107.170.39.103
198.54.116.135
2001:4de0:ac19::1:b:2b
2606:4700:10::6814:14ef
2a00:1450:4001:80b::2008
2a00:1450:4001:821::2008
2a04:4e42:1b::621
35.190.72.161
52.212.22.221
52.48.27.208
95.211.229.247
08f427bde4b808872ef4b712b198edaa5f7706adc66973dcf72ea4ac4afd08b5
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
4ac7de6ee8491dc3894a50f0956711db733233cfa476dd6cbc1e7e56a7b85c2a
4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
93843ec5d164f6834bf7c8b0203e97459277958476df1dcce17f1b61b96c04cb
9c0800056ef53fada8c7fb18c8a19716a929b439c5ef4ce01134a94836177883
a0054cb907bee526169a8718932e3949ed5d5c6468342cf4daa7bd052c77b38c
d2fd5844f9197a209376ce1917d17e37c2f81c88989166280520022f91515c0d
d3f814d49049b29143de2fccdbd97d0a1f0739e2554c482684c7c906b535ea43
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855