bestdownloademporium.com Open in urlscan Pro
104.26.0.10 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://u.totalnicenewz.com/partitial/3735488/?var=5202628&ab2r=0&prfrev=false&rhd=true&os_version=10.15.7)
Effective URL:
https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Submission: On February 10 via api (February 10th 2024, 10:24:22 pm UTC) from US — Scanned from US

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 15 HTTP transactions. The main IP is 104.26.0.10, located in and belongs to CLOUDFLARENET, US. The main domain is bestdownloademporium.com.
TLS certificate: Issued by GTS CA 1P5 on January 5th 2024. Valid for: 3 months.

This is the only time bestdownloademporium.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	172.67.181.247 172.67.181.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	23.49.251.150 23.49.251.150	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	139.45.195.253 139.45.195.253	9002 (RETN-AS) (RETN-AS)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1 1	172.64.152.67 172.64.152.67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.26.0.10 104.26.0.10	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.26.11.198 104.26.11.198	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:817::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700:10:... 2606:4700:10::6816:3bb5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2003	15169 (GOOGLE) (GOOGLE)
15	10

1 172.67.181.247 (United States)

ASN13335 (CLOUDFLARENET, US)

u.totalnicenewz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.49.251.150 (Edison, United States) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-49-251-150.deploy.static.akamaitechnologies.com

ak.ocoaksib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.253 (United Kingdom)

ASN9002 (RETN-AS, GB)

datatechone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.152.67 (San Francisco, United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

click.bounceads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.26.0.10 (None, )

ASN13335 (CLOUDFLARENET, US)

bestdownloademporium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.11.198 (None, )

ASN13335 (CLOUDFLARENET, US)

javascriptcdnlive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:3bb5 (United States)

ASN13335 (CLOUDFLARENET, US)

app.posthog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	posthog.com app.posthog.com — Cisco Umbrella Rank: 8095	38 KB
3	bestdownloademporium.com bestdownloademporium.com	43 KB
3	ocoaksib.com 1 redirects ak.ocoaksib.com	15 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	2 KB
1	javascriptcdnlive.com javascriptcdnlive.com	7 KB
1	bounceads.net 1 redirects click.bounceads.net	183 B
1	datatechone.com datatechone.com — Cisco Umbrella Rank: 47879	468 B
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11964 Failed	491 B
1	totalnicenewz.com u.totalnicenewz.com	2 KB
15	10

	Domain	Requested by
3	app.posthog.com	bestdownloademporium.com app.posthog.com
3	bestdownloademporium.com	bestdownloademporium.com
3	ak.ocoaksib.com	1 redirects u.totalnicenewz.com ak.ocoaksib.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	bestdownloademporium.com
1	javascriptcdnlive.com	bestdownloademporium.com
1	click.bounceads.net	1 redirects
1	datatechone.com	ak.ocoaksib.com
1	my.rtmark.net	u.totalnicenewz.com ak.ocoaksib.com
1	u.totalnicenewz.com
15	10

This site contains links to these domains. Also see Links.

Domain
www.7-zip.org

Subject Issuer	Validity	Valid
ak.hetaruwg.com R3	`2024-02-08` - `2024-05-08`	3 months	crt.sh
datatechone.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-10` - `2024-12-23`	a year	crt.sh
rtmark.net R3	`2023-12-23` - `2024-03-22`	3 months	crt.sh
bestdownloademporium.com GTS CA 1P5	`2024-01-05` - `2024-04-04`	3 months	crt.sh
javascriptcdnlive.com GTS CA 1P5	`2024-01-26` - `2024-04-25`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-15` - `2024-04-14`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Frame ID: C78E2CDD7D7B61B4B771615DE0A86298
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://u.totalnicenewz.com/partitial/3735488/?var=5202628&ab2r=0&prfrev=false&rhd=true&os_version=10.15.7) Page URL
https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto= Page URL
https://ak.ocoaksib.com/?z=6118780&syncedCookie=true&rhd=false HTTP 302
https://click.bounceads.net/click.php?ID=cmp89804&sub=cmp89804&subid=6118780&S2=780309734732603942 HTTP 302
https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

15
Requests

87 %
HTTPS

30 %
IPv6

10
Domains

10
Subdomains

10
IPs

3
Countries

156 kB
Transfer

276 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.7-zip.org/a/7z2201-x64.msi
Title: Proceed To Download ›

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://u.totalnicenewz.com/partitial/3735488/?var=5202628&ab2r=0&prfrev=false&rhd=true&os_version=10.15.7) Page URL
https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto= Page URL
https://ak.ocoaksib.com/?z=6118780&syncedCookie=true&rhd=false HTTP 302
https://click.bounceads.net/click.php?ID=cmp89804&sub=cmp89804&subid=6118780&S2=780309734732603942 HTTP 302
https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
u.totalnicenewz.com/partitial/3735488/ 1 KB
2 KB 333ms
292ms Document
text/html 172.67.181.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://u.totalnicenewz.com/partitial/3735488/?var=5202628&ab2r=0&prfrev=false&rhd=true&os_version=10.15.7)

Protocol

HTTP/1.1

Server

172.67.181.247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
CF-Cache-Status: DYNAMIC
CF-RAY: 8537c2e2299c8d9d-MIA
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf8
Date: Sat, 10 Feb 2024 22:24:15 GMT
Expires: Tue, 11 Jan 1994 10:00:00 GMT
Link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://ak.ocoaksib.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma: no-cache
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jPvXjUr3z5OfNqOmLDRBRUdLl4FIxHUfz9oGAtJvo%2BalMx95%2FRdYeV%2FLj1MgQX8jnDoIlXxK1tu3iTP7eEOaYGRkEpDMr%2BsaN9AO%2FfM7gPmCmD4wZnhaq0edftkLy9NjIcu%2BKW2J"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Strict-Transport-Security: max-age=1
Timing-Allow-Origin: *
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Trace-Id: f60eb8862828600a16d3ed0afce9877e
alt-svc: h3=":443"; ma=86400

POST img.gif
my.rtmark.net/ 0
0

GET
H2 200 / Show response
ak.ocoaksib.com/4/6118780/ 33 KB
14 KB 381ms
154ms Document
text/html 23.49.251.150
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=
Requested by: Host: u.totalnicenewz.com
URL: http://u.totalnicenewz.com/partitial/3735488/?var=5202628&ab2r=0&prfrev=false&rhd=true&os_version=10.15.7)
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.251.150 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-251-150.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5fbb0a6ca92151c7650739c91eb9932eb431368f64242cdbf4fdf6c6d59a1e24

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding, favicon
access-control-allow-methods: GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: * *
access-control-max-age: 86400
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 13306
content-type: text/html; charset=utf8
date: Sat, 10 Feb 2024 22:24:16 GMT
expires: Sat, 10 Feb 2024 22:24:16 GMT
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma: no-cache
timing-allow-origin: *
vary: Accept-Encoding
x-trace-id: 88dbdb3a517912acdb66c9594bedfe65

POST
H2 200 sftouch
ak.ocoaksib.com/ 2 B
539 B 149ms
149ms Ping
text/plain 23.49.251.150
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ak.ocoaksib.com/sftouch?userId=32312f091c764e0d8c082de373ad9287&z=6118780&p_rid=edd801c8-aa56-4029-bfcf-86915cabcded&p_src=sf&branchId=150041&rb=-NoosugJN_UE48PxP0J-0sgncGzVRvsnIoQQ-sajnT4nxZ6uGbDU6-KAfPAx9Q_7Ms1CVCj2wkRePHqlhNqvZShye83EGgI9uF0lfyF_7KvGxuCY-sXBckXDV0OY_E_Y1bDQFmHli6Iup4ubRlH5iMOFnBokWTfJxTq1G_UAUfFOf0rDsqQAbkFBIJfGzP2Fgr8p1bOXZdNuHG9qUnIondPtg5WblxLAvRe4O_5aTHAFKipPGIb-N7QOmgRZWcpzL8nk_A6kGDc2GNwJ67mDW86G6UEJ0DOsJUAQSyaGvbBX-b-ttdqSHA==

Requested by

Host: ak.ocoaksib.com
URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.49.251.150 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-49-251-150.deploy.static.akamaitechnologies.com

Software

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=1
date: Sat, 10 Feb 2024 22:24:16 GMT
x-content-type-options: nosniff
content-length: 2
x-trace-id: c7e2a7e95c8c84ae7d8be0b6c17b3c15
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
access-control-allow-origin: https://ak.ocoaksib.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
expires: Sat, 10 Feb 2024 22:24:16 GMT

POST
H/1.1 200
OK add
datatechone.com/log/ 2 B
468 B 451ms
153ms XHR
text/plain 139.45.195.253
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=edd801c8-aa56-4029-bfcf-86915cabcded
Requested by: Host: ak.ocoaksib.com
URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.195.253 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

Referer: https://ak.ocoaksib.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 10 Feb 2024 22:24:16 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://ak.ocoaksib.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H2 200 img.gif
my.rtmark.net/ 43 B
491 B 141ms
140ms Image
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=32312f091c764e0d8c082de373ad9287&z=6118780&p_rid=edd801c8-aa56-4029-bfcf-86915cabcded&p_src=sf

Requested by

Host: ak.ocoaksib.com
URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ak.ocoaksib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 22:24:16 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

GET
H2

200

Primary Request / Show response
bestdownloademporium.com/NLP1/
Redirect Chain

https://ak.ocoaksib.com/?z=6118780&syncedCookie=true&rhd=false
https://click.bounceads.net/click.php?ID=cmp89804&sub=cmp89804&subid=6118780&S2=780309734732603942
https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe

3 KB
2 KB

344ms
242ms

Document
text/html

104.26.0.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.0.10 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: a584d13c6629298997d6f592fbdf4c81f722a523f23dddec705c58025603685e

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://ak.ocoaksib.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8537c2ebdeca4c33-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 10 Feb 2024 22:24:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tDrqP8xqhiCjWkBDzztHgKDAH5DY3F0SmSKgy3wNihGyn2w1pJO9rDQZevrAd6yX5PTRVGrLTmiP0B9riChEAO24iyT5u%2Fd%2FRrr8Lhjf65i%2FczsBXIqnczhzR%2BG162E1ux3%2Ft5FzZDXX5g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 8537c2ea4f4b0996-MIA
content-type: text/html; charset=UTF-8
date: Sat, 10 Feb 2024 22:24:17 GMT
location: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
server: cloudflare

GET
H2 200 dl.min.js Show response
javascriptcdnlive.com/ 18 KB
7 KB 251ms
148ms Script
text/html 104.26.11.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://javascriptcdnlive.com/dl.min.js
Requested by: Host: bestdownloademporium.com
URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.11.198 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f878295a13ab9f922ba046207c3cb9da598d0e00cca7d488ef0cd15fc866c574

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bestdownloademporium.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 22:24:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tixmzInOEZ8B3C59p1wXOBiTopre6eGvvrrwMYFGyhmqrht6%2BOjGdHL8UVDcpeVzQDOIrWM3AbDDF2pTXK2foVTX8WaRp6ZD4htThlA8NPC6Kv4WHpHucRuoisUVM%2FKuHo7mKizmvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 8537c2ee08184c0a-MIA

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
2 KB 251ms
79ms Stylesheet
text/css 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&display=swap

Requested by

Host: bestdownloademporium.com
URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8bd8a746efd5972536245f2f2c6e4213360405be048112ee66e3a2612edb43bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bestdownloademporium.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Feb 2024 22:24:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 21:59:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Feb 2024 22:24:17 GMT

GET
H2 200 steps.png
bestdownloademporium.com/NLP1/img/ 20 KB
20 KB 152ms
138ms Image
image/png 104.26.0.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bestdownloademporium.com/NLP1/img/steps.png
Requested by: Host: bestdownloademporium.com
URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.0.10 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: a895c9befb38c055f1342e615480cbd29c82421c04afc2e8428d962eb8b91b05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 22:24:17 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 05 Oct 2023 21:54:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
etag: "4fee-606ff2c99ef97"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5OpU0nnuskzsHVhEVgDbGmxkuPP15r9qRaLvaiQHFABwwSS73LHcTYn%2FsR3OK8%2Fuw0ZVV3pz1oeQhv0x3qgea%2Fdu3QHJdpq7UgoM9101LvLJusEKzrzM4BbnbLvbmf4%2B8fHJBHvRCuAYyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cf-ray: 8537c2ed78b34c33-MIA
content-length: 20462

GET
H2 200 steps_.png
bestdownloademporium.com/NLP1/img/ 21 KB
21 KB 151ms
137ms Image
image/png 104.26.0.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bestdownloademporium.com/NLP1/img/steps_.png
Requested by: Host: bestdownloademporium.com
URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.0.10 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 1f0e737701f4d8318802a742ae518602eca202f24107dccd74965889385d72d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 22:24:17 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 05 Oct 2023 21:54:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
etag: "53f1-606ff2cc1325f"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=91OoNRFk99%2FT1ry%2F5%2FAcEUTlWRtJy2%2Fszj8WNhcehSofN%2BESmypDHD72G%2B4SYoDP29kkwXmFCubjxlgLRuokpR%2BHTZKABpOpUg9Aus6Lft2NhdkfkrIUIn%2BZ9SbRFEsBQjkiRvvl0w5aBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cf-ray: 8537c2ed78b44c33-MIA
content-length: 21489

GET
H2 200 array.js Show response
app.posthog.com/static/ 121 KB
38 KB 150ms
52ms Script
text/javascript 2606:4700:10::6816:3bb5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.posthog.com/static/array.js

Requested by

Host: bestdownloademporium.com
URL: https://bestdownloademporium.com/NLP1/?source=6118780&click=780309734732603942&filename=Setup.exe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d754526c3501a7d282c6884854b90c54b222e4248b00c71651e5ed11f260fadb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bestdownloademporium.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 22:24:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 193
referrer-policy: same-origin
last-modified: Fri, 09 Feb 2024 21:21:50 GMT
server: cloudflare
cross-origin-opener-policy: same-origin
etag: W/"65c6976e-1e5cb"
x-frame-options: SAMEORIGIN
vary: Cookie, Accept-Encoding
content-type: text/javascript; charset="utf-8"
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 8537c2efdeb431dd-MIA

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 204ms
64ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bestdownloademporium.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 00:21:07 GMT
x-content-type-options: nosniff
age: 165790
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 00:21:07 GMT

POST
H2 200 / Show response
app.posthog.com/e/ 13 B
97 B 85ms
84ms XHR
application/json 2606:4700:10::6816:3bb5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.posthog.com/e/?ip=1&_=1707603857969&ver=1.105.6

Requested by

Host: app.posthog.com
URL: https://app.posthog.com/static/array.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bestdownloademporium.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 10 Feb 2024 22:24:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
server: cloudflare
cross-origin-opener-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://bestdownloademporium.com
access-control-allow-credentials: true
cf-ray: 8537c2f06f9231dd-MIA
access-control-allow-headers: X-Requested-With,Content-Type

POST
H2 200 / Show response
app.posthog.com/decide/ 444 B
511 B 82ms
81ms XHR
application/json 2606:4700:10::6816:3bb5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.posthog.com/decide/?v=3&ip=1&_=1707603857970&ver=1.105.6

Requested by

Host: app.posthog.com
URL: https://app.posthog.com/static/array.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a886dd7cebaba694929aa52c831814230430d460d4a844de9f094b223d5d63f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bestdownloademporium.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 10 Feb 2024 22:24:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
server: cloudflare
cross-origin-opener-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://bestdownloademporium.com
access-control-allow-credentials: true
cf-ray: 8537c2f06f9631dd-MIA
access-control-allow-headers: X-Requested-With,Content-Type

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: my.rtmark.net
URL: https://my.rtmark.net/img.gif?f=merge&userId=1b9d1bfad41c4fd3b598be379654674c

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| UAParser object| posthog

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
u.totalnicenewz.com/	1970-01-21 03:05:39	Name: OAID Value: 1b9d1bfad41c4fd3b598be379654674c
u.totalnicenewz.com/	1970-01-21 03:05:39	Name: oaidts Value: 1707603855
ak.ocoaksib.com/	1970-01-21 03:05:39	Name: oaidts Value: 1707603856
my.rtmark.net/	1970-01-21 03:05:39	Name: ID Value: 1b9d1bfad41c4fd3b598be379654674c
ak.ocoaksib.com/	1970-01-21 03:05:39	Name: OAID Value: 1b9d1bfad41c4fd3b598be379654674c
ak.ocoaksib.com/	1970-01-20 18:30:08	Name: syncedCookie Value: true
.bestdownloademporium.com/	1970-01-21 03:05:39	Name: ph_phc_I7xIcObtskp1VsaEcJOtHrq8kXlkuX7ljpvqVh3ICFz_posthog Value: %7B%22distinct_id%22%3A%22018d951f-1229-7868-8037-c9cef85bff50%22%2C%22%24sesid%22%3A%5B1707603857965%2C%22018d951f-122d-71e3-8460-7703c6ec9ce4%22%2C1707603857965%5D%7D

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto=(Line 49) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ak.ocoaksib.com/4/6118780/?var=3735488&btz=&bto= Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ak.ocoaksib.com
app.posthog.com
bestdownloademporium.com
click.bounceads.net
datatechone.com
fonts.googleapis.com
fonts.gstatic.com
javascriptcdnlive.com
my.rtmark.net
u.totalnicenewz.com
my.rtmark.net
104.26.0.10
104.26.11.198
139.45.195.253
139.45.195.8
172.64.152.67
172.67.181.247
23.49.251.150
2606:4700:10::6816:3bb5
2607:f8b0:4006:817::200a
2607:f8b0:4006:81c::2003
1f0e737701f4d8318802a742ae518602eca202f24107dccd74965889385d72d8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5fbb0a6ca92151c7650739c91eb9932eb431368f64242cdbf4fdf6c6d59a1e24
7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56
8bd8a746efd5972536245f2f2c6e4213360405be048112ee66e3a2612edb43bf
a584d13c6629298997d6f592fbdf4c81f722a523f23dddec705c58025603685e
a886dd7cebaba694929aa52c831814230430d460d4a844de9f094b223d5d63f7
a895c9befb38c055f1342e615480cbd29c82421c04afc2e8428d962eb8b91b05
d754526c3501a7d282c6884854b90c54b222e4248b00c71651e5ed11f260fadb
f878295a13ab9f922ba046207c3cb9da598d0e00cca7d488ef0cd15fc866c574

bestdownloademporium.com Open in urlscan Pro 104.26.0.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

30 %IPv6

10 Domains

10 Subdomains

10 IPs

3 Countries

156 kBTransfer

276 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

7 Cookies

3 Console Messages

Security Headers

Indicators

bestdownloademporium.com Open in urlscan Pro
104.26.0.10 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

30 %
IPv6

10
Domains

10
Subdomains

10
IPs

3
Countries

156 kB
Transfer

276 kB
Size

7
Cookies

15 HTTP transactions
0 data transactions