www.2-spyware.com Open in urlscan Pro
209.126.117.72 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.2-spyware.com/remove-xpcproxy.html#:~:text=Xpcproxy%20is%20a%20legitimate%20Mac
Effective URL:
https://www.2-spyware.com/remove-xpcproxy.html
Submission: On September 13 via api (September 13th 2020, 7:36:07 pm UTC) from US

Summary HTTP 28 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 28 HTTP transactions. The main IP is 209.126.117.72, located in St Louis, United States and belongs to AS-30083-GO-DADDY-COM-LLC, US. The main domain is www.2-spyware.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 12th 2020. Valid for: 3 months.

This is the only time www.2-spyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	209.126.117.72 209.126.117.72	30083 (AS-30083-...) (AS-30083-GO-DADDY-COM-LLC)
4	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::ac43:ad8d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	109.235.67.100 109.235.67.100	62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
2	2a00:1450:400... 2a00:1450:4001:818::2001	15169 (GOOGLE) (GOOGLE)
28	10

10 209.126.117.72 (St Louis, United States)

ASN30083 (AS-30083-GO-DADDY-COM-LLC, US)
PTR: usloft4272.serverprofi24.eu

www.2-spyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:ad8d (United States)

ASN13335 (CLOUDFLARENET, US)

track.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.235.67.100 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)
PTR: server.hey.lt

www.hey.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	2-spyware.com www.2-spyware.com	198 KB
7	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	145 KB
2	doubleclick.net googleads.g.doubleclick.net
2	google-analytics.com www.google-analytics.com	18 KB
1	hey.lt www.hey.lt	815 B
1	youtube.com www.youtube.com Failed
1	track.lt track.lt	471 B
1	googletagservices.com www.googletagservices.com	27 KB
1	google.com adservice.google.com	890 B
1	google.de adservice.google.de	890 B
28	10

	Domain	Requested by
10	www.2-spyware.com	www.2-spyware.com
5	pagead2.googlesyndication.com	www.2-spyware.com pagead2.googlesyndication.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	www.google-analytics.com	www.2-spyware.com www.google-analytics.com
1	www.hey.lt
1	www.youtube.com	www.2-spyware.com
1	track.lt	www.2-spyware.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
28	11

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.reimageplus.com
www.enigmasoftware.com
www.malwarebytes.com
www.combocleaner.com
www.forbes.com
www.statista.com
lesvirus.fr
thehackernews.com
virusactivity.com
www.hey.lt
feeds.feedburner.com
esolutions.lt

Subject Issuer	Validity	Valid
2-spyware.com Let's Encrypt Authority X3	`2020-08-12` - `2020-11-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
hey.lt Sectigo RSA Domain Validation Secure Server CA	`2019-03-04` - `2021-06-01`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.2-spyware.com/remove-xpcproxy.html
Frame ID: 83641E76D8FDAD273D3B23F757A149BC
Requests: 30 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/gen_204?id=rmvasftr&type=true
Frame ID: D7CDADE9942AC4B3B86CF2A7EC71E474
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200909/r20190131/zrt_lookup.html
Frame ID: C0C40A05C02B03228A26406D3520AC2E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1600025730&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Fremove-xpcproxy.html&ea=0&flash=0&pra=5&wgl=1&dt=1600025730469&bpp=9&bdt=197&idt=70&shv=r20200909&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2213499195707&frm=20&pv=2&ga_vid=1188661610.1600025730&ga_sid=1600025731&ga_hid=1359847930&ga_fc=0&iag=0&icsg=35519&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066897%2C21066944&oid=3&pvsid=188812221411975&pem=377&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=86
Frame ID: 8B292F15CB3B6B081EEFB8A2FF5D99DC
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/QIh7QgEkdsY?rel=0&autoplay=1&mute=1
Frame ID: 21447B00CB9C91B4556F4DF3D23E6F18
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: A2BEE103BA16367E17F0281727C284EA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

28
Requests

96 %
HTTPS

78 %
IPv6

10
Domains

11
Subdomains

10
IPs

3
Countries

392 kB
Transfer

1017 kB
Size

8
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/alicewoods001

Search URL Search Domain Scan URL

URL: https://www.facebook.com/profile.php?id=100015986711895

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/terms-of-use/
Title: Reimage EULA

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/system-requirements/
Title: Supported versions

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/refund-policy/
Title: Refund Policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/enigmasoft-privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/spyhunter5-eula/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/privacy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/tos/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/eula/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/refund-policy/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://www.forbes.com/sites/thomasbrewster/2014/11/06/china-wirelurker-ios-malware/#4a929caf3ed2
Title: WireLurker Apple iDevice Malware Attacks More Than 350,000 In China - Was It The Government Again?

Search URL Search Domain Scan URL

URL: https://www.statista.com/statistics/276623/number-of-apps-available-in-leading-app-stores/
Title: Number of apps available in leading app stores as of 1st quarter 2018

Search URL Search Domain Scan URL

URL: https://lesvirus.fr/
Title: LesVirus

Search URL Search Domain Scan URL

URL: https://thehackernews.com/2018/09/apple-trendmicro-macos-apps.html
Title: Apple Removes Several Trend Micro Apps For Collecting MacOS Users' Data

Search URL Search Domain Scan URL

URL: https://virusactivity.com/

Search URL Search Domain Scan URL

URL: https://www.hey.lt/details.php?id=spyware

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/2-spyware/XBaU
Title: Rss feed

Search URL Search Domain Scan URL

URL: https://twitter.com/2spyware
Title: Follow us

Search URL Search Domain Scan URL

URL: https://www.facebook.com/2spyware
Title: Like us

Search URL Search Domain Scan URL

URL: http://esolutions.lt/
Title: esolutions.lt

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request remove-xpcproxy.html Show response
www.2-spyware.com/ 104 KB
27 KB 593ms
276ms Document
text/html 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: b3f1472e03b65bb37e43c19360adde6502976fa06f6ca75d8e6e704e98fcd56a

Request headers

:method: GET
:authority: www.2-spyware.com
:scheme: https
:path: /remove-xpcproxy.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: cloudflare-nginx
date: Sun, 13 Sep 2020 19:35:29 GMT
content-type: text/html; charset=UTF-8
content-length: 26908
x-pingback: https://www.2-spyware.com/news/xmlrpc.php
vary: Accept-Encoding
content-encoding: gzip
accept-ranges: bytes
x-varnish: 425980187
age: 0
via: 1.1 varnish

GET
H2 200 style_2s.min.css
www.2-spyware.com/news/wp-content/themes/AskIt/css/ 174 KB
31 KB 171ms
170ms Stylesheet
text/css 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/css/style_2s.min.css?ver=1599650702
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 7c745df241a1a57e05070c5756097ae326ee187df168e042e505c71dd035e66c

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
last-modified: Wed, 02 Sep 2020 10:18:24 GMT
server: cloudflare-nginx
age: 0
etag: "2b775-5ae51f4ab3c00-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980189
accept-ranges: bytes
content-length: 31212
via: 1.1 varnish

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 130 KB
46 KB 42ms
22ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28870619e0b50cef037f0ef0daba635dd98ea53bbdaa94244b724c42e23d94c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45965
x-xss-protection: 0
server: cafe
etag: 15926848246370085333
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Sep 2020 19:35:30 GMT

GET
H2 200 xpcproxy-virus_en.jpg.webp
www.2-spyware.com/news/wp-content/uploads/virusai/ 16 KB
16 KB 281ms
280ms Image
image/webp 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/virusai/xpcproxy-virus_en.jpg.webp
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 97e12d25dcd6003719d4a5a28ea08e6c0ca2d29edf8161f9ea9a89bf6be50bbe

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
via: 1.1 varnish
last-modified: Thu, 30 Jul 2020 16:09:52 GMT
server: cloudflare-nginx
age: 0
etag: "3e26-5abaae7101a20"
vary: User-Agent
content-type: image/webp
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980190
accept-ranges: bytes
content-length: 15910

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Aug 2020 20:46:40 GMT
server: Golfe2
age: 1190
date: Sun, 13 Sep 2020 19:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18323
expires: Sun, 13 Sep 2020 21:15:40 GMT

GET
DATA 200
OK truncated
/ 116 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 254c92a8c9718fae1cf0bde4bde5f96027df45fc72ac2b9e5497df220b6ce517

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edd8076d1897300f954c3e2ff22561988017747a10983e2f34c613b3da103549

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 logo2x.png
www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/ 6 KB
7 KB 281ms
281ms Image
image/png 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/logo2x.png
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
via: 1.1 varnish
last-modified: Thu, 11 Jun 2020 12:55:56 GMT
server: cloudflare-nginx
age: 0
etag: "1948-5a7ce7b392f00"
vary: User-Agent
content-type: image/png
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980191
accept-ranges: bytes
content-length: 6472

GET
H2 200 sprites.png
www.2-spyware.com/news/wp-content/themes/esolaskit/css/ 44 KB
45 KB 291ms
291ms Image
image/png 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/css/sprites.png?v=k6j5tim3
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: ed39b882f90708af2ee950e46c0f4e1c5814428a1ecc9f70707d6ae1470937ac

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
via: 1.1 varnish
last-modified: Thu, 11 Jun 2020 12:55:56 GMT
server: cloudflare-nginx
age: 0
etag: "b1fb-5a7ce7b392f00"
vary: User-Agent
content-type: image/png
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980192
accept-ranges: bytes
content-length: 45563

GET
DATA 200
OK truncated
/ 410 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24799b6af2d844857a4585203539076f4d0534617397cb8bb442b770187eb7a4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery-3.5.1.min.js Show response
www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/ 87 KB
30 KB 337ms
335ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: cloudflare-nginx
age: 0
etag: "15d84-5a4da870aa1c0-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980193
accept-ranges: bytes
content-length: 30910
via: 1.1 varnish

GET
H2 200 esol-email.js Show response
www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/ 4 KB
1 KB 336ms
335ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/esol-email.js?ver=1.0.1
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: c6ebf212edfaaf5d74025a919eebdd462feed26676999480891b7d9c3159e6d6

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 09:59:55 GMT
server: cloudflare-nginx
age: 0
etag: "ed2-59e5e08c81cc0-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980194
accept-ranges: bytes
content-length: 1211
via: 1.1 varnish

GET
H2 200 all.min.js Show response
www.2-spyware.com/news/wp-content/themes/AskIt/js/ 53 KB
16 KB 336ms
335ms Script
application/javascript 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/js/all.min.js?ver=1595244873
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 8b4df7cd262606ef4bd552cc2b2e149a3207e032245ef1f246371ebe2052bede

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
last-modified: Thu, 23 Jul 2020 13:40:41 GMT
server: cloudflare-nginx
age: 0
etag: "d321-5ab1c0098c840-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980195
accept-ranges: bytes
content-length: 15963
via: 1.1 varnish

GET
DATA 200
OK truncated
/ 213 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7909baf134ca656d1e4dbc68819638cc2e1e7bdbd8ccaaebc3cf86b3e7a9e4fd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
397 B 39ms
13ms XHR
text/plain 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j85&a=1359847930&t=pageview&_s=1&dl=https%3A%2F%2Fwww.2-spyware.com%2Fremove-xpcproxy.html&ul=en-us&de=UTF-8&dt=Remove%20Xpcproxy%20(Removal%20Instructions)%20-%20Free%20Guide&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1106021352&gjid=710129781&cid=1188661610.1600025730&tid=UA-60636-1&_gid=1788453915.1600025730&_r=1&z=382718815

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Sep 2020 19:35:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.2-spyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D7CD 0
0 60ms
46ms Document
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rmvasftr&type=true

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/gen_204?id=rmvasftr&type=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
date: Sun, 13 Sep 2020 19:35:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/ 228 KB
87 KB 50ms
37ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19beb10327997e7c00d9c8cb6a9ae4f72963968d2c763c6fe579071c9ee2b86a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 87777
x-xss-protection: 0
server: cafe
etag: 541389345409318010
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Sep 2020 19:35:30 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200909/r20190131/ Frame C0C4 0
0 6ms
6ms Document
text/html 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200909/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200909/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/remove-xpcproxy.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/remove-xpcproxy.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Sat, 12 Sep 2020 23:42:04 GMT
expires: Sat, 26 Sep 2020 23:42:04 GMT
content-type: text/html; charset=UTF-8
etag: 9704104221650600920
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4744
x-xss-protection: 0
age: 71606
cache-control: public, max-age=1209600
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
890 B 38ms
15ms Script
application/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.2-spyware.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
890 B 37ms
15ms Script
application/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.2-spyware.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 8B29 0
0 90ms
89ms Document
text/html 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1600025730&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Fremove-xpcproxy.html&ea=0&flash=0&pra=5&wgl=1&dt=1600025730469&bpp=9&bdt=197&idt=70&shv=r20200909&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2213499195707&frm=20&pv=2&ga_vid=1188661610.1600025730&ga_sid=1600025731&ga_hid=1359847930&ga_fc=0&iag=0&icsg=35519&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066897%2C21066944&oid=3&pvsid=188812221411975&pem=377&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=86

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8083807248066628&output=html&adk=1812271804&adf=3025194257&lmt=1600025730&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.2-spyware.com%2Fremove-xpcproxy.html&ea=0&flash=0&pra=5&wgl=1&dt=1600025730469&bpp=9&bdt=197&idt=70&shv=r20200909&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2213499195707&frm=20&pv=2&ga_vid=1188661610.1600025730&ga_sid=1600025731&ga_hid=1359847930&ga_fc=0&iag=0&icsg=35519&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066897%2C21066944&oid=3&pvsid=188812221411975&pem=377&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=86
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/remove-xpcproxy.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/remove-xpcproxy.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Sep 2020 19:35:31 GMT
server: cafe
content-length: 34
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 13-Sep-2020 19:50:31 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Sep 2020 19:35:31 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

568c4d6160efabb5b61ed1d2add90083e6bef67fc9964a27310c8a135b1e077d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1599824047903655"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27476
x-xss-protection: 0
expires: Sun, 13 Sep 2020 19:35:30 GMT

GET
DATA 200
OK truncated
/ 85 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 index.php Show response
track.lt/visitapi/ 116 B
471 B 149ms
117ms XHR
text/html 2606:4700:3035::ac43:ad8d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://track.lt/visitapi/index.php?r=
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:ad8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.3
Resource Hash: be79ce60bc2200a2ce2c467ab82b48080af41be4ea43d071a2eabacb19b1c1a5

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/5.3.3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: text/html
access-control-allow-origin: https://www.2-spyware.com
cf-ray: 5d244fd1bfe22bce-FRA
cf-request-id: 052a90370e00002bce4424f200000001

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 11b0c1495108f329dfa60b822b529229e7d55d3cf1bc8993afbb9bac3ad724c2

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 visited-porn-sites-you-are-infected_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
13 KB 158ms
157ms Image
image/jpeg 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/visited-porn-sites-you-are-infected_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: 4473c97cf92b148c2b75290404fec7b83d1864fe9cf8376f80f25077f1fe1e21

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
via: 1.1 varnish
last-modified: Wed, 07 Feb 2018 11:27:44 GMT
server: cloudflare-nginx
age: 0
etag: "3200-5649d957a666b"
vary: User-Agent
content-type: image/jpeg
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980197
accept-ranges: bytes, bytes
content-length: 12800

GET
H2 200 stay-home-stay-safe-use-vpn_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
14 KB 207ms
206ms Image
image/jpeg 209.126.117.72
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/stay-home-stay-safe-use-vpn_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-xpcproxy.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.126.117.72 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: usloft4272.serverprofi24.eu
Software: cloudflare-nginx /
Resource Hash: c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:30 GMT
via: 1.1 varnish
last-modified: Tue, 31 Mar 2020 14:32:30 GMT
server: cloudflare-nginx
age: 0
etag: "352d-5a227700c2d9a"
vary: User-Agent
content-type: image/jpeg
status: 200
cache-control: max-age=15854400, public
x-varnish: 425980198
accept-ranges: bytes, bytes
content-length: 13613

GET QIh7QgEkdsY
www.youtube.com/embed/ Frame 2144 0
0

GET
H2 200 QIh7QgEkdsY
www.youtube.com/embed/ Frame 2144 0
0 100ms
80ms Document
text/html 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/QIh7QgEkdsY?rel=0&autoplay=1&mute=1

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/QIh7QgEkdsY?rel=0&autoplay=1&mute=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/remove-xpcproxy.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/remove-xpcproxy.html

Response headers

status: 200
content-length: 10699
strict-transport-security: max-age=31536000
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache
date: Sun, 13 Sep 2020 19:35:31 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=sz30Pskpxfg; path=/; domain=.youtube.com; secure; expires=Fri, 12-Mar-2021 19:35:31 GMT; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Sun, 13-Sep-2020 20:05:31 GMT YSC=pH2yp7t4g3k; path=/; domain=.youtube.com; secure; httponly; samesite=None VISITOR_INFO1_LIVE=sz30Pskpxfg; path=/; domain=.youtube.com; secure; expires=Fri, 12-Mar-2021 19:35:31 GMT; httponly; samesite=None
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK count.php
www.hey.lt/ 437 B
815 B 185ms
60ms Image
image/png 109.235.67.100
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.hey.lt/count.php?id=spyware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 109.235.67.100 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: server.hey.lt
Software: Apache /
Resource Hash: 0eeb8b44163c6b2ec84cffa35a2cd21d13c7713195e3c049c11390a4f2ce2396

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Sep 2020 19:35:31 GMT
Server: Apache
P3P: CP="NID"
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 437
Expires: Thu, 1 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 44ms
31ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200909&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95498ea809f6a850bddb57165f48bbf40f2d4c7234ad8ba9179e118aefc60d57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Sep 2020 19:35:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6460
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 59ms
39ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200909/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 13 Sep 2020 19:35:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Sun, 13 Sep 2020 19:35:31 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame A2BE 0
0 27ms
13ms Document
text/html 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.2-spyware.com/remove-xpcproxy.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.2-spyware.com/remove-xpcproxy.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Sun, 13 Sep 2020 19:15:26 GMT
expires: Mon, 13 Sep 2021 19:15:26 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1205
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
22 B 39ms
39ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200909&jk=188812221411975&bg=!ubqluqJYnADEdtr71qgCAAAAaFIAAAATCgGojv145Dg_9JrC9ZvPUKoYnxBQ2SOWCDU8-ShY8WGF64gzd6tDSaV_VO-Mjzk5gHvwmgEGzhsvFyVg4adFrFmGSsOY76gr8Eyn1Tp7HZNbF9zWAZmJw3rUmxlTfTMekG1NZdk0FLGnSEKmWoyMP6Z0WUBNE7ByNMm4m5nH5DygpSc1AfM5BZC4QZCrlT8TsYXMfPWTsWgRvAQLuXI-07wjUd2MPmwoy2aKcFH7AmlgRK7zUTONBBPLH0vZOvs0wc7Sbk1E2QSFl_EhetqghvkLHtxG8tE-50ThFw3pmVnmelJVUaOub4phzlssREzLipgBn_74i5YCAxBNcPcKUkAYuPq9lQBSCRU08383IAGfY5pEOPC9znefnurOhCUmyzguhhK62cuU6G8z9LZwLZDGNN5MQgdQsoKzBTHbGyjIhEee_PdVLja8JuyHoxZ9kS9nlbQK2ZriadLAdH2yYL0wlz1PIKCPaap8sdwzYduTkpMXKro7_bczBASfA58FwIDMXQnbykkgMcBbnAYiECJr59zfMdLVRFGzKHBGOWf5hIBokrXTP7Xm6ZkBqjSn8XdwmHLcbjatdu6gfsaRdpy__3CueQDEadINDLtuy4bihQ1xZuyfnbXBL-RQvpw5zxlujfMlnP7lIKv-jUKjFuvIvPgnvQSBuqjXGW9jZQRzt34eliBH864qOF4cc0VitVscU6Dm5TWve9pFJ7cSqly22D2aZ6jvUZQDVRCnOgChuW2MHG0eJt_dC4wqpLvMgo7fMuM926ul-GVx4L_PYpJv9nJPh4NSP6oB_5co_dh03jG4ZeCgUFS_sQnI-LZ6wRxA4fMpYIq_L0nstgRfizV36qzfEbv78VLwjz_lU9qmhiMFTm1NykLN_3hD7W_tYLBo_Xqv3huiDsJwzcS0Tt6pNOt3bqrQzPid40DRnQXEjdm6gsSDrKQ06cu17DHHwR57MygSoK5bsv1BF43KCDFDo_rXYqc3d7MxH13diwjMsl0wOSRAH5f93xSRKmCPQ27QSf7g810tHw4p-TL7_yFCabUekaOurdvEw_f3WU9vovrBpY9pem5-XGsPEMDVPsiKbwQm-7d9-K_j7JkqUVM1qJrmWEyQUVnNNO957nhYYM3p5CYQgg

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.2-spyware.com/remove-xpcproxy.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Sep 2020 19:35:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.youtube.com
URL: https://www.youtube.com/embed/QIh7QgEkdsY?rel=0

Verdicts & Comments Add Verdict or Comment

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 21:48:41	Name: IDE Value: AHWqTUn04-2r-cAWDyZG4y6emTCeOs3A9avNuoVIHQYdyu5BHiSwkrjmQ3P4QKF8
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: pH2yp7t4g3k
.youtube.com/	1970-01-19 16:46:17	Name: VISITOR_INFO1_LIVE Value: sz30Pskpxfg
www.2-spyware.com/	1969-12-31 23:59:59	Name: ce Value: 1
www.2-spyware.com/	1970-01-19 12:28:32	Name: pagrojo Value: 1
.2-spyware.com/	1970-01-19 12:28:32	Name: _gid Value: GA1.2.1788453915.1600025730
.2-spyware.com/	1970-01-19 12:27:05	Name: _gat Value: 1
.2-spyware.com/	1970-01-20 05:58:17	Name: _ga Value: GA1.2.1188661610.1600025730

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
googleads.g.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
track.lt
www.2-spyware.com
www.google-analytics.com
www.googletagservices.com
www.hey.lt
www.youtube.com
www.youtube.com
109.235.67.100
209.126.117.72
2606:4700:3035::ac43:ad8d
2a00:1450:4001:800::200e
2a00:1450:4001:806::2002
2a00:1450:4001:818::2001
2a00:1450:4001:81a::200e
2a00:1450:4001:820::2002
2a00:1450:4001:821::200e
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874
0eeb8b44163c6b2ec84cffa35a2cd21d13c7713195e3c049c11390a4f2ce2396
11b0c1495108f329dfa60b822b529229e7d55d3cf1bc8993afbb9bac3ad724c2
19beb10327997e7c00d9c8cb6a9ae4f72963968d2c763c6fe579071c9ee2b86a
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
24799b6af2d844857a4585203539076f4d0534617397cb8bb442b770187eb7a4
254c92a8c9718fae1cf0bde4bde5f96027df45fc72ac2b9e5497df220b6ce517
28870619e0b50cef037f0ef0daba635dd98ea53bbdaa94244b724c42e23d94c1
4473c97cf92b148c2b75290404fec7b83d1864fe9cf8376f80f25077f1fe1e21
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
568c4d6160efabb5b61ed1d2add90083e6bef67fc9964a27310c8a135b1e077d
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7909baf134ca656d1e4dbc68819638cc2e1e7bdbd8ccaaebc3cf86b3e7a9e4fd
7c745df241a1a57e05070c5756097ae326ee187df168e042e505c71dd035e66c
8b4df7cd262606ef4bd552cc2b2e149a3207e032245ef1f246371ebe2052bede
95498ea809f6a850bddb57165f48bbf40f2d4c7234ad8ba9179e118aefc60d57
97e12d25dcd6003719d4a5a28ea08e6c0ca2d29edf8161f9ea9a89bf6be50bbe
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341
b3f1472e03b65bb37e43c19360adde6502976fa06f6ca75d8e6e704e98fcd56a
be79ce60bc2200a2ce2c467ab82b48080af41be4ea43d071a2eabacb19b1c1a5
c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e
c6ebf212edfaaf5d74025a919eebdd462feed26676999480891b7d9c3159e6d6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed39b882f90708af2ee950e46c0f4e1c5814428a1ecc9f70707d6ae1470937ac
edd8076d1897300f954c3e2ff22561988017747a10983e2f34c613b3da103549
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.2-spyware.com Open in urlscan Pro 209.126.117.72 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

28 Requests

96 %HTTPS

78 %IPv6

10 Domains

11 Subdomains

10 IPs

3 Countries

392 kBTransfer

1017 kBSize

8 Cookies

24 Outgoing links

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.2-spyware.com Open in urlscan Pro
209.126.117.72 Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

96 %
HTTPS

78 %
IPv6

10
Domains

11
Subdomains

10
IPs

3
Countries

392 kB
Transfer

1017 kB
Size

8
Cookies

28 HTTP transactions
8 data transactions