clean.soapagent.com Open in urlscan Pro
109.122.46.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://clean.soapagent.com/
Effective URL:
https://clean.soapagent.com/
Submission: On January 16 via manual (January 16th 2024, 3:30:00 pm UTC) from US — Scanned from DE

Summary HTTP 25 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 9 domains to perform 25 HTTP transactions. The main IP is 109.122.46.55, located in Dallas, United States and belongs to DOT-TECH-LLC, US. The main domain is clean.soapagent.com.
TLS certificate: Issued by R3 on December 22nd 2023. Valid for: 3 months.

This is the only time clean.soapagent.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Adobe Update

Domain & IP information

	IP Address	AS Autonomous System
1 8	109.122.46.55 109.122.46.55	398395 (DOT-TECH-LLC) (DOT-TECH-LLC)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2606:4700:e4:... 2606:4700:e4::ac40:ac1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.121.75.187 3.121.75.187	16509 (AMAZON-02) (AMAZON-02)
1	192.243.59.12 192.243.59.12	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
7	192.243.61.227 192.243.61.227	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	2606:4700:20:... 2606:4700:20::681a:713	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700:e2:... 2606:4700:e2::ac40:8303	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	9

8 109.122.46.55 (Dallas, United States) 1 redirects

ASN398395 (DOT-TECH-LLC, US)
PTR: unassigned.forestracks.net

clean.soapagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e4::ac40:ac1f (United States)

ASN13335 (CLOUDFLARENET, US)

friendshipmale.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.121.75.187 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-75-187.eu-central-1.compute.amazonaws.com

proftrafficcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

unseenreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.243.61.227 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

splashjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:713 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.yourwebbars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:e2::ac40:8303 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.creative-bars1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	soapagent.com 1 redirects clean.soapagent.com	489 KB
7	splashjar.com splashjar.com — Cisco Umbrella Rank: 89374	9 KB
5	creative-bars1.com cdn.creative-bars1.com — Cisco Umbrella Rank: 27267	49 KB
1	yourwebbars.com cdn.yourwebbars.com — Cisco Umbrella Rank: 50056	977 B
1	unseenreport.com unseenreport.com — Cisco Umbrella Rank: 21727	425 B
1	proftrafficcounter.com proftrafficcounter.com — Cisco Umbrella Rank: 15666	303 B
1	friendshipmale.com friendshipmale.com — Cisco Umbrella Rank: 18684	27 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2029	247 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	74 KB
25	9

	Domain	Requested by
8	clean.soapagent.com	1 redirects clean.soapagent.com
7	splashjar.com	clean.soapagent.com
5	cdn.creative-bars1.com	clean.soapagent.com
1	cdn.yourwebbars.com	clean.soapagent.com
1	unseenreport.com
1	proftrafficcounter.com	clean.soapagent.com
1	friendshipmale.com	clean.soapagent.com
1	region1.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	clean.soapagent.com
25	9

This site contains links to these domains. Also see Links.

Domain
discord.gg

Subject Issuer	Validity	Valid
clean.soapagent.com R3	`2023-12-22` - `2024-03-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-18` - `2024-02-17`	a year	crt.sh
proftrafficcounter.com Amazon RSA 2048 M03	`2023-11-21` - `2024-12-19`	a year	crt.sh
*.unseenreport.com R3	`2023-11-22` - `2024-02-20`	3 months	crt.sh
splashjar.com R3	`2024-01-05` - `2024-04-04`	3 months	crt.sh
creative-bars1.com GTS CA 1P5	`2023-12-19` - `2024-03-18`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://clean.soapagent.com/
Frame ID: 8EC1521562BECF4465DCA708081ED1CF
Requests: 22 HTTP requests in this frame

Frame: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/img/close.svg
Frame ID: 5CCC8914D0366A32040A8B0A61179701
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Emerald

Page URL History Show full URLs

http://clean.soapagent.com/ HTTP 308
https://clean.soapagent.com/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

25
Requests

100 %
HTTPS

56 %
IPv6

9
Domains

9
Subdomains

9
IPs

2
Countries

650 kB
Transfer

1754 kB
Size

14
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://discord.gg/KGBHgamMgY
Title: Discord

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://clean.soapagent.com/ HTTP 308
https://clean.soapagent.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
clean.soapagent.com/
Redirect Chain

http://clean.soapagent.com/
https://clean.soapagent.com/

2 KB
912 B

401ms
140ms

Document
text/html

109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: 1eaee76da80223731e041d1beca2aa468a8606ef666ebfaf09004bb523b1fe4f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
cache-control: no-cache
content-encoding: gzip
content-type: text/html
date: Tue, 16 Jan 2024 15:29:55 GMT
etag: W/"6e9-2dHwTS9XhQmBeWoJf0C1AVjwAso"
server: Caddy

Redirect headers

Connection: close
Content-Length: 0
Date: Tue, 16 Jan 2024 15:29:54 GMT
Location: https://clean.soapagent.com/
Server: Caddy

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 204 KB
74 KB 86ms
36ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9CYZED8RHV

Requested by

Host: clean.soapagent.com
URL: https://clean.soapagent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

884c5e55c487c7a31ff27457f7a10dcd1985e42a31d969a724397495ac26465b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 75850
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 16 Jan 2024 15:29:55 GMT

GET
H2 200 uv.bundle.js Show response
clean.soapagent.com/uv/ 684 KB
182 KB 148ms
147ms Script
application/javascript 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/uv/uv.bundle.js
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: 7af214805f210d3e8f37a2c89890bc51f60f14309d362300623eb2ef0dd09c0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Jan 2024 04:13:07 GMT
server: Caddy
etag: W/"700899-1704946387083"
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000

GET
H2 200 uv.config.js Show response
clean.soapagent.com/uv/ 5 KB
2 KB 148ms
148ms Script
application/javascript 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/uv/uv.config.js
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: fb0f1f9952a407682c1a1abad1b81f89f9c51a4022a98b7653c916917c907f6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Jan 2024 04:13:07 GMT
server: Caddy
etag: W/"5376-1704946387095"
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000

GET
H2 200 xxb Show response
clean.soapagent.com/ 42 KB
42 KB 669ms
668ms Script
text/javascript 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/xxb
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: 45003ef3442160d97430c207224376461bca9737ad69f5d92031d4fb42e316cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 16 Jan 2024 15:29:55 GMT
server: Caddy
alt-svc: h3=":443"; ma=2592000
content-length: 43103
content-type: text/javascript

GET
H2 200 index-nkzpJpAh.js Show response
clean.soapagent.com/assets/ 476 KB
153 KB 278ms
277ms Script
application/javascript 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/assets/index-nkzpJpAh.js
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: 8356bd360d5e2d21cedffe6c012c4e9ce2f78ad8904b61beb3727d344056cdcf

Request headers

Referer: https://clean.soapagent.com/
Origin: https://clean.soapagent.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Jan 2024 04:13:08 GMT
server: Caddy
etag: W/"487009-1704946388511"
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000

GET
H2 200 index-dNthbQ9D.css
clean.soapagent.com/assets/ 27 KB
5 KB 277ms
277ms Stylesheet
text/css 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://clean.soapagent.com/assets/index-dNthbQ9D.css
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: d1be44acdc7171d8cf0cd7e2dfbf067da517cabb239bc81dc258aeb44d7ef33e

Request headers

Referer: https://clean.soapagent.com/
Origin: https://clean.soapagent.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Jan 2024 04:13:08 GMT
server: Caddy
etag: W/"27385-1704946388511"
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000

POST
H2 204 collect
region1.google-analytics.com/g/ 0
247 B 82ms
29ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-9CYZED8RHV&gtm=45je41a0v871182148&_p=1705418995272&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=616627429.1705418995&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1705418995&sct=1&seg=0&dl=https%3A%2F%2Fclean.soapagent.com%2F&dt=Emerald&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1139
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9CYZED8RHV
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Jan 2024 15:29:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://clean.soapagent.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sfp.js Show response
friendshipmale.com/ 83 KB
27 KB 294ms
206ms Script
application/javascript 2606:4700:e4::ac40:ac1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://friendshipmale.com/sfp.js

Requested by

Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e4::ac40:ac1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:56 GMT
strict-transport-security: max-age=0; includeSubdomains
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
alt-svc: h3=":443"; ma=86400
x-request-id: fd5b27d46d64ad1dad212be9ea3ee464
last-modified: Tue, 16 Jan 2024 15:29:56 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bVG75j3If%2B3a4OwuQ5lYAvpcA1MmKgR10jQ%2FvDp1T%2FEDCEoo5kfwqo3x0zoq4KqItog4NJLUSR9gUe0uR2QXDR13LOpJNauaD9wmBGEbFajUT73lIYXoHZZoNLGpcNNG8MrgmHAkQvWav%2BjViVwUM6Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 846765957a3f6f09-CDG
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 stats Show response
proftrafficcounter.com/ 40 B
303 B 83ms
23ms XHR
text/html 3.121.75.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://proftrafficcounter.com/stats
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.75.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-75-187.eu-central-1.compute.amazonaws.com
Software: fasthttp /
Resource Hash: 666deb9ea465f03b582655700ae6e0fd64fd3512b56ab7e9a71b84b4054da608

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

access-control-allow-origin: https://clean.soapagent.com
date: Tue, 16 Jan 2024 15:29:56 GMT
access-control-allow-credentials: true
server: fasthttp
content-length: 40
vary: Origin
content-type: text/html; charset=UTF-8

GET
H3 200 emerald.png
clean.soapagent.com/ 104 KB
104 KB 141ms
141ms Image
image/png 109.122.46.55
DOT-TECH-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clean.soapagent.com/emerald.png
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 109.122.46.55 Dallas, United States, ASN398395 (DOT-TECH-LLC, US),
Reverse DNS: unassigned.forestracks.net
Software: Caddy /
Resource Hash: b547ab2d113c1340c2b751b12a0e7a6e1a915c27e3a58885653ef71e46a0d14f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:56 GMT
last-modified: Thu, 11 Jan 2024 04:13:07 GMT
server: Caddy
etag: W/"106055-1704946387083"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
content-length: 106055

GET
H/1.1 200
OK pxf.gif
unseenreport.com/ 1 B
425 B 367ms
124ms Image
image/gif 192.243.59.12
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://unseenreport.com/pxf.gif?uuid=fb68780c-3f0e-47fb-954c-668b2dd511be&eb=a91dabb3b2c78afe5dd91841f9446be0&te=a29db2d4d4d2524b20a5baa34ed01eab&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F120.0.6099.216%20Safari%2F537.36&dev=r&res=14.31&b_frame=0&pk=f2a68a8efbb3bb45a81c03d70688068d&bl=en-US&sr=1200x1600&sz=1200x1600&hjs=16

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:56 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1
X-Request-ID: 2a76c780b9afc2cf52b93a9f1063ed20
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK sbar.json Show response
splashjar.com/ 6 KB
5 KB 431ms
175ms XHR
text/plain 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://splashjar.com/sbar.json?key=f2a68a8efbb3bb45a81c03d70688068d&uuid=fb68780c-3f0e-47fb-954c-668b2dd511be%3A3%3A1

Requested by

Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

52034e8e5a753f43b316c4b004f8cf1879bf4d605f125a602c70f408b9bf6716

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:56 GMT
Custom-Referer: https://clean.soapagent.com
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://clean.soapagent.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: ba8f16d0b262d5b77c3cf80a85f795c0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 index.html Show response
cdn.yourwebbars.com/sb/interstitial/software/flash/multi/2/ 2 KB
977 B 574ms
510ms XHR
text/html 2606:4700:20::681a:713
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.yourwebbars.com/sb/interstitial/software/flash/multi/2/index.html
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:713 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f9d30e4c63260fc23122fab2bb70483d342972a0118a0ca72d0935b8e5a20d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:57 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 30 Sep 2021 13:29:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FSBCCDNtYGK4mRMLcCgm7gIVu8Bay%2FomQpcp2OY8OaIBorow3rLNxiY0Ep3VEsen9HnOsLSO81zURG6AIR3FD%2BBZX0EWTj6E3jPrFz%2Bw4UaZAT1rLz8laGlI3S8FWmzUXKmcQs0IHAmEl1VDmSeoFO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 8467659b2c89bbb0-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK ren.gif
splashjar.com/ 7 B
641 B 116ms
116ms Image
image/gif 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://splashjar.com/ren.gif?sid=H4sIAAAAAAAC%2F1xSTYgcRRSu3gQ9GBC9itCChwSzk%2B6Znp4eAoZk82PcxMQkslfrr2fL7e5qqqqnNwtCMCDxNrmIBw%2B932x2UYMonoM6K6gsiIyn9bA37x704EGQ2SwMWJf33vfVg%2Fd97324WR2QEBXdd9f1hsoyeqbbCvyTK6oQurb%2BW3f8MGgFZ%2F0VVcTRWX89jk7558sykyuSLSt3ptvptTqxf3L5jTvXr532M7Um%2FSuSr%2BlT%2FtKq0bk8E7aDVtCKg36%2F1Q5j%2FzZNqVFHfVDll%2B2w1wrDqNUOk1bYx7r5P2IrD5Z6EMMD8iKUmJ742f8Jik9Q5F9dlHbN6fL0pbzKqNMGQ7HzTrFW6LpAPk9T4yEtdo5%2BQ9spIZ8sQBc7R0qhh1szpWBqSrx%2FXwcrtp8KABuOw3YAlkFIMPE86uEEMptA0Qm4vg8l%2BuACFy%2BhyHeuSJPT4i4U3QWnM3JKnnm4DVVPybPvf48i316Wd2vJsJ42UOsTqMEEZbULt%2BFB1bvg7gMo8QtZPP4xivzxBWkGhayso8JBif1XUxYnvSTgi500kItRL2WL%2FW7EF%2BM4YW0humHI5KE9Sk2g0gkyOQK1x1BZD5XyUKULqMoF5GLfFzIKUt5lohfEnU7EozTopjTgPOCJpL0eKj7TMIIrR%2BDZCNzcQ2nuYU2NYKrvYFcbWOHBOoKhaFBLgtoS1JSgVgS1I6iHzSOR2bZttkVmKxYexfZR7DRj7Qab9JF2A1kQUPNwYbM8IC%2FM3PNuvP0P1uS%2Bn7ZpnNBEpox1GIu6NAl50JkNniRBnAhY1UDZBVDrYUNNSbS0hVJNyYknn4LRXdhsF1wdA61eBq3HvXYAujqOkgAbxTc8k7RoWU1LOpCFa3GdQ%2BgGpTsOd9fbzA7IS4fLfPPH1yD5Hjl64KZBaRq8p34gGGQPxrd0TbZu6dqSr2%2BUTuVqgzqli9uOOul9Plu%2BNuLqRTv67DyfEbP08R1p3TVaCFUMLPnighJCmsvacEmeXLUrkt2s7OqFyhRVee3m0uWreWmktUoXE9DZwS79Da6m5LmbO4cH%2FEq9DGUmMFWDvJrPqvQueHkPtpxjVhOYbF6z0kNdNWPTZnMwUwSZnNeUNbBy79zvv%2F7x7vmPemBy79s%2Fn3JjQ2fdVDWb9gEGxgN191HkDYamwTBrQLMRbHVs7Eqzd%2B63zuEDy7wxy4y3xTKTPXxqs1X7fiqTKA6CtmCiE1MadfoyDmXAww6jERV9ODuV281f%2FwEAAP%2F%2FAQAA%2F%2F9zOozRygQAAA%3D%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:56 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 7
X-Request-ID: 84e74a57d8b68fdacbf5ee9caa3f0c7d
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 style.css Show response
cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/css/ 6 KB
2 KB 353ms
269ms XHR
text/css 2606:4700:e2::ac40:8303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/css/style.css
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8303 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3672c27ea6b951de6642b0385c403071f7542a4a3f84f77de723611b61c194ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:57 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Sep 2021 13:29:09 GMT
server: cloudflare
etag: W/"6155bba5-1891"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7OY9mP%2Fc0DtNQl4NTgBA5Sxm0SNj3s6YGhyJGyaOP5OO72AF4Kae4klZOC4LNi0299M1g0PiVXRg3MZw%2Bv7hUYtZ9KwUYdz%2Fw%2BOmwxo4gbezePisQ7C%2FToQ7MZFZ%2FNFwDNz1MiXaSj7u4wopGh%2FM6S%2Fgwf5A"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 8467659ee8106400-LHR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
splashjar.com/pixel/ 0
469 B 116ms
116ms Image
text/plain 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://splashjar.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.yourwebbars.com%2Fsb%2Finterstitial%2Fsoftware%2Fflash%2Fmulti%2F2%2Findex.html&l=1631&fd=575.3999996185303
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:57 GMT
Server: nginx/1.21.6
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 close.svg
cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/img/ Frame 5CCC 1 KB
1 KB 116ms
44ms Image
image/svg+xml 2606:4700:e2::ac40:8303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/img/close.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8303 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:57 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1052804
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Sep 2021 13:29:05 GMT
server: cloudflare
etag: W/"6155bba1-4ff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nn5e6SUBK%2FgbE1xGXmUS6oCNAH%2BGxuv1MxfMKh%2BUPbCKyr3m%2BUAxbZcQ1TuGnCPH0u6J%2BJFkFzS%2BDDHbHK%2B2DJvkrPBi%2BZq9lOY2qkhTpOdDkm5YeXuUJvym%2FR1iMPYGd3UMu301DwQriNiouifpT5MzDrpA"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 8467659f7c5d2a14-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fine.png
cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/img/ Frame 5CCC 7 KB
7 KB 118ms
46ms Image
image/png 2606:4700:e2::ac40:8303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/img/fine.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8303 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4c14d0156315e5c1655e51cf2478e5e350772b1bf3ec62f17e01fe18ea01cbe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:57 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5663212
alt-svc: h3=":443"; ma=86400
content-length: 7308
last-modified: Thu, 30 Sep 2021 13:29:06 GMT
server: cloudflare
etag: "6155bba2-1c8c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xy%2BulEaUqquriMSnttSO67xeaQDqERDZ6CboilH2FqJI2%2B2XknDd35X4aXInIvmrKmT2rQIHpMMNmBBVtI%2FD%2BEy0mYlGwyERSa9USDwrT2EwtiUKfCUnl93jNYUONlziv3asqGn3IIT7EA%2Ftu37NaPDSCvJx"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 8467659f7c622a14-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/js/ Frame 5CCC 85 KB
31 KB 121ms
49ms Script
application/javascript 2606:4700:e2::ac40:8303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/js/jquery.min.js
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8303 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:57 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5832135
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Sep 2021 13:29:08 GMT
server: cloudflare
etag: W/"6155bba4-15391"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LirmZJM9FTtckl5prESmwypCNC2kTCX7dmHp3AZ4rwOKBbpkdU8rPWRZ3hSIn358NN3GsuZEva9R0vqcDNOyEszyEetjSAZr5Q8Zxe0d%2FXH2OAemJhOnIvH12ybG4J8Xxw0xtls62rtqKoqzvbVZFgR0yTP5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 8467659f7c602a14-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 script.js Show response
cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/js/ 20 KB
8 KB 377ms
377ms XHR
application/javascript 2606:4700:e2::ac40:8303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/interstitial/software/flash/multi/2/js/script.js
Requested by: Host: clean.soapagent.com
URL: https://clean.soapagent.com/xxb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8303 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c7017f080260371622bffa59e57591c58271e6184fc55aa8f4c4f23359e9f9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:29:58 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 29 Oct 2021 09:58:01 GMT
server: cloudflare
etag: W/"617bc5a9-51ec"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cCUsixEI7XkpPPBkYqRz7L1Cy46QAxZ0Ow4PuLrZBwpD6otw2%2FLhbZC2lVez1upMymVdrbTdRIeouXU7MGDypVV%2Fuzu%2BETJMbhtuJ4sCkNi1JBRIy2jgV2H9iWYlswTO6mbtvia%2F%2FNQlM9OMxw2iH0o%2F5EdK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 846765a009cf6400-LHR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
splashjar.com/pixel/ 0
469 B 115ms
115ms Image
text/plain 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://splashjar.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Finterstitial%2Fsoftware%2Fflash%2Fmulti%2F2%2Fcss%2Fstyle.css&l=6289&fd=353.8999996185303
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:57 GMT
Server: nginx/1.21.6
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK sbls
splashjar.com/pixel/ 0
469 B 121ms
121ms Image
text/plain 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://splashjar.com/pixel/sbls?bv=23.51.2179&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Finterstitial%2Fsoftware%2Fflash%2Fmulti%2F2%2Fjs%2Fscript.js&l=17311&fd=379.3999996185303
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:58 GMT
Server: nginx/1.21.6
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK impr.gif
splashjar.com/ 7 B
641 B 118ms
117ms Image
image/gif 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://splashjar.com/impr.gif?sid=H4sIAAAAAAAC%2F1xSTWgdVRS%2BkxZdWBDdijCCixab15l58%2BZNKFja9Mea1ta2kq33b16umZk73HvnTRoQigWpu9eNuHAx%2BV6aoBZRXBf1RVAJiDxXcZGdexe6cCHISwMB7%2Bac8333wPm%2Bcz7cqPdJiJruuet6XeU5PdPrBP7JZVUK3Vj%2FrTt%2BGHSCs%2F6yKpP4rL%2BWxKf881WVy2XJlpQ70%2Bv2O93EP7n0xp3r1077uVqV%2FhXJV%2FUpf3HF6EKeCaOgE3SSYGGhE4WJf5tm1KjDPqjqyyjsd8Iw7kRh2gkXsGb%2Bj9jag6UexHCfvAglpid%2B9n%2BC4hOUxVcXpV11ujp9qahz6rTBUGy%2FU66WuilRHKWZ8ZCV24e%2Foe2UkE%2FmoMvtQ6XQw82ZUjA1Jd6%2Fr4OVW08FgA3HYRSA5RASTDyPZjiBzCdQdAKu70OJBXCBi5dQFttXpCloeReK7oDTGTklzzzcgmqm5Nn3v0dZbC3Ju41kWMtaqLUJ1GCCqt6BW%2Fegmh1w9wGU%2BIXMH%2F8YZfH4gjSDUtbWUeGgxN6rGUvSfhrw%2BW4WyPm4n7H5hV7M55MkZZEQvTBk8sAepSZQ2QS5HIHaY6ith1p5qLM51NUcCrHnCxkHGe8x0Q%2BSbjfmcRb0MhpwHvBU0n4fNZ9pGMFVI%2FB8BG7uoTL3sKpGMPV3sCstrPBgHcFQtGgkQWMJGkrQKILGETTD9pHIbWTbLZHbmoWHMTqM3Xas3WCDPtJuIEsCah7ObVT75IWZe96Nt%2F%2FBqtzzs4gmKU1lxliXsbhH05AH3dngaRokqYBVLZSdA7Ue1tWUxIubqNSUnHjyKRjdgc13wNUx0Ppl0GbcjwLQlXGcBlgvv%2BG5pGXHalrRgSxdh%2BsCQreo3HG4u95Gvk9eOljmmz%2B%2BBsl3yeEDNy0q0%2BI99QPBIH8wvqUbsnlLN5Z8faNyqlDr1Cld3nbUSe%2Fz2fK1EVcv2tFn5%2FmMmKWP70jrrtFSqHJgyRcXlBDSXNaGS%2FLkql2W7GZtVy7UpqyrazcXL18tKiOtVbqcgM4OdvFvcDUlz93cPjjgV5olKDOBqVsU9dGsSu%2BAV%2FdgqyPMagKTH9Ws8tDU7dhE7AjMFUEuj2rKWli5e%2B73X%2F949%2FxHfTC5%2B%2B2fT7mxobNuqtoN%2BwAD44G6%2ByiLFkPTYpi3oPkItj42dpXZPfdb9%2BCB5d6Y5cbbZLnJHz612ao9X9BkIYpFKFgUdPu9KORpGvEg7MU9kSWZhLNTudX%2B9R8AAAD%2F%2FwEAAP%2F%2Ft3yiksoEAAA%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:58 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 7
X-Request-ID: 4050662e5839fa25a7df8d7dd5b781e2
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK sbs
splashjar.com/pixel/ 0
469 B 234ms
115ms Image
text/plain 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://splashjar.com/pixel/sbs?c=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://clean.soapagent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 16 Jan 2024 15:29:58 GMT
Server: nginx/1.21.6
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Adobe Update

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.soapagent.com/	1970-01-21 03:19:38	Name: _ga_9CYZED8RHV Value: GS1.1.1705418995.1.0.1705418995.0.0.0
.soapagent.com/	1970-01-21 03:19:38	Name: _ga Value: GA1.1.616627429.1705418995
proftrafficcounter.com/	1970-01-21 03:19:38	Name: uid_id2 Value: fb68780c-3f0e-47fb-954c-668b2dd511be:3:1
clean.soapagent.com/	1970-01-20 17:53:43	Name: dom3ic8zudi28v8lr6fgphwffqoz0j6c Value: fb68780c-3f0e-47fb-954c-668b2dd511be%3A3%3A1
clean.soapagent.com/	1970-01-20 17:43:46	Name: sb_main_f2a68a8efbb3bb45a81c03d70688068d Value: 1
clean.soapagent.com/	1970-01-20 17:43:46	Name: sb_count_f2a68a8efbb3bb45a81c03d70688068d Value: 1
splashjar.com/	1970-01-20 17:45:05	Name: u_pl Value: 21975545
splashjar.com/	1970-01-20 17:53:43	Name: uid_id2 Value: fb68780c-3f0e-47fb-954c-668b2dd511be:3:1
splashjar.com/	1970-01-20 17:45:05	Name: pdhtkv Value: true
splashjar.com/	1970-01-20 17:45:05	Name: uncs Value: 1
splashjar.com/	1970-01-20 17:45:05	Name: pdhtkv29 Value: true
splashjar.com/	1970-01-20 17:45:05	Name: uncs29 Value: 1
splashjar.com/	1970-01-20 17:43:39	Name: slecf2a68a8efbb3bb45a81c03d70688068d Value: [4900651]
clean.soapagent.com/	1970-01-20 17:43:39	Name: pbpr0tpuw4isk85t8yg3jb2lj5vqf Value: splashjar.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.creative-bars1.com
cdn.yourwebbars.com
clean.soapagent.com
friendshipmale.com
proftrafficcounter.com
region1.google-analytics.com
splashjar.com
unseenreport.com
www.googletagmanager.com
109.122.46.55
192.243.59.12
192.243.61.227
2001:4860:4802:34::36
2606:4700:20::681a:713
2606:4700:e2::ac40:8303
2606:4700:e4::ac40:ac1f
2a00:1450:4001:810::2008
3.121.75.187
1eaee76da80223731e041d1beca2aa468a8606ef666ebfaf09004bb523b1fe4f
3672c27ea6b951de6642b0385c403071f7542a4a3f84f77de723611b61c194ba
3f9d30e4c63260fc23122fab2bb70483d342972a0118a0ca72d0935b8e5a20d3
45003ef3442160d97430c207224376461bca9737ad69f5d92031d4fb42e316cf
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
52034e8e5a753f43b316c4b004f8cf1879bf4d605f125a602c70f408b9bf6716
666deb9ea465f03b582655700ae6e0fd64fd3512b56ab7e9a71b84b4054da608
7af214805f210d3e8f37a2c89890bc51f60f14309d362300623eb2ef0dd09c0f
7c7017f080260371622bffa59e57591c58271e6184fc55aa8f4c4f23359e9f9c
8356bd360d5e2d21cedffe6c012c4e9ce2f78ad8904b61beb3727d344056cdcf
884c5e55c487c7a31ff27457f7a10dcd1985e42a31d969a724397495ac26465b
9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21
ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95
b547ab2d113c1340c2b751b12a0e7a6e1a915c27e3a58885653ef71e46a0d14f
d1be44acdc7171d8cf0cd7e2dfbf067da517cabb239bc81dc258aeb44d7ef33e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4c14d0156315e5c1655e51cf2478e5e350772b1bf3ec62f17e01fe18ea01cbe
fb0f1f9952a407682c1a1abad1b81f89f9c51a4022a98b7653c916917c907f6a

clean.soapagent.com Open in urlscan Pro 109.122.46.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

100 %HTTPS

56 %IPv6

9 Domains

9 Subdomains

9 IPs

2 Countries

650 kBTransfer

1754 kBSize

14 Cookies

1 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

14 Cookies

Indicators

clean.soapagent.com Open in urlscan Pro
109.122.46.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

100 %
HTTPS

56 %
IPv6

9
Domains

9
Subdomains

9
IPs

2
Countries

650 kB
Transfer

1754 kB
Size

14
Cookies

25 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!