urlscan.io logo urlscan.io
SecurityTrails logo

posterstairs.info Open in urlscan Pro
2606:4700:3035::ac43:a656  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.hotlasvegascasino.com/CAxJYpvZ988.pdf?VNFbyphFhJDHC=DrdhCPfDgkvwj1fh01b202wiku01nh0j011mo180lo322lhc9r==
Effective URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Submission: On August 13 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 5 domains to perform 16 HTTP transactions. The main IP is 2606:4700:3035::ac43:a656, located in United States and belongs to CLOUDFLARENET, US. The main domain is posterstairs.info.
TLS certificate: Issued by GTS CA 1P5 on July 6th 2023. Valid for: 3 months.
This is the only time posterstairs.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 104.223.59.34 8100 (ASN-QUADR...)
1 193.25.219.15 8100 (ASN-QUADR...)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
10 2606:4700:303... 13335 (CLOUDFLAR...)
5 2a06:98c1:312... 13335 (CLOUDFLAR...)
16 3
1    104.223.59.34 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 104.223.59.34.static.quadranet.com
www.hotlasvegascasino.com
1    193.25.219.15 (Ashburn, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
franticshades.com
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
uniformdinner.com
10    2606:4700:3035::ac43:a656 (United States)

ASN13335 (CLOUDFLARENET, US)
posterstairs.info
5    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
trk-essursta.com
event.trk-essursta.com
Apex Domain
Subdomains		 Transfer
10 posterstairs.info
posterstairs.info
46 KB
5 trk-essursta.com
trk-essursta.com — Cisco Umbrella Rank: 318395
event.trk-essursta.com — Cisco Umbrella Rank: 334715
3 KB
1 uniformdinner.com
uniformdinner.com
677 B
1 franticshades.com
franticshades.com
435 B
1 hotlasvegascasino.com
www.hotlasvegascasino.com
295 B
16 5
Domain Requested by
10 posterstairs.info franticshades.com
posterstairs.info
4 event.trk-essursta.com trk-essursta.com
1 trk-essursta.com posterstairs.info
1 uniformdinner.com 1 redirects
1 franticshades.com
1 www.hotlasvegascasino.com 1 redirects
16 6

This site contains no links.

Subject Issuer Validity Valid
franticshades.com
R3		 2023-07-19 -
2023-10-17		 3 months crt.sh
posterstairs.info
GTS CA 1P5		 2023-07-06 -
2023-10-04		 3 months crt.sh
trk-essursta.com
GTS CA 1P5		 2023-06-23 -
2023-09-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Frame ID: 4157AF55B02E866C3371A2A287175EDA
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

McAfee Anti-Virus

Page URL History Show full URLs

  1. http://www.hotlasvegascasino.com/CAxJYpvZ988.pdf?VNFbyphFhJDHC=DrdhCPfDgkvwj1fh01b202wiku01nh0j011mo180lo322l... HTTP 302
    https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l... Page URL
  2. https://uniformdinner.com/?s1=350886&s2=1036809099&s3=5896&s4=3170&s10=3229 HTTP 302
    https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46 Page URL

Page Statistics

16
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

3
IPs

1
Countries

49 kB
Transfer

65 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.hotlasvegascasino.com/CAxJYpvZ988.pdf?VNFbyphFhJDHC=DrdhCPfDgkvwj1fh01b202wiku01nh0j011mo180lo322lhc9r== HTTP 302
    https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245 Page URL
  2. https://uniformdinner.com/?s1=350886&s2=1036809099&s3=5896&s4=3170&s10=3229 HTTP 302
    https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.hotlasvegascasino.com/CAxJYpvZ988.pdf?VNFbyphFhJDHC=DrdhCPfDgkvwj1fh01b202wiku01nh0j011mo180lo322lhc9r== HTTP 302
  • https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
935547806_193-32-248-245
franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/
Redirect Chain
  • http://www.hotlasvegascasino.com/CAxJYpvZ988.pdf?VNFbyphFhJDHC=DrdhCPfDgkvwj1fh01b202wiku01nh0j011mo180lo322lhc9r==
  • https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245
138 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.25.219.15 Ashburn, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
138
content-type
text/html; charset=UTF-8
date
Sun, 13 Aug 2023 02:13:26 GMT
server
Apache

