news.todaysmainnews.com Open in urlscan Pro
2606:4700:30::6812:2f9c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mq5.org/3lN67j
Effective URL:
https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXL...
Submission: On March 27 via manual (March 27th 2019, 5:18:55 pm UTC) from DK

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 2606:4700:30::6812:2f9c, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is news.todaysmainnews.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 8th 2018. Valid for: a year.

This is the only time news.todaysmainnews.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	185.212.129.86 185.212.129.86	200313 (INTERNET-IT) (INTERNET-IT)
1	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1 1	18.184.38.55 18.184.38.55	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9	2606:4700:30:... 2606:4700:30::6812:2f9c	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	2606:4700::68... 2606:4700::6810:d0a5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
15	4

2 185.212.129.86 (None, ) 1 redirects

ASN200313 (INTERNET-IT, NL)
PTR: josef.bakhovsky.ptr1.ru

mq5.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.38.55 (Cambridge, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com

track.goodtohavethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:30::6812:2f9c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

news.todaysmainnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:d0a5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	todaysmainnews.com news.todaysmainnews.com	149 KB
4	onesignal.com cdn.onesignal.com onesignal.com	60 KB
2	mq5.org 1 redirects mq5.org	742 B
1	goodtohavethis.com 1 redirects track.goodtohavethis.com	1009 B
1	jquery.com code.jquery.com	30 KB
15	5

	Domain	Requested by
9	news.todaysmainnews.com	mq5.org news.todaysmainnews.com
2	onesignal.com	cdn.onesignal.com
2	cdn.onesignal.com	news.todaysmainnews.com cdn.onesignal.com
2	mq5.org	1 redirects
1	track.goodtohavethis.com	1 redirects
1	code.jquery.com	mq5.org
15	6

This site contains links to these domains. Also see Links.

Domain
track.goodtohavethis.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2018-11-08` - `2019-11-08`	a year	crt.sh
ssl473492.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-01-22` - `2019-07-31`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Frame ID: B70A131AF79C2D2F9F2F8C914CDB5554
Requests: 14 HTTP requests in this frame

Frame: https://onesignal.com/webPushAnalytics
Frame ID: 9F90F016F3156DDEC082F7DB20BED0F9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://mq5.org/3lN67j Page URL
http://mq5.org/3lN67j?redirect=true HTTP 302
https://track.goodtohavethis.com/a7a7e573-f8c4-47eb-8c2a-e78026ee6200 HTTP 302
https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZb... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

15
Requests

87 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

239 kB
Transfer

556 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://track.goodtohavethis.com/click/1
Title: BEKRÆFT OG FORTSÆT

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mq5.org/3lN67j Page URL
http://mq5.org/3lN67j?redirect=true HTTP 302
https://track.goodtohavethis.com/a7a7e573-f8c4-47eb-8c2a-e78026ee6200 HTTP 302
https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK 3lN67j Show response
mq5.org/ 230 B
458 B 114ms
75ms Document
text/html 185.212.129.86
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL: http://mq5.org/3lN67j
Protocol: HTTP/1.1
Server: 185.212.129.86 -, , ASN200313 (INTERNET-IT, NL),
Reverse DNS: josef.bakhovsky.ptr1.ru
Software: nginx/1.12.2 / Express
Resource Hash: 9395ed524dc8e35e7fadee357dccb89f2853d390702f3000cca88c4f55e68324

Request headers

Host: mq5.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 17:18:40 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 230
Connection: keep-alive
X-Powered-By: Express
ETag: W/"e6-mK6gUseP8v5or34twn6blCAkGAg"

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 44ms
19ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: mq5.org
URL: http://mq5.org/3lN67j
Protocol: HTTP/1.1
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://mq5.org/3lN67j
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 27 Mar 2019 17:18:40 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: "5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1553707120.dop011.pa1.t,1553707120.cds033.pa1.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H2

200

Primary Request / Show response
news.todaysmainnews.com/koqddk/
Redirect Chain

http://mq5.org/3lN67j?redirect=true
https://track.goodtohavethis.com/a7a7e573-f8c4-47eb-8c2a-e78026ee6200
https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUF...

7 KB
2 KB

114ms
48ms

Document
text/html

2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Requested by: Host: mq5.org
URL: http://mq5.org/3lN67j
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62a671849607c7b37dc080b9fd95cf8a85a6db8a39804f972312fbcea052b528

Request headers

:method: GET
:authority: news.todaysmainnews.com
:scheme: https
:path: /koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://mq5.org/3lN67j
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://mq5.org/3lN67j

Response headers

status: 200
date: Wed, 27 Mar 2019 17:18:40 GMT
content-type: text/html
set-cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120; expires=Thu, 26-Mar-20 17:18:40 GMT; path=/; domain=.todaysmainnews.com; HttpOnly
last-modified: Tue, 11 Dec 2018 14:27:24 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4be3065f9dbc63c7-FRA
content-encoding: br

Redirect headers

Server: nginx
Date: Wed, 27 Mar 2019 17:18:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Pragma: no-cache
Set-Cookie: a7a7e573-f8c4-47eb-8c2a-e78026ee6200-v4=a7a7e573-f8c4-47eb-8c2a-e78026ee6200;domain=track.goodtohavethis.com;path=/;HttpOnly cep-v4=WT6KlSzWNS_KSFvAzNpR6o4XXZ4Be1N6hszSDATuiKEWmV0IyDRu1Qls506Mm11LDN25mpHfI9EP9_5oaBHv0O2u5xHS7EahvVu_t0LZ_EsWoiA-xIm2GQDfkeuqStQ46sB-yODuUAd4IEVE0oZx1-i1_SNjeuj-xlfYUDKp_IrSYbrduwIBW6lCH3KjEy3mcvKksUoipA74cTOLa4nMdQ;Max-Age=86400;Expires=Thu, 28-Mar-2019 17:18:40 GMT;domain=track.goodtohavethis.com;path=/;HttpOnly

GET
H2 200 lander.min.css
news.todaysmainnews.com/koqddk/ 11 KB
3 KB 30ms
20ms Stylesheet
text/css 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/koqddk/lander.min.css
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cc73dd5ec63339df197bda69edfb7c91abf3e47e6e63bdd9dff9b8a9c38e9ef

Request headers

:path: /koqddk/lander.min.css
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4be306601e8163c7-FRA
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 17 KB
6 KB 69ms
20ms Script
application/javascript 2606:4700::6810:d0a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:d0a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50

Request headers

Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
etag: W/"a5067802576549b3e0627521f03ee508"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=43200
cf-ray: 4be3066058d4bebc-FRA
expires: Thu, 28 Mar 2019 05:18:40 GMT

GET
H2 200 product.png
news.todaysmainnews.com/koqddk/ 37 KB
37 KB 24ms
15ms Image
image/png 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://news.todaysmainnews.com/koqddk/product.png
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5dd15ee83624d9e495501e1bcceedf7eec8e9936ec9024aaef648f72699d33bc

Request headers

:path: /koqddk/product.png
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 4be306601e8463c7-FRA
content-length: 38151
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 amazon.png
news.todaysmainnews.com/koqddk/ 36 KB
36 KB 14ms
11ms Image
image/png 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://news.todaysmainnews.com/koqddk/amazon.png
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e58e2645d7ea1770f7b9c78f47f06dd8a9fc8eedc769e662e740397df8998b2

Request headers

:path: /koqddk/amazon.png
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 4be306603eb663c7-FRA
content-length: 36989
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 low.png
news.todaysmainnews.com/koqddk/ 35 KB
35 KB 13ms
10ms Image
image/png 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://news.todaysmainnews.com/koqddk/low.png
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a705dd23b75e824b4e8118a38ed5ed50e03678f72ccee1bbb9cb394f565035d8

Request headers

:path: /koqddk/low.png
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 4be306603eb763c7-FRA
content-length: 35800
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 font-awesome.min.css
news.todaysmainnews.com/koqddk/ 27 KB
6 KB 30ms
21ms Stylesheet
text/css 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/koqddk/font-awesome.min.css
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c91328144122a2b3196a7aa5379fc26e2be6015342f9fd1b40d63763b01c198a

Request headers

:path: /koqddk/font-awesome.min.css
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4be306601e8263c7-FRA
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 jquery-2.1.4.min.js Show response
news.todaysmainnews.com/koqddk/ 82 KB
28 KB 19ms
14ms Script
application/javascript 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/koqddk/jquery-2.1.4.min.js
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

:path: /koqddk/jquery-2.1.4.min.js
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4be306603eb363c7-FRA
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 script.min.js Show response
news.todaysmainnews.com/koqddk/ 3 KB
1 KB 16ms
13ms Script
application/javascript 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/koqddk/script.min.js
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69e6849c186b30870bcf3b77114ffca60a34661bd2061d3cfe8fec8da4bb1209

Request headers

:path: /koqddk/script.min.js
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/?dom=track.goodtohavethis.com&cep=zWqBS07pgkM6F3B_tvZX5-fh_yZ6OCabSZbRprGc_U8LiFAvz6PNKXLgXQ-97rYB5TTE7kSfaVaaKLyxdM9z-qDZOEWdt2LmrhjWx2jMc201tjoEXXFl5kCOuAUFJzNQ67W12SJBMuyaYVj_H4koUV_cXvKZMZLNTXX_9iVdhVYvAS08Ji5rElO5438g8cZrMbJaLSKQSNTlEe6t469YSg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 14 Nov 2018 06:25:54 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4be306603eb463c7-FRA
expires: Wed, 27 Mar 2019 21:18:40 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 212 KB
52 KB 17ms
16ms Script
application/javascript 2606:4700::6810:d0a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:d0a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b

Request headers

Referer: https://news.todaysmainnews.com/koqddk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:40 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
etag: W/"c855e8eb5fbdafddfa15bc848b662c44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=259200
cf-ray: 4be30660c96fbebc-FRA
expires: Sat, 30 Mar 2019 17:18:40 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/546d8368-1d40-49f0-87b4-27397f31cce1/ 3 KB
2 KB 477ms
464ms Script
text/javascript 2606:4700::6810:d0a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/546d8368-1d40-49f0-87b4-27397f31cce1/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:d0a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Phusion Passenger 5.3.2

Resource Hash

1f2ac9d20813beef501a2abfb14486530d96afa3bf827324e3876cc54453cc06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://news.todaysmainnews.com/koqddk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-powered-by: Phusion Passenger 5.3.2
status: 200, 200 OK
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-request-id: 5561a25a-a0a0-46f4-874b-25d651aab727
x-runtime: 0.062625
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 4be306614a70bebc-FRA
access-control-allow-headers: SDK-Version
expires: Wed, 27 Mar 2019 17:23:41 GMT

GET
H2 404 script.min.js
news.todaysmainnews.com/m3_assets/3/js/ 0
0 45ms
45ms Script
text/html 2606:4700:30::6812:2f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://news.todaysmainnews.com/m3_assets/3/js/script.min.js
Requested by: Host: news.todaysmainnews.com
URL: https://news.todaysmainnews.com/koqddk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:2f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /m3_assets/3/js/script.min.js
pragma: no-cache
cookie: __cfduid=d3a91091030e4bffab33d702b657a497f1553707120
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: news.todaysmainnews.com
referer: https://news.todaysmainnews.com/koqddk/
:scheme: https
:method: GET
Referer: https://news.todaysmainnews.com/koqddk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 27 Mar 2019 17:18:41 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=iso-8859-1
status: 404
cache-control: public, max-age=14400
cf-ray: 4be306643bfc63c7-FRA
expires: Wed, 27 Mar 2019 21:18:41 GMT

GET
H2 200 webPushAnalytics
onesignal.com/ Frame 9F90 0
0 11ms
10ms Document
text/html 2606:4700::6810:d0a5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/webPushAnalytics
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:d0a5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: onesignal.com
:scheme: https
:path: /webPushAnalytics
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://news.todaysmainnews.com/koqddk/
accept-encoding: gzip, deflate, br
cookie: __cfduid=dfd351a2e19087e85504a768c1685045c1553707120
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://news.todaysmainnews.com/koqddk/

Response headers

status: 200
date: Wed, 27 Mar 2019 17:18:43 GMT
content-type: text/html
last-modified: Tue, 26 Mar 2019 23:43:13 GMT
cf-cache-status: HIT
expires: Wed, 27 Mar 2019 18:18:43 GMT
cache-control: public, max-age=3600
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 4be306714d3bbebc-FRA
content-encoding: gzip

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.todaysmainnews.com/	1970-01-19 08:20:43	Name: __cfduid Value: d3a91091030e4bffab33d702b657a497f1553707120

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703(Line 1) Message: TypeError: Cannot read property 'permission' of undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.onesignal.com
code.jquery.com
mq5.org
news.todaysmainnews.com
onesignal.com
track.goodtohavethis.com
18.184.38.55
185.212.129.86
205.185.208.52
2606:4700:30::6812:2f9c
2606:4700::6810:d0a5
0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1e58e2645d7ea1770f7b9c78f47f06dd8a9fc8eedc769e662e740397df8998b2
1f2ac9d20813beef501a2abfb14486530d96afa3bf827324e3876cc54453cc06
5dd15ee83624d9e495501e1bcceedf7eec8e9936ec9024aaef648f72699d33bc
62a671849607c7b37dc080b9fd95cf8a85a6db8a39804f972312fbcea052b528
63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50
69e6849c186b30870bcf3b77114ffca60a34661bd2061d3cfe8fec8da4bb1209
6cc73dd5ec63339df197bda69edfb7c91abf3e47e6e63bdd9dff9b8a9c38e9ef
9395ed524dc8e35e7fadee357dccb89f2853d390702f3000cca88c4f55e68324
a705dd23b75e824b4e8118a38ed5ed50e03678f72ccee1bbb9cb394f565035d8
c91328144122a2b3196a7aa5379fc26e2be6015342f9fd1b40d63763b01c198a
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

news.todaysmainnews.com Open in urlscan Pro 2606:4700:30::6812:2f9c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

40 %IPv6

5 Domains

6 Subdomains

4 IPs

2 Countries

239 kBTransfer

556 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

news.todaysmainnews.com Open in urlscan Pro
2606:4700:30::6812:2f9c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

239 kB
Transfer

556 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!