ak.hetahien.com Open in urlscan Pro
2.19.126.95 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://j0nn2c98.daeu971.pics/
Effective URL:
https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e
Submission: On November 07 via manual (November 7th 2023, 8:57:52 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 12 domains to perform 10 HTTP transactions. The main IP is 2.19.126.95, located in and belongs to . The main domain is ak.hetahien.com.
TLS certificate: Issued by R3 on October 30th 2023. Valid for: 3 months.

This is the only time ak.hetahien.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.194.9.60 104.194.9.60	23470 (RELIABLESITE) (RELIABLESITE)
1	216.137.189.80 216.137.189.80	55293 (A2HOSTING) (A2HOSTING)
1 1	3.222.98.215 3.222.98.215	14618 (AMAZON-AES) (AMAZON-AES)
1 1	64.227.23.114 64.227.23.114	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	67.212.184.147 67.212.184.147	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	104.18.32.223 104.18.32.223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2.19.126.95 2.19.126.95	() ()
1	95.101.148.132 95.101.148.132	() ()
1	139.45.195.8 139.45.195.8	() ()
2 2	34.147.37.248 34.147.37.248	() ()
1	35.201.76.95 35.201.76.95	() ()
1	72.246.168.139 72.246.168.139	() ()
10	9

1 104.194.9.60 (Piscataway, United States)

ASN23470 (RELIABLESITE, US)

j0nn2c98.daeu971.pics	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.137.189.80 (United States)

ASN55293 (A2HOSTING, US)
PTR: server.wolfpanels.cc

wolfpanels.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.222.98.215 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-98-215.compute-1.amazonaws.com

rb.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.227.23.114 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

polo.thegadgetguru.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.212.184.147 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

my.contentrightnow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.32.223 (None, )

ASN13335 (CLOUDFLARENET, US)

for-j.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.126.95 (None, )

ASN- ()

ak.hetahien.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.148.132 (None, )

ASN- ()

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (None, )

ASN- ()

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.147.37.248 (None, ) 2 redirects

ASN- ()

wildbearads.go2affise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wildbearads.g2afse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.76.95 (None, )

ASN- ()

www.cwn0drtrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.246.168.139 (None, )

ASN- ()

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	go-mpulse.net s.go-mpulse.net c.go-mpulse.net	50 KB
2	contentrightnow.com my.contentrightnow.com	4 KB
1	cwn0drtrk.com www.cwn0drtrk.com
1	g2afse.com 1 redirects wildbearads.g2afse.com	331 B
1	go2affise.com 1 redirects wildbearads.go2affise.com	187 B
1	rtmark.net my.rtmark.net	508 B
1	hetahien.com ak.hetahien.com	3 KB
1	for-j.com for-j.com — Cisco Umbrella Rank: 54029	14 KB
1	thegadgetguru.club 1 redirects polo.thegadgetguru.club	364 B
1	rb.gy 1 redirects rb.gy — Cisco Umbrella Rank: 122589	213 B
1	wolfpanels.cc wolfpanels.cc	283 B
1	daeu971.pics j0nn2c98.daeu971.pics	472 B
10	12

	Domain	Requested by
2	my.contentrightnow.com	wolfpanels.cc my.contentrightnow.com
1	c.go-mpulse.net	s.go-mpulse.net
1	www.cwn0drtrk.com	ak.hetahien.com
1	wildbearads.g2afse.com	1 redirects
1	wildbearads.go2affise.com	1 redirects
1	my.rtmark.net	ak.hetahien.com
1	s.go-mpulse.net	ak.hetahien.com
1	ak.hetahien.com	for-j.com
1	for-j.com	my.contentrightnow.com
1	polo.thegadgetguru.club	1 redirects
1	rb.gy	1 redirects
1	wolfpanels.cc	j0nn2c98.daeu971.pics
1	j0nn2c98.daeu971.pics
10	13

This site contains no links.

Subject Issuer	Validity	Valid
wolfpanels.cc R3	`2023-10-20` - `2024-01-18`	3 months	crt.sh
my.contentrightnow.com R3	`2023-09-25` - `2023-12-24`	3 months	crt.sh
for-j.com GTS CA 1P5	`2023-09-23` - `2023-12-22`	3 months	crt.sh
ak.hetaruwg.com R3	`2023-10-30` - `2024-01-28`	3 months	crt.sh
akstat.io DigiCert TLS RSA SHA256 2020 CA1	`2023-04-05` - `2024-04-04`	a year	crt.sh
rtmark.net R3	`2023-10-07` - `2024-01-05`	3 months	crt.sh
cwn0drtrk.com Starfield Secure Certificate Authority - G2	`2023-06-06` - `2024-05-03`	a year	crt.sh

This page contains 2 frames:

Frame: https://www.cwn0drtrk.com/8LJN3/H65MGM/?source_id=184_184_5460780&sub1=654aa4ce1551be00015a6876
Frame ID: 5B3B8C8D63C62636C78E8BB7358339E6
Requests: 8 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/LDA9V-XELL8-WJK28-ZAL9U-A63WA
Frame ID: 9F46592017556F9903C623D20E2FA414
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://j0nn2c98.daeu971.pics/ Page URL
https://rb.gy/o2zq3z HTTP 301
https://polo.thegadgetguru.club/?k=ef202c33ba40584012084b548432c1b6&type=mainstream&subtype=global HTTP 302
https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream... Page URL
https://my.contentrightnow.com/proc.php?19681b986bfb46b3d70f13b74ef70617657dad0a Page URL
https://for-j.com/tds3_2.html?zoneid=5460780&ymid=M7298827337909403704&sourceid=4400-9e76e65e&... Page URL
https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

12
Domains

13
Subdomains

9
IPs

2
Countries

73 kB
Transfer

264 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://j0nn2c98.daeu971.pics/ Page URL
https://rb.gy/o2zq3z HTTP 301
https://polo.thegadgetguru.club/?k=ef202c33ba40584012084b548432c1b6&type=mainstream&subtype=global HTTP 302
https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783 Page URL
https://my.contentrightnow.com/proc.php?19681b986bfb46b3d70f13b74ef70617657dad0a Page URL
https://for-j.com/tds3_2.html?zoneid=5460780&ymid=M7298827337909403704&sourceid=4400-9e76e65e&tt=2&geo=us Page URL
https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://rb.gy/o2zq3z HTTP 301
https://polo.thegadgetguru.club/?k=ef202c33ba40584012084b548432c1b6&type=mainstream&subtype=global HTTP 302
https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783

Request Chain 7

https://wildbearads.go2affise.com/click?pid=184&offer_id=11180&sub1=745861129372447389&sub2=5460780 HTTP 302
https://wildbearads.g2afse.com/click?pid=184&offer_id=11078&sub1=745861129372447389&sub2=184_5460780&sub4=11180&sub5= HTTP 302
https://www.cwn0drtrk.com/8LJN3/H65MGM/?source_id=184_184_5460780&sub1=654aa4ce1551be00015a6876

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
j0nn2c98.daeu971.pics/ 360 B
472 B 428ms
186ms Document
text/html 104.194.9.60
RELIABLESITE

General

Check archive.org

Show headers Download Go to

Full URL: http://j0nn2c98.daeu971.pics/
Protocol: HTTP/1.1
Server: 104.194.9.60 Piscataway, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c080634da73038a32a57053cb4d5a8847e22c2de0179b9d724639f86c8598243

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 07 Nov 2023 20:57:44 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H/1.1 200
OK a
wolfpanels.cc/ 58 B
283 B 476ms
153ms Script
text/html 216.137.189.80
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://wolfpanels.cc/a?name=gotti
Requested by: Host: j0nn2c98.daeu971.pics
URL: http://j0nn2c98.daeu971.pics/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 216.137.189.80 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS: server.wolfpanels.cc
Software: nginx/1.14.2 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://j0nn2c98.daeu971.pics/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 20:57:45 GMT
Content-Encoding: gzip
Server: nginx/1.14.2
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2

200

/ Show response
my.contentrightnow.com/
Redirect Chain

https://rb.gy/o2zq3z
https://polo.thegadgetguru.club/?k=ef202c33ba40584012084b548432c1b6&type=mainstream&subtype=global
https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783

