ww1.elkodailyfreepress.com
91.195.240.46

Go To Report Rescan

Submitted URL:
http://elkodailyfreepress.com
Effective URL:
http://ww1.elkodailyfreepress.com/
Submission: On December 03 via api (December 3rd 2019, 5:47:41 am) from US

Summary HTTP 14 Links 3 Behaviour IoCs

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 14 HTTP transactions.
The main IP is 91.195.240.46, located in Germany and belongs to SEDO-AS, DE. The main domain is ww1.elkodailyfreepress.com.

This is the first time this domain was scanned on urlscan.io!

Verdict: Unknown

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.224.212.222 103.224.212.222	133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited)
2	91.195.240.46 91.195.240.46	47846 (SEDO-AS) (SEDO-AS)
2	205.234.175.175 205.234.175.175	30081 (CACHENETW...) (CACHENETWORKS - CacheNetworks)
1	2a00:1450:400... 2a00:1450:4001:818::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	91.215.100.39 91.215.100.39	43407 (INFONLINE-AS) (INFONLINE-AS)
1	193.46.63.75 193.46.63.75	43407 (INFONLINE-AS) (INFONLINE-AS)
1 2	91.215.103.65 91.215.103.65	43407 (INFONLINE-AS) (INFONLINE-AS)
5	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
14	8

1 103.224.212.222 (Australia) 1 redirects

ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: lb-212-222.above.com

elkodailyfreepress.com
Domain lookup

2 91.195.240.46 (Germany)

ASN47846 (SEDO-AS, DE)

ww1.elkodailyfreepress.com
Domain lookup

2 205.234.175.175 (United States)

ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US)
PTR: vip1.G-anycast1.cachefly.net

img.sedoparking.com
Domain lookup

1 2a00:1450:4001:818::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com
Domain lookup

1 91.215.100.39 (Germany)

ASN43407 (INFONLINE-AS, NL)
PTR: script4.ioam.de

script.ioam.de
Domain lookup

1 193.46.63.75 (Alfter, Germany)

ASN43407 (INFONLINE-AS, NL)
PTR: irqs.ioam.de

irqs.ioam.de
Domain lookup

2 91.215.103.65 (Germany) 1 redirects

ASN43407 (INFONLINE-AS, NL)
PTR: de3.ioam.de

de.ioam.de
Domain lookup

5 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com
Domain lookup

1 2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.gstatic.com
Domain lookup

	Domain Subdomains	Transfer
6	google.com	55 KB
4	ioam.de 1 redirects	13 KB
3	elkodailyfreepress.com 1 redirects	21 KB
2	sedoparking.com	28 KB
1	gstatic.com	380 B
14	5

	Domain	Requested by
6	www.google.com	ww1.elkodailyfreepress.com www.google.com
2	de.ioam.de	1 redirects ww1.elkodailyfreepress.com
2	img.sedoparking.com	ww1.elkodailyfreepress.com
2	ww1.elkodailyfreepress.com	img.sedoparking.com
1	www.gstatic.com	ww1.elkodailyfreepress.com
1	irqs.ioam.de	script.ioam.de
1	script.ioam.de	ww1.elkodailyfreepress.com
1	elkodailyfreepress.com	1 redirects
14	8

This site contains links to these domains. Also see Links.

Domain
sedo.com
www.sedoparking.com
www.sedo.com

Subject / Issuer	Validity	Valid
*.ioam.de COMODO RSA Organization Validation Secure Server CA	`2017-12-22` - `2020-12-21`	3 years
www.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Website

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Website

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page. For each link, only the first name is shown.

https://sedo.com/search/details/?partnerid=14453&language=d&domain=elkodailyfreepress.com&origin=parking&utm_medium=Parking&utm_campaign=template&utm_source=2043
Title: Domain erwerben
http://www.sedoparking.com/
https://www.sedo.com/services/parking.php3
Title: Domain Parking Programm

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set / Show response

Redirect Chain

http://elkodailyfreepress.com/
http://ww1.elkodailyfreepress.com/

73 KB
21 KB

211ms
60ms

Document
text/html

91.195.240.46
SEDO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ww1.elkodailyfreepress.com/
Protocol: HTTP/1.1
Server: 91.195.240.46 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software: NginX /
Resource Hash: 59e93f2b5245909091d1ddcc47dbfca578c468c6bd55b2e3965f7fbc693e3b19

