ballista.xyz Open in urlscan Pro
158.69.52.12 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://link.popprincesspenny.com/oc/67039251b8474f80a7eab237f6fd8cb0.asp
Effective URL:
https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv...
Submission: On December 19 via api (December 19th 2019, 1:05:06 pm UTC) from BE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 6 countries across 13 domains to perform 22 HTTP transactions. The main IP is 158.69.52.12, located in Montreal, Canada and belongs to OVH, FR. The main domain is ballista.xyz.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 28th 2019. Valid for: 3 months.

This is the only time ballista.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	51.38.33.240 51.38.33.240	16276 (OVH) (OVH)
1 3	198.143.165.221 198.143.165.221	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
2 2	212.32.252.92 212.32.252.92	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1 3	198.143.165.219 198.143.165.219	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
1 3	107.6.174.196 107.6.174.196	() ()
1	104.26.7.83 104.26.7.83	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 2	99.198.108.196 99.198.108.196	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
4	205.147.93.132 205.147.93.132	393676 (ZENEDGE) (ZENEDGE - Oracle Corporation)
3 3	52.76.175.101 52.76.175.101	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	163.172.255.137 163.172.255.137	12876 (Online SAS) (Online SAS)
2	158.69.52.12 158.69.52.12	16276 (OVH) (OVH)
1	78.46.106.103 78.46.106.103	24940 (HETZNER-AS) (HETZNER-AS)
4	158.69.26.44 158.69.26.44	16276 (OVH) (OVH)
22	10

2 51.38.33.240 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: mails1.popprincesspenny.com

link.popprincesspenny.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 198.143.165.221 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

links.securedark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.32.252.92 (Netherlands) 2 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

track.wbamedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wildbearads.go2affise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 198.143.165.219 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

offers.wildbearads.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.6.174.196 (Amsterdam, Netherlands) 1 redirects

ASN- ()
PTR: bigfish.setupcentral