shovecoffee.com Open in urlscan Pro
104.21.15.227  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.akagaki.com/ Page URL
2. http://www.akagaki.com/page/bouncy.php?&bpae=GbhGdK3mtVx7j3O11f%2B3AFD1aCG038qZdkh18cdvoBWbdSgOflLLe613cqyPkIt2Vo%2B3KgwTDRhIoXJ6IjK%2BlmpPwGLIn1bHsUs2v3h7VhAcOvbHbo8zo0v5EPJZozf%2FbAEAtdwKetnrbVZKWlvfsY1Si%2FEOdjtFs0kypj9A7qHR6D81wTDEN2a9b3QzRyE1hPiC0hLWBkqnAj4%2FUyeVueToCGN2OdvAtYr%2FhFXKqgJuAnU8bJvNj9pMyDxMKHkC%2F3QjcHDElvp8RDeCkpFgBHduEzZjc9TlOsyrAKaruhTdTFaIj38LWfdB4XVwjGbcHGGt0WEsgoRG1FRoDOEz3NatPrR1nPaXShvDz1OLQ128WvmBVaCXra4lhfRkig9mmZjCFXbBidZN3UCgqP2K5KqBrIMh8vW0%2FqhBPsu6yfaCOh%2B5cwPmed1tyIsy8Ty8bcHbtef%2FY0YP7G4Z8zvOuCy6ftRe7g7K40oaVajFx95C03Tk%2BooQBEtc2xRFWN71pw%3D%3D&redirectType=js&inIframe=false&inPopUp=false Page URL
3. https://alia-iso.com/zcvisitor/aac73431-b246-11ed-afe1-0ab1a2eeabeb/c48f16c0-a519-11ec-9226-0a76dcc61f13?campaignid=e5578420-4b9d-11ed-9c7e-128084d1ce51 Page URL
4. https://alia-iso.com/zcredirect?visitid=aac73431-b246-11ed-afe1-0ab1a2eeabeb&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false Page URL
5. https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ www.akagaki.com/	2 KB 3 KB	2082ms 950ms	Document text/html	67.227.226.240 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL http://www.akagaki.com/ Protocol HTTP/1.1 Server 67.227.226.240 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS lb01.parklogic.com Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16 Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 22 Feb 2023 00:20:10 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 Transfer-Encoding chunked X-Powered-By PHP/5.4.16
GET H/1.1	200 OK	bouncy.php www.akagaki.com/page/	982 B 1 KB	212ms 212ms	Document text/html	67.227.226.240 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL http://www.akagaki.com/page/bouncy.php?&bpae=GbhGdK3mtVx7j3O11f%2B3AFD1aCG038qZdkh18cdvoBWbdSgOflLLe613cqyPkIt2Vo%2B3KgwTDRhIoXJ6IjK%2BlmpPwGLIn1bHsUs2v3h7VhAcOvbHbo8zo0v5EPJZozf%2FbAEAtdwKetnrbVZKWlvfsY1Si%2FEOdjtFs0kypj9A7qHR6D81wTDEN2a9b3QzRyE1hPiC0hLWBkqnAj4%2FUyeVueToCGN2OdvAtYr%2FhFXKqgJuAnU8bJvNj9pMyDxMKHkC%2F3QjcHDElvp8RDeCkpFgBHduEzZjc9TlOsyrAKaruhTdTFaIj38LWfdB4XVwjGbcHGGt0WEsgoRG1FRoDOEz3NatPrR1nPaXShvDz1OLQ128WvmBVaCXra4lhfRkig9mmZjCFXbBidZN3UCgqP2K5KqBrIMh8vW0%2FqhBPsu6yfaCOh%2B5cwPmed1tyIsy8Ty8bcHbtef%2FY0YP7G4Z8zvOuCy6ftRe7g7K40oaVajFx95C03Tk%2BooQBEtc2xRFWN71pw%3D%3D&redirectType=js&inIframe=false&inPopUp=false Requested by Host: www.akagaki.com URL: http://www.akagaki.com/ Protocol HTTP/1.1 Server 67.227.226.240 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS lb01.parklogic.com Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16 Resource Hash Request headers Referer http://www.akagaki.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 22 Feb 2023 00:20:10 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 Transfer-Encoding chunked X-Powered-By PHP/5.4.16
GET H2	200	c48f16c0-a519-11ec-9226-0a76dcc61f13 Show response alia-iso.com/zcvisitor/aac73431-b246-11ed-afe1-0ab1a2eeabeb/	1 KB 2 KB	608ms 190ms	Document text/html	54.237.193.255 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alia-iso.com/zcvisitor/aac73431-b246-11ed-afe1-0ab1a2eeabeb/c48f16c0-a519-11ec-9226-0a76dcc61f13?campaignid=e5578420-4b9d-11ed-9c7e-128084d1ce51 Requested by Host: www.akagaki.com URL: http://www.akagaki.com/page/bouncy.php?&bpae=GbhGdK3mtVx7j3O11f%2B3AFD1aCG038qZdkh18cdvoBWbdSgOflLLe613cqyPkIt2Vo%2B3KgwTDRhIoXJ6IjK%2BlmpPwGLIn1bHsUs2v3h7VhAcOvbHbo8zo0v5EPJZozf%2FbAEAtdwKetnrbVZKWlvfsY1Si%2FEOdjtFs0kypj9A7qHR6D81wTDEN2a9b3QzRyE1hPiC0hLWBkqnAj4%2FUyeVueToCGN2OdvAtYr%2FhFXKqgJuAnU8bJvNj9pMyDxMKHkC%2F3QjcHDElvp8RDeCkpFgBHduEzZjc9TlOsyrAKaruhTdTFaIj38LWfdB4XVwjGbcHGGt0WEsgoRG1FRoDOEz3NatPrR1nPaXShvDz1OLQ128WvmBVaCXra4lhfRkig9mmZjCFXbBidZN3UCgqP2K5KqBrIMh8vW0%2FqhBPsu6yfaCOh%2B5cwPmed1tyIsy8Ty8bcHbtef%2FY0YP7G4Z8zvOuCy6ftRe7g7K40oaVajFx95C03Tk%2BooQBEtc2xRFWN71pw%3D%3D&redirectType=js&inIframe=false&inPopUp=false Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.237.193.255 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-237-193-255.compute-1.amazonaws.com Software RhOqcnjQ / Resource Hash 6f243c9dcdf2bc1887f5ba010c8d0f52e24bb8a6208963c40fa0479c7bcefbee Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' Request headers Referer http://www.akagaki.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers access-control-allow-headers X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag access-control-allow-methods GET,POST,OPTIONS access-control-allow-origin * cache-control no-store, no-cache, pre-check=0, post-check=0 content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' content-type text/html;charset=UTF-8 date Wed, 22 Feb 2023 00:20:11 GMT server RhOqcnjQ x-content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' x-webkit-csp default-src 'self'; script-src 'self' 'unsafe-inline'
GET H2	200	zcredirect alia-iso.com/	568 B 1 KB	379ms 378ms	Document text/html	54.237.193.255 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alia-iso.com/zcredirect?visitid=aac73431-b246-11ed-afe1-0ab1a2eeabeb&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false Requested by Host: alia-iso.com URL: https://alia-iso.com/zcvisitor/aac73431-b246-11ed-afe1-0ab1a2eeabeb/c48f16c0-a519-11ec-9226-0a76dcc61f13?campaignid=e5578420-4b9d-11ed-9c7e-128084d1ce51 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.237.193.255 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-237-193-255.compute-1.amazonaws.com Software nEugRwcJ / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' Request headers Referer https://alia-iso.com/zcvisitor/aac73431-b246-11ed-afe1-0ab1a2eeabeb/c48f16c0-a519-11ec-9226-0a76dcc61f13?campaignid=e5578420-4b9d-11ed-9c7e-128084d1ce51 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers access-control-allow-headers X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag access-control-allow-methods GET,POST,OPTIONS access-control-allow-origin * cache-control no-store, no-cache, pre-check=0, post-check=0 content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' content-type text/html;charset=UTF-8 date Wed, 22 Feb 2023 00:20:11 GMT redirected JS server nEugRwcJ x-content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' x-webkit-csp default-src 'self'; script-src 'self' 'unsafe-inline'
GET H2	200	Primary Request / Show response shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/	29 KB 14 KB	806ms 397ms	Document text/html	104.21.15.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Requested by Host: alia-iso.com URL: https://alia-iso.com/zcredirect?visitid=aac73431-b246-11ed-afe1-0ab1a2eeabeb&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.15.227 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 96985c5e819e31924d1fa24022446427ad6656b09eb08a086c4a903178bf6a03 Request headers Referer https://alia-iso.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ch Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 79d38df98dd3aff4-NRT content-encoding br content-type text/html date Wed, 22 Feb 2023 00:20:12 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AM1eIhxYUyjEDz9u79YZYgvfK%2B%2FV6GSzCIGmXmhGBzfzbqu0wLV06KYAohH0yJsz0vIoBHYXjMFo4xPkC2UvKxdtmaa3aS7tr%2FNmFlIO7%2FhhglNGXiaoD0oyB03lOEzVXCA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type image/png
GET H2	200	AFU1kAAPatM Show response feed.cn-rtb.com/v1/native/	659 B 851 B	782ms 685ms	Fetch application/json	172.67.197.244 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://feed.cn-rtb.com/v1/native/AFU1kAAPatM?subid=57611&uid=4da18a73-1c80-498a-baa5-591e0fd2d532&kw=download%20install Requested by Host: shovecoffee.com URL: https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.197.244 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d4039b9da11c6442cb53e53af709301a09d0719223c96e4448a13ebef9429cad Request headers accept-language jp-JP,jp;q=0.9 Referer https://shovecoffee.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 22 Feb 2023 00:20:13 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare model report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iYdrowngvKl0FMKpyzrQ6tJWy2oWWdQanssMXkaYHxSBzDVdv8p9Qqpbz0JOExsj3KV1JHJV6ki2I0sjQUTGTnNy9gDjP17EZBTJcjMLvwR66imprmfG3aENjxF04EuuoLU%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin * cache-control no-cache cf-ray 79d38dfcdca81ed0-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	conf.json Show response shovecoffee.com/hood/c2hvdmVjb2ZmZWUuY29t/	49 B 419 B	383ms 382ms	Fetch application/json	104.21.15.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://shovecoffee.com/hood/c2hvdmVjb2ZmZWUuY29t/conf.json Requested by Host: shovecoffee.com URL: https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.15.227 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4a30040a87b3fc79417470286ea34e8e2eb990f118f3378ea456b59247bd630e Request headers accept-language jp-JP,jp;q=0.9 Referer https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 22 Feb 2023 00:20:13 GMT content-encoding gzip cf-cache-status DYNAMIC last-modified Wed, 22 Feb 2023 00:12:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"63f55dd9-31" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=duD0uQfkFrpeZP4GVR7oPy6qzVWnNhr5Vz5QMb8MQ3n5PLfyCuc%2BeBFzpgbIDOZiFe02ZRzVo7Afjv7xtbGt7nDImGsy954CjM%2FyfxjstX3w%2BkDZ0QVpFuTOtlqOW4cvIX0%3D"}],"group":"cf-nel","max_age":604800} content-type application/json cf-ray 79d38dfc4fd5aff4-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET DATA	200 OK	truncated /	748 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	ht.js Show response sdk.ocmhood.com/sdk/	30 KB 12 KB	425ms 29ms	Script application/javascript	104.26.6.228 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN Requested by Host: shovecoffee.com URL: https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.6.228 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70ca645441ebfae7bb9653172c781bd55e9bcf45e3c0d49fe2bbce6c8a83da25 Request headers Referer https://shovecoffee.com/ Origin https://shovecoffee.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 22 Feb 2023 00:20:13 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1847 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 service-worker-allowed / last-modified Mon, 13 Feb 2023 09:58:42 GMT server cloudflare etag W/"63ea09d2-2e94" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GnaR5zTVlpMzEdgI%2Bk0e4CYePcG6lzsowHbreMsg%2BXdZen1XZCprOV4T%2BP%2FoO1eQM2keVZdahpH0yy%2F1trP8P%2BybwosUnJHIPbKtO2JJGIBkSzMQD6LRrdlu0dkZQMIXcw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=14400 cf-ray 79d38e012dfdaf88-NRT
GET H2	204	imp t.cn-rtb.com/	0 0	150ms 136ms	Fetch	172.67.197.244 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://t.cn-rtb.com/imp?l2=jQ3sXMhqWRRbtpv7bHk78ptYD2i3OfsieQdo3gaKPNnaDxesz_KODPiC01YGgdCMmSG2aU2kwsgGHf8EthZ_eE--4jpo8QX7EChQwqCHOjM_JYkbJBwQqlwemS8Xux8CW5fGFRsScmay2QoquaK-5UD1T7HtAF69jER3iByYaDXDO96_kSf6BdkU0-eHD8R- Requested by Host: shovecoffee.com URL: https://shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao/?cid=zraac73431b24611edafe10ab1a2eeabeb8f061ef93fc749ad9648445c49241434071376a28490dde422&dom=romeo-thy-kppqzlxo48&s=0.008000 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.197.244 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://shovecoffee.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 22 Feb 2023 00:20:13 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DzikftiHZx%2Fz1TESwXMF0S3p1ZE79nwMVUL46p5XqGmxhXUeGTYfqCauw8RYg2aqEPHiJA7AZGoCLZG08rovixh7uMmiJD0SmBUWawPiluIL0cQHDf%2FDnWgWeIrr92M%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-origin * cache-control no-cache cf-ray 79d38e014e741ed0-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN.js Show response cdn.ocmhood.com/tag/	191 B 701 B	424ms 30ms	Script application/javascript	172.67.72.9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.ocmhood.com/tag/NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN.js Requested by Host: sdk.ocmhood.com URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.72.9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d6d36ee2cb87eb00329f9b75a85faa08e081402af330d283c93516c96f9aeaa0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://shovecoffee.