urlscan.io logo urlscan.io
SecurityTrails logo

workingupdate.bestplaceforgetcontentfree.icu Open in urlscan Pro
212.83.134.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://eathlink.net/
Effective URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&...
Submission: On December 20 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 10 domains to perform 14 HTTP transactions. The main IP is 212.83.134.40, located in France and belongs to AS12876, FR. The main domain is workingupdate.bestplaceforgetcontentfree.icu.
This is the only time workingupdate.bestplaceforgetcontentfree.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple Software Update (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 192.161.187.200 8100 (ASN-QUADR...)
1 1 85.159.233.59 43350 (NFORCE)
1 2 209.15.13.136 13768 (COGECO-PEER1)
2 18.232.41.86 14618 (AMAZON-AES)
1 18.184.38.55 16509 (AMAZON-02)
1 18.195.174.160 16509 (AMAZON-02)
2 2 195.154.41.240 12876 (AS12876)
1 1 163.172.125.151 12876 (AS12876)
1 212.83.134.40 12876 (AS12876)
8 2600:9000:20b... 16509 (AMAZON-02)
14 6
2    192.161.187.200 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US)
PTR: 192.161.187.200.static.quadranet.com
eathlink.net
www.eathlink.net
1    85.159.233.59 (Netherlands)

ASN43350 (NFORCE, NL)
eartlink.net
2    209.15.13.136 (Atlanta, United States)

ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA)
dprtb.com
2    18.232.41.86 (Cambridge, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-232-41-86.compute-1.amazonaws.com
use.xanthos-alf.com
1    18.184.38.55 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
wait.contenthostload.com
1    18.195.174.160 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
pereams-pubstees.com
2    195.154.41.240 (France)

ASN12876 (AS12876, FR)
PTR: 195-154-41-240.rev.poneytelecom.eu
redirect8.admedit.net
1    163.172.125.151 (United Kingdom)

ASN12876 (AS12876, FR)
PTR: 163-172-125-151.rev.poneytelecom.eu
www.getgreatandsecurelinks.club
1    212.83.134.40 (France)

ASN12876 (AS12876, FR)
PTR: 212-83-134-40.rev.poneytelecom.eu
workingupdate.bestplaceforgetcontentfree.icu
8    2600:9000:20bb:1e00:0:1c7c:cc80:21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
d3pkjdk5khxwdu.cloudfront.net
Domain Requested by
8 d3pkjdk5khxwdu.cloudfront.net workingupdate.bestplaceforgetcontentfree.icu
2 redirect8.admedit.net 2 redirects
2 use.xanthos-alf.com dprtb.com
use.xanthos-alf.com
2 dprtb.com 1 redirects
1 workingupdate.bestplaceforgetcontentfree.icu
1 www.getgreatandsecurelinks.club 1 redirects
1 pereams-pubstees.com
1 wait.contenthostload.com use.xanthos-alf.com
1 eartlink.net 1 redirects
1 www.eathlink.net 1 redirects
1 eathlink.net 1 redirects
14 11

This site contains no links.

Subject Issuer Validity Valid
*.cloudfront.net
DigiCert Global CA G2		 2018-10-08 -
2019-10-09		 a year crt.sh

This page contains 1 frames:

Primary Page: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Frame ID: 8972CE72A509B36333ACB4C7889B34AD
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://eathlink.net/ HTTP 301
    http://www.eathlink.net/ HTTP 301
    http://eartlink.net/ HTTP 302
    http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduT... Page URL
  2. http://dprtb.com/Redirect/ HTTP 302
    http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8... Page URL
  3. http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth... Page URL
  4. http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadow... Page URL
  5. http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz... Page URL
  6. https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w3MEHSQS4R74AC2J1P44HRK4&ptrack=950d4c9... HTTP 302
    https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew... HTTP 302
    http://www.getgreatandsecurelinks.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w3MEHSQS4R74AC2J1P44... HTTP 302
    http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElF... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Page Statistics

14
Requests

57 %
HTTPS

10 %
IPv6

10
Domains

11
Subdomains

6
IPs

4
Countries

103 kB
Transfer

135 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://eathlink.net/ HTTP 301
    http://www.eathlink.net/ HTTP 301
    http://eartlink.net/ HTTP 302
    http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b Page URL
  2. http://dprtb.com/Redirect/ HTTP 302
    http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962 Page URL
  3. http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false Page URL
  4. http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw3MEHSQS4R74AC2J1P44HRK4%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&cid=w3MEHSQS4R74AC2J1P44HRK4&rt=D Page URL
  5. http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXczTUVIU1FTNFI3NEFDMkoxUDQ0SFJLNCZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzNNRUhTUVM0Ujc0QUMySjFQNDRIUks0&ts=1545281467286&hash=07SdvAyQ299WqWjW8V-XCwHdTnB7047rh7S1Lk0h55g&rm=D Page URL
  6. https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w3MEHSQS4R74AC2J1P44HRK4&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4 HTTP 302
    https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&ctrack=w3MEHSQS4R74AC2J1P44HRK4&cmp=576&t=1545281467&rh=5&avs=avs2&utm_src=8&sids=6 HTTP 302
    http://www.getgreatandsecurelinks.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4 HTTP 302
    http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://eathlink.net/ HTTP 301
  • http://www.eathlink.net/ HTTP 301
  • http://eartlink.net/ HTTP 302
  • http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b
Request Chain 1
  • http://dprtb.com/Redirect/ HTTP 302
  • http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set click
dprtb.com/
Redirect Chain
  • http://eathlink.net/
  • http://www.eathlink.net/
  • http://eartlink.net/
  • http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM...
5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b
Protocol
HTTP/1.1
Server
209.15.13.136 Atlanta, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
ee784e6309bc4d54edb25f34d2caec8c051bb1b9018f6bdca782a1f342e16a3c

Request headers

Host
dprtb.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/8.5
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
Set-Cookie
qmTISXqgSPbQdnw=qmTISXqgSPbQdnw; path=/
X-Server
web02
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
Content-Type
Date
Thu, 20 Dec 2018 04:51:05 GMT
Content-Length
2179

Redirect headers

server
nginx
date
Thu, 20 Dec 2018 04:51:06 GMT
content-length
11
set-cookie
sid=dbe1152c-0412-11e9-88bc-8b7835cb3675; path=/; domain=eartlink.net; HttpOnly
cache-control
max-age=0, private, must-revalidate
connection
close
location
http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b
dbf527b2-0412-11e9-8be4-06bf76b5c00c
use.xanthos-alf.com/zcvisitor/
Redirect Chain
  • http://dprtb.com/Redirect/
  • http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
1008 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Requested by
Host: dprtb.com
URL: http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b
Protocol
HTTP/1.1
Server
18.232.41.86 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-232-41-86.compute-1.amazonaws.com
Software
ZeroPark-Traffic /
Resource Hash
8c93b4d9066960a01ed693c3e6f082dce5a7c568006b08198860921f390b1e81
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host
use.xanthos-alf.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b
Accept-Encoding
gzip, deflate
Origin
http://dprtb.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://dprtb.com/click?data=azhlbmtUNlZ6NjBXTDNLNWphZWNpdl9IQkIwU3QtSFpZY2I5WXlBX3dHUjdsclduTVU1SDhqR1Y2azVIcUR5dmM3T242UmxfRWFPdTBEZDFuVVplWl9FY0ZNVUFwX0hJaC12c3NWeHNHVDlKR0RrOUNfMk5jeEpVaDV0c1RYM0w3ZUttb0l0RkN0bG55ZXc4UzNVOHlnMg2&id=26a44eac-2df8-4e9c-a8ce-efc015182a7b

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Type
text/html;charset=UTF-8
Date
Thu, 20 Dec 2018 04:51:06 GMT
Server
ZeroPark-Traffic
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
transfer-encoding
chunked
Connection
keep-alive

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Location
http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Server
Microsoft-IIS/8.5
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
X-Server
web02
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
Content-Type
Date
Thu, 20 Dec 2018 04:51:05 GMT
Content-Length
238
zcredirect
use.xanthos-alf.com/ 		890 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Requested by
Host: use.xanthos-alf.com
URL: http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Protocol
HTTP/1.1
Server
18.232.41.86 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-18-232-41-86.compute-1.amazonaws.com
Software
ZeroPark-Traffic /
Resource Hash
220eb2222db0bb3a4e6625c854a97b873794bc20d2b87219f405b3ce0c910d73
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host
use.xanthos-alf.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://use.xanthos-alf.com/zcvisitor/dbf527b2-0412-11e9-8be4-06bf76b5c00c?campaignid=25729870-f18d-11e8-9600-0ebb138d3962

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Type
text/html;charset=UTF-8
Date
Thu, 20 Dec 2018 04:51:06 GMT
redirected
JS
Server
ZeroPark-Traffic
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Length
890
Connection
keep-alive
Cookie set zp-redirect
wait.contenthostload.com/ 		548 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw3MEHSQS4R74AC2J1P44HRK4%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&cid=w3MEHSQS4R74AC2J1P44HRK4&rt=D
Requested by
Host: use.xanthos-alf.com
URL: http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Protocol
HTTP/1.1
Server
18.184.38.55 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
548372ebf188e7bce977e64c1bc104cd971286878472a4b3d4d6bffe04c0fad7

Request headers

Host
wait.contenthostload.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://use.xanthos-alf.com/zcredirect?visitid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false

Response headers

Server
nginx
Date
Thu, 20 Dec 2018 04:51:07 GMT
Content-Type
text/html;charset=UTF-8
Content-Length
548
Connection
keep-alive
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Set-Cookie
8a613fbc-7f0f-4b03-969d-daba3b5e84ee-v4=8a613fbc-7f0f-4b03-969d-daba3b5e84ee;domain=wait.contenthostload.com;path=/;HttpOnly cc-v4=uj%2BmuRVdHvZuJMMoBpDF8QHsCKr20%2FK7h2uM%2FIeCZJt15ZMme04XMdNYZiqkGXRMWfAtQg2UfHBKb1glxHpdjKp%2BFasscKIu1jlIbly5QHqypEPdyzRD2hRR9hwqB7%2BjTh%2B91JDdthAM7sAEJMMEeA%3D%3D;Max-Age=31536000;Expires=Fri, 20-Dec-2019 04:51:07 GMT;domain=wait.contenthostload.com;path=/;HttpOnly
redirect
pereams-pubstees.com/ 		371 B
646 B 		Document
General
Check archive.org
Download Go to
Full URL
http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXczTUVIU1FTNFI3NEFDMkoxUDQ0SFJLNCZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzNNRUhTUVM0Ujc0QUMySjFQNDRIUks0&ts=1545281467286&hash=07SdvAyQ299WqWjW8V-XCwHdTnB7047rh7S1Lk0h55g&rm=D
Protocol
HTTP/1.1
Server
18.195.174.160 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e68ebba2b1099d53d298a81b679e30245ed2447d3bdfa42acee140dd028d4575

Request headers

Host
pereams-pubstees.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw3MEHSQS4R74AC2J1P44HRK4%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&cid=w3MEHSQS4R74AC2J1P44HRK4&rt=D
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://wait.contenthostload.com/zp-redirect?target=https%3A%2F%2Fredirect8.admedit.net%2Fadvertise%2F%3Fadown%3D8851%26cmp%3D576%26ctrack%3Dw3MEHSQS4R74AC2J1P44HRK4%26ptrack%3D950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&caid=8a613fbc-7f0f-4b03-969d-daba3b5e84ee&zpid=dbf527b2-0412-11e9-8be4-06bf76b5c00c&cid=w3MEHSQS4R74AC2J1P44HRK4&rt=D

Response headers

Server
nginx
Date
Thu, 20 Dec 2018 04:51:07 GMT
Content-Type
text/html;charset=UTF-8
Content-Length
371
Connection
keep-alive
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Primary Request Cookie set /
workingupdate.bestplaceforgetcontentfree.icu/
Redirect Chain
  • https://redirect8.admedit.net/advertise/?adown=8851&cmp=576&ctrack=w3MEHSQS4R74AC2J1P44HRK4&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4
  • https://redirect8.admedit.net/advertise/refine.php?adown=8851&ptrack=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&ctrack=w3MEHSQS4R74AC2J1P44HRK4&cmp=576&t=1545281467&rh=5&avs=avs2&...
  • http://www.getgreatandsecurelinks.club/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQ.&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4
  • http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48...
41 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
HTTP/1.1
Server
212.83.134.40 , France, ASN12876 (AS12876, FR),
Reverse DNS
212-83-134-40.rev.poneytelecom.eu
Software
nginx /
Resource Hash
56cbeb05e40eaf31a7bbea4d5d64ed4bb2970d53ea73c9f0c484dc672cb188e0

Request headers

Host
workingupdate.bestplaceforgetcontentfree.icu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXczTUVIU1FTNFI3NEFDMkoxUDQ0SFJLNCZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzNNRUhTUVM0Ujc0QUMySjFQNDRIUks0&ts=1545281467286&hash=07SdvAyQ299WqWjW8V-XCwHdTnB7047rh7S1Lk0h55g&rm=D
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://pereams-pubstees.com/redirect?target=BASE64aHR0cHM6Ly9yZWRpcmVjdDguYWRtZWRpdC5uZXQvYWR2ZXJ0aXNlLz9hZG93bj04ODUxJmNtcD01NzYmY3RyYWNrPXczTUVIU1FTNFI3NEFDMkoxUDQ0SFJLNCZwdHJhY2s9OTUwZDRjOTItZTQxOC00OGVlLTkyMTUtZWNlMmFlZjk2NzlldzNNRUhTUVM0Ujc0QUMySjFQNDRIUks0&ts=1545281467286&hash=07SdvAyQ299WqWjW8V-XCwHdTnB7047rh7S1Lk0h55g&rm=D

Response headers

Server
nginx
Date
Thu, 20 Dec 2018 04:51:07 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
channel=sofi2_mac_soupertrouper; expires=Thu, 20-Dec-2018 05:11:07 GMT; Max-Age=1200; path=/ dist_id=7090; expires=Thu, 20-Dec-2018 05:11:07 GMT; Max-Age=1200; path=/ lp_id=2745; expires=Thu, 20-Dec-2018 05:11:07 GMT; Max-Age=1200; path=/
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Thu, 20 Dec 2018 04:51:07 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Location
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
logobook3.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/logobook3.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6bd771653c6ed9b640ced176672d514c67342d866b2931ef541184b6aa7ba7ed

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Dec 2018 17:06:54 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 04 Jul 2018 12:40:13 GMT
server
AmazonS3
age
54616
etag
"b96a3763b6364fabd1cb58b58f6421f4"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
14117
x-amz-cf-id
iVpNo7CpwtBXHUzmwTZxp0wUupx8rbPBe8mpJc-pG3whWaNK_TDWxg==
commands_3.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/commands_3.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5377ef31bb10d31f7c6d96dd13f32bcdef03e1fb41f81f3eb3a73808d94d9842

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Dec 2018 08:09:52 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Tue, 03 Jul 2018 12:08:19 GMT
server
AmazonS3
age
108349
etag
"ccf7c636dc17d4e8adcbbf78e72e13d4"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
14740
x-amz-cf-id
j3uRrx-gROzXhLrSnvOv4TcIiLIqSrwWRVnfdHrYJ4y6VVmyTkhH7w==
flash_windows.png
d3pkjdk5khxwdu.cloudfront.net/lps/om_flash/images/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/om_flash/images/flash_windows.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a758ae0536764924b776fcfda61e99b776cc29bd0770395187f3adedadf0bc32

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 17 Oct 2018 21:34:00 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:15:26 GMT
server
AmazonS3
age
62337
etag
"1bb793fb8bd52a0d150d3821ca31e8f4"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
16970
x-amz-cf-id
OfwcA7Ori-5b3r7RIaCnyLzA-SSAY0xYlq0JXTPlxkmC4o6cL2fA0g==
logo.png
d3pkjdk5khxwdu.cloudfront.net/lps/FlashOfficial_T/images/ 		851 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/FlashOfficial_T/images/logo.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
437732c13947ebcfbc91f7a808671fbdb87f2b697cadf3833c44682e942e19e9

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 17 Oct 2018 21:34:00 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:16:44 GMT
server
AmazonS3
age
42253
etag
"c1650ca2560fae927569486121db8ec9"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
851
x-amz-cf-id
BHmb-gMa6-qKQxpkmA2BOqCuv7aI--UHLC2pEDSuOJi2xErqPocS0g==
arrow__blue.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/arrow__blue.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 15 Oct 2018 12:41:48 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:11:30 GMT
server
AmazonS3
age
74475
etag
"6d26faedbdd557f7dcd86e9060de347f"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
2266
x-amz-cf-id
YUhX6wNq2y4IHxJ7_5xhvEAofey9BZhUM84nrhrh574LJFTfLRwNDQ==
pattern__safari1.jpg
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/pattern__safari1.jpg
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Dec 2018 08:09:52 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:11:28 GMT
server
AmazonS3
age
112529
etag
"918dfef192de7b99284e969e75d6cc29"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
25293
x-amz-cf-id
y_g2x7ZpwpeFcM4_-Tm9kGijvJoNAxInWbUcldFApFTs6WKuGYFieQ==
pattern__safari-arrow.png
d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/flash_mac/images/pattern__safari-arrow.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Dec 2018 08:09:52 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:10:05 GMT
server
AmazonS3
age
108349
etag
"496171f7f5272b0c3b8ae1d526110caf"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
3478
x-amz-cf-id
A2RtFqzXnPRWTqzNu20p16Cee0Kz7rwCWL4j8dceXUy2rlMyuJngAA==
shadow.png
d3pkjdk5khxwdu.cloudfront.net/lps/newLPs/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d3pkjdk5khxwdu.cloudfront.net/lps/newLPs/shadow.png
Requested by
Host: workingupdate.bestplaceforgetcontentfree.icu
URL: http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:1e00:0:1c7c:cc80:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
25b13e2e8af4969b966c36d6700b019e506dc5151ea6d63224e8827ac318de91

Request headers

Referer
http://workingupdate.bestplaceforgetcontentfree.icu/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uRwxlqrbv5HV1Kqu6a4Qg8ZU9ElFxNyBkccMAVNbGntIQ..&cid=w3MEHSQS4R74AC2J1P44HRK4&sid=950d4c92-e418-48ee-9215-ece2aef9679ew3MEHSQS4R74AC2J1P44HRK4&v_id=oDT6Ksn_BMnYYaqnxp7Gz--D2oIlS4_x1ySgq9mJK_Y.
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Dec 2018 22:21:19 GMT
via
1.1 7483360604f484b4fd54bffc9e822f46.cloudfront.net (CloudFront)
last-modified
Wed, 30 May 2018 18:02:31 GMT
server
AmazonS3
age
23468
etag
"fdc87cbc7a3a305aae8ed3db8eee2488"
x-cache
Hit from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
10049
x-amz-cf-id
ik5kHG1wDMLOlPEbOpmxMEWXRB-GNG74mo_KM18BsHUin9WBq3d7EQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| nAgt string| browserimg number| verOffset function| dragElement function| hide_download function| showStep function| onDownloadButtonClicked object| dlobj

3 Cookies

Domain/Path Name / Value
workingupdate.bestplaceforgetcontentfree.icu/ Name: lp_id
Value: 2745
workingupdate.bestplaceforgetcontentfree.icu/ Name: dist_id
Value: 7090
workingupdate.bestplaceforgetcontentfree.icu/ Name: channel
Value: sofi2_mac_soupertrouper