urlscan.io logo urlscan.io
SecurityTrails logo

www.threat2remove.com Open in urlscan Pro
166.62.36.180  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://threat2remove.com/
Effective URL: http://www.threat2remove.com/
Submission: On September 16 via manual from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 19 domains to perform 37 HTTP transactions. The main IP is 166.62.36.180, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is www.threat2remove.com.
This is the only time www.threat2remove.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 26 166.62.36.180 26496 (AS-26496-...)
1 2a00:1450:400... 15169 (GOOGLE)
3 3 89.207.16.72 25751 (VALUECLICK)
1 23.45.238.30 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 6 149.126.77.38 19551 (INCAPSULA)
1 1 161.47.7.14 19994 (RACKSPACE)
3 3 52.54.161.129 14618 (AMAZON-AES)
1 52.45.74.92 14618 (AMAZON-AES)
1 13.35.253.76 16509 (AMAZON-02)
1 2 45.60.33.126 19551 (INCAPSULA)
37 12
26    166.62.36.180 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-36-180.ip.secureserver.net
threat2remove.com
www.threat2remove.com
1    2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
3    89.207.16.72 (Sweden)

ASN25751 (VALUECLICK - Conversant, Inc., US)
www.tqlkg.com
cj.dotomi.com
www.emjcd.com
1    23.45.238.30 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-238-30.deploy.static.akamaitechnologies.com
www.yceml.net
1    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
3    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
4    2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
pagead2.googlesyndication.com
www.googletagservices.com
1    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
3    2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
googleads.g.doubleclick.net
6    149.126.77.38 (Frankfurt am Main, Germany)

ASN19551 (INCAPSULA - Incapsula Inc, US)
PTR: 149.126.77.38.ip.incapdns.net
gilobi.reimage.revenuewire.net
gilobi.reimage.safecart.com
link.safecart.com
gilobi.enigma.revenuewire.net
gilobi.enigma.safecart.com
1    161.47.7.14 (San Antonio, United States)

ASN19994 (RACKSPACE - Rackspace Hosting, US)
www.reimageplus.com
3    52.54.161.129 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-54-161-129.compute-1.amazonaws.com
kromtech.net
assets.kromtech.net
1    52.45.74.92 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-45-74-92.compute-1.amazonaws.com
app4.kromtech.net
1    13.35.253.76 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-76.fra6.r.cloudfront.net
www.spyhunter.com
2    45.60.33.126 (United States)

ASN19551 (INCAPSULA - Incapsula Inc, US)
send.onenetworkdirect.net
affiliates.digitalriver.com
Domain Requested by
23 www.threat2remove.com 6 redirects www.threat2remove.com
3 googleads.g.doubleclick.net pagead2.googlesyndication.com
3 fonts.gstatic.com www.threat2remove.com
3 pagead2.googlesyndication.com www.threat2remove.com
pagead2.googlesyndication.com
3 threat2remove.com 1 redirects www.threat2remove.com
2 kromtech.net 2 redirects
2 link.safecart.com 1 redirects www.threat2remove.com
1 www.googletagservices.com pagead2.googlesyndication.com
1 affiliates.digitalriver.com www.threat2remove.com
1 send.onenetworkdirect.net 1 redirects
1 www.spyhunter.com www.threat2remove.com
1 gilobi.enigma.safecart.com 1 redirects
1 gilobi.enigma.revenuewire.net 1 redirects
1 app4.kromtech.net www.threat2remove.com
1 assets.kromtech.net 1 redirects
1 www.reimageplus.com 1 redirects
1 gilobi.reimage.safecart.com 1 redirects
1 gilobi.reimage.revenuewire.net 1 redirects
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 www.yceml.net www.threat2remove.com
1 www.emjcd.com 1 redirects
1 cj.dotomi.com 1 redirects
1 www.tqlkg.com 1 redirects
1 fonts.googleapis.com www.threat2remove.com
37 25

This site contains links to these domains. Also see Links.

Domain
www.tkqlhce.com
Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh
*.google.com
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
kromtech.net
Amazon		 2019-08-13 -
2020-09-13		 a year crt.sh
*.spyhunter.com
Amazon		 2019-06-18 -
2020-07-18		 a year crt.sh

This page contains 5 frames:

Primary Page: http://www.threat2remove.com/
Frame ID: 230F9CA5C91811F7F6A680D628024A8A
Requests: 33 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Frame ID: 0B3B167F225B4D44392F00B10D238781
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/zrt_lookup.html
Frame ID: 87856D9227B28B5EC41060E241DFC700
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=2302244270&w=300&lmt=1568666025&guci=1.2.0.0.2.2.0.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&dt=1568666025720&bpp=41&bdt=1341&fdt=186&idt=187&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&correlator=2067350434327&frm=20&pv=2&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=4188927&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1112&ady=2942&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=0&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=1&uci=1.ovalmgh6m1tp&fsb=1&xpc=kJsusNtOiy&p=http%3A//www.threat2remove.com&dtd=222
Frame ID: 97AD02840BD1FD7A4FD566548BCBBD84
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&adk=1812271804&adf=3025194257&lmt=1568666025&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=http%3A%2F%2Fwww.threat2remove.com%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1568666025837&bpp=14&bdt=1457&fdt=141&idt=141&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=300x250&nras=1&correlator=2067350434327&frm=20&pv=1&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=23&ifi=1&uci=1.ay64un7t6y5u&fsb=1&dtd=163
Frame ID: F0E80F4321C584F08CB647B5B144E9A5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://threat2remove.com/ HTTP 301
    http://www.threat2remove.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

37
Requests

27 %
HTTPS

40 %
IPv6

19
Domains

25
Subdomains

12
IPs

4
Countries

596 kB
Transfer

1078 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://threat2remove.com/ HTTP 301
    http://www.threat2remove.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • http://www.tqlkg.com/image-7141446-11114083-1421849326000 HTTP 302
  • http://cj.dotomi.com/cb74uuy0E/ov-/uys/DDDDGCKF/JDGDGGI/C/C/C/C/C?q=c%3c%3c3FFB%3A%2F%2FIII.FC762.yA8%3AUM%2F48w20-TNQNQQS-NNNNQMUP-NQONUQVPOSMMM%3c%3cc%3c3FFB%3A%2F%2FIII.F3D0wFOD08AH0.yA8%2F%3c%3cN%3cN%3cM%3cM%3c HTTP 302
  • http://www.emjcd.com/ss67h48BR/z5A/482/OOOORNVQ/UORORRT/N/PNNVNQPTTVUUONNSVT:gQxGVZ9vYK9u/N/N/N?l=r%3c%3c6IIE%3A%2F%2FLLL.IFA95.1DB%3AXP%2F7Bz53-WQTQTTV-QQQQTPXS-QTRQXTYSRVPPP%3c%3cf%3c6IIE%3A%2F%2FLLL.I6G3zIRG3BDK3.1DB%2F%3cVXX3XW3U-4YSS-TzzT-XTX0-VT1XQ34QRV01%3cQ%3cQ%3cP%3cP%3c HTTP 302
  • http://www.yceml.net/0611/11114083-1538176699272
Request Chain 28
  • http://www.threat2remove.com/download-reimage HTTP 301
  • http://www.threat2remove.com/download-reimage/ HTTP 302
  • http://gilobi.reimage.revenuewire.net/reimage-pc-repair/download/ HTTP 302
  • http://gilobi.reimage.safecart.com/reimage-pc-repair/download/ HTTP 301
  • http://www.reimageplus.com/includes/router_land.php?tracking=revenuewire&exec=run HTTP 302
  • https://link.safecart.com/2m4rj9 HTTP 301
  • http://kromtech.net/link/5e1038fc-2605-11e9-83b4-127369ec21d1&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404 HTTP 302
  • http://assets.kromtech.net/lnd?back=aHR0cDovL2tyb210ZWNoLm5ldC9saW5rLzVlMTAzOGZjLTI2MDUtMTFlOS04M2I0LTEyNzM2OWVjMjFkMSZ0aWRfZXh0PVBvaW9uZWVyQ2xpY2s7MThmNDM2YWUyNzRiZTdjNjBmYmUyYzMzZDA5N2NlYzkyNDIzZDQwNCZyZXFpZD1Sb290PTEtNWQ3ZmYxYWItOGE0ZjMzZDQ1MmMyMDM5MzEyMjgzN2M5&reqid=Root%3D1-5d7ff1ab-8a4f33d452c20393122837c9&sign=79fcfc4a4bb5b9e6ee68072e70a9854198678313 HTTP 302
  • http://kromtech.net/link/5e1038fc-2605-11e9-83b4-127369ec21d1&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404&reqid=Root=1-5d7ff1ab-8a4f33d452c20393122837c9&guid=491f5cad-d8c1-11e9-8128-0242ac110004&adb=0 HTTP 302
  • https://app4.kromtech.net/landings/198/?affid=4934de00-d8c1-11e9-b173-9a85279c2000-mzb&alert=44&epayId=29&guid=491f5cad-d8c1-11e9-8128-0242ac110004&landId=2070&reqid=Root=1-5d7ff1ab-8a4f33d452c20393122837c9&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404&trt=29_45121156&userDefiner=mzb_2754&utm_campaign=mk_rvnwr_cpi_t2_198&utm_content=&utm_medium=&utm_source=&utm_term=
Request Chain 29
  • http://www.threat2remove.com/download-plumbytes HTTP 301
  • http://www.threat2remove.com/download-plumbytes/ HTTP 302
  • http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
Request Chain 30
  • http://www.threat2remove.com/download-spyhunter HTTP 301
  • http://www.threat2remove.com/download-spyhunter/ HTTP 302
  • http://gilobi.enigma.revenuewire.net/spyhunter2/download/ HTTP 302
  • http://gilobi.enigma.safecart.com/spyhunter2/download/ HTTP 301
  • https://www.spyhunter.com/rw/
Request Chain 31
  • http://send.onenetworkdirect.net/z/580857/CD230692 HTTP 302
  • http://affiliates.digitalriver.com/z/580857/CD230692

37 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
www.threat2remove.com/
Redirect Chain
  • http://threat2remove.com/
  • http://www.threat2remove.com/
29 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/
Protocol
HTTP/1.1
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
670b5fb660b4bd124af7baa973336eaea70f9503e9714cabf5b961eba97c4ac7

Request headers

Host
www.threat2remove.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Mon, 16 Sep 2019 20:33:43 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Set-Cookie
_icl_current_language=en; expires=Tue, 17-Sep-2019 20:33:43 GMT; Max-Age=86400; path=/
X-Pingback
http://www.threat2remove.com/xmlrpc.php
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Mon, 16 Sep 2019 20:33:43 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
_icl_current_language=en; expires=Tue, 17-Sep-2019 20:33:42 GMT; Max-Age=86400; path=/
X-Pingback
http://www.threat2remove.com/xmlrpc.php
Location
http://www.threat2remove.com/
ajax-contact.css
www.threat2remove.com/wp-content/plugins/ajax-contact/css/ 		2 KB
997 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/ajax-contact/css/ajax-contact.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
236a892279988cc2c59f931c6bfff562494d4d57252807fa25990fda3f5c9621

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 24 Nov 2014 14:17:58 GMT
Server
nginx
ETag
W/"54733e16-725"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
style.css
www.threat2remove.com/wp-content/plugins/side-matter/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/side-matter/css/style.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
811576ad12c342afa480be3ee4e6f0b0536d7af0dd7cd45219b321cd62917a86

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 04 Nov 2016 13:48:44 GMT
Server
nginx
ETag
W/"581c91bc-ab5"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
display-authors-widget.css
www.threat2remove.com/wp-content/plugins/display-authors-widget/css/ 		545 B
625 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/display-authors-widget/css/display-authors-widget.css?ver=20122709
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
84b37226dd1ba126264c6b5d1369d28d6fb5fa26f7cd6f3e1458e86ff41d14e7

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 Nov 2013 19:50:22 GMT
Server
nginx
ETag
W/"528fb57e-221"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
font-awesome.min.css
www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/ 		27 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/font-awesome.min.css?ver=4.5.0
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
W/"5741e8ae-6b4a"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
css
fonts.googleapis.com/ 		14 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
cea1b7d1b7c0a6760c2af9e0bd43ea71872ef5f43bf5bb0c2c0e27eaad087b34
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Sep 2019 20:33:44 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
0
Expires
Mon, 16 Sep 2019 20:33:44 GMT
style.css
www.threat2remove.com/wp-content/themes/uniform/ 		46 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/style.css?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
fd7ffc2056e10c09d88c0eb2f0b2df7d368ed1aa54d74d62871167fd00c79710

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 04 Nov 2016 13:46:28 GMT
Server
nginx
ETag
W/"581c9134-b757"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
responsive.css
www.threat2remove.com/wp-content/themes/uniform/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/css/responsive.css?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
d514cbc699d757a21b9898585e77009597337a101af50b7cd783a1df579373cc

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
W/"5741e8ae-13eb"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 10 Sep 2020 20:33:44 GMT
styles.php
www.threat2remove.com/wp-content/themes/uniform/css/ 		0
339 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/css/styles.php?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/css;charset=UTF-8
jquery.js
www.threat2remove.com/wp-includes/js/jquery/ 		94 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
74785791e63a226fb98b9050f80b5d90f0ca26401e187c99ff74962ff64301d3

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Fri, 02 May 2014 06:29:16 GMT
Server
nginx
ETag
"53633b3c-1763f"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95807
Expires
Thu, 10 Sep 2020 20:33:44 GMT
jquery-migrate.min.js
www.threat2remove.com/wp-includes/js/jquery/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Tue, 23 Jul 2013 12:28:26 GMT
Server
nginx
ETag
"51ee76ea-1c20"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7200
Expires
Thu, 10 Sep 2020 20:33:44 GMT
ajax-contact.js
www.threat2remove.com/wp-content/plugins/ajax-contact/js/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/ajax-contact/js/ajax-contact.js?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
6ea00f64b4e1b58ac8e1162060375aeb983cbc6589ef55675c999e1fc3f447d9

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Wed, 29 Aug 2012 05:47:50 GMT
Server
nginx
ETag
"503dad06-1135"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4405
Expires
Thu, 10 Sep 2020 20:33:44 GMT
jquery.autosize.js
www.threat2remove.com/wp-content/plugins/side-matter/js/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/plugins/side-matter/js/jquery.autosize.js?ver=4.1.9
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
9feb1e84c6703aee7b5e7aeb6abfd1aacaf725796c4b5640fe736abe3447545a

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Tue, 21 Nov 2017 13:24:44 GMT
Server
nginx
ETag
"5a14291c-1aec"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6892
Expires
Thu, 10 Sep 2020 20:33:44 GMT
11114083-1538176699272
www.yceml.net/0611/
Redirect Chain
  • http://www.tqlkg.com/image-7141446-11114083-1421849326000
  • http://cj.dotomi.com/cb74uuy0E/ov-/uys/DDDDGCKF/JDGDGGI/C/C/C/C/C?q=c%3c%3c3FFB%3A%2F%2FIII.FC762.yA8%3AUM%2F48w20-TNQNQQS-NNNNQMUP-NQONUQVPOSMMM%3c%3cc%3c3FFB%3A%2F%2FIII.F3D0wFOD08AH0.yA8%2F%3c%3...
  • http://www.emjcd.com/ss67h48BR/z5A/482/OOOORNVQ/UORORRT/N/PNNVNQPTTVUUONNSVT:gQxGVZ9vYK9u/N/N/N?l=r%3c%3c6IIE%3A%2F%2FLLL.IFA95.1DB%3AXP%2F7Bz53-WQTQTTV-QQQQTPXS-QTRQXTYSRVPPP%3c%3cf%3c6IIE%3A%2F%2...
  • http://www.yceml.net/0611/11114083-1538176699272
24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.yceml.net/0611/11114083-1538176699272
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
23.45.238.30 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-238-30.deploy.static.akamaitechnologies.com
Software
Resin/3.1.14 /
Resource Hash
d4d6f13572616a4fcb1834b1a15d4785035617f715ad69c7fa411ad14ee03392

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Sep 2019 20:33:44 GMT
Cache-Control
max-age=95595
Server
Resin/3.1.14
Connection
keep-alive
Content-Length
24254
Expires
Tue, 17 Sep 2019 23:06:59 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Sep 2019 20:33:44 GMT
Server
Resin/3.1.14
P3P
policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Location
http://www.yceml.net/0611/11114083-1538176699272
Cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
Content-Type
text/html; charset=UTF-8
Content-Length
86
Expires
Mon, 16 Sep 2019 20:33:44 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		96 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
2ea955cabe710b582d2dab5a5659f00c789af91e5a1fb8a1678e5cc69c82f107
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Mon, 16 Sep 2019 20:33:44 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
13665209909426514778
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
35377
X-XSS-Protection
0
Expires
Mon, 16 Sep 2019 20:33:44 GMT
jquery.bxslider.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		49 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/jquery.bxslider.js?ver=4.1.2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
bddbba35635904eca1d7f9edc74bdbcba04ec0f5a16286fdbd8f78fb0f7e0c6f

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
"5741e8ae-c58d"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
50573
Expires
Thu, 10 Sep 2020 20:33:44 GMT
navigation.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/navigation.js?ver=20120206
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:44 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
"5741e8ae-8e7"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2279
Expires
Thu, 10 Sep 2020 20:33:44 GMT
skip-link-focus-fix.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		751 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/skip-link-focus-fix.js?ver=20130115
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:45 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
"5741e8ae-2ef"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
751
Expires
Thu, 10 Sep 2020 20:33:45 GMT
custom-scripts.js
www.threat2remove.com/wp-content/themes/uniform/js/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/js/custom-scripts.js?ver=1.1.8
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
d666ba68515e9d1b8770b7d44c5d2fccba27fe62e04ac3e181beff249cd39a23

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Mon, 16 Sep 2019 20:33:45 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
"5741e8ae-4ea"
Content-Type
application/javascript
Cache-Control
max-age=31104000, public, must-revalidate, proxy-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1258
Expires
Thu, 10 Sep 2020 20:33:45 GMT
generator.php
threat2remove.com/ 		53 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://threat2remove.com/generator.php
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/wp-content/plugins/side-matter/js/jquery.autosize.js?ver=4.1.9
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
4ca8f7722320d5e59ac553dc60baf881d5fddc53eef14a442c8f69bc2b481a4a

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Sep 2019 20:33:46 GMT
Transfer-Encoding
chunked
Last-Modified
Mon, 16 Sep 2019 20:33:45 GMT
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Origin
http://www.threat2remove.com

Response headers

Date
Wed, 21 Aug 2019 21:06:01 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 23 Jul 2019 19:30:49 GMT
Server
sffe
Age
2244464
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9132
X-XSS-Protection
0
Expires
Thu, 20 Aug 2020 21:06:01 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Origin
http://www.threat2remove.com

Response headers

Date
Mon, 02 Sep 2019 12:46:15 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 23 Jul 2019 19:30:44 GMT
Server
sffe
Age
1237650
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9180
X-XSS-Protection
0
Expires
Tue, 01 Sep 2020 12:46:15 GMT
fontawesome-webfont.woff2
www.threat2remove.com/wp-content/themes/uniform/font-awesome/fonts/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/fonts/fontawesome-webfont.woff2?v=4.5.0
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://www.threat2remove.com/wp-content/themes/uniform/font-awesome/css/font-awesome.min.css?ver=4.5.0
Origin
http://www.threat2remove.com

Response headers

Date
Mon, 16 Sep 2019 20:33:45 GMT
Last-Modified
Sun, 22 May 2016 17:13:18 GMT
Server
nginx
ETag
"5741e8ae-10440"
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
66624
memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v17/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v17/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans%3A400%2C400italic%2C300italic%2C300%2C600%2C600italic&ver=4.1.9
Origin
http://www.threat2remove.com

Response headers

Date
Sat, 24 Aug 2019 14:53:54 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 23 Jul 2019 19:30:56 GMT
Server
sffe
Age
2007591
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9744
X-XSS-Protection
0
Expires
Sun, 23 Aug 2020 14:53:54 GMT
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.threat2remove.com
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Sep 2019 20:33:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.threat2remove.com
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Sep 2019 20:33:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
104
x-xss-protection
0
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ 		222 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Sep 2019 20:33:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
84018
x-xss-protection
0
server
cafe
etag
7346031692830552506
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 16 Sep 2019 20:33:45 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/ Frame 0B3B 		222 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Sep 2019 20:33:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
84018
x-xss-protection
0
server
cafe
etag
7346031692830552506
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 16 Sep 2019 20:33:45 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/ Frame 8785 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20190911/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20190911/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
http://www.threat2remove.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
http://www.threat2remove.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 12 Sep 2019 14:01:50 GMT
expires
Thu, 26 Sep 2019 14:01:50 GMT
content-type
text/html; charset=UTF-8
etag
14866779439905550351
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
7273
x-xss-protection
0
cache-control
public, max-age=1209600
age
369115
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
/
app4.kromtech.net/landings/198/
Redirect Chain
  • http://www.threat2remove.com/download-reimage
  • http://www.threat2remove.com/download-reimage/
  • http://gilobi.reimage.revenuewire.net/reimage-pc-repair/download/
  • http://gilobi.reimage.safecart.com/reimage-pc-repair/download/
  • http://www.reimageplus.com/includes/router_land.php?tracking=revenuewire&exec=run
  • https://link.safecart.com/2m4rj9
  • http://kromtech.net/link/5e1038fc-2605-11e9-83b4-127369ec21d1&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404
  • http://assets.kromtech.net/lnd?back=aHR0cDovL2tyb210ZWNoLm5ldC9saW5rLzVlMTAzOGZjLTI2MDUtMTFlOS04M2I0LTEyNzM2OWVjMjFkMSZ0aWRfZXh0PVBvaW9uZWVyQ2xpY2s7MThmNDM2YWUyNzRiZTdjNjBmYmUyYzMzZDA5N2NlYzkyNDIzZ...
  • http://kromtech.net/link/5e1038fc-2605-11e9-83b4-127369ec21d1&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404&reqid=Root=1-5d7ff1ab-8a4f33d452c20393122837c9&guid=491f5cad-d8c1-11e9-8...
  • https://app4.kromtech.net/landings/198/?affid=4934de00-d8c1-11e9-b173-9a85279c2000-mzb&alert=44&epayId=29&guid=491f5cad-d8c1-11e9-8128-0242ac110004&landId=2070&reqid=Root=1-5d7ff1ab-8a4f33d452c2039...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app4.kromtech.net/landings/198/?affid=4934de00-d8c1-11e9-b173-9a85279c2000-mzb&alert=44&epayId=29&guid=491f5cad-d8c1-11e9-8128-0242ac110004&landId=2070&reqid=Root=1-5d7ff1ab-8a4f33d452c20393122837c9&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404&trt=29_45121156&userDefiner=mzb_2754&utm_campaign=mk_rvnwr_cpi_t2_198&utm_content=&utm_medium=&utm_source=&utm_term=
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.74.92 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-45-74-92.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Location
https://app4.kromtech.net/landings/198/?affid=4934de00-d8c1-11e9-b173-9a85279c2000-mzb&alert=44&epayId=29&guid=491f5cad-d8c1-11e9-8128-0242ac110004&landId=2070&reqid=Root=1-5d7ff1ab-8a4f33d452c20393122837c9&tid_ext=PoioneerClick;18f436ae274be7c60fbe2c33d097cec92423d404&trt=29_45121156&userDefiner=mzb_2754&utm_campaign=mk_rvnwr_cpi_t2_198&utm_content=&utm_medium=&utm_source=&utm_term=
Date
Mon, 16 Sep 2019 20:33:48 GMT
Connection
keep-alive
Content-Length
461
Content-Type
text/html; charset=utf-8
aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
link.safecart.com/2h6vrg/
Redirect Chain
  • http://www.threat2remove.com/download-plumbytes
  • http://www.threat2remove.com/download-plumbytes/
  • http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
149.126.77.38 Frankfurt am Main, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
149.126.77.38.ip.incapdns.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Location
http://link.safecart.com/2h6vrg/aHR0cDovL3d3dy5wbHVtYnl0ZXMuY29tL3BhcnRuZXIvdXJsL2Rvd25sb2Fk
Date
Mon, 16 Sep 2019 20:33:46 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
/
www.spyhunter.com/rw/
Redirect Chain
  • http://www.threat2remove.com/download-spyhunter
  • http://www.threat2remove.com/download-spyhunter/
  • http://gilobi.enigma.revenuewire.net/spyhunter2/download/
  • http://gilobi.enigma.safecart.com/spyhunter2/download/
  • https://www.spyhunter.com/rw/
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.spyhunter.com/rw/
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.35.253.76 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-35-253-76.fra6.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Mon, 16 Sep 2019 20:33:46 GMT
Server
Apache
X-Frame-Options
ALLOW-FROM https://reimageplus.com/
Content-Type
text/html; charset=UTF-8
Location
https://www.spyhunter.com/rw/
X-Iinfo
2-5466414-5466415 NNNN CT(158 -1 0) RT(1568666026331 1) q(0 0 1 0) r(4 4) U5
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
close
X-CDN
Incapsula
Expires
Thu, 19 Nov 1981 08:52:00 GMT
CD230692
affiliates.digitalriver.com/z/580857/
Redirect Chain
  • http://send.onenetworkdirect.net/z/580857/CD230692
  • http://affiliates.digitalriver.com/z/580857/CD230692
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://affiliates.digitalriver.com/z/580857/CD230692
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
45.60.33.126 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date
Mon, 16 Sep 2019 20:33:46 GMT
X-Server-Name
www@smcwebprd035001.c035.digitalriverws.net
Vary
Host
P3P
policyref="/w3c/p3p.xml", CP="NOR NOI DSP COR ADM OUR PHY"
Location
http://affiliates.digitalriver.com/z/580857/CD230692
X-Iinfo
9-10451507-10451515 NNNN CT(113 -1 0) RT(1568666025453 7) q(0 0 1 0) r(3 3) U5
Cache-Control
public, max-age=0, must-revalidate
Connection
close
Content-Type
text/html
Keep-Alive
timeout=3, max=1000
Content-Length
0
X-CDN
Incapsula
Server
Apache
ads
googleads.g.doubleclick.net/pagead/ Frame 97AD 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=2302244270&w=300&lmt=1568666025&guci=1.2.0.0.2.2.0.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&dt=1568666025720&bpp=41&bdt=1341&fdt=186&idt=187&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&correlator=2067350434327&frm=20&pv=2&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=4188927&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1112&ady=2942&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=0&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=1&uci=1.ovalmgh6m1tp&fsb=1&xpc=kJsusNtOiy&p=http%3A//www.threat2remove.com&dtd=222
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-7943855733030580&output=html&h=250&slotname=8176009208&adk=838100573&adf=2302244270&w=300&lmt=1568666025&guci=1.2.0.0.2.2.0.0&format=300x250&url=http%3A%2F%2Fwww.threat2remove.com%2F&flash=0&avail_w=265&wgl=1&dt=1568666025720&bpp=41&bdt=1341&fdt=186&idt=187&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&correlator=2067350434327&frm=20&pv=2&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=4188927&dssz=16&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1112&ady=2942&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=0&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=1&uci=1.ovalmgh6m1tp&fsb=1&xpc=kJsusNtOiy&p=http%3A//www.threat2remove.com&dtd=222
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
http://www.threat2remove.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
http://www.threat2remove.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 16 Sep 2019 20:33:46 GMT
server
cafe
content-length
198
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 16-Sep-2019 20:48:46 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
expires
Mon, 16 Sep 2019 20:33:46 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
fa6c0d77f097497e1a53b31c22f0aac13947e9a7a72a5202806411bebf7c916a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Sep 2019 20:33:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1568373336498356"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
29135
x-xss-protection
0
expires
Mon, 16 Sep 2019 20:33:45 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame F0E8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7943855733030580&output=html&adk=1812271804&adf=3025194257&lmt=1568666025&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=http%3A%2F%2Fwww.threat2remove.com%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1568666025837&bpp=14&bdt=1457&fdt=141&idt=141&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=300x250&nras=1&correlator=2067350434327&frm=20&pv=1&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=23&ifi=1&uci=1.ay64un7t6y5u&fsb=1&dtd=163
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190911/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-7943855733030580&output=html&adk=1812271804&adf=3025194257&lmt=1568666025&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=http%3A%2F%2Fwww.threat2remove.com%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1568666025837&bpp=14&bdt=1457&fdt=141&idt=141&shv=r20190911&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=300x250&nras=1&correlator=2067350434327&frm=20&pv=1&ga_vid=1116981850.1568666026&ga_sid=1568666026&ga_hid=1811466327&ga_fc=0&iag=0&icsg=37743359&dssz=17&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=23&ifi=1&uci=1.ay64un7t6y5u&fsb=1&dtd=163
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
http://www.threat2remove.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
http://www.threat2remove.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Mon, 16 Sep 2019 20:33:46 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 16-Sep-2019 20:48:46 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
expires
Mon, 16 Sep 2019 20:33:46 GMT
cache-control
private
generator.php
threat2remove.com/ 		0
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://threat2remove.com/generator.php?action_name=Threat%202%20Remove&idsite=340&rec=1&r=835180&h=22&m=33&s=46&url=http%3A%2F%2Fwww.threat2remove.com%2F&_id=3e6dc487a2a51ac0&_idts=1568666027&_idvc=1&_idn=0&_refts=0&_viewts=1568666027&send_image=0&cookie=1&res=1600x1200&gt_ms=738
Requested by
Host: www.threat2remove.com
URL: http://www.threat2remove.com/
Protocol
HTTP/1.1
Security
, ,
Server
166.62.36.180 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-166-62-36-180.ip.secureserver.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.threat2remove.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Sep 2019 20:33:47 GMT
Server
nginx
Connection
keep-alive
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| $ function| jQuery object| objectL10n function| iwacontactConstruct object| _paq function| httfebnbnh object| adsbygoogle function| setCookie function| getCookie object| google_js_reporting_queue object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad number| _gfp_ function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_t12n_vars object| jQuery111106466075607420012 function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy function| Goog_AdSense_getAdAdapterInstance boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| JSON2 object| Piwik object| AnalyticsTracker function| piwik_log

3 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
www.threat2remove.com/ Name: _pk_ses.340.3329
Value: *
www.threat2remove.com/ Name: _pk_id.340.3329
Value: 3e6dc487a2a51ac0.1568666027.1.1568666027.1568666027.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
affiliates.digitalriver.com
app4.kromtech.net
assets.kromtech.net
cj.dotomi.com
fonts.googleapis.com
fonts.gstatic.com
gilobi.enigma.revenuewire.net
gilobi.enigma.safecart.com
gilobi.reimage.revenuewire.net
gilobi.reimage.safecart.com
googleads.g.doubleclick.net
kromtech.net
link.safecart.com
pagead2.googlesyndication.com
send.onenetworkdirect.net
threat2remove.com
www.emjcd.com
www.googletagservices.com
www.reimageplus.com
www.spyhunter.com
www.threat2remove.com
www.tqlkg.com
www.yceml.net
13.35.253.76
149.126.77.38
161.47.7.14
166.62.36.180
23.45.238.30
2a00:1450:4001:808::2002
2a00:1450:4001:809::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:81d::2003
2a00:1450:4001:81f::200a
2a00:1450:4001:820::2002
45.60.33.126
52.45.74.92
52.54.161.129
89.207.16.72
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
236a892279988cc2c59f931c6bfff562494d4d57252807fa25990fda3f5c9621
2ea955cabe710b582d2dab5a5659f00c789af91e5a1fb8a1678e5cc69c82f107
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
4ca8f7722320d5e59ac553dc60baf881d5fddc53eef14a442c8f69bc2b481a4a
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
670b5fb660b4bd124af7baa973336eaea70f9503e9714cabf5b961eba97c4ac7
6ea00f64b4e1b58ac8e1162060375aeb983cbc6589ef55675c999e1fc3f447d9
74785791e63a226fb98b9050f80b5d90f0ca26401e187c99ff74962ff64301d3
794fe0486515f44881ce168acf0fb4ba478b6971fe3448ae96176f50075fadca
811576ad12c342afa480be3ee4e6f0b0536d7af0dd7cd45219b321cd62917a86
84b37226dd1ba126264c6b5d1369d28d6fb5fa26f7cd6f3e1458e86ff41d14e7
9feb1e84c6703aee7b5e7aeb6abfd1aacaf725796c4b5640fe736abe3447545a
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bddbba35635904eca1d7f9edc74bdbcba04ec0f5a16286fdbd8f78fb0f7e0c6f
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c
cea1b7d1b7c0a6760c2af9e0bd43ea71872ef5f43bf5bb0c2c0e27eaad087b34
d4d6f13572616a4fcb1834b1a15d4785035617f715ad69c7fa411ad14ee03392
d514cbc699d757a21b9898585e77009597337a101af50b7cd783a1df579373cc
d666ba68515e9d1b8770b7d44c5d2fccba27fe62e04ac3e181beff249cd39a23
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa6c0d77f097497e1a53b31c22f0aac13947e9a7a72a5202806411bebf7c916a
fd7ffc2056e10c09d88c0eb2f0b2df7d368ed1aa54d74d62871167fd00c79710
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995