value.us Open in urlscan Pro
104.236.101.193 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn
Effective URL:
https://value.us/waste.php?reason=Visitor+From+Unexpected+Country
Submission Tags: phishing malicious Search All
Submission: On May 26 via api (May 26th 2020, 6:23:01 am UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 9 HTTP transactions. The main IP is 104.236.101.193, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is value.us.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 20th 2020. Valid for: 3 months.

This is the only time value.us was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	185.53.177.52 185.53.177.52	61969 (TEAMINTER...) (TEAMINTERNET-AS)
1	185.53.179.29 185.53.179.29	61969 (TEAMINTER...) (TEAMINTERNET-AS)
2	35.172.40.232 35.172.40.232	14618 (AMAZON-AES) (AMAZON-AES)
1	52.218.97.18 52.218.97.18	16509 (AMAZON-02) (AMAZON-02)
1 1	2a03:b0c0:3:d... 2a03:b0c0:3:d0::d13:7001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	104.236.101.193 104.236.101.193	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
9	5

4 185.53.177.52 (Germany)

ASN61969 (TEAMINTERNET-AS, DE)

paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.53.179.29 (Germany)

ASN61969 (TEAMINTERNET-AS, DE)

parkingcrew.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.172.40.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-40-232.compute-1.amazonaws.com

katie.ttnrd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.97.18 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:b0c0:3:d0::d13:7001 (Frankfurt am Main, Germany) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

clk.value.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.236.101.193 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: value.us

value.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	hyd.me paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me	3 KB
2	value.us 1 redirects clk.value.us value.us	1 KB
2	ttnrd.com katie.ttnrd.com	3 KB
1	amazonaws.com s3-eu-west-1.amazonaws.com	7 KB
1	parkingcrew.net parkingcrew.net	18 KB
9	5

	Domain	Requested by
4	paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me	parkingcrew.net paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me
2	katie.ttnrd.com	paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me katie.ttnrd.com
1	value.us	katie.ttnrd.com
1	clk.value.us	1 redirects
1	s3-eu-west-1.amazonaws.com	katie.ttnrd.com
1	parkingcrew.net	paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me
9	6

This site contains no links.

Subject Issuer	Validity	Valid
ttnrd.com Amazon	`2019-12-11` - `2021-01-11`	a year	crt.sh
*.s3-eu-west-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2020-12-10`	a year	crt.sh
www.value.us Let's Encrypt Authority X3	`2020-04-20` - `2020-07-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://value.us/waste.php?reason=Visitor+From+Unexpected+Country
Frame ID: 7290243EE71372EA47FCCF81AD711C25
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Page URL
https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsIn... Page URL
https://clk.value.us/15Gdif?searchword=&subid1=51e6689daa77f4a75604ab02&subid2=uncategorized&code... HTTP 302
https://value.us/waste.php?reason=Visitor+From+Unexpected+Country Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

9
Requests

44 %
HTTPS

17 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

31 kB
Transfer

30 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Page URL
https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Page URL
https://clk.value.us/15Gdif?searchword=&subid1=51e6689daa77f4a75604ab02&subid2=uncategorized&code=FynN5ZWH&source=Tonic&cost=0.055&external_id=01798778442296bc4889ec459bcc6013945af06c4e.r.1590474153.9f8a190b2966ed4610400aea742a1689 HTTP 302
https://value.us/waste.php?reason=Visitor+From+Unexpected+Country Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	cgi-bn Show response paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/	3 KB 2 KB	570ms 481ms	Document text/html	185.53.177.52 TEAMINTERNET-AS
General Check archive.org Show headers Download Go to Full URL http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Protocol HTTP/1.1 Server 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE), Reverse DNS Software nginx / Resource Hash `dcae9b2cfc75b0f4fa39a7934ae29a9f19c9c7bf990efbd23247e6493791a4ca` Request headers Host paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx Date Tue, 26 May 2020 06:21:59 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Check 3c12dc4d54f8e22d666785b733b0052100c53444 Content-Encoding gzip
GET H/1.1	200 OK	js3.js Show response parkingcrew.net/assets/scripts/	17 KB 18 KB	128ms 94ms	Script application/javascript	185.53.179.29 TEAMINTERNET-AS
General Check archive.org Show headers Download Go to Full URL http://parkingcrew.net/assets/scripts/js3.js Requested by Host: paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me URL: http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Protocol HTTP/1.1 Server 185.53.179.29 , Germany, ASN61969 (TEAMINTERNET-AS, DE), Reverse DNS Software nginx / Resource Hash `a606134e35db97024d04789609660c94f87f660dc259d91db5180e32787d4dad` Request headers Referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 26 May 2020 06:22:00 GMT Last-Modified Tue, 17 Mar 2020 13:25:50 GMT Server nginx ETag "5e70cfde-45fb" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 17915
GET H/1.1	200 OK	track.php Show response paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/	0 300 B	67ms 67ms	XHR text/html	185.53.177.52 TEAMINTERNET-AS
General Check archive.org Show headers Download Go to Full URL http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/track.php?domain=hyd.me&toggle=browserjs&uid=MTU5MDQ3NDE1My43MjA0OjMxOWNmODUyMWE4NTRhYmVhZDQ2NjMwYmZmNDQ3NDg4ZjljMTEwZjg1YTY3MDM3ZmNiOTUwNGM4MDlhNTIxMTM6NWVjY2I1YTlhZmUwMw%3D%3D Requested by Host: parkingcrew.net URL: http://parkingcrew.net/assets/scripts/js3.js Protocol HTTP/1.1 Server 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 26 May 2020 06:22:00 GMT Content-Encoding gzip Server nginx X-Custom-Track browserjs Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Transfer-Encoding chunked Connection keep-alive
POST H/1.1	201 Created	ls.php paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/	0 449 B	69ms 69ms	XHR text/javascript	185.53.177.52 TEAMINTERNET-AS
General Check archive.org Show headers Download Go to Full URL http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/ls.php Requested by Host: paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me URL: http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Protocol HTTP/1.1 Server 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE), Reverse DNS Software nginx / Resource Hash Request headers Referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Tue, 26 May 2020 06:22:00 GMT Server nginx Transfer-Encoding chunked Access-Control-Allow-Methods POST, OPTIONS Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me Access-Control-Max-Age 86400 Connection keep-alive X-Log-Success 5eccb5aa4c8c5f4e8c030999
GET H/1.1	200 OK	track.php paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/	0 293 B	356ms 325ms	XHR text/html	185.53.177.52 TEAMINTERNET-AS
General Check archive.org Show headers Download Go to Full URL http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/track.php?click=bfbe3027df6eebe6fba9c0e8bd906799782a431d&domain=hyd.me&uid=MTU5MDQ3NDE1My43MjA0OjMxOWNmODUyMWE4NTRhYmVhZDQ2NjMwYmZmNDQ3NDg4ZjljMTEwZjg1YTY3MDM3ZmNiOTUwNGM4MDlhNTIxMTM6NWVjY2I1YTlhZmUwMw%3D%3D&ts=fHx8ZDQxZDh8fHx8fHx8NWVjY2I1YTlhZTkzYnx8fDE1OTA0NzQxNTQuMDkzMnwyNTgwMWMzMWM1NDllZDkyZmNjMjE0MGE5ZjY0NDU2NTU1NDNmMzBjfHx8fHwxfHx8MHx8fHwwfHx8fHwwfDB8fHx8fHx8fHx8MHwxfHwwfDB8MXwwfDB8VzEwPXx8MXxXMTA9&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off Requested by Host: parkingcrew.net URL: http://parkingcrew.net/assets/scripts/js3.js Protocol HTTP/1.1 Server 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE), Reverse DNS Software nginx / Resource Hash Request headers Referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 26 May 2020 06:22:00 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * X-View-Match true Connection keep-alive Transfer-Encoding chunked