Redirect headers

Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sun, 13 Aug 2023 02:13:32 GMT
Location
https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245
Server
Apache
Primary Request ddd6086101e9342e1b786020e52b0b46
posterstairs.info/
Redirect Chain
  • https://uniformdinner.com/?s1=350886&s2=1036809099&s3=5896&s4=3170&s10=3229
  • https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Requested by
Host: franticshades.com
URL: https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a106b5474b23b82912285fc2e5dddd0565c68958716eaa8e75295a39e4826ae5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://franticshades.com/0/0/0/437bf65704ebd9716c3d2c1bcea6f563/1_809055_2774755/2112_4876302_0lo322l_44/935547806_193-32-248-245
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7f5d705c88e3bb71-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sun, 13 Aug 2023 02:13:27 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IZ6naUnvKowq7WxzHUDo1AjVUs1QfONI8vDVoB%2Fshw6pAIrNAPFZRhq8P1%2BWc9pHGu6M0tS0nf84MB%2FRG8ooX2f1FjaQ60IuQrZPgZhyq4QS70BqdRUCtdHxiPsfmDya%2F0GJ%2FlwUxovU56Y1aSsVYA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
7f5d7057f8061e4a-FRA
content-type
text/html; charset=UTF-8
date
Sun, 13 Aug 2023 02:13:26 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WBjNTNMwnhZ%2FxXQcJYzb%2FT1fjNsK9Vw7xRhpBU0TOgNJTIQqgcTF8OfwFOnisX9Y2wTBX5KuFuMMTF0UdLptMCsCwRUPpH8O6oFysAqM7BXAMO4NDoMgeoDz4BczAhUJ36glK9xc3iuf5VBzSy1k4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
_style0.css
posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/_style0.css
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9189c40bb35200cebcea3cb51d71949301d5973176bf8e4ebf4171000949ec2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding
binary
content-disposition
inline; filename="/home/verticals/advertorials/views/mcafee/google-malware-us-v2/assets/_style0.css"
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=myDQmqbeuaoo30HKKCOy8bu%2BuyBpzlBl1i6USG%2BVPkMxbBmfCpSX7APVbQTSDoWD4MekilYR%2FuNOntBTWn5cfuKnTamqLqEvTnJZYqbLRLP16QMDEBuU9PIvE5MTVALW1qDa1WRK0liobpgyauSRWg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate
cf-ray
7f5d705ffafdbb71-FRA
expires
Thu, 19 Nov 1981 08:52:00 GMT
style.css
posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/ 		368 B
596 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/style.css
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9969c8de6ccc88ccdb237fc9034ff4feb3459adb511d16fc3463f824355bd312
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding
binary
content-disposition
inline; filename="/home/verticals/advertorials/views/mcafee/google-malware-us-v2/assets/style.css"
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kMiJbMfVebTtY2vs1grO4inQDEGfmsaqBa2Jyjz3mju637IMrh5ByjqufmY8vhcZMOrWFDIH9wWscAXXkmhP8NMehPqzljEMYjgehfWHbBAcsz3475Bn9Sf6CFooXlsgU8l3Hu9InOqZeshRJbINKA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate
cf-ray
7f5d705ffafebb71-FRA
expires
Thu, 19 Nov 1981 08:52:00 GMT
script.js
posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/ 		1 KB
690 B 		Script
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/fim/23de8ac7efac3b2739b0bb50deb4c6e9/script.js
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
762861b793c529836994eb25a7291ba81c10baee61666aae4fb6e3eaa87c82af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding
binary
content-disposition
inline; filename="/home/verticals/advertorials/views/mcafee/google-malware-us-v2/assets/script.js"
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uVwQcT92k9kogW150Z5qnSnBaHqRDvGE5bXR2ggZW6O6ti5%2B1Yg6f6qL5xnBrvipBwu10G3hrWTL4%2BPRSyZByDqri6PjyHPzQL5Oe%2FoEOK438OqSPZeJS%2FCluKHammu%2BQ5MYrnNftk3buwIhYbZlgw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate
cf-ray
7f5d705ffaffbb71-FRA
expires
Thu, 19 Nov 1981 08:52:00 GMT
msg.v3.js
posterstairs.info/inc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/inc/msg.v3.js?64d83c478c568
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
448b2102656fc14a1cd8cc0e30a1d41aca27281ed91b00fb7cf5a23c7d8f8749
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 11 Jul 2023 21:35:45 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qNLgjrELN2VBG8utImSRIXFjI9nZXUXZ%2BLccujpexwtO01xG7Lxt6g3Mj0KrELGk%2FVKs8RgNqltkKaNt9%2Bm03Q0Ms7O4Jhz%2FXIwUOIG0tsyP%2Bitp9GzMi7BG6HSaZkJnsETJBW3l%2Blrj2tGnfSGJGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
7f5d705ffb01bb71-FRA
expires
Sun, 20 Aug 2023 02:13:27 GMT
1f809d2cc501755e86d95bf220aeb8e5.png
posterstairs.info/fim/3229/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://posterstairs.info/fim/3229/1f809d2cc501755e86d95bf220aeb8e5.png
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f35d5b8560544ef2d2b83d02f4b34b8e2afa1b82afd2594fe9ee62e5c112cc39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
10752
x-xss-protection
1; mode=block
last-modified
Sun, 13 Aug 2023 01:53:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWuztZFx1v9m%2F87FRh%2BU6rLF9F5JW%2BVpV3%2BvW89kDgeUG%2BTdgKTToHt7%2FwI8PJKG8HZOguxjJR%2FgifSlwxUZ3WnzpEqHofg10REsZvG5eJihJfvz4wNMi6PDxO2OysC2nqWUw9HG%2FtUaG6wJjCsh9A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
7f5d70632f5a383a-FRA
expires
Sun, 20 Aug 2023 02:13:28 GMT
7e7452b02b866540d6d77145d5c715e8.png
posterstairs.info/fim/3229/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://posterstairs.info/fim/3229/7e7452b02b866540d6d77145d5c715e8.png
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1a5ce6b7f2a2e4599acaf82195b2719023d9735475de984c69373f49382c717
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
2816
x-xss-protection
1; mode=block
last-modified
Sun, 13 Aug 2023 01:53:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C5MqmBfX4jVlvIWbeD78VfrU62nTcuYyXrV3Z91w4SNTSlqHa9vxV%2B5os6zEf7uHJoUnwuukzfq27O7KV4p0aoGK6hOT7JQSfnEE%2BMC1KNC4JeCYG0i7vS9O59frQzjmMXmWLkGntR%2BbDTENMaS88g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
7f5d7064081c383a-FRA
expires
Sun, 20 Aug 2023 02:13:28 GMT
v9e118mez8
trk-essursta.com/scripts/push/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-essursta.com/scripts/push/v9e118mez8
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/inc/msg.v3.js?64d83c478c568
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c65c15e3af0d349af61501f7749076aacef349171d95638bb475f800d8367084
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=86kQ1H4bzW2JpbOoLZVL4HTb2CX4PZXv4NBsbFhbhRLmgmL43kTOBaH8Sh%2B7067%2FVa3DMmqxK8HhvmaVakfUD9ATBzyNbzAPF%2F3ENIUjrzWDOX%2B1joQOqXrDWlXwYzoCh%2FFs%2Fwl9SXgLfuB2N7Av"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
7f5d70648a2c35f7-FRA
expires
0
img1.jpeg
posterstairs.info/views/mcafee/google-malware-us-v2/assets/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://posterstairs.info/views/mcafee/google-malware-us-v2/assets/img1.jpeg
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
68bd43afffdd14a7f819839e34914e40358fc737841b254e6e5f341c5eac0fcd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
117783
alt-svc
h3=":443"; ma=86400
content-length
11841
x-xss-protection
1; mode=block
last-modified
Tue, 08 Aug 2023 14:34:20 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/jpeg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3lEH6V6zZKYDvjj2Oa7ViujRTL1mvwn8Nj40zHDDH2EfEjoHF522P4dvPts1zv8h1aXYEK%2BAtifL7Hj8frtAqz2I35LvkubzLH0bFU10FuDiD0YbJ3Ju%2BOqhyNF%2Bbzsx%2FN%2BCIUrboBwO%2BUy1JNIa0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
7f5d70640821383a-FRA
expires
Fri, 18 Aug 2023 17:30:25 GMT
cs4.mp3
posterstairs.info/views/mcafee/google-malware-us-v2/assets/ 		10 KB
10 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/views/mcafee/google-malware-us-v2/assets/cs4.mp3
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5dbb717513e60e28d05796164577a06f908500f177ad4a0db44b8a93dcb5c8cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Range
bytes=0-

Response headers

date
Sun, 13 Aug 2023 02:13:28 GMT
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-9805/9806
alt-svc
h3=":443"; ma=86400
Content-Length
9806
x-xss-protection
1; mode=block
last-modified
Tue, 08 Aug 2023 14:34:20 GMT
server
cloudflare
vary
User-Agent,User-Agent, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
audio/mpeg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OLPtSontG9HjptJgTSiILXcjS6WexAfzVWbNE6qQEDOIJaS6J8LIpvHul%2BwkJpUtWkFTkyckwZFHNZdU%2FskOOw9yt%2BRviJdeImX0zMcWCFS7viOhySlidnUDz57tZBkLYl9Avjjnp7c%2FxORxaJpU%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
7f5d70642836383a-FRA
ddd6086101e9342e1b786020e52b0b46
posterstairs.info/ 		25 B
585 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Requested by
Host: posterstairs.info
URL: https://posterstairs.info/inc/msg.v3.js?64d83c478c568
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:a656 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c17435e1a09ed89d29dab00015da616c16e39da1c5daf5f8c8026dcbcf5836a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Sun, 13 Aug 2023 02:13:29 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/json
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zxbZ3i5BQv2fr%2FSUeZ98vCeq6Z7aGwbKJ8f0Bf7f4tv7Vfmx0R4mA6jodwzNmBThMox%2BC8%2BQK2FYPChyWisY3tf3JoZ6GnuA3yOsfZuRcBp6mET4xpRrNZyboPDSundjQhfCyu6W1W4Fb6chbaJewA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate
cf-ray
7f5d70671a17383a-FRA
expires
Thu, 19 Nov 1981 08:52:00 GMT
v9e118mez8
event.trk-essursta.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-essursta.com/register/event_log/v9e118mez8
Requested by
Host: trk-essursta.com
URL: https://trk-essursta.com/scripts/push/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Sun, 13 Aug 2023 02:13:29 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HwiJsjekNdkm4pG8lapKHg34ZVWpqsq8M4Z9Q3PEzK3lMIMjETfSEuKSf4lwKxpfW%2FW43quEmWdpD9G%2BrvN7tVDEobk26FCn1pWdGmdOoYkiweGjJvylDffDbzN%2BuTY6BBr%2BKqReGdQeLoW95HifdtdwSaME"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://posterstairs.info
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
7f5d706b8af13688-FRA
x-pushplatformapp-params
v9e118mez8
event.trk-essursta.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-essursta.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://posterstairs.info
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://posterstairs.info
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7f5d706909303688-FRA
content-length
0
date
Sun, 13 Aug 2023 02:13:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2lkPAzhfMXYdDuqxSpDc4iCzh6Bi4ch2CeW1JU3Ny7xEmBGhQazWTEFARrpXzqSGgHtENK%2FbFDGqyR9TX9vbP6TRVhSzKump9pC0F4zOxeWn0bduoI2H92Gm1TseEE0a%2BfVMAj9yBP0%2BcvfPwVQJyFusMBrk"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
v9e118mez8
event.trk-essursta.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-essursta.com/register/event_log/v9e118mez8
Requested by
Host: trk-essursta.com
URL: https://trk-essursta.com/scripts/push/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Sun, 13 Aug 2023 02:13:29 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g7O2MTsWk6C%2F3gZsEkcIXma%2FcJADETLcoxmeaf3Ea%2B0QMzRHLWWcbF1FXY6yQfPa5pceIcKKo3MJpmv126pmU6kXE4DpXzegR82n%2F3b7NotoH%2FotQ2fwcSgQnfD2Bsv91KSl70Gl7zpGH0PqYvuI5%2FrwjBxN"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://posterstairs.info
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
7f5d706b8aef3688-FRA
x-pushplatformapp-params
v9e118mez8
event.trk-essursta.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-essursta.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://posterstairs.info
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://posterstairs.info
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7f5d706909323688-FRA
content-length
0
date
Sun, 13 Aug 2023 02:13:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4NA9hgF%2B42atvzx%2FzUGynYzcTeAhvYPbPBesPvL9Un3v14JUHX0sw91MFLK2UHp6jOpDW5gV%2FqZ18Iq76t8dHG68gYd13M8dhGw5bpdrnIFf2eFfIzQH%2Fq1m1Ad8b7BMESpM5QpHwsW7AmXh93nqFLoqFe9E"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| timer function| countdown function| change function| pushCount object| MYCALL string| s1 string| s2 string| fp string| esource string| pshpub string| pshdomain string| pshfingerprint object| currentdate object| months function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore

3 Cookies

Domain/Path Name / Value
franticshades.com/ Name: uid5896
Value: 1036809099-20230812221326-f43c07091b34b5667d6af74b792eab19-3170
uniformdinner.com/ Name: PHPSESSID
Value: 282fa8ab566deca7a9eb07681287843b
posterstairs.info/ Name: PHPSESSID
Value: 300f6061fc72ee2447d392fc1ecd5fd6

1 Console Messages

Source Level URL
Text
other error URL: https://posterstairs.info/ddd6086101e9342e1b786020e52b0b46
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.