![](/screenshots/8d4d320c-fbf0-42f6-9ca3-e0cc4bd51543.png)
w1.buysub.com
Open in
urlscan Pro
198.176.166.187
Public Scan
Effective URL: https://w1.buysub.com/pubs/YM/FAM/under_construction.jsp?cds_mag_code=FAM&cds_page_id=257277
Submission: On February 07 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 10th 2023. Valid for: a year.
This is the only time w1.buysub.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 104.18.43.192 104.18.43.192 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 34.224.161.167 34.224.161.167 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 198.176.166.187 198.176.166.187 | 397973 (CDS-GLOBA...) (CDS-GLOBAL-01) | |
2 | 63.148.46.76 63.148.46.76 | 53316 (ASN-CHEET...) (ASN-CHEETA-MAIL) | |
4 | 2 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-161-167.compute-1.amazonaws.com
ftm.pcdfusion.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
eccmp.com
sts.eccmp.com — Cisco Umbrella Rank: 24401 |
8 KB |
2 |
buysub.com
w1.buysub.com — Cisco Umbrella Rank: 380094 |
402 KB |
2 |
familytreemagazine.com
2 redirects
enews.familytreemagazine.com |
905 B |
1 |
pcdfusion.com
1 redirects
ftm.pcdfusion.com |
299 B |
4 | 4 |
Domain | Requested by | |
---|---|---|
2 | sts.eccmp.com |
w1.buysub.com
sts.eccmp.com |
2 | w1.buysub.com |
w1.buysub.com
|
2 | enews.familytreemagazine.com | 2 redirects |
1 | ftm.pcdfusion.com | 1 redirects |
4 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.buysub.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-07-10 - 2024-08-09 |
a year | crt.sh |
*.eccmp.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-05-24 - 2024-06-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://w1.buysub.com/pubs/YM/FAM/under_construction.jsp?cds_mag_code=FAM&cds_page_id=257277
Frame ID: B167167AAE86B3C95902D3E0C40CC346
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/8d4d320c-fbf0-42f6-9ca3-e0cc4bd51543.png)
Page Title
Family Tree Magazine | Under ConstructionPage URL History Show full URLs
-
http://enews.familytreemagazine.com/q/hzFSF8aBaY0XiegIkl17rKw-oLr5FqNa4q_ZcOJYmVydEBiYWVydC5uZXTDiAtnxDIRmvf466L...
HTTP 301
https://enews.familytreemagazine.com/q/hzFSF8aBaY0XiegIkl17rKw-oLr5FqNa4q_ZcOJYmVydEBiYWVydC5uZXTDiAtnxDIRmvf466L... HTTP 302
https://ftm.pcdfusion.com/pcd/Order?iKey=C**W31&trk_msg=F30CKV5MQCI458TLDLE36OD4BC&trk_contact=PLDRB3G... HTTP 302
https://w1.buysub.com/pubs/YM/FAM/under_construction.jsp?cds_mag_code=FAM&cds_page_id=257277 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://enews.familytreemagazine.com/q/hzFSF8aBaY0XiegIkl17rKw-oLr5FqNa4q_ZcOJYmVydEBiYWVydC5uZXTDiAtnxDIRmvf466L5_NgwYyM1Ld9QA
HTTP 301
https://enews.familytreemagazine.com/q/hzFSF8aBaY0XiegIkl17rKw-oLr5FqNa4q_ZcOJYmVydEBiYWVydC5uZXTDiAtnxDIRmvf466L5_NgwYyM1Ld9QA HTTP 302
https://ftm.pcdfusion.com/pcd/Order?iKey=C**W31&trk_msg=F30CKV5MQCI458TLDLE36OD4BC&trk_contact=PLDRB3GKK1A34BPJNR5H3VVF3G&trk_module=reg&trk_sid=AOVV7PH0P1EATUF7KSF6NRE3OC&trk_link=SI34OSOH56FKVFKERV153UDUNC&utm_source=Listrak&utm_medium=Email&utm_term=Subscribe+to+Family+Tree+Magazine&utm_campaign=FTM+Re-Engagement&utm_content=Re-Engagement+2 HTTP 302
https://w1.buysub.com/pubs/YM/FAM/under_construction.jsp?cds_mag_code=FAM&cds_page_id=257277 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
under_construction.jsp
w1.buysub.com/pubs/YM/FAM/ Redirect Chain
|
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FAM_logo.jpg
w1.buysub.com/pubs/YM/FAM/images/ |
399 KB 399 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
conversen-SDK.js
sts.eccmp.com/sts/scripts/ |
15 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1188
sts.eccmp.com/wts/WebEvent/GetCookieExpiry/ |
35 B 426 B |
XHR
text/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| content function| cnvAsyncInit object| Cnv object| stack object| data3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ftm.pcdfusion.com/ | Name: ProdSession Value: zj3a345vaqy0nzgq0w1oeer1 |
|
w1.buysub.com/ | Name: JSESSIONID Value: 00009CY-eMvhTyYxYjwE7WCBcsi:1dgnqdgcu |
|
.buysub.com/ | Name: xyz_cr_1188_et_100 Value: =&cr=1188&et=100 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'none' ; |
Strict-Transport-Security | max-age=31536000 ; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 1; mode = block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
enews.familytreemagazine.com
ftm.pcdfusion.com
sts.eccmp.com
w1.buysub.com
104.18.43.192
198.176.166.187
34.224.161.167
63.148.46.76
5e3701267bcdd8e89b9be608460a1eb65a1fd001dbd6fe8e237319a5566ca0fd
61339a21fa71d17d0dfebceba08dc76ce605e73f65a88438397483478d953aae
76f5dd748611c8ca536ab75be3904944a33cdec07d2395a1ebc63501c0674012
b0a58fb8c12ffbb8b641ae4316da491e42969f9fe904a0dc35f1203cbb76a444