Request headers

Host: ww1.elkodailyfreepress.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_ZlDKR+OpIv/I20YeQjFpHuv8Zn+JZM3NY38by6vQN+0tQDQHCwh1SO3BCiY1wqMZWpa8RIGDpALMM3XoZq+hSQ==
Set-Cookie: tu=9d5bbf9720a19fe0f392e1409225ca07; expires=Tue, 31-Dec-2019 23:00:00 GMT; Max-Age=2481138; path=/; domain=elkodailyfreepress.com; HttpOnly
Last-Modified: Tue, 03 Dec 2019 05:47:42 GMT
X-Cache-Miss-From: parking-8bb88b6c8-rc2vx
Server: NginX
Content-Encoding: gzip

Redirect headers

Date: Tue, 03 Dec 2019 05:47:41 GMT
Server: Apache/2.4.25 (Debian)
Set-Cookie: __tad=1575352061.4707491; expires=Fri, 30-Nov-2029 05:47:41 GMT; Max-Age=315360000
Location: http://ww1.elkodailyfreepress.com/
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery-1.11.3.custom.min.js Show response
img.sedoparking.com/js 62 KB
25 KB 24ms
14ms Script
application/x-javascript 205.234.175.175
CacheNetworks

General

Check archive.org

Show headers Download Go to

Full URL: http://img.sedoparking.com/js/jquery-1.11.3.custom.min.js
Requested by: Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/
Protocol: HTTP/1.1
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 855f296903dc76c25d8b3eac33dd7e7742abf28d121d9f3f67d5d337aaeb18e7

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Content-Encoding: gzip
X-CF3: M
CF4ttl: 31536000.000
X-CF1: 11696:fC.fra2:cf:cacheN.fra2-01:H
Connection: keep-alive
Content-Length: 25176
x-cf-tsc: 1571268772
Access-Control-Allow-Origin: *
X-CF2: H
Last-Modified: Thu, 28 Jun 2018 13:09:28 GMT
Server: CFS 0215
X-CFF: B
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-CFHash: "7dd2fc9525d32ef5c44abe9036c98ad1"
Cache-Control: max-age=86400
CF4Age: 19
Accept-Ranges: bytes
Expires: Wed, 04 Dec 2019 05:47:42 GMT

GET
H/1.1 200
OK caf.js Show response
www.google.com/adsense/domains 155 KB
55 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:818::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.google.com/adsense/domains/caf.js

Requested by

Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

80cd910ba6e1d8237fc9652ada81f644cc3d5f145de1c251e49b95b4200ea08b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "1657737798934270224"
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: private, max-age=3600
Transfer-Encoding: chunked
Accept-Ranges: bytes
X-XSS-Protection: 0
Expires: Tue, 03 Dec 2019 05:47:42 GMT

GET
H/1.1 200
OK iam.js Show response
script.ioam.de 34 KB
11 KB 43ms
13ms Script
application/javascript 91.215.100.39
INFONLINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://script.ioam.de/iam.js
Requested by: Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.215.100.39 , Germany, ASN43407 (INFONLINE-AS, NL),
Reverse DNS: script4.ioam.de
Software: nginx / BLACKBIRD-SRC v0.10 0019
Resource Hash: e4d2fd3ddd5af75287dcce44fe1eb8230c414b64782bcd6061e88abf19ca6462

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Dec 2019 05:47:42 GMT
Server: nginx
X-Powered-By: BLACKBIRD-SRC v0.10 0019
Vary: Accept-Encoding
P3P: policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Cache-Control: private, max-age=7200, pre-check=7200
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: application/javascript
Expires: Tue, 03 Dec 2019 07:47:42 GMT

GET
H/1.1 200
OK tsc.php?200=MzEyNjA5NTQz&21=MTg1LjE1MS41OC4xMTU=&681=MTU3NTM1MjA2MjJkOTVmNzZiMTAwMTgwZjJlN2U0MjhkMmUyYWQ2Mzlm&crc=97a252ed07f743ffb2182ce2b7cf55d3b79d9917&cv=1 Show response
/search 0
174 B 17ms
16ms XHR
text/html 91.195.240.46
SEDO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ww1.elkodailyfreepress.com/search/tsc.php?200=MzEyNjA5NTQz&21=MTg1LjE1MS41OC4xMTU=&681=MTU3NTM1MjA2MjJkOTVmNzZiMTAwMTgwZjJlN2U0MjhkMmUyYWQ2Mzlm&crc=97a252ed07f743ffb2182ce2b7cf55d3b79d9917&cv=1
Requested by: Host: img.sedoparking.com
URL: http://img.sedoparking.com/js/jquery-1.11.3.custom.min.js
Protocol: HTTP/1.1
Server: 91.195.240.46 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software: NginX /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: http://ww1.elkodailyfreepress.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
X-Cache-Miss-From: parking-8bb88b6c8-gmnpg
Server: NginX
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 identitystatus?offerIdentifier=sedo&siteIdentifier=322&sampleType=in&pixelType=CP&isFadeoutFlash=true&isFadeoutFrame=true&isFadeoutForm=true&positionTop=10&positionLeft=100&zIndex=1100000&c=0.48684...
irqs.ioam.de 25 B
213 B 30ms
10ms XHR
application/vnd.api+json 193.46.63.75
INFONLINE-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://irqs.ioam.de/identitystatus?offerIdentifier=sedo&siteIdentifier=322&sampleType=in&pixelType=CP&isFadeoutFlash=true&isFadeoutFrame=true&isFadeoutForm=true&positionTop=10&positionLeft=100&zIndex=1100000&c=0.48684025251626983

Requested by

Host: script.ioam.de
URL: https://script.ioam.de/iam.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

193.46.63.75 Alfter, Germany, ASN43407 (INFONLINE-AS, NL),

Reverse DNS

irqs.ioam.de

Software

nginx /

Resource Hash

9efa53ec1a261a8576a66a71befaf9d03c1a108aac36271f4599b87597b8a71e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ww1.elkodailyfreepress.com/
Origin: http://ww1.elkodailyfreepress.com

Response headers

date: Tue, 03 Dec 2019 05:47:42 GMT
server: nginx
status: 200
vary: Origin
content-type: application/vnd.api+json
access-control-allow-origin: http://ww1.elkodailyfreepress.com
access-control-allow-credentials: true
strict-transport-security: max-age=15768000

GET
H/1.1

200
OK

tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=sxnjyl&i3=nocookie&n... Show response
de.ioam.de
Redirect Chain

https://de.ioam.de/tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=s...
https://de.ioam.de/tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=s...

0
694 B

14ms
13ms

Script
application/x-javascript

91.215.103.65
INFONLINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://de.ioam.de/tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=sxnjyl&i3=nocookie&n1=1&dntt=0&lt=1575352062141&ev=&cs=rfb02k&mo=1&sr=71
Requested by: Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.215.103.65 , Germany, ASN43407 (INFONLINE-AS, NL),
Reverse DNS: de3.ioam.de
Software: nginx / BLACKBIRD-RCV v1.05.0 0034
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Server: nginx
X-Powered-By: BLACKBIRD-RCV v1.05.0 0034
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
P3P: policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies

Redirect headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
X-Powered-By: BLACKBIRD-RCV v1.05.0 0034
Transfer-Encoding: chunked
P3P: policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Connection: keep-alive
Pragma: no-cache
Last-Modified: Tue, 03 Dec 2019 05:47:42 GMT
Server: nginx
Location: /tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=sxnjyl&i3=nocookie&n1=1&dntt=0&lt=1575352062141&ev=&cs=rfb02k&mo=1&sr=71
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies
Expires: Mon, 03 Dec 2018 05:47:42 GMT

GET
H2 200 ads?r=m&client=dp-sedo92_3ph&channel=exp-0051%2Cauxa-control-1%2C563161&hl=de&adtest=off&adsafe=low&type=3&swp=as-drid-2430676874350336&uiopt=false&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C1730000... Show response
www.google.com/dp 0
0 75ms
75ms Document
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/dp/ads?r=m&client=dp-sedo92_3ph&channel=exp-0051%2Cauxa-control-1%2C563161&hl=de&adtest=off&adsafe=low&type=3&swp=as-drid-2430676874350336&uiopt=false&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17300002%2C17300107&format=r10%7Cs&num=0&output=afd_ads&domain_name=ww1.elkodailyfreepress.com&v=3&preload=true&adext=as1%2Csr1&bsl=8&u_his=2&u_tz=60&dt=1575352062229&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=102&frm=0&uio=sl1sr1-ff3fa2st22sa14lt40-ff2&jsv=16577&rurl=http%3A%2F%2Fww1.elkodailyfreepress.com%2F

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

gws /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /dp/ads?r=m&client=dp-sedo92_3ph&channel=exp-0051%2Cauxa-control-1%2C563161&hl=de&adtest=off&adsafe=low&type=3&swp=as-drid-2430676874350336&uiopt=false&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17300002%2C17300107&format=r10%7Cs&num=0&output=afd_ads&domain_name=ww1.elkodailyfreepress.com&v=3&preload=true&adext=as1%2Csr1&bsl=8&u_his=2&u_tz=60&dt=1575352062229&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=102&frm=0&uio=sl1sr1-ff3fa2st22sa14lt40-ff2&jsv=16577&rurl=http%3A%2F%2Fww1.elkodailyfreepress.com%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: http://ww1.elkodailyfreepress.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ww1.elkodailyfreepress.com/

Response headers

status: 200
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Tue, 03 Dec 2019 05:47:42 GMT
expires: Tue, 03 Dec 2019 05:47:42 GMT
cache-control: private, max-age=3600
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 6375
x-xss-protection: 0
set-cookie: 1P_JAR=2019-12-03-05; expires=Thu, 02-Jan-2020 05:47:42 GMT; path=/; domain=.google.com; SameSite=none NID=192=AjuM7lY1h666hhkclMiilRtFv2dN681W_0DF7m6zGdmh_xric9FLpddMWHJ15FI4TE3A9ZI-vWqFa2kuNeO-duxBUj8lwPF2k04CPzFUyGVlCal2866nIUzPiiWpcj1fUK7NTvrBwT_tPEs21PtLAtR0vjl8oZRKpVeLVBCu3Ao; expires=Wed, 03-Jun-2020 05:47:42 GMT; path=/; domain=.google.com; HttpOnly CONSENT=WP.281032; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK caf.gif?ts=1575352062205&rid=7866008
www.gstatic.com/domainads/tracking 43 B
380 B 46ms
40ms Image
image/gif 2a00:1450:4001:81f::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.gstatic.com/domainads/tracking/caf.gif?ts=1575352062205&rid=7866008

Requested by

Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 05:47:42 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 22 Oct 2019 18:15:00 GMT
Server: sffe
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate
Accept-Ranges: bytes
Content-Length: 43
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK logo_2016_bbbbbb.svg
img.sedoparking.com/templates/brick_gfx/common 4 KB
3 KB 16ms
15ms Image
image/svg+xml 205.234.175.175
CacheNetworks

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.sedoparking.com/templates/brick_gfx/common/logo_2016_bbbbbb.svg
Requested by: Host: ww1.elkodailyfreepress.com
URL: http://ww1.elkodailyfreepress.com/
Protocol: HTTP/1.1
Server: 205.234.175.175 , United States, ASN30081 (CACHENETWORKS - CacheNetworks, Inc., US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 52f5919c4897d366761c7f7ae51bfb06e517a082153196fe0375482da57e441b

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 05:47:42 GMT
Content-Encoding: gzip
X-CF3: H
CF4ttl: 31536000.000
X-CF1: 11696:fC.fra2:cf:cacheN.fra2-01:H
Connection: keep-alive
Content-Length: 2072
x-cf-tsc: 1575157128
Access-Control-Allow-Origin: *
X-CF2: H
Last-Modified: Thu, 05 Sep 2019 07:18:32 GMT
Server: CFS 0215
X-CFF: B
Vary: Accept-Encoding
Content-Type: image/svg+xml
X-CFHash: "adc1ae99a6c288fdf2e52bbf62e06aed"
Cache-Control: max-age=604800
CF4Age: 664
Accept-Ranges: bytes
Expires: Tue, 10 Dec 2019 05:47:42 GMT

GET
H2 200 iframe.html Show response
www.google.com/afs/ads/i 0
0 39ms
39ms Document
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/afs/ads/i/iframe.html

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /afs/ads/i/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: http://ww1.elkodailyfreepress.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ww1.elkodailyfreepress.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-2LsMerP0ES1gUYAmbUp78Q' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-length: 619
date: Tue, 03 Dec 2019 05:47:42 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 18:30:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 iframe.html Show response
www.google.com/afs/ads/i 0
0 38ms
38ms Document
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/afs/ads/i/iframe.html

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /afs/ads/i/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: http://ww1.elkodailyfreepress.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ww1.elkodailyfreepress.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-hLDoYGb1xMUBqt7cVvVtFw' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-length: 619
date: Tue, 03 Dec 2019 05:47:42 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 18:30:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204?client=dp-sedo92_3ph&output=uds_ads_only&zx=5v3wy1fvjcgw&aqid=_vblXdKfEdjH3wPL_azYBA&pbt=bo&adbn=slave-0-1&uio=%7C24%7C8%7C%7C10%7C%7C%2F%2Fafs.googleusercontent.com%2Fdp-sedo%2Fbullet_just... Show response
www.google.com/afs 0
164 B 24ms
24ms Image
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=dp-sedo92_3ph&output=uds_ads_only&zx=5v3wy1fvjcgw&aqid=_vblXdKfEdjH3wPL_azYBA&pbt=bo&adbn=slave-0-1&uio=|24|8||10||%2F%2Fafs.googleusercontent.com%2Fdp-sedo%2Fbullet_justads.gif|20||||10||||||||%23d6d6d6|transparent||||||%232f4878|2|||||tahoma%2Cverdana%2Ctrebuchet%20ms|arial||14||||22||||||40|||||||||||%23888888|||true|true|true|20||rb-default||relatedsearch|||

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 05:47:42 GMT
server: gws
x-frame-options: SAMEORIGIN
content-type: text/html; charset=ISO-8859-1
status: 204
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 gen_204?client=dp-sedo92_3ph&output=uds_ads_only&zx=f4c2u7arg09t&aqid=_vblXdKfEdjH3wPL_azYBA&pbt=bo&adbn=slave-1-1&uio=%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7Ctransparent%7C%7C%... Show response
www.google.com/afs 0
141 B 26ms
26ms Image
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=dp-sedo92_3ph&output=uds_ads_only&zx=f4c2u7arg09t&aqid=_vblXdKfEdjH3wPL_azYBA&pbt=bo&adbn=slave-1-1&uio=||||||||||||||||||||transparent||||||||||||arial|||||||||||||||||||||||||||true|true||||sb-default||searchbox|||

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://ww1.elkodailyfreepress.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 05:47:42 GMT
server: gws
x-frame-options: SAMEORIGIN
content-type: text/html; charset=ISO-8859-1
status: 204
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 0

http://elkodailyfreepress.com/
http://ww1.elkodailyfreepress.com/

Request 6

https://de.ioam.de/tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=s...
https://de.ioam.de/tx.io?st=sedo&cp=322&sv=in&pt=CP&ps=lin&er=N22&rf=&r2=&ur=ww1.elkodailyfreepress.com&xy=1600x1200x24&lo=DE%2FHessen&cb=0019&i2=001928a14a56f063a5de5f6fe&ep=1597003507&vr=415&id=s...

67 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-19 06:19:04	Name: 1P_JAR Value: 2019-12-03-05
.google.com/	1970-01-25 20:05:16	Name: CONSENT Value: WP.281032
.google.com/	1970-01-19 09:59:23	Name: NID Value: 192=AjuM7lY1h666hhkclMiilRtFv2dN681W_0DF7m6zGdmh_xric9FLpddMWHJ15FI4TE3A9ZI-vWqFa2kuNeO-duxBUj8lwPF2k04CPzFUyGVlCal2866nIUzPiiWpcj1fUK7NTvrBwT_tPEs21PtLAtR0vjl8oZRKpVeLVBCu3Ao
ww1.elkodailyfreepress.com/	1970-01-19 05:37:18	Name: POPUPCHECK Value: 1575438462140
.elkodailyfreepress.com/	1970-01-19 06:17:13	Name: tu Value: 9d5bbf9720a19fe0f392e1409225ca07

Indicators of compromise (IoCs)

This is a term in the security industry to describe indicators around an attack. This includes IPs, hashes, domains, etc.

de.ioam.de
elkodailyfreepress.com
img.sedoparking.com
irqs.ioam.de
script.ioam.de
ww1.elkodailyfreepress.com
www.google.com
www.gstatic.com


103.224.212.222
193.46.63.75
205.234.175.175
2a00:1450:4001:800::2004
2a00:1450:4001:818::2004
2a00:1450:4001:81f::2003
91.195.240.46
91.215.100.39
91.215.103.65

52f5919c4897d366761c7f7ae51bfb06e517a082153196fe0375482da57e441b
59e93f2b5245909091d1ddcc47dbfca578c468c6bd55b2e3965f7fbc693e3b19
80cd910ba6e1d8237fc9652ada81f644cc3d5f145de1c251e49b95b4200ea08b
855f296903dc76c25d8b3eac33dd7e7742abf28d121d9f3f67d5d337aaeb18e7
9efa53ec1a261a8576a66a71befaf9d03c1a108aac36271f4599b87597b8a71e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d2fd3ddd5af75287dcce44fe1eb8230c414b64782bcd6061e88abf19ca6462
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

ww1.elkodailyfreepress.com 91.195.240.46

Summary

Verdict: Unknown

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Stats

0 Requests

0 Ad-blocked

0 Malicious

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

0 IPs

0 Countries

0 kBTransfer

0 kBSize

0 Cookies

3 Outgoing links

14 HTTP transactions Everything HTML Script AJAX CSS Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect requests

67 JavaScript Global Variables

5 Cookies

Indicators of compromise (IoCs)

ww1.elkodailyfreepress.com
91.195.240.46

Screenshot
Live screenshot

Full Image

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions