urlscan.io logo urlscan.io
SecurityTrails logo

alpha-news.org Open in urlscan Pro
3.223.219.251  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://789ff.fr.am/red.php
Effective URL: https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=436454...
Submission: On November 29 via manual from HK — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 7 HTTP transactions. The main IP is 3.223.219.251, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is alpha-news.org.
TLS certificate: Issued by R3 on October 23rd 2021. Valid for: 3 months.
This is the only time alpha-news.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 212.107.18.203 47583 (AS-HOSTINGER)
1 1 18.66.122.63 16509 (AMAZON-02)
1 35.190.38.40 15169 (GOOGLE)
2 2 35.201.117.228 15169 (GOOGLE)
1 3.223.219.251 14618 (AMAZON-AES)
2 104.22.64.104 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
7 7
1    212.107.18.203 (Germany)

ASN47583 (AS-HOSTINGER, CY)
789ff.fr.am
1    18.66.122.63 (United States)

ASN16509 (AMAZON-02, US)
elevisions.biz
1    35.190.38.40 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 40.38.190.35.bc.googleusercontent.com
www.adspredictiv.com
2    35.201.117.228 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 228.117.201.35.bc.googleusercontent.com
dexchangeinc.com
1    3.223.219.251 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-219-251.compute-1.amazonaws.com
alpha-news.org
2    104.22.64.104 (None, )

ASN13335 (CLOUDFLARENET, US)
feed.r-tb.com
t.r-tb.com
1    2606:4700:20::681a:6e4 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.ocmhood.com
1    2606:4700:20::ac43:4809 (United States)

ASN13335 (CLOUDFLARENET, US)
t.ocmhood.com
Domain Requested by
2 dexchangeinc.com 2 redirects
1 t.r-tb.com alpha-news.org
1 t.ocmhood.com cdn.ocmhood.com
1 cdn.ocmhood.com alpha-news.org
1 feed.r-tb.com alpha-news.org
1 alpha-news.org www.adspredictiv.com
1 www.adspredictiv.com 789ff.fr.am
1 elevisions.biz 1 redirects
1 789ff.fr.am
7 9

This site contains no links.

Subject Issuer Validity Valid
adspredictiv.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-15 -
2022-07-04		 2 years crt.sh
alpha-news.org
R3		 2021-10-23 -
2022-01-21		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-11 -
2022-06-10		 a year crt.sh
ocmhood.com
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
Frame ID: 71AB53BD34BF8927F8AE32BB9B3E22EC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Click Allow if you are not a robot

Page URL History Show full URLs

  1. http://789ff.fr.am/red.php Page URL
  2. https://elevisions.biz/redirect?tid=936185 HTTP 302
    https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185 Page URL
  3. https://dexchangeinc.com/jump/next.php?stamat=m%257CdndhO6djaQdH8AH0dEdHP3xP.4d0%252C7H0PozvLiGV-YkDx... HTTP 302
    https://dexchangeinc.com/script/i.php?stamat=m%257C%252C%252CwjZjdiNSoGU3B_-GH0dEdHP3xP.d70%252CcbGDh... HTTP 302
    https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489... Page URL

Page Statistics

7
Requests

86 %
HTTPS

25 %
IPv6

7
Domains

9
Subdomains

7
IPs

3
Countries

63 kB
Transfer

76 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://789ff.fr.am/red.php Page URL
  2. https://elevisions.biz/redirect?tid=936185 HTTP 302
    https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185 Page URL
  3. https://dexchangeinc.com/jump/next.php?stamat=m%257CdndhO6djaQdH8AH0dEdHP3xP.4d0%252C7H0PozvLiGV-YkDx825CHmRBJzVyFx8xR8AX9M_r4aRNs9UKPv1pLV9WYheRhfJnlw3YxmROpJW85UDjrik6JWwz7X1bbCWBRFfIzJOac50KuxvPDq5rSPf-fbFifE73&cbur=0.4060779992595649&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref=http%3A%2F%2F789ff.fr.am%2F HTTP 302
    https://dexchangeinc.com/script/i.php?stamat=m%257C%252C%252CwjZjdiNSoGU3B_-GH0dEdHP3xP.d70%252CcbGDhV9zheVaCsX0oK4DxwElkJHlM74ua-f33r5KS59FEAZAk9xi-vUDG3ftOmubSDFH6wmPg7teAmgC6iZExywpHBIkNykcBZ53LqGxfVYYlt-jlYcSapIW_PnzYOkcuzRFcQvHT5G0-k2ianpEjaf6iXcC7lQviykZm3p92c49iFrgXBjK0VISdr7dX-kg_DjHAcmzFSZjf-0lttlEGQze9TJ81kYrz7_6L97iojoNcTibEFvhXdq7jr2WJlTnpy2C296gUXLMaktPYAmDyqjsAUHHBHW5AlUZEaEHQtQqIa45isrBmZKiq_h12uE8vR9l3u6q7zHRvlqbYvvTrt4SDODN4Oe9f4BThggaVRXz8RCNLeWOcf9uXh1wAC3zeprQMVu5SCUoJQwVTJyRbG0RNEtBUq5SloZY4VfWuVvZmSwnw3EKaDVTDcN6tCSrVzFuvdWBYH2dYpfX-a-Jyb5RLDuf5X5lVWPJo-MYB1d3hE48QZF86vDrlRfYkZ_tdG0JOUsnrJqJoYqLqVcMWiSI4azmW560MspJLBBBhNo4RefMocv2Sl30kHuj3biG HTTP 302
    https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://elevisions.biz/redirect?tid=936185 HTTP 302
  • https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
red.php
789ff.fr.am/ 		474 B
563 B 		Document
General
Check archive.org
Download Go to
Full URL
http://789ff.fr.am/red.php
Protocol
HTTP/1.1
Server
212.107.18.203 , Germany, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.11
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
x-powered-by
PHP/7.4.11
content-type
text/html; charset=UTF-8
content-length
298
content-encoding
gzip
vary
Accept-Encoding
date
Mon, 29 Nov 2021 13:31:08 GMT
server
LiteSpeed
next.php
www.adspredictiv.com/jump/
Redirect Chain
  • https://elevisions.biz/redirect?tid=936185
  • https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185
7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185
Requested by
Host: 789ff.fr.am
URL: http://789ff.fr.am/red.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
40.38.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
adf32da22a8052da9b9e50b3b6188c57b41de7d7fee0b8f295c1eff0604be199

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9
Referer
http://789ff.fr.am/red.php

Response headers

server
openresty
date
Mon, 29 Nov 2021 13:31:09 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

content-type
text/plain
content-length
0
location
https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185
date
Mon, 29 Nov 2021 13:31:09 GMT
server
openresty/1.17.8.2
cache-control
no-store, no-cache, must-revalidate, no-transform
pragma
no-cache
p3p
CP="NID DSP ALL COR"
x-cache
Miss from cloudfront
via
1.1 375431e28d82888f474ac3665a4ceb67.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P2
x-amz-cf-id
QBncD-bQZkYzPLxEqG0R7SMNMafp2fsxw4TtY5PkH0i1ndl-_PKabQ==
Primary Request /
alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/
Redirect Chain
  • https://dexchangeinc.com/jump/next.php?stamat=m%257CdndhO6djaQdH8AH0dEdHP3xP.4d0%252C7H0PozvLiGV-YkDx825CHmRBJzVyFx8xR8AX9M_r4aRNs9UKPv1pLV9WYheRhfJnlw3YxmROpJW85UDjrik6JWwz7X1bbCWBRFfIzJOac50KuxvP...
  • https://dexchangeinc.com/script/i.php?stamat=m%257C%252C%252CwjZjdiNSoGU3B_-GH0dEdHP3xP.d70%252CcbGDhV9zheVaCsX0oK4DxwElkJHlM74ua-f33r5KS59FEAZAk9xi-vUDG3ftOmubSDFH6wmPg7teAmgC6iZExywpHBIkNykcBZ53L...
  • https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
54 KB
54 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
Requested by
Host: www.adspredictiv.com
URL: https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.219.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-219-251.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5a64fb6f359ed11e9edcf3d088873812561bff51e55125b414eafad8cb5976e4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.adspredictiv.com/jump/next.php?r=4364547&pub_clickid=1108884800909068475&sub1=936185

Response headers

Date
Mon, 29 Nov 2021 13:31:10 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Origin
*
Server
nginx

Redirect headers

server
openresty
date
Mon, 29 Nov 2021 13:31:09 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
location
https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
referrer-policy
no-referrer
via
1.1 google
alt-svc
clear
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
AFU1kAAPatM
feed.r-tb.com/v1/native/ 		694 B
639 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://feed.r-tb.com/v1/native/AFU1kAAPatM?subid=wba_w10_0807_neymar4&uid=8a853a19-76bf-4dc6-9baa-fa78729aef61&kw=download%20install
Requested by
Host: alpha-news.org
URL: https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.64.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a791d90d32612ba2b2f924ace83b90667059bda930a29dbfbb110640d8386d8b

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://alpha-news.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 13:31:10 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
cf-ray
6b5c31df2c544075-CDG
hood.js
cdn.ocmhood.com/sdk/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ocmhood.com/sdk/hood.js?hf=Hood
Requested by
Host: alpha-news.org
URL: https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4229280f8c4cc467dddbab3f2230f827f3755c90f6df84324b9b80d0887cbe

Request headers

Referer
https://alpha-news.org/
Origin
https://alpha-news.org
Accept-Language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 13:31:10 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4316
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
service-worker-allowed
/
last-modified
Fri, 01 Oct 2021 12:49:39 GMT
server
cloudflare
etag
W/"615703e3-103e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sV2a2P6J99c%2Fbgi89hKuktYj%2BG4XLqQQM3QxRJKQkIFknzZ3IxPxN09%2Bo3jklGONEXQKGJdzTokWJ1i9Rs7BOw8ShV9lUia%2BD5zhQeBsULQ98S9tgK6swHZrjR2jaY9rcTx1AIMSlewluQu1oA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b5c31df7e370f76-MXP
truncated
/ 		748 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/svg+xml
activity
t.ocmhood.com/v2/ 		0
562 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://t.ocmhood.com/v2/activity
Requested by
Host: cdn.ocmhood.com
URL: https://cdn.ocmhood.com/sdk/hood.js?hf=Hood
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4809 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://alpha-news.org/
Accept-Language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 29 Nov 2021 13:31:10 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I8DFhVCYWeZf0kRCfEt1BaWfTee%2F0EKx4FW5rkMiWm823ipE9m7NFo8mRSBxII7gf4XtRj384dRjk3pSq%2FbiKPwLtKXYM3t4uAgfaPeU%2FK8dgYYjVX9w6E57OQsSFaBrGFibLAMoU2K29Ms%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
no-cache
cf-ray
6b5c31e0acac374a-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
imp
t.r-tb.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://t.r-tb.com/imp?l2=YSTeczwDAiFkWBsLthEFfefcaqKfXlK62iKi4ZmdI4M58wvQjjrzrllzhpPInORsKI2P1bmHw4ZGOOMbth1sj2PcwnpC8ZgOvYaDW_wYTG8x6c1NnhVmv4OpkZhsL9gmLBAovOtryJvMvPeFlOlYGCzEQxJlOQ0yQh1nX3youasjsEp86RFJ5xNFJeIgdxtZ1Ge4ATXTSRVg_uAt6s7cCw
Requested by
Host: alpha-news.org
URL: https://alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ/?clck=16381926690628673732104489492132241&sid=4364547-3321062802-0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.64.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://alpha-news.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 29 Nov 2021 13:31:10 GMT
cache-control
no-cache
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6b5c31e09fae4075-CDG
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler string| qs string| fallback_url object| ad number| cpc function| popme function| pbcid function| finalRedirect function| uuidv4 function| fetchAd function| goNextUrl function| goNext function| goNextWithUserGesture function| isPushApiSupported function| goToRedirectBack function| goToRedirectBlock function| goToRedirectonAllow function| goToRedirectSmart2 function| Hood function| before_redirect_block object| isSamsungBrowser

2 Cookies

Domain/Path Name / Value
alpha-news.org/pRWdftUYUV7WwEiL_QI8fNrFM7dUutzLcy3hJeiJmSQ Name: session
Value: SM7gI-_cGc58jl3-66rwcVQiveacK0hI
elevisions.biz/ Name: csu
Value: cbcbb554-44ce-4b4e-8231-b27552b55893