GET H2	200	tr Show response katie.ttnrd.com/	2 KB 2 KB	431ms 130ms	Document text/html	35.172.40.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Requested by Host: paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me URL: http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.172.40.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-172-40-232.compute-1.amazonaws.com Software / Resource Hash `3ed6e25914aadeb33447d2f626e0e0bfd2fc1211872cf5197470b513923b4c34` Request headers :method GET :authority katie.ttnrd.com :scheme https :path /tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me/cgi-bn Response headers status 200 date Tue, 26 May 2020 06:22:35 GMT content-type text/html; charset=utf-8 content-length 2345 p3p CP="CUR NOI NID STA STP" x-robots-tag noindex, nofollow set-cookie checkme=89dd3a726405164ea9e3db7a26ae1468b789; Path=/
GET H/1.1	200 OK	ajax-loader.gif s3-eu-west-1.amazonaws.com/pxgif/	7 KB 7 KB	265ms 72ms	Image image/gif	52.218.97.18 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3-eu-west-1.amazonaws.com/pxgif/ajax-loader.gif Requested by Host: katie.ttnrd.com URL: https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.218.97.18 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS s3-eu-west-1.amazonaws.com Software AmazonS3 / Resource Hash Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 26 May 2020 06:22:36 GMT Last-Modified Fri, 12 Aug 2016 15:23:54 GMT Server AmazonS3 x-amz-request-id E1155E856763D672 ETag "dc5b98ed1c3c7959cdcb76113e7442cd" Content-Type image/gif Accept-Ranges bytes Content-Length 6820 x-amz-id-2 YHb8T4254VEmPOFcHSg6oGMqSUuU5/cM3Nydghp5pQNs8sczNq3sBmMxa8v9Zmli3/BN61EwRcI=
GET H2	200	trx katie.ttnrd.com/	231 B 382 B	160ms 159ms	XHR text/html	35.172.40.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://katie.ttnrd.com/trx?id=01798778442296bc4889ec459bcc6013945af06c4e.r&confirm=89dd3a726405164ea9e3db7a26ae1468&size=1920000&noframe=1&tnc_ref=http%3A%2F%2Fpaypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me%2Fcgi-&reftaken=feed&refEqual=true Requested by Host: katie.ttnrd.com URL: https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.172.40.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-172-40-232.compute-1.amazonaws.com Software / Resource Hash Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Tue, 26 May 2020 06:22:35 GMT referrer-policy no-referrer content-type text/html; charset=utf-8 x-robots-tag noindex, nofollow content-length 231 p3p CP="CUR NOI NID STA STP"
GET H/1.1	403 Forbidden	Primary Request waste.php Show response value.us/ Redirect Chain https://clk.value.us/15Gdif?searchword=&subid1=51e6689daa77f4a75604ab02&subid2=uncategorized&code=FynN5ZWH&source=Tonic&cost=0.055&external_id=01798778442296bc4889ec459bcc6013945af06c4e.r.159047415... https://value.us/waste.php?reason=Visitor+From+Unexpected+Country	265 B 440 B	496ms 124ms	Document text/html	104.236.101.193 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://value.us/waste.php?reason=Visitor+From+Unexpected+Country Requested by Host: katie.ttnrd.com URL: https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.236.101.193 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS value.us Software Apache/2.4.29 (Ubuntu) / Resource Hash `172053a682faa4e933a7303553488073d115be2812537c9bcb694c788530e9c4` Request headers Host value.us Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://katie.ttnrd.com/tr?id=01798778442296bc4889ec459bcc6013945af06c4e.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MDVjNmI4MTcxMzIwNDAyNTc1YjFkNmUiLCJ0cyI6IjA1MjYwNjIyIiwiZCI6Imh5ZC5tZSJ9.V9EK6x1Gd9hv7swU1h6ccrhiAo6d8eQ5Dh2VBrCJmkg Response headers Date Tue, 26 May 2020 06:22:36 GMT Server Apache/2.4.29 (Ubuntu) Content-Length 265 Connection close Content-Type text/html; charset=UTF-8 Redirect headers Server nginx/1.17.8 Date Tue, 26 May 2020 06:22:35 GMT Content-Type text/html; charset=utf-8 Content-Length 174 Connection keep-alive X-Powered-By Express Set-Cookie 15Gdifo=20200526061590474625713; domain=.clk.value.us; path=/;expires=Wed, 27 May 2020 06:22:35 GMT; httpOnly=true; _pc_lc_id=15Gdif; domain=.clk.value.us; path=/;expires=Wed, 27 May 2020 06:22:35 GMT; httpOnly=true; peerclickcid=12dcb0210057995ff2d6bcdd25643450-9794-0526; domain=.clk.value.us; path=/;expires=Wed, 27 May 2020 06:22:35 GMT; httpOnly=true; _norg=1; domain=.clk.value.us; path=/;expires=Wed, 27 May 2020 06:22:35 GMT; httpOnly=true; Location https://value.us/waste.php?reason=Visitor+From+Unexpected+Country Vary Accept

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

clk.value.us
katie.ttnrd.com
parkingcrew.net
paypal.com.confirmation.account-security.174a9535b7fd93ceecbe1fc0392fa0f2174a9535b7fd93ceecbe1fc0392fa.wsedw.hyd.me
s3-eu-west-1.amazonaws.com
value.us
104.236.101.193
185.53.177.52
185.53.179.29
2a03:b0c0:3:d0::d13:7001
35.172.40.232
52.218.97.18
172053a682faa4e933a7303553488073d115be2812537c9bcb694c788530e9c4
3ed6e25914aadeb33447d2f626e0e0bfd2fc1211872cf5197470b513923b4c34
a606134e35db97024d04789609660c94f87f660dc259d91db5180e32787d4dad
dcae9b2cfc75b0f4fa39a7934ae29a9f19c9c7bf990efbd23247e6493791a4ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

value.us Open in urlscan Pro 104.236.101.193 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

44 %HTTPS

17 %IPv6

5 Domains

6 Subdomains

5 IPs

3 Countries

31 kBTransfer

30 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

Indicators

value.us Open in urlscan Pro
104.236.101.193 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

44 %
HTTPS

17 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

31 kB
Transfer

30 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions