urlscan.io logo urlscan.io
SecurityTrails logo

www.onclickbright.com Open in urlscan Pro
104.154.50.7  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://pleasewaitfor.com/gts/?token=f95e209cd50176063fc46ca07089e9a1eb233495&q=AGreene%20%5B256-MP3%5D.zip&s1=0QAI_J34eD0...
Effective URL: https://www.onclickbright.com/jump/next.php?r=1924131
Submission: On March 30 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main IP is 104.154.50.7, located in Mountain View, United States and belongs to GOOGLE - Google LLC, US. The main domain is www.onclickbright.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on June 19th 2017. Valid for: a year.
This is the only time www.onclickbright.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 78.140.165.25 35415 (WEBZILLA)
1 2 34.205.36.136 14618 (AMAZON-AES)
2 2 88.208.60.16 39572 (ADVANCEDH...)
1 104.154.50.7 15169 (GOOGLE)
2 2
Apex Domain
Subdomains		 Transfer
2 inxy.run
inxy.run
600 B
2 adxml.click
xml.adxml.click
2 KB
1 onclickbright.com
www.onclickbright.com
2 KB
1 pleasewaitfor.com
pleasewaitfor.com
998 B
2 4
Domain Requested by
2 inxy.run 2 redirects
2 xml.adxml.click 1 redirects
1 www.onclickbright.com
1 pleasewaitfor.com 1 redirects
2 4

This site contains no links.

Subject Issuer Validity Valid
www.onclickbright.com
COMODO RSA Domain Validation Secure Server CA		 2017-06-19 -
2018-07-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.onclickbright.com/jump/next.php?r=1924131
Frame ID: B03A7C3ED20B6FF48C9B2409499BDDB5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://pleasewaitfor.com/gts/?token=f95e209cd50176063fc46ca07089e9a1eb233495&q=AGreene%20%5B256-MP3%5... HTTP 302
    http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy... Page URL
  2. http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy... HTTP 302
    https://inxy.run/zone/586?r=true&nsid=62498 HTTP 302
    https://inxy.run/z-go/586?cid=2026&nsid=62498 HTTP 302
    https://www.onclickbright.com/jump/next.php?r=1924131 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

4 kB
Transfer

6 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pleasewaitfor.com/gts/?token=f95e209cd50176063fc46ca07089e9a1eb233495&q=AGreene%20%5B256-MP3%5D.zip&s1=0QAI_J34eD0KfEIa_NZeafZgM2eA_-tyP6PAu6eBU0mtxZPPKN4b_3LtYqiTDey1D5lWWIXm1ShT3Wi6Up1FRoAafC4xkySxmKNlJ9LZ8HyEJ3v-iYm1 HTTP 302
    http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA Page URL
  2. http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA&token=ec925cb99a804c8c2eee857172b1854f HTTP 302
    https://inxy.run/zone/586?r=true&nsid=62498 HTTP 302
    https://inxy.run/z-go/586?cid=2026&nsid=62498 HTTP 302
    https://www.onclickbright.com/jump/next.php?r=1924131 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://pleasewaitfor.com/gts/?token=f95e209cd50176063fc46ca07089e9a1eb233495&q=AGreene%20%5B256-MP3%5D.zip&s1=0QAI_J34eD0KfEIa_NZeafZgM2eA_-tyP6PAu6eBU0mtxZPPKN4b_3LtYqiTDey1D5lWWIXm1ShT3Wi6Up1FRoAafC4xkySxmKNlJ9LZ8HyEJ3v-iYm1 HTTP 302
  • http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
log
xml.adxml.click/
Redirect Chain
  • http://pleasewaitfor.com/gts/?token=f95e209cd50176063fc46ca07089e9a1eb233495&q=AGreene%20%5B256-MP3%5D.zip&s1=0QAI_J34eD0KfEIa_NZeafZgM2eA_-tyP6PAu6eBU0mtxZPPKN4b_3LtYqiTDey1D5lWWIXm1ShT3Wi6Up1FRoA...
  • http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA
Protocol
HTTP/1.1
Server
34.205.36.136 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-205-36-136.compute-1.amazonaws.com
Software
openresty/1.13.6.1 /
Resource Hash
2c1882a1a83d897a3d7f16c6dd2f8339b0540da9430fa2419ef471776d0cac1b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
xml.adxml.click
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Fri, 30 Mar 2018 17:06:26 GMT
Access-Control-Allow-Credentials
true
Server
openresty/1.13.6.1
Connection
keep-alive
Content-Length
1593
Content-Type
text/html;charset=ISO-8859-1

Redirect headers

Location
http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA
Date
Fri, 30 Mar 2018 17:06:25 GMT
Connection
keep-alive
Server
nginx/1.12.1
Set-Cookie
bd_context=lDyvkMVbaLlqmpFIYTNmmnvJP5arKnEVLGrppz3QehT7u9K+yddpT66Z2ahTDskyOepNBZwn2Xj0EXHl25wNXg5WBYkWY5At8dJXC0fefDdfgKalfEJytxJedkuHXS6pfYM3UEwgtHVEjgBdu6FkPeewj1gi8l3hXTIAy7gULruhttToxsakfpQHW75xpCAnaQgqEB82i1GDaQbwMdyumHg8ajmTj8IPgPiWTQsbO7+kY4xJ3+T9sNPneFKG3UZLVtwEbQR0fee4ydMsudqfGyPVFs8+gMg5sXJeUYKIRn8+J8Z+3w0gCpU0+szRd38tA36R8t7KlFOQs0p0P/wQIyJsIa7O7FaQv6KB72ez/PNIUWaDHgK4jvDNPCFlcnmFGcF1Gfk5SLbjtdNtJXp3vg80Mm6QKXfG11TmChcps93JUoocmmEc3wcWdf29u8vA5bNmmgDZJy43evfWsZIi92f2oRGShIeTnhOljRYuMvDq5HE3O8l3Mf/ZlwPJIjzxCl/oMTU6mW+ntWxnjLI91SCPHaMfgHFlunCsRFHG30KrtixJvSDBqsYb3U5KdEI+SCb17w19SEi7mg==; Expires=Sat, 30 Mar 2019 17:06:25 GMT
Content-Length
203
Content-Type
text/html; charset=utf-8
Primary Request next.php
www.onclickbright.com/jump/
Redirect Chain
  • http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA&token=ec925cb99a804c8c2eee857172...
  • https://inxy.run/zone/586?r=true&nsid=62498
  • https://inxy.run/z-go/586?cid=2026&nsid=62498
  • https://www.onclickbright.com/jump/next.php?r=1924131
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.onclickbright.com/jump/next.php?r=1924131
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.154.50.7 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
7.50.154.104.bc.googleusercontent.com
Software
openresty /
Resource Hash
ec17a8cf1b4d16b3215aef6165f9f9dfd7c02a4a852819229a09f34dde1cb9f4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.onclickbright.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA
Connection
keep-alive
Cache-Control
no-cache
Referer
http://xml.adxml.click/log?action=click&key=pop-under-6a34dfd5-9303-419c-9b1e-978594420e4f&strategy=125574&ts=1522429585923&aff_sub=AJFuvlpQIgAASIABAERFFQASAHGLSMsA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Fri, 30 Mar 2018 17:06:26 GMT
Content-Encoding
gzip
Referrer-Policy
no-referrer
Server
openresty
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Link
<//www.onclickbright.com>; rel=dns-prefetch,<//www.onclickbright.com>; rel=preconnect

Redirect headers

Date
Fri, 30 Mar 2018 17:07:03 GMT
X-Content-Type-Options
nosniff
Server
nginx
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Location
https://www.onclickbright.com/jump/next.php?r=1924131
Set-Cookie
adrot=2026; Path=/
Connection
keep-alive
Content-Length
0

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| inIframe function| checkDocumentBody function| documentAsyncWriteElementFromHtml undefined| ufp function| ReopenUrlBuilder function| preppopedRedirect

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

inxy.run
pleasewaitfor.com
www.onclickbright.com
xml.adxml.click
104.154.50.7
34.205.36.136
78.140.165.25
88.208.60.16
2c1882a1a83d897a3d7f16c6dd2f8339b0540da9430fa2419ef471776d0cac1b
ec17a8cf1b4d16b3215aef6165f9f9dfd7c02a4a852819229a09f34dde1cb9f4