urlscan.io logo urlscan.io
SecurityTrails logo

www.threat2remove.com Open in urlscan Pro
50.63.133.255  Public Scan

Go To Rescan Add Verdict Report
URL: http://www.threat2remove.com/
Submission: On September 26 via manual from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 4 countries across 19 domains to perform 35 HTTP transactions. The main IP is 50.63.133.255, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is www.threat2remove.com.
This is the only time www.threat2remove.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 25 50.63.133.255 26496 (AS-26496-...)
1 2a00:1450:400... 15169 (GOOGLE)
3 3 63.215.202.80 25751 (VALUECLICK)
1 23.38.49.188 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 5 149.126.77.38 19551 (INCAPSULA)
1 1 161.47.7.14 19994 (RACKSPACE)
1 1 50.56.52.48 19994 (RACKSPACE)
1 205.185.208.80 20446 (HIGHWINDS3)
2 3 45.55.29.117 14061 (DIGITALOC...)
1 54.230.95.74 16509 (AMAZON-02)
1 2 45.60.33.126 19551 (INCAPSULA)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
35 13
25    50.63.133.255 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
www.threat2remove.com
threat2remove.com
1    2a00:1450:4001:817::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
3    63.215.202.80 (Amsterdam, Netherlands)

ASN25751 (VALUECLICK - Conversant, Inc., US)
PTR: tracking-ams5.cj.com
www.tqlkg.com
cj.dotomi.com
www.emjcd.com
1    23.38.49.188 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-49-188.deploy.static.akamaitechnologies.com
www.yceml.net
4    2a00:1450:4001:81d::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
1    2a00:1450:4001:812::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2a00:1450:4001:81b::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
5    149.126.77.38 (Frankfurt, Germany)

ASN19551 (INCAPSULA - Incapsula Inc, US)
PTR: 149.126.77.38.ip.incapdns.net
gilobi.reimage.revenuewire.net
gilobi.reimage.safecart.com
link.safecart.com
gilobi.enigma.revenuewire.net
gilobi.enigma.safecart.com
1    161.47.7.14 (San Antonio, United States)

ASN19994 (RACKSPACE - Rackspace Hosting, US)
www.reimageplus.com
1    50.56.52.48 (San Antonio, United States)

ASN19994 (RACKSPACE - Rackspace Hosting, US)
www.reimagemac.com
1    205.185.208.80 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip080.ssl.hwcdn.net
cdnrep.reimageplus.com
3    45.55.29.117 (San Francisco, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
www.plumbytes.com
plumbytes.com
1    54.230.95.74 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-95-74.fra2.r.cloudfront.net
download.enigmasoftware.com
2    45.60.33.126 (Redwood City, United States)

ASN19551 (INCAPSULA - Incapsula Inc, US)
send.onenetworkdirect.net
affiliates.digitalriver.com
1    2a00:1450:4001:81a::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
1    2a00:1450:4001:81f::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
2    2a00:1450:4001:815::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
googleads.g.doubleclick.net
Domain Requested by
23 www.threat2remove.com 6 redirects www.threat2remove.com
4 pagead2.googlesyndication.com www.threat2remove.com
pagead2.googlesyndication.com
2 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 www.plumbytes.com 2 redirects
2 fonts.gstatic.com www.threat2remove.com
2 threat2remove.com www.threat2remove.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 affiliates.digitalriver.com www.threat2remove.com
1 send.onenetworkdirect.net 1 redirects
1 download.enigmasoftware.com www.threat2remove.com
1 gilobi.enigma.safecart.com 1 redirects
1 gilobi.enigma.revenuewire.net 1 redirects
1 plumbytes.com www.threat2remove.com
1 link.safecart.com 1 redirects
1 cdnrep.reimageplus.com www.threat2remove.com
1 www.reimagemac.com 1 redirects
1 www.reimageplus.com 1 redirects
1 gilobi.reimage.safecart.com 1 redirects
1 gilobi.reimage.revenuewire.net 1 redirects
1 www.yceml.net www.threat2remove.com
1 www.emjcd.com 1 redirects
1 cj.dotomi.com 1 redirects
1 www.tqlkg.com 1 redirects
1 fonts.googleapis.com www.threat2remove.com
35 25

This site contains links to these domains. Also see Links.

Domain
www.tkqlhce.com
Subject Issuer Validity Valid
*.plumbytes.com
COMODO RSA Domain Validation Secure Server CA		 2018-06-21 -
2019-06-22		 a year crt.sh
*.google.com
Google Internet Authority G3		 2018-08-28 -
2018-11-20		 3 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3		 2018-08-28 -
2018-11-20		 3 months crt.sh

This page contains 4 frames:

Primary Page: http://www.threat2remove.com/
Frame ID: 130396DBF2E47FDBDDA9E0570628E3AE
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20180919/r20180604/zrt_lookup.html
Frame ID: 16F85039BC817E9B23090A1F2EF689D1
Requests: 1 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/show_ads_impl.js
Frame ID: D0B6AC73F549D5E080FAEDD17BFFA8AD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=1941173397&w=300&lmt=1537958154&guci=1.2.0.0.2.2.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&adsid=NT&dt=1537958154626&bpp=7&bdt=1296&fdt=9&idt=51&shv=r20180919&cbv=r20180604&saldr=aa&abxe=1&correlator=4210604322827&frm=20&pv=2&ga_vid=1627694103.1537958155&ga_sid=1537958155&ga_hid=339143570&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=811&ady=697&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C828064254&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&fsb=1&xpc=CCwKUQhkl6&p=http%3A//www.threat2remove.com&dtd=75
Frame ID: 7D50FB28308D777B49AD74DC1461A250
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^google_ad_/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i
Overall confidence: 100%
Detected patterns
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • env /^Piwik$/i
  • env /^_paq$/i

Page Statistics

35
Requests

20 %
HTTPS

41 %
IPv6

19
Domains

25
Subdomains

13
IPs

4
Countries

573 kB
Transfer

862 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • http://www.tqlkg.com/image-7141446-11114083-1421849326000 HTTP 302
  • http://cj.dotomi.com/ts76ax03H/ry2/x0v/GGGGJFNI/MGJGJJL/F/F/F/F/F?q=n%3c%3cr33z%3A%2F%2F666.30vuq.myw%3AIA%2Fswkqo-HBEBEEG-BBBBEAID-BECBIEJDCGAAA%3c%3cQ%3cr33z%3A%2F%2F666.3r1ok3C1owy5o.myw%2F%3c%3cB%3cB%3c-B%3cB%3cA%3c HTTP 302
  • http://www.emjcd.com/pf65kptwB/jqv/ptn/8888B7FA/E8B8BBD/7/FC8C7BD7DCCB9CGBDE:0Bog4pSaIEN8/7/7/7?q=g%3c%3c0CC8%3A%2F%2FFFF.C943z.v75%3ARJ%2F15tzx-QKNKNNP-KKKKNJRM-KNLKRNSMLPJJJ%3c%3cZ%3c0CC8%3A%2F%2FFFF.C0AxtCLAx57Ex.v75%2F%3cJNQwNPMK-RRJt-NMLw-uKPu-tKytMvvMOOuR%3cK%3cK%3c-K%3cK%3cJ%3c HTTP 302
  • http://www.yceml.net/0611/11114083-1527088477787
Request Chain 22
  • http://www.threat2remove.com/download-reimage HTTP 301
  • http://www.threat2remove.com/download-reimage/ HTTP 302
  • http://gilobi.reimage.revenuewire.net/reimage-pc-repair/download/ HTTP 302
  • http://gilobi.reimage.safecart.com/reimage-pc-repair/download/ HTTP 301
  • http://www.reimageplus.com/includes/router_land.php?tracking=revenuewire&exec=run HTTP 301
  • http://www.reimagemac.com/tracker/track.php?tracking=revenuewire&campaign=direct&adgroup=direct&ads_name=direct&keyword=direct&exec=run&nms=1 HTTP 302
  • http://cdnrep.reimageplus.com/mac/ReimageCleaner.dmg
Request Chain 23
  • http://www.threat2remove.com/download-plumbytes HTTP 301
  • http://www.threat2remove.com/download-plumbytes/ HTTP 302
  • http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk HTTP 301
  • http://www.plumbytes.com/partner/url/download HTTP 302
  • http://www.plumbytes.com/download/cuid/?tid=rwid_p00000 HTTP 301
  • https://plumbytes.com/download/cuid/?tid=rwid_p00000
Request Chain 24
  • http://www.threat2remove.com/download-spyhunter HTTP 301
  • http://www.threat2remove.com/download-spyhunter/ HTTP 302
  • http://gilobi.enigma.revenuewire.net/spyhunter2/download/ HTTP 302
  • http://gilobi.enigma.safecart.com/spyhunter2/download/ HTTP 301
  • http://download.enigmasoftware.com/spyhunter-free-download/revenuewire/SpyHunter-Installer.exe
Request Chain 25
  • http://send.onenetworkdirect.net/z/580857/CD230692 HTTP 302
  • http://affiliates.digitalriver.com/z/580857/CD230692

35 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
www.threat2remove.com/ 		12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 / PHP/5.4.12
Resource Hash
ffbaf9a4a1dca294d56eb6765a8a88db35baf9a953741454e57a3e26e172e7dd

Request headers

Host
www.threat2remove.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx/1.10.2
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.4.12
Set-Cookie
_icl_current_language=en; expires=Thu, 27-Sep-2018 10:35:52 GMT; path=/
X-Pingback
http://www.threat2remove.com/xmlrpc.php
Content-Encoding
gzip
ajax-contact.css
www.threat2remove.com/wp-content/plugins/ajax-contact/css/ 		2 KB
1016 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/ajax-contact/css/ajax-contact.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
236a892279988cc2c59f931c6bfff562494d4d57252807fa25990fda3f5c9621

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Nov 2014 14:17:58 GMT
Server
nginx/1.10.2
ETag
W/"54733e16-725"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
style.css
www.threat2remove.com/wp-content/plugins/side-matter/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/side-matter/css/style.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
811576ad12c342afa480be3ee4e6f0b0536d7af0dd7cd45219b321cd62917a86

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 04 Nov 2016 13:48:44 GMT
Server
nginx/1.10.2
ETag
W/"581c91bc-ab5"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
display-authors-widget.css
www.threat2remove.com/wp-content/plugins/display-authors-widget/css/ 		545 B
613 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/display-authors-widget/css/display-authors-widget.css?ver=20122709
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
84b37226dd1ba126264c6b5d1369d28d6fb5fa26f7cd6f3e1458e86ff41d14e7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 Nov 2013 19:50:22 GMT
Server
nginx/1.10.2
ETag
W/"528fb57e-221"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
font-awesome.min.css
www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/ 		27 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/font-awesome.min.css?ver=4.5.0
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
W/"5741e8ae-6b4a"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
css
fonts.googleapis.com/ 		14 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
2a00:1450:4001:817::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0b00b4291cb12308f654fc5640ed518ba0ec0e74f8507ac5fd40a03898fc8cd0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Sep 2018 10:35:53 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Wed, 26 Sep 2018 10:35:53 GMT
style.css
www.threat2remove.com/wp-content/themes/uniform/ 		46 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/style.css?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
fd7ffc2056e10c09d88c0eb2f0b2df7d368ed1aa54d74d62871167fd00c79710

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 04 Nov 2016 13:46:28 GMT
Server
nginx/1.10.2
ETag
W/"581c9134-b757"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
responsive.css
www.threat2remove.com/wp-content/themes/uniform/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/css/responsive.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
d514cbc699d757a21b9898585e77009597337a101af50b7cd783a1df579373cc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
W/"5741e8ae-13eb"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Sat, 21 Sep 2019 10:35:53 GMT
Cookie set styles.php
www.threat2remove.com/wp-content/themes/uniform/css/ 		0
320 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/css/styles.php?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 / PHP/5.4.12
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
Server
nginx/1.10.2
X-Powered-By
PHP/5.4.12
Transfer-Encoding
chunked
Content-Type
text/css
Set-Cookie
_icl_current_language=en; expires=Thu, 27-Sep-2018 10:35:53 GMT; path=/
Connection
keep-alive
jquery.js
www.threat2remove.com/wp-includes/js/jquery/ 		94 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
74785791e63a226fb98b9050f80b5d90f0ca26401e187c99ff74962ff64301d3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Fri, 02 May 2014 06:29:16 GMT
Server
nginx/1.10.2
ETag
"53633b3c-1763f"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95807
Expires
Sat, 21 Sep 2019 10:35:53 GMT
jquery-migrate.min.js
www.threat2remove.com/wp-includes/js/jquery/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Tue, 23 Jul 2013 12:28:26 GMT
Server
nginx/1.10.2
ETag
"51ee76ea-1c20"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7200
Expires
Sat, 21 Sep 2019 10:35:53 GMT
ajax-contact.js
www.threat2remove.com/wp-content/plugins/ajax-contact/js/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/ajax-contact/js/ajax-contact.js?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
6ea00f64b4e1b58ac8e1162060375aeb983cbc6589ef55675c999e1fc3f447d9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Wed, 29 Aug 2012 05:47:50 GMT
Server
nginx/1.10.2
ETag
"503dad06-1135"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4405
Expires
Sat, 21 Sep 2019 10:35:53 GMT
jquery.autosize.js
www.threat2remove.com/wp-content/plugins/side-matter/js/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/side-matter/js/jquery.autosize.js?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
9feb1e84c6703aee7b5e7aeb6abfd1aacaf725796c4b5640fe736abe3447545a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Tue, 21 Nov 2017 13:24:44 GMT
Server
nginx/1.10.2
ETag
"5a14291c-1aec"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6892
Expires
Sat, 21 Sep 2019 10:35:53 GMT
11114083-1527088477787
www.yceml.net/0611/
Redirect Chain
  • http://www.tqlkg.com/image-7141446-11114083-1421849326000
  • http://cj.dotomi.com/ts76ax03H/ry2/x0v/GGGGJFNI/MGJGJJL/F/F/F/F/F?q=n%3c%3cr33z%3A%2F%2F666.30vuq.myw%3AIA%2Fswkqo-HBEBEEG-BBBBEAID-BECBIEJDCGAAA%3c%3cQ%3cr33z%3A%2F%2F666.3r1ok3C1owy5o.myw%2F%3c%3...
  • http://www.emjcd.com/pf65kptwB/jqv/ptn/8888B7FA/E8B8BBD/7/FC8C7BD7DCCB9CGBDE:0Bog4pSaIEN8/7/7/7?q=g%3c%3c0CC8%3A%2F%2FFFF.C943z.v75%3ARJ%2F15tzx-QKNKNNP-KKKKNJRM-KNLKRNSMLPJJJ%3c%3cZ%3c0CC8%3A%2F%2...
  • http://www.yceml.net/0611/11114083-1527088477787
24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.yceml.net/0611/11114083-1527088477787
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
23.38.49.188 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-49-188.deploy.static.akamaitechnologies.com
Software
Resin/3.1.14 /
Resource Hash
d4d6f13572616a4fcb1834b1a15d4785035617f715ad69c7fa411ad14ee03392

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:53 GMT
Cache-Control
max-age=156899
Server
Resin/3.1.14
Connection
keep-alive
Content-Length
24254
Expires
Fri, 28 Sep 2018 06:10:52 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 10:35:53 GMT
Server
Resin/3.1.14
P3P
policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Location
http://www.yceml.net/0611/11114083-1527088477787
Cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
Content-Type
text/html; charset=UTF-8
Content-Length
86
Expires
Wed, 26 Sep 2018 10:35:53 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		74 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
170723ae6a33b5b76518e8fa69dab1f6a6d1e0ae09fda837d973640884764f72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Wed, 26 Sep 2018 10:35:53 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
2682206521697608841
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
27600
X-XSS-Protection
1; mode=block
Expires
Wed, 26 Sep 2018 10:35:53 GMT
jquery.bxslider.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		49 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/jquery.bxslider.js?ver=4.1.2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
bddbba35635904eca1d7f9edc74bdbcba04ec0f5a16286fdbd8f78fb0f7e0c6f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
"5741e8ae-c58d"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
50573
Expires
Sat, 21 Sep 2019 10:35:53 GMT
navigation.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/navigation.js?ver=20120206
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:53 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
"5741e8ae-8e7"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2279
Expires
Sat, 21 Sep 2019 10:35:53 GMT
skip-link-focus-fix.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		751 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/skip-link-focus-fix.js?ver=20130115
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:54 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
"5741e8ae-2ef"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
751
Expires
Sat, 21 Sep 2019 10:35:54 GMT
custom-scripts.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/custom-scripts.js?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
d666ba68515e9d1b8770b7d44c5d2fccba27fe62e04ac3e181beff249cd39a23

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 26 Sep 2018 10:35:54 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
"5741e8ae-4ea"
Content-Type
application/javascript
Cache-Control
max-age=31104000 public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1258
Expires
Sat, 21 Sep 2019 10:35:54 GMT
generator.php
threat2remove.com/ 		53 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://threat2remove.com/generator.php
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/wp-content/plugins/side-matter/js/jquery.autosize.js?ver=4.1.9
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 / PHP/5.4.12
Resource Hash
4ca8f7722320d5e59ac553dc60baf881d5fddc53eef14a442c8f69bc2b481a4a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:55 GMT
Last-Modified
Wed, 26 Sep 2018 10:35:54 GMT
Server
nginx/1.10.2
X-Powered-By
PHP/5.4.12
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
Protocol
HTTP/1.1
Server
2a00:1450:4001:812::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Origin
http://www.threat2remove.com

Response headers

Date
Fri, 31 Aug 2018 16:42:24 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 21:49:46 GMT
Server
sffe
Age
2224410
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
8892
X-XSS-Protection
1; mode=block
Expires
Sat, 31 Aug 2019 16:42:24 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
Protocol
HTTP/1.1
Server
2a00:1450:4001:81b::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Origin
http://www.threat2remove.com

Response headers

Date
Wed, 29 Aug 2018 23:18:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 21:49:48 GMT
Server
sffe
Age
2373440
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
8916
X-XSS-Protection
1; mode=block
Expires
Thu, 29 Aug 2019 23:18:34 GMT
fontawesome-webfont.woff2
www.threat2remove.com/wp-content/themes/uniform/font-awesome/fonts/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/fonts/fontawesome-webfont.woff2?v=4.5.0
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 /
Resource Hash
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Request headers

Pragma
no-cache
Origin
http://www.threat2remove.com
Accept-Encoding
gzip, deflate
Host
www.threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/font-awesome.min.css?ver=4.5.0
Cookie
_icl_current_language=en
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/font-awesome.min.css?ver=4.5.0
Origin
http://www.threat2remove.com

Response headers

Date
Wed, 26 Sep 2018 10:35:54 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx/1.10.2
ETag
"5741e8ae-10440"
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
66624
ReimageCleaner.dmg
cdnrep.reimageplus.com/mac/
Redirect Chain
  • http://www.threat2remove.com/download-reimage
  • http://www.threat2remove.com/download-reimage/
  • http://gilobi.reimage.revenuewire.net/reimage-pc-repair/download/
  • http://gilobi.reimage.safecart.com/reimage-pc-repair/download/
  • http://www.reimageplus.com/includes/router_land.php?tracking=revenuewire&exec=run
  • http://www.reimagemac.com/tracker/track.php?tracking=revenuewire&campaign=direct&adgroup=direct&ads_name=direct&keyword=direct&exec=run&nms=1
  • http://cdnrep.reimageplus.com/mac/ReimageCleaner.dmg
28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cdnrep.reimageplus.com/mac/ReimageCleaner.dmg
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
205.185.208.80 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip080.ssl.hwcdn.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
cdnrep.reimageplus.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.threat2remove.com/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:58 GMT
Last-Modified
Thu, 31 May 2018 08:50:44 GMT
ETag
"1527756644"
X-HW
1537958158.dop009.fr8.t,1537958158.cds033.fr8.c
Content-Type
application/binary
Cache-Control
max-age=86400
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4296849

Redirect headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 10:33:53 GMT
Content-Encoding
gzip
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Connection
Keep-Alive
P3P
CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml"
Location
http://cdnrep.reimageplus.com/mac/ReimageCleaner.dmg
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie
X-Mapping-fjhppofk=2D7BD2BD1FBD96C6CE462FA180D83E44; path=/ PHPSESSID=h2b327agfkdmdlvtsm25aa0j42; path=/ _refcook_product_19=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/ _source=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/ _refcook_product_19=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/ _source=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/ _trackid_product_19=5568445478; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _trackid_product_19_5568445478=5568445478; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _tracking_product_19=revenuewire; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _tracking_product_19_revenuewire=revenuewire; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _campaign_product_19=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _campaign_product_19_direct=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _adgroup_product_19=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _adgroup_product_19_direct=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _keyword_product_19=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _keyword_product_19_direct=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _ads_product_19=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _ads_product_19_direct=direct; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _browser_product_19=Chrome; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _browser_product_19_Chrome=Chrome; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _country_product_19=Germany; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com _country_product_19_Germany=Germany; expires=Sun, 25-Nov-2018 10:33:56 GMT; path=/; domain=reimagemac.com
Content-Type
text/html; charset=UTF-8
Content-Length
20
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cookie set /
plumbytes.com/download/cuid/
Redirect Chain
  • http://www.threat2remove.com/download-plumbytes
  • http://www.threat2remove.com/download-plumbytes/
  • http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
  • http://www.plumbytes.com/partner/url/download
  • http://www.plumbytes.com/download/cuid/?tid=rwid_p00000
  • https://plumbytes.com/download/cuid/?tid=rwid_p00000
32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plumbytes.com/download/cuid/?tid=rwid_p00000
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.55.29.117 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.4.45 / PHP/5.4.45
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
plumbytes.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.threat2remove.com/
Cookie
2b305=%7B%22streams%22%3A%7B%222%22%3A1537929554%2C%220%22%3A1537929554%7D%2C%22campaigns%22%3A%7B%221%22%3A1537929554%2C%223%22%3A1537929554%7D%2C%22time%22%3A1537929554%7D
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:39:31 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.4.45
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Content-Type
application/octet-stream
Connection
Keep-Alive
Content-Disposition
attachment; filename=antimalwaresetup.exe;
Set-Cookie
usrid=9a7a4a72; expires=Sun, 25-Nov-2018 10:39:31 GMT; path=/
Keep-Alive
timeout=5, max=100

Redirect headers

Location
https://plumbytes.com/download/cuid/?tid=rwid_p00000
Date
Wed, 26 Sep 2018 10:39:30 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.4.45
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
260
Content-Type
text/html; charset=iso-8859-1
SpyHunter-Installer.exe
download.enigmasoftware.com/spyhunter-free-download/revenuewire/
Redirect Chain
  • http://www.threat2remove.com/download-spyhunter
  • http://www.threat2remove.com/download-spyhunter/
  • http://gilobi.enigma.revenuewire.net/spyhunter2/download/
  • http://gilobi.enigma.safecart.com/spyhunter2/download/
  • http://download.enigmasoftware.com/spyhunter-free-download/revenuewire/SpyHunter-Installer.exe
25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download.enigmasoftware.com/spyhunter-free-download/revenuewire/SpyHunter-Installer.exe
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
54.230.95.74 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-74.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
download.enigmasoftware.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.threat2remove.com/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-meta-cb-modifiedtime
Thu, 21 Jun 2018 17:08:23 GMT
Date
Thu, 02 Aug 2018 16:22:44 GMT
Via
1.1 6558236a06004e2e5ed43d07e2124e70.cloudfront.net (CloudFront)
Last-Modified
Fri, 22 Jun 2018 15:26:57 GMT
Server
AmazonS3
Age
64624
ETag
"12690e2db038cf5655fd13713cc2984a"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5930728
X-Amz-Cf-Id
v65YO1xLqOQo1yUXCAVGHHSb9xxbweftwFUL2DBQ1o4ZzgsE600zkg==

Redirect headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 10:35:55 GMT
Server
Apache
Set-Cookie
PHPSESSID=qbcg2bvt15qo88idk7d3j2abo0; path=/; secure; HttpOnly enigma=a%3A6%3A%7Bs%3A9%3A%22sessionId%22%3Bs%3A26%3A%221i27r3pgj1elui0ad2kjo8rjc3%22%3Bs%3A10%3A%22networkFid%22%3Bs%3A5%3A%22rwire%22%3Bs%3A9%3A%22partnerId%22%3Bi%3A1907455%3Bs%3A15%3A%22affiliateInfoId%22%3Bi%3A454547%3Bs%3A15%3A%22merchantAliasId%22%3BN%3Bs%3A2%3A%22id%22%3Bs%3A40%3A%22cd30c3566c37ce909b0fda166fc951efe867beaf%22%3B%7D; expires=Tue, 25-Dec-2018 10:35:55 GMT; Max-Age=7776000; path=/; domain=.safecart.com RWSERVERID=php-app1; path=/; HttpOnly; Secure visid_incap_118135=GWqtV0gHTYixYgYluaOOJwphq1sAAAAAQUIPAAAAAABjStHCXYym52mXiK69uYve; expires=Thu, 26 Sep 2019 05:46:11 GMT; path=/; Domain=.enigma.safecart.com incap_ses_260_118135=LlO1ciYblyVAUO+DXeubAwthq1sAAAAA2FjHrsx92T09xFmRARUzvw==; path=/; Domain=.enigma.safecart.com
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Location
http://download.enigmasoftware.com/spyhunter-free-download/revenuewire/SpyHunter-Installer.exe
X-Iinfo
7-169932499-169932500 NNNN CT(164 -1 0) RT(1537958154613 0) q(0 0 1 0) r(4 4) U5
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
X-CDN
Incapsula
Expires
Thu, 19 Nov 1981 08:52:00 GMT
CD230692
affiliates.digitalriver.com/z/580857/
Redirect Chain
  • http://send.onenetworkdirect.net/z/580857/CD230692
  • http://affiliates.digitalriver.com/z/580857/CD230692
0
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://affiliates.digitalriver.com/z/580857/CD230692
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
45.60.33.126 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
public, max-age=0, must-revalidate
Content-Type
text/html

Redirect headers

Date
Wed, 26 Sep 2018 10:35:55 GMT
X-Server-Name
www@smcwebprd035001.c035.digitalriverws.net
Vary
Host
P3P
policyref="/w3c/p3p.xml", CP="NOR NOI DSP COR ADM OUR PHY"
Location
http://affiliates.digitalriver.com/z/580857/CD230692
X-Iinfo
13-257503146-257503147 NNNN CT(114 -1 0) RT(1537958155325 1) q(0 0 1 0) r(2 2) U5
Cache-Control
public, max-age=0, must-revalidate
Connection
close
Content-Type
text/html
Keep-Alive
timeout=3, max=1000
Content-Length
0
X-CDN
Incapsula
Server
Apache
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.threat2remove.com
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 10:35:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.threat2remove.com
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 10:35:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-7943855733030580.js
pagead2.googlesyndication.com/pub-config/r20160913/ 		133 B
243 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-7943855733030580.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ad3f5743027d58f0c5e8b2f074edc3fb50e776ddecdb8a90531fd30407d6ff48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 10:10:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 25 Sep 2018 22:50:16 GMT
server
sffe
age
1519
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
125
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 22:10:35 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20180919/r20180604/ Frame 16F8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20180919/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20180919/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://www.threat2remove.com/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.threat2remove.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Wed, 19 Sep 2018 19:12:42 GMT
expires
Wed, 03 Oct 2018 19:12:42 GMT
content-type
text/html; charset=UTF-8
etag
18162506661661110595
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6931
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
573792
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/ Frame D0B6 		197 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d49ffc415418611ddecc843a5238ffc87fd4424baa80d1730cf06f68335a9396
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Wed, 26 Sep 2018 10:35:54 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
17411404670683501251
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=1209600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
74219
X-XSS-Protection
1; mode=block
Expires
Wed, 26 Sep 2018 10:35:54 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 7D50 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=1941173397&w=300&lmt=1537958154&guci=1.2.0.0.2.2.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&adsid=NT&dt=1537958154626&bpp=7&bdt=1296&fdt=9&idt=51&shv=r20180919&cbv=r20180604&saldr=aa&abxe=1&correlator=4210604322827&frm=20&pv=2&ga_vid=1627694103.1537958155&ga_sid=1537958155&ga_hid=339143570&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=811&ady=697&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C828064254&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&fsb=1&xpc=CCwKUQhkl6&p=http%3A//www.threat2remove.com&dtd=75
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=1941173397&w=300&lmt=1537958154&guci=1.2.0.0.2.2.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&adsid=NT&dt=1537958154626&bpp=7&bdt=1296&fdt=9&idt=51&shv=r20180919&cbv=r20180604&saldr=aa&abxe=1&correlator=4210604322827&frm=20&pv=2&ga_vid=1627694103.1537958155&ga_sid=1537958155&ga_hid=339143570&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=811&ady=697&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C828064254&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&fsb=1&xpc=CCwKUQhkl6&p=http%3A//www.threat2remove.com&dtd=75
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://www.threat2remove.com/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.threat2remove.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Wed, 26 Sep 2018 10:35:54 GMT
server
cafe
cache-control
private
content-length
18158
x-xss-protection
1; mode=block
set-cookie
test_cookie=CheckForPermission; expires=Wed, 26-Sep-2018 10:50:54 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
expires
Wed, 26 Sep 2018 10:35:54 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/ 		72 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/r20180919/r20180604/show_ads_impl.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Sep 2018 19:12:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
573790
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
26901
x-xss-protection
1; mode=block
server
cafe
etag
11805512267064086570
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Oct 2018 19:12:44 GMT
generator.php
threat2remove.com/ 		0
162 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://threat2remove.com/generator.php?action_name=Threat%202%20Remove&idsite=340&rec=1&r=765583&h=10&m=35&s=56&url=http%3A%2F%2Fwww.threat2remove.com%2F&_id=dfd905229082c239&_idts=1537958156&_idvc=1&_idn=0&_refts=0&_viewts=1537958156&send_image=0&cookie=1&res=1600x1200&gt_ms=1226
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
50.63.133.255 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
Software
nginx/1.10.2 / PHP/5.4.12
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
threat2remove.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.threat2remove.com/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 10:35:57 GMT
Server
nginx/1.10.2
Connection
keep-alive
X-Powered-By
PHP/5.4.12
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| $ function| jQuery object| objectL10n function| iwacontactConstruct object| _paq function| httfebnbnh object| adsbygoogle function| setCookie function| getCookie object| jQuery1111008051002297994936 object| google_js_reporting_queue object| google_ad_modifications boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state function| google_spfd number| google_unique_id object| google_sv_map object| google_t12n_vars object| google_jobrunner object| google_iframe_oncopy object| google_persistent_state_async object| google_pub_config object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_AdSense_getAdAdapterInstance boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| JSON2 object| Piwik object| AnalyticsTracker function| piwik_log

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
affiliates.digitalriver.com
cdnrep.reimageplus.com
cj.dotomi.com
download.enigmasoftware.com
fonts.googleapis.com
fonts.gstatic.com
gilobi.enigma.revenuewire.net
gilobi.enigma.safecart.com
gilobi.reimage.revenuewire.net
gilobi.reimage.safecart.com
googleads.g.doubleclick.net
link.safecart.com
pagead2.googlesyndication.com
plumbytes.com
send.onenetworkdirect.net
threat2remove.com
www.emjcd.com
www.plumbytes.com
www.reimagemac.com
www.reimageplus.com
www.threat2remove.com
www.tqlkg.com
www.yceml.net
149.126.77.38
161.47.7.14
205.185.208.80
23.38.49.188
2a00:1450:4001:812::2003
2a00:1450:4001:815::2002
2a00:1450:4001:817::200a
2a00:1450:4001:81a::2002
2a00:1450:4001:81b::2003
2a00:1450:4001:81d::2002
2a00:1450:4001:81f::2002
45.55.29.117
45.60.33.126
50.56.52.48
50.63.133.255
54.230.95.74
63.215.202.80
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0b00b4291cb12308f654fc5640ed518ba0ec0e74f8507ac5fd40a03898fc8cd0
170723ae6a33b5b76518e8fa69dab1f6a6d1e0ae09fda837d973640884764f72
236a892279988cc2c59f931c6bfff562494d4d57252807fa25990fda3f5c9621
4ca8f7722320d5e59ac553dc60baf881d5fddc53eef14a442c8f69bc2b481a4a
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
6ea00f64b4e1b58ac8e1162060375aeb983cbc6589ef55675c999e1fc3f447d9
74785791e63a226fb98b9050f80b5d90f0ca26401e187c99ff74962ff64301d3
811576ad12c342afa480be3ee4e6f0b0536d7af0dd7cd45219b321cd62917a86
84b37226dd1ba126264c6b5d1369d28d6fb5fa26f7cd6f3e1458e86ff41d14e7
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
9feb1e84c6703aee7b5e7aeb6abfd1aacaf725796c4b5640fe736abe3447545a
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
ad3f5743027d58f0c5e8b2f074edc3fb50e776ddecdb8a90531fd30407d6ff48
bddbba35635904eca1d7f9edc74bdbcba04ec0f5a16286fdbd8f78fb0f7e0c6f
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c
d49ffc415418611ddecc843a5238ffc87fd4424baa80d1730cf06f68335a9396
d4d6f13572616a4fcb1834b1a15d4785035617f715ad69c7fa411ad14ee03392
d514cbc699d757a21b9898585e77009597337a101af50b7cd783a1df579373cc
d666ba68515e9d1b8770b7d44c5d2fccba27fe62e04ac3e181beff249cd39a23
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd7ffc2056e10c09d88c0eb2f0b2df7d368ed1aa54d74d62871167fd00c79710
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995
ffbaf9a4a1dca294d56eb6765a8a88db35baf9a953741454e57a3e26e172e7dd