urlscan.io logo urlscan.io
SecurityTrails logo

dreamsnest.com Open in urlscan Pro
2606:4700:3032::ac43:b3df  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://installyourfiles.com/show.php?l=0&u=361033&id=32329
Effective URL: https://dreamsnest.com/comecome
Submission: On February 28 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 2 countries across 11 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3032::ac43:b3df, located in United States and belongs to CLOUDFLARENET, US. The main domain is dreamsnest.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 14th 2020. Valid for: a year.
This is the only time dreamsnest.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 212.32.250.1 60781 (LEASEWEB-...)
1 3 216.104.36.157 32475 (SINGLEHOP...)
1 1 172.67.183.58 13335 (CLOUDFLAR...)
1 172.64.142.2 13335 (CLOUDFLAR...)
1 2 52.201.162.15 14618 (AMAZON-AES)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 192.243.59.12 39572 (ADVANCEDH...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
12 10
1    2606:4700:20::ac43:49e3 (United States)

ASN13335 (CLOUDFLARENET, US)
installyourfiles.com
2    212.32.250.1 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
go.secureclickers.com
yo.wackotracko.com
3    216.104.36.157 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi
get.w0pt0p.online
1    172.67.183.58 (United States)

ASN13335 (CLOUDFLARENET, US)
tracking.armorads.com
1    172.64.142.2 (United States)

ASN13335 (CLOUDFLARENET, US)
manuqas.com
2    52.201.162.15 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-162-15.compute-1.amazonaws.com
tare.pro
1    2606:4700:3031::ac43:8067 (United States)

ASN13335 (CLOUDFLARENET, US)
dreams.ninja
1    192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
harassfinreach.com
1    2606:4700:3032::ac43:b3df (United States)

ASN13335 (CLOUDFLARENET, US)
dreamsnest.com
1    2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
2    2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)
cloudflareinsights.com
Domain Requested by
3 get.w0pt0p.online 1 redirects get.w0pt0p.online
2 cloudflareinsights.com static.cloudflareinsights.com
2 tare.pro 1 redirects manuqas.com
1 static.cloudflareinsights.com dreamsnest.com
1 dreamsnest.com
1 harassfinreach.com 1 redirects
1 dreams.ninja tare.pro
1 manuqas.com get.w0pt0p.online
1 tracking.armorads.com 1 redirects
1 yo.wackotracko.com
1 go.secureclickers.com installyourfiles.com
1 installyourfiles.com
12 12

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-29 -
2021-07-29		 a year crt.sh
itsokto.linktolinkyourlink.com
Sectigo RSA Domain Validation Secure Server CA		 2020-03-12 -
2021-03-13		 a year crt.sh
get.w0pt0p.online
R3		 2020-12-21 -
2021-03-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dreamsnest.com/comecome
Frame ID: 27F2D4FCEC28B8E0F3B3F3D28E910430
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://installyourfiles.com/show.php?l=0&u=361033&id=32329 Page URL
  2. https://go.secureclickers.com/click?pid=100&offer_id=9720&sub1=1085787320&sub2=100_361033 Page URL
  3. https://yo.wackotracko.com/click?pid=2&offer_id=719&sub1=1085787320&sub2=100&sub3=100_361033&sub4=9720&... Page URL
  4. https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpo... Page URL
  5. https://get.w0pt0p.online/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
  6. https://get.w0pt0p.online/proc.php?0c9eeccc2290fd40117b9bc4a798c2f1335e3532 HTTP 302
    http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6934337644163760473&sub2=4525&sub... HTTP 302
    http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4 Page URL
  7. http://tare.pro/go/216668/575137?wnw=true Page URL
  8. http://tare.pro/ad/ad?p=216668&w=575137&t=81a94f82953cbf23&r=aHR0cCUzQSUyRiUyRm1hbnVxYXMuY29... HTTP 303
    http://dreams.ninja/25dex.html Page URL
  9. https://harassfinreach.com/phkgws5f?key=c28dc212c4fb024da2cf686f02c9d417 HTTP 302
    https://dreamsnest.com/comecome Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

12
Requests

75 %
HTTPS

45 %
IPv6

11
Domains

12
Subdomains

10
IPs

2
Countries

276 kB
Transfer

635 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://installyourfiles.com/show.php?l=0&u=361033&id=32329 Page URL
  2. https://go.secureclickers.com/click?pid=100&offer_id=9720&sub1=1085787320&sub2=100_361033 Page URL
  3. https://yo.wackotracko.com/click?pid=2&offer_id=719&sub1=1085787320&sub2=100&sub3=100_361033&sub4=9720&sub5=DK&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36 Page URL
  4. https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466 Page URL
  5. https://get.w0pt0p.online/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
  6. https://get.w0pt0p.online/proc.php?0c9eeccc2290fd40117b9bc4a798c2f1335e3532 HTTP 302
    http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6934337644163760473&sub2=4525&sub3=4525-7d98cc5b HTTP 302
    http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4 Page URL
  7. http://tare.pro/go/216668/575137?wnw=true Page URL
  8. http://tare.pro/ad/ad?p=216668&w=575137&t=81a94f82953cbf23&r=aHR0cCUzQSUyRiUyRm1hbnVxYXMuY29tJTJG&vw=1600&vh=1200 HTTP 303
    http://dreams.ninja/25dex.html Page URL
  9. https://harassfinreach.com/phkgws5f?key=c28dc212c4fb024da2cf686f02c9d417 HTTP 302
    https://dreamsnest.com/comecome Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://get.w0pt0p.online/proc.php?0c9eeccc2290fd40117b9bc4a798c2f1335e3532 HTTP 302
  • http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6934337644163760473&sub2=4525&sub3=4525-7d98cc5b HTTP 302
  • http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4
Request Chain 7
  • http://tare.pro/ad/ad?p=216668&w=575137&t=81a94f82953cbf23&r=aHR0cCUzQSUyRiUyRm1hbnVxYXMuY29tJTJG&vw=1600&vh=1200 HTTP 303
  • http://dreams.ninja/25dex.html

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
show.php
installyourfiles.com/ 		602 B
834 B 		Document
General
Check archive.org
Download Go to
Full URL
https://installyourfiles.com/show.php?l=0&u=361033&id=32329
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::ac43:49e3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6baa69f9cef8b25ab9e22c5f91cad229358241fbcd0a07bd0f13c8d101a2a1ed

Request headers

:method
GET
:authority
installyourfiles.com
:scheme
https
:path
/show.php?l=0&u=361033&id=32329
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 28 Feb 2021 15:31:37 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=da15ba131e0bce2f17cd76b719d003ba51614526296; expires=Tue, 30-Mar-21 15:31:36 GMT; path=/; domain=.installyourfiles.com; HttpOnly; SameSite=Lax
cf-cache-status
DYNAMIC
cf-request-id
088add4b2c00004abcaf358000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Uvh8X83KA1QWrlzLwVe4AbK9nqmRMndQ6QtxouRofCzxCH5On8FvFK5EJF%2BIufQZ3GUbFdHwQkSUZG6sWplgpf394LwIBypm9bU2ufCKmzSb7H%2B2JgtrfhpDJObZcc%2B5pw%3D%3D"}]}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
628b318b7c104abc-FRA
content-encoding
br
click
go.secureclickers.com/ 		394 B
391 B 		Document
General
Check archive.org
Download Go to
Full URL
https://go.secureclickers.com/click?pid=100&offer_id=9720&sub1=1085787320&sub2=100_361033
Requested by
Host: installyourfiles.com
URL: https://installyourfiles.com/show.php?l=0&u=361033&id=32329
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
50f1a54d3e5c2fcff72e9dbbaa62fb419a144b935eed5ec24c9a80787a4a18b7

Request headers

:method
GET
:authority
go.secureclickers.com
:scheme
https
:path
/click?pid=100&offer_id=9720&sub1=1085787320&sub2=100_361033
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://installyourfiles.com/show.php?l=0&u=361033&id=32329
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://installyourfiles.com/show.php?l=0&u=361033&id=32329

Response headers

server
nginx
date
Sun, 28 Feb 2021 15:31:37 GMT
content-type
text/html; charset=utf-8
content-encoding
gzip
click
yo.wackotracko.com/ 		277 B
387 B 		Document
General
Check archive.org
Download Go to
Full URL
https://yo.wackotracko.com/click?pid=2&offer_id=719&sub1=1085787320&sub2=100&sub3=100_361033&sub4=9720&sub5=DK&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
b76473bb931169c2b665978e9f5fe900af0a3b203f787a557e2df03e1a1f682c

Request headers

:method
GET
:authority
yo.wackotracko.com
:scheme
https
:path
/click?pid=2&offer_id=719&sub1=1085787320&sub2=100&sub3=100_361033&sub4=9720&sub5=DK&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Sun, 28 Feb 2021 15:31:37 GMT
content-type
text/html; charset=utf-8
set-cookie
afclick=603bb7593585e90001bd5466; expires=Mon, 28 Feb 2022 15:31:37 GMT; secure; SameSite=None
content-encoding
gzip
/
get.w0pt0p.online/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.104.36.157 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.4.10
Resource Hash
36d615a6a2e6e14dc091b38c906e5898d5618e84c8bcd96442fd9928293e4c86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
get.w0pt0p.online
:scheme
https
:path
/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Sun, 28 Feb 2021 15:31:37 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/7.4.10
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
set-cookie
u=267699890bd7f30b4eb3facd9e040bb0; expires=Mon, 28-Feb-2022 15:31:37 GMT; Max-Age=31536000; path=/
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip
/
get.w0pt0p.online/ 		9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://get.w0pt0p.online/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
Requested by
Host: get.w0pt0p.online
URL: https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.104.36.157 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.4.10
Resource Hash
06d80da5b26b6493db4d3e6dc01cbe546f43b1ccbd340b1a8157d3ef5adad898
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
get.w0pt0p.online
:scheme
https
:path
/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
u=267699890bd7f30b4eb3facd9e040bb0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://get.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=603bb7593585e90001bd5466

Response headers

server
nginx
date
Sun, 28 Feb 2021 15:31:37 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
x-powered-by
PHP/7.4.10
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip
Cookie set swim
manuqas.com/dile/
Redirect Chain
  • https://get.w0pt0p.online/proc.php?0c9eeccc2290fd40117b9bc4a798c2f1335e3532
  • http://tracking.armorads.com/sl?id=5faa890a127bd6bcbd27203b&pid=4&sub1=M6934337644163760473&sub2=4525&sub3=4525-7d98cc5b
  • http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4
Requested by
Host: get.w0pt0p.online
URL: https://get.w0pt0p.online/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
Protocol
HTTP/1.1
Server
172.64.142.2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd114f4a5c970f25ea95e8048e8a9cda7d0c32d8708aaf83a08c60d31b0f8389

Request headers

Host
manuqas.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://get.w0pt0p.online/?utm_term=6934337644163760473&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f#

Response headers

Date
Sun, 28 Feb 2021 15:31:38 GMT
Content-Type
text/html;charset=ISO-8859-1
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d23701a7a05fd4b890cbf367e327f09f21614526298; expires=Tue, 30-Mar-21 15:31:38 GMT; path=/; domain=.manuqas.com; HttpOnly; SameSite=Lax
Referrer-Policy
origin
Cache-control
no-store, no-cache
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
088add4ff400004e9283a89000000001
Report-To
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lVHeMF8WYNcRIV12c7iI6s1V6k4C9kk7S%2FfYUHOAkVQr2oDa6b80XoleFZZPzH46%2FikkdACDw%2BnoAdjT6QurQPo4UKBwjWbcPyWZ8g%3D%3D"}],"max_age":604800}
NEL
{"max_age":604800,"report_to":"cf-nel"}
Server
cloudflare
CF-RAY
628b31931bc54e92-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Sun, 28 Feb 2021 15:31:38 GMT
Content-Length
0
Connection
keep-alive
Set-Cookie
__cfduid=d6e282c47f444a192193d7fa9156e85681614526297; expires=Tue, 30-Mar-21 15:31:37 GMT; path=/; domain=.armorads.com; HttpOnly; SameSite=Lax
Referer
Referrer-Policy
no-referrer
Location
http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4
CF-Cache-Status
DYNAMIC
cf-request-id
088add4f7500001d1e76348000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZdFvwAPwr1%2BoH0Ygb5Fotkgl1g%2BQrz5uF7f3oRovlUv4Pe%2BuqH9aVtPFiBSZ4RFDhjWDtYn6SUy0NrWO0ODh1I7aF%2Fwda4niv1dCDGrn%2B2diR4Jz%2FBA%3D"}],"group":"cf-nel","max_age":604800}
NEL
{"max_age":604800,"report_to":"cf-nel"}
Server
cloudflare
CF-RAY
628b31925c8d1d1e-CPH
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
575137
tare.pro/go/216668/ 		462 B
498 B 		Document
General
Check archive.org
Download Go to
Full URL
http://tare.pro/go/216668/575137?wnw=true
Requested by
Host: manuqas.com
URL: http://manuqas.com/dile/swim?five=JQSUGdQN%2BZi89ZUMq5ZJhg%3D%3D&clk=&sid=4
Protocol
HTTP/1.1
Server
52.201.162.15 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-162-15.compute-1.amazonaws.com
Software
nginx /
Resource Hash
581d8f1d71684a71a538ad6f5dd145e7cfd7c98b71aad68afe274607b08c673d

Request headers

Host
tare.pro
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://manuqas.com/
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://manuqas.com/

Response headers

Content-Encoding
gzip
Content-Type
text/html
Date
Sun, 28 Feb 2021 15:31:38 GMT
Server
nginx
Vary
Accept-Encoding
Content-Length
310
Connection
keep-alive
Cookie set 25dex.html
dreams.ninja/
Redirect Chain
  • http://tare.pro/ad/ad?p=216668&w=575137&t=81a94f82953cbf23&r=aHR0cCUzQSUyRiUyRm1hbnVxYXMuY29tJTJG&vw=1600&vh=1200
  • http://dreams.ninja/25dex.html
316 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://dreams.ninja/25dex.html
Requested by
Host: tare.pro
URL: http://tare.pro/go/216668/575137?wnw=true
Protocol
HTTP/1.1
Server
2606:4700:3031::ac43:8067 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1585168a0e67cb4dfc6f91d43572847eeca328cebeabcbb7ff6a1a2351d7f767

Request headers

Host
dreams.ninja
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://tare.pro/go/216668/575137?wnw=true
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://tare.pro/go/216668/575137?wnw=true

Response headers

Date
Sun, 28 Feb 2021 15:31:38 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d1512b577919187f95fad6ee89153e2711614526298; expires=Tue, 30-Mar-21 15:31:38 GMT; path=/; domain=.dreams.ninja; HttpOnly; SameSite=Lax
cf-request-id
088add521c000005fd049fe000000001
Report-To
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eW2MKscYyt9E6CTna3CamScEZ8W8K%2BwRAd9aDQR0kBJJwuhCn54qZ4KBNGRYXc8D2bu5EZNFI0jzbYrdFpP0e1k42mD%2FOsk8PmBqTHaKImODX%2FCmjcsMfTI%3D"}],"max_age":604800}
NEL
{"max_age":604800,"report_to":"cf-nel"}
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
628b31969d8405fd-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Content-Type
text/html; charset=utf-8
Date
Sun, 28 Feb 2021 15:31:38 GMT
Location
http://dreams.ninja/25dex.html
Server
nginx
Content-Length
57
Connection
keep-alive
Primary Request comecome
dreamsnest.com/
Redirect Chain
  • https://harassfinreach.com/phkgws5f?key=c28dc212c4fb024da2cf686f02c9d417
  • https://dreamsnest.com/comecome
348 KB
262 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dreamsnest.com/comecome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:b3df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49d9424f4d787ddfdd57bc59578184240fbc95a0c71758955bd199ff70cb04e4

Request headers

:method
GET
:authority
dreamsnest.com
:scheme
https
:path
/comecome
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://dreams.ninja/25dex.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://dreams.ninja/25dex.html

Response headers

date
Sun, 28 Feb 2021 15:31:41 GMT
content-type
text/html;charset=UTF-8
set-cookie
__cfduid=d9768e1d124beac36e652693570e1981d1614526301; expires=Tue, 30-Mar-21 15:31:41 GMT; path=/; domain=.dreamsnest.com; HttpOnly; SameSite=Lax; Secure
cf-request-id
088add5e9d0000dfd779bd9000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GIG5K7QezmmGIVq3%2BEqFfs6bHLZUjmrOtPKRL7ObW8F26Eud%2F1H%2BQNKH6oyjSwDKXuaEeCt2RFnrQfGdym0PRJNaQs2OZt8zCKLE5ZqF%2B4QXQvEtYOabsYVa6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
server
cloudflare
cf-ray
628b31aa9c1ddfd7-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Server
nginx/1.17.6
Date
Sun, 28 Feb 2021 15:31:41 GMT
Content-Type
text/html
Content-Length
0
Connection
keep-alive
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location
https://dreamsnest.com/comecome
Set-Cookie
u_pl=15872591; expires=Mon, 01 Mar 2021 15:31:41 GMT backurled=c28dc212c4fb024da2cf686f02c9d417; expires=Sun, 28 Feb 2021 15:32:41 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control
no-cache
X-Request-ID
be7891862b88ef8ade8e9a017af43c83
Strict-Transport-Security
max-age=0; includeSubdomains
beacon.min.js
static.cloudflareinsights.com/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js
Requested by
Host: dreamsnest.com
URL: https://dreamsnest.com/comecome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b426c6bd8d3fa03a9c575fda5ce95829e721e4e47ecc33185c1be4e77528c784

Request headers

Referer
https://dreamsnest.com/comecome
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 28 Feb 2021 15:31:41 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cross-origin-resource-policy
cross-origin
cf-ray
628b31ab1bc0dfa5-FRA
cf-request-id
088add5eee0000dfa52428c000000001
truncated
/ 		260 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3828ad8d87f7d2549faeffc0f7542f4d6adc638f5c7e184368effc8b89712692

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
rum
cloudflareinsights.com/cdn-cgi/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://cloudflareinsights.com/cdn-cgi/rum
Protocol
H2
Server
2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://dreamsnest.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 28 Feb 2021 15:31:41 GMT
content-type
text/plain
access-control-allow-origin
https://dreamsnest.com
access-control-allow-methods
POST,OPTIONS
access-control-allow-headers
Content-Type
access-control-max-age
86400
vary
Origin
access-control-allow-credentials
true
server
cloudflare
cf-ray
628b31ab5e602c32-FRA
x-frame-options
DENY
x-content-type-options
nosniff
content-encoding
gzip
rum
cloudflareinsights.com/cdn-cgi/ 		0
78 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cloudflareinsights.com/cdn-cgi/rum
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://dreamsnest.com/comecome
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type
application/json

Response headers

date
Sun, 28 Feb 2021 15:31:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://dreamsnest.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
628b31ab6e7a2c32-FRA
vary
Origin

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
.dreamsnest.com/ Name: __cfduid
Value: d9768e1d124beac36e652693570e1981d1614526301