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 22 Feb 2023 00:20:14 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1584 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 service-worker-allowed / last-modified Fri, 14 Oct 2022 11:06:03 GMT server cloudflare etag W/"6349429b-bf" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=95Yy4rISpHuasgJMwt5tt0iXhRG68wnr%2Bhib%2BvwO6mJtUtJTipNdSamuQQavdc1P6njSAuWQErQJoRiCEObJ%2BjBXZwVIczi%2BEQLRyR80IX9xdo3C77wE4yROoCTzaLqm7w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=300 cf-ray 79d38e03e84d3457-NRT
POST H2	201	activity t.ocmhood.com/v2/	0 288 B	209ms 195ms	Ping application/octet-stream	172.67.72.9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://t.ocmhood.com/v2/activity Requested by Host: sdk.ocmhood.com URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.72.9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://shovecoffee.com/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 22 Feb 2023 00:20:14 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ySQAcZ5OIGeZSsD5rr2p%2F020awxJgaiGVx0TjXTw0AavAMIUZUbKibIBsH7D%2Bb5NONrb0Zze5%2FsdSBGh67jbtHgbvAP9ELtOCblolrOjktuChdQolTXska7ZOp%2FtKvU%3D"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream cache-control no-cache cf-ray 79d38e04386c3457-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H2	201	activity t.ocmhood.com/v2/	0 254 B	206ms 198ms	Ping application/octet-stream	172.67.72.9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://t.ocmhood.com/v2/activity Requested by Host: sdk.ocmhood.com URL: https://sdk.ocmhood.com/sdk/ht.js?tag=NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.72.9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://shovecoffee.com/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 22 Feb 2023 00:20:14 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y879L0j048Is1PPgJ7k3TPJE3ZkQk591Syy9Iw4Dmp9D7fhxOwR161TyglOf69bSV%2F8JU3EVhIpM%2BfIMpipI%2BhOfKMETrDKVZb9IPNGf2Eo30Oi84CSTQHU2uE9dsxw%3D"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream cache-control no-cache cf-ray 79d38e04386d3457-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange string| qs function| importOmpServiceWorker function| initOmpServiceWorker function| clearSession function| getLpType function| fetchAd function| getOCP function| popme function| pbcid function| finalRedirect function| goNextStep function| goToRedirectonAllow function| goToRedirectSmart2 function| isPushApiSupported function| uuidv4 function| initLpPush function| startOmpWorker object| ad number| cpc number| o_eid string| o_ocid string| fallback_url function| before_redirect_block function| Hood function| NjY4ZwSkNAFfmDQ2NXcxNDY4MjE0NgjN

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			shovecoffee.com/HaOe8ChYkNAUNlbvG6j1Ch0ujPL0Ydm7twjkotJQiao	1969-12-31 23:59:59	Name: session Value: alwQeDbFMw0Hd4HF7E2UeDKt-vLb7E22
			.shovecoffee.com/	1970-01-20 18:36:01	Name: _ht_v Value: 1677025214.5345407566
			.shovecoffee.com/	1970-01-20 09:50:27	Name: _ht_s Value: 1677025214.2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alia-iso.com
cdn.ocmhood.com
feed.cn-rtb.com
sdk.ocmhood.com
shovecoffee.com
t.cn-rtb.com
t.ocmhood.com
www.akagaki.com
104.21.15.227
104.26.6.228
172.67.197.244
172.67.72.9
54.237.193.255
67.227.226.240
4a30040a87b3fc79417470286ea34e8e2eb990f118f3378ea456b59247bd630e
6f243c9dcdf2bc1887f5ba010c8d0f52e24bb8a6208963c40fa0479c7bcefbee
70ca645441ebfae7bb9653172c781bd55e9bcf45e3c0d49fe2bbce6c8a83da25
96985c5e819e31924d1fa24022446427ad6656b09eb08a086c4a903178bf6a03
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
d4039b9da11c6442cb53e53af709301a09d0719223c96e4448a13ebef9429cad
d6d36ee2cb87eb00329f9b75a85faa08e081402af330d283c93516c96f9aeaa0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2