Submitted URL: http://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd6608...
Effective URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd6608...
Submission: On March 31 via api from US — Scanned from US

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 185.105.110.5, located in Moscow, Russian Federation and belongs to EUROBYTE, RU. The main domain is sammyyyyyy.mcdir.me.
TLS certificate: Issued by R3 on February 5th 2024. Valid for: 3 months.
This is the only time sammyyyyyy.mcdir.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 185.105.110.5 210079 (EUROBYTE)
1 149.7.16.92 63023 (AS-GLOBAL...)
3 193.108.118.16 63023 (AS-GLOBAL...)
1 188.34.194.114 24940 (HETZNER-AS)
1 5.9.79.115 24940 (HETZNER-AS)
1 5.9.197.87 24940 (HETZNER-AS)
10 6
Apex Domain
Subdomains
Transfer
3 news-jicako.com
news-jicako.com
13 KB
3 mcdir.me
sammyyyyyy.mcdir.me
25 KB
1 cdn.house
img.cdn.house — Cisco Umbrella Rank: 14004
3 KB
1 partners.house
s3.partners.house
1 KB
1 revopush.com
show.revopush.com — Cisco Umbrella Rank: 20426
922 B
1 news-zacine.com
news-zacine.com — Cisco Umbrella Rank: 224635
9 KB
10 6
Domain Requested by
3 news-jicako.com sammyyyyyy.mcdir.me
news-jicako.com
3 sammyyyyyy.mcdir.me sammyyyyyy.mcdir.me
1 img.cdn.house
1 s3.partners.house sammyyyyyy.mcdir.me
1 show.revopush.com news-jicako.com
1 news-zacine.com sammyyyyyy.mcdir.me
10 6

This site contains links to these domains. Also see Links.

Domain
qwoyby.abadit5rckd.com
Subject Issuer Validity Valid
sammyyyyyy.mcdir.me
R3
2024-02-05 -
2024-05-05
3 months crt.sh
news-zacine.com
ZeroSSL ECC Domain Secure Site CA
2024-02-02 -
2024-05-02
3 months crt.sh
*.news-jicako.com
R3
2024-01-24 -
2024-04-23
3 months crt.sh
show.revopush.com
Go Daddy Secure Certificate Authority - G2
2024-03-22 -
2025-03-22
a year crt.sh
s3.partners.house
R3
2024-01-21 -
2024-04-20
3 months crt.sh
img.cdn.house
R3
2024-03-21 -
2024-06-19
3 months crt.sh

This page contains 1 frames:

Primary Page: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Frame ID: 3B5A5817D01BE830002E1DE2794939BF
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Age verification

Page URL History Show full URLs

  1. http://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286... HTTP 307
    https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286... Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

52 kB
Transfer

69 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350 HTTP 307
    https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
sammyyyyyy.mcdir.me/
Redirect Chain
  • http://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
  • https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
2 KB
2 KB
Document
General
Full URL
https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.105.110.5 Moscow, Russian Federation, ASN210079 (EUROBYTE, RU),
Reverse DNS
isp102.mchost.ru
Software
nginx/1.14.1 /
Resource Hash
4962561dc9384b41e588c5452f4f75dc56f1ac07b5abd8ee2dde4d3c906425fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-type
text/html
date
Sun, 31 Mar 2024 22:48:46 GMT
server
nginx/1.14.1
strict-transport-security
max-age=31536000;

Redirect headers

Location
https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Non-Authoritative-Reason
HttpsUpgrades
style.css
sammyyyyyy.mcdir.me/
5 KB
5 KB
Stylesheet
General
Full URL
https://sammyyyyyy.mcdir.me/style.css
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.105.110.5 Moscow, Russian Federation, ASN210079 (EUROBYTE, RU),
Reverse DNS
isp102.mchost.ru
Software
nginx/1.14.1 /
Resource Hash
fe0a365c65a52805e8a6e8120fbaa6b23dc254ce4065efecbbaec2673197c635
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:46 GMT
strict-transport-security
max-age=31536000;
last-modified
Mon, 17 Jul 2023 17:59:34 GMT
server
nginx/1.14.1
etag
"64b58186-1262"
content-type
text/css
accept-ranges
bytes
content-length
4706
https-v2.js
news-zacine.com/code/
9 KB
9 KB
Script
General
Full URL
https://news-zacine.com/code/https-v2.js?uid=177209&site=1220525018&banadu=0&sub1=sub1&sub2=sub2&sub3=sub3&sub4=sub4
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.7.16.92 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS
92-16-7-149.clients.gthost.com
Software
nginx /
Resource Hash
8547793f2152822c9daf7e50c472b1a3fcca2bb5ba9fd494db7c01bea9b0d34d

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:46 GMT
last-modified
Mon, 25 Mar 2024 08:51:19 GMT
server
nginx
etag
"66013b07-22a6"
content-type
application/javascript
cache-control
max-age=315360000
accept-ranges
bytes
content-length
8870
expires
Thu, 31 Dec 2037 23:55:55 GMT
process.js
news-jicako.com/
27 KB
11 KB
Script
General
Full URL
https://news-jicako.com/process.js?id=1220525018&p1=sub1&p2=sub2&p3=sub3&p4=sub4
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.108.118.16 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS
16-118-108-193.clients.gthost.com
Software
nginx /
Resource Hash
35413945dd05223e95e431d4c3c0d897ed352dc019fc130385de5a4148de8859

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sun, 31 Mar 2024 22:48:46 GMT
content-encoding
gzip
server
nginx
vary
Origin
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, must-revalidate
expires
0
3.png
sammyyyyyy.mcdir.me/i/
18 KB
18 KB
Image
General
Full URL
https://sammyyyyyy.mcdir.me/i/3.png
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.105.110.5 Moscow, Russian Federation, ASN210079 (EUROBYTE, RU),
Reverse DNS
isp102.mchost.ru
Software
nginx/1.14.1 /
Resource Hash
68b1dd768586aaeaff37127c5aea25f95b1cf86cf56a20410e526d7fb8dc7875
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:46 GMT
strict-transport-security
max-age=31536000;
last-modified
Mon, 17 Jul 2023 17:59:04 GMT
server
nginx/1.14.1
etag
"64b58168-4884"
content-type
image/png
accept-ranges
bytes
content-length
18564
/
show.revopush.com/api/v1/inpage/show/
719 B
922 B
Fetch
General
Full URL
https://show.revopush.com/api/v1/inpage/show/?uid=177209&subacc=1220525018&sub1=&sub2=&sub3=&sub4=&adult=true&limit=1&traffic=adult
Requested by
Host: news-jicako.com
URL: https://news-jicako.com/process.js?id=1220525018&p1=sub1&p2=sub2&p3=sub3&p4=sub4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.34.194.114 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.114.194.34.188.clients.your-server.de
Software
nginx /
Resource Hash
a22628d7557dad29a3a5e571303bb36692bfcf27c7319d48ea0f3465b6830347

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
https://sammyyyyyy.mcdir.me
date
Sun, 31 Mar 2024 22:48:47 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA, Sec-CH-UA-Model, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Wow64
server
nginx
vary
Origin
content-type
application/json
588.js
news-jicako.com/
4 KB
2 KB
Script
General
Full URL
https://news-jicako.com/588.js
Requested by
Host: news-jicako.com
URL: https://news-jicako.com/process.js?id=1220525018&p1=sub1&p2=sub2&p3=sub3&p4=sub4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.108.118.16 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS
16-118-108-193.clients.gthost.com
Software
nginx /
Resource Hash
bcd7c8afe24173b1cbc38d03d4d6b7f4b498e424bf9472e4894354857196e276

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:47 GMT
content-encoding
gzip
last-modified
Tue, 26 Mar 2024 13:19:08 GMT
server
nginx
etag
"6602cb4c-6e3"
content-type
application/javascript; charset=utf-8
accept-ranges
bytes
content-length
1763
defaultIcon.png
s3.partners.house/partners.house-subaccounts/
609 B
1 KB
Image
General
Full URL
https://s3.partners.house/partners.house-subaccounts/defaultIcon.png
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
5.9.79.115 Giessen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.115.79.9.5.clients.your-server.de
Software
nginx /
Resource Hash
4dcbf7d7699713e6a5a12fddb86a6c0273849e58cbe04809957f82ec219b3ecf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sun, 31 Mar 2024 22:48:47 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 18 Jan 2024 09:55:55 GMT
Server
nginx
X-Amz-Request-Id
17C1FB03FA53F902
ETag
"b8ad9819f28350bd064b3b1f05034397"
Vary
Origin, Accept-Encoding
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
609
X-Amz-Id-2
379fdbf77e309ed7a446dfb6e40ba552b879f9063d689df2d405b005f76b82f4
X-Xss-Protection
1; mode=block
572f03ce7fabf11169b0.svg
news-jicako.com/
669 B
414 B
Image
General
Full URL
https://news-jicako.com/572f03ce7fabf11169b0.svg
Requested by
Host: sammyyyyyy.mcdir.me
URL: https://sammyyyyyy.mcdir.me/?aref=https%3a%2f%2fqwoyby.abadit5rckd.com%2fsite%2fredirectpage%3fsid%3d286521%26hv%3dolcpd660850de00057946%26hid%3d766350
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.108.118.16 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS
16-118-108-193.clients.gthost.com
Software
nginx /
Resource Hash
6fcfb576e3dd91cdad5eac40d10dcada503b588271188e30eb4f68ba3b7a1510

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:47 GMT
content-encoding
gzip
last-modified
Tue, 26 Mar 2024 13:19:08 GMT
server
nginx
etag
W/"6602cb4c-29d"
content-type
image/svg+xml
-caQ_6SuOwPZkbWjhH-wlfuCW9PUDTUMz6MZmI1UVuCt5eiAUjMOrIDigpzVqda8utJeMUQH18sN3fdogePmFoHm2TlAyQ3SA1dXX3Gx35msyqYStgMcPzyG9JyHZomADqcmco_7ksIkOqrBVZ5qwNvR3uZw_swUeUhNV-kEH7ft6062T6l-b6pwESTBws6lq23tvJ4=
img.cdn.house/i/1/
3 KB
3 KB
Image
General
Full URL
https://img.cdn.house/i/1/-caQ_6SuOwPZkbWjhH-wlfuCW9PUDTUMz6MZmI1UVuCt5eiAUjMOrIDigpzVqda8utJeMUQH18sN3fdogePmFoHm2TlAyQ3SA1dXX3Gx35msyqYStgMcPzyG9JyHZomADqcmco_7ksIkOqrBVZ5qwNvR3uZw_swUeUhNV-kEH7ft6062T6l-b6pwESTBws6lq23tvJ4=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.9.197.87 Weil am Rhein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
push-house-cdn-72.t.push.house
Software
nginx /
Resource Hash
61e29cd891894e62329da8113957fb24ad9ce2ccad4b8d442495d367279d6782

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://sammyyyyyy.mcdir.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 22:48:48 GMT
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
last-modified
Mon, 03 Apr 2023 07:58:05 GMT
server
nginx
accept-ranges
bytes
content-length
2712
content-type
image/webp

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| encrypt_url function| a0_0x3504 function| revoInit function| a0_0x938a function| addSubscriber function| pagelocker object| _PHV2SITE object| webpackChunklands_static object| Sentry object| _phv2Activator

0 Cookies

1 Console Messages

Source Level URL
Text
network error
Message:
A bad HTTP response code (404) was received when fetching the script.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;