8 KB
3 KB

928ms
157ms

Document
text/html

67.212.184.147
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783
Requested by: Host: wolfpanels.cc
URL: https://wolfpanels.cc/a?name=gotti
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.212.184.147 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/8.2.12
Resource Hash: d2244359ba7503844cf2ce236b135162debe60a2f06f44ea439614e9b59fe7f3

Request headers

Referer: http://j0nn2c98.daeu971.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 20:57:47 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.2.12

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 07 Nov 2023 20:57:46 GMT
Location: https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783
Server: nginx/1.16.1 (Ubuntu)

GET
H2 200 proc.php
my.contentrightnow.com/ 1 KB
1 KB 146ms
146ms Document
text/html 67.212.184.147
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://my.contentrightnow.com/proc.php?19681b986bfb46b3d70f13b74ef70617657dad0a
Requested by: Host: my.contentrightnow.com
URL: https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.212.184.147 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/8.2.12
Resource Hash

Request headers

Referer: https://my.contentrightnow.com/?utm_medium=9c35b5222fc2ff0fe1ebd5f2cf75ff10bf245093&utm_campaign=Mainstream_agress&cid=7478eb8b347bb194dcffb46ae2ea34b5&data4=176.115.236.15&1=4783
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 07 Nov 2023 20:57:47 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://for-j.com/tds3_2.html?zoneid=5460780&ymid=M7298827337909403704&sourceid=4400-9e76e65e&tt=2&geo=us
pragma: no-cache
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.2.12

GET
H2 200 tds3_2.html
for-j.com/ 45 KB
14 KB 1013ms
61ms Document
text/html 104.18.32.223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://for-j.com/tds3_2.html?zoneid=5460780&ymid=M7298827337909403704&sourceid=4400-9e76e65e&tt=2&geo=us
Requested by: Host: my.contentrightnow.com
URL: https://my.contentrightnow.com/proc.php?19681b986bfb46b3d70f13b74ef70617657dad0a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.32.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://my.contentrightnow.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 36196
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=2678400
cf-cache-status: HIT
cf-ray: 82287d9fcbf89b9a-FRA
content-encoding: br
content-type: text/html
date: Tue, 07 Nov 2023 20:57:48 GMT
expires: Fri, 08 Dec 2023 20:57:48 GMT
last-modified: Fri, 27 Oct 2023 10:22:36 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 Primary Request afu.php Show response
ak.hetahien.com/ 4 KB
3 KB 734ms
464ms Document
text/html 2.19.126.95

General

Check archive.org

Show headers Download Go to

Full URL

https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e

Requested by

Host: for-j.com
URL: https://for-j.com/tds3_2.html?zoneid=5460780&ymid=M7298827337909403704&sourceid=4400-9e76e65e&tt=2&geo=us

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.126.95 -, , ASN (),

Reverse DNS

Software

Resource Hash

4860dc0b1bde9b749c575d46bb028d6cd7d8a98ac5dbc09d90d72c1914d9c765

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 2293
content-type: text/html; charset=utf8
date: Tue, 07 Nov 2023 20:57:49 GMT
expires: Tue, 07 Nov 2023 20:57:49 GMT
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://wildbearads.go2affise.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
pragma: no-cache
server-timing: cdn-cache; desc=MISS edge; dur=8 origin; dur=161 ak_p; desc="1699390668968_34634079_3524015751_16903_882_8_469_255";dur=1
strict-transport-security: max-age=1
timing-allow-origin: * *
vary: Accept-Encoding
x-akamai-transformed: 9 650 0 pmb=mRUM,1
x-content-type-options: nosniff
x-trace-id: 1da0b9b22e7406fa156ec617891f2192

GET
H2 200 LDA9V-XELL8-WJK28-ZAL9U-A63WA Show response
s.go-mpulse.net/boomerang/ Frame 9F46 205 KB
49 KB 891ms
73ms Script
application/javascript 95.101.148.132

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/LDA9V-XELL8-WJK28-ZAL9U-A63WA
Requested by: Host: ak.hetahien.com
URL: https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 95.101.148.132 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:57:50 GMT
content-encoding: br
customappheader: mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified: Mon, 16 Oct 2023 14:48:03 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=604800
timing-allow-origin: *
content-length: 50393

POST
H2 200 img.gif
my.rtmark.net/ 43 B
508 B 213ms
65ms Ping
image/gif 139.45.195.8

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=2dc443f87ff343ec90134c836215518d

Requested by

Host: ak.hetahien.com
URL: https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:57:49 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: https://ak.hetahien.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

GET
H2

204

/
www.cwn0drtrk.com/8LJN3/H65MGM/
Redirect Chain

https://wildbearads.go2affise.com/click?pid=184&offer_id=11180&sub1=745861129372447389&sub2=5460780
https://wildbearads.g2afse.com/click?pid=184&offer_id=11078&sub1=745861129372447389&sub2=184_5460780&sub4=11180&sub5=
https://www.cwn0drtrk.com/8LJN3/H65MGM/?source_id=184_184_5460780&sub1=654aa4ce1551be00015a6876

0
0

348ms
159ms

Document
text/plain

35.201.76.95

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cwn0drtrk.com/8LJN3/H65MGM/?source_id=184_184_5460780&sub1=654aa4ce1551be00015a6876
Requested by: Host: ak.hetahien.com
URL: https://ak.hetahien.com/afu.php?zoneid=5460780&ymid=M7298827337909403704&var=4400-9e76e65e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.95 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://ak.hetahien.com/partitial/5578752/?var=5460780&ab2r=0&prfrev=false&rhd=false
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-Ch-Ua-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Nov 2023 20:57:50 GMT
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: b4397c24-d21a-45e5-a8f0-32178167ec52

Redirect headers

access-control-allow-origin: *
content-length: 0
date: Tue, 07 Nov 2023 20:57:50 GMT
location: https://www.cwn0drtrk.com/8LJN3/H65MGM/?source_id=184_184_5460780&sub1=654aa4ce1551be00015a6876
server: nginx
x-adjust-use-original-forwarded-for: 1

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 9F46 51 B
323 B 481ms
91ms XHR
application/json 72.246.168.139

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=LDA9V-XELL8-WJK28-ZAL9U-A63WA&d=ak.hetahien.com&t=5664636&v=1.720.0&if=&sl=0&si=7dd2a874-a881-4c75-affd-ddc442241917-s3ru8d&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=760894
Requested by: Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/LDA9V-XELL8-WJK28-ZAL9U-A63WA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 72.246.168.139 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88887c0577ebe9d352d46747b383994a932a62690f933d749be40ee6016463f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 07 Nov 2023 20:57:51 GMT
Cache-Control: private, max-age=120, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 51
Content-Type: application/json

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ak.hetahien.com
c.go-mpulse.net
for-j.com
j0nn2c98.daeu971.pics
my.contentrightnow.com
my.rtmark.net
polo.thegadgetguru.club
rb.gy
s.go-mpulse.net
wildbearads.g2afse.com
wildbearads.go2affise.com
wolfpanels.cc
www.cwn0drtrk.com
104.18.32.223
104.194.9.60
139.45.195.8
2.19.126.95
216.137.189.80
3.222.98.215
34.147.37.248
35.201.76.95
64.227.23.114
67.212.184.147
72.246.168.139
95.101.148.132
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
4860dc0b1bde9b749c575d46bb028d6cd7d8a98ac5dbc09d90d72c1914d9c765
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
88887c0577ebe9d352d46747b383994a932a62690f933d749be40ee6016463f8
c080634da73038a32a57053cb4d5a8847e22c2de0179b9d724639f86c8598243
d2244359ba7503844cf2ce236b135162debe60a2f06f44ea439614e9b59fe7f3

ak.hetahien.com Open in urlscan Pro 2.19.126.95 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

0 %IPv6

12 Domains

13 Subdomains

9 IPs

2 Countries

73 kBTransfer

264 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

ak.hetahien.com Open in urlscan Pro
2.19.126.95 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

0 %
IPv6

12
Domains

13
Subdomains

9
IPs

2
Countries

73 kB
Transfer

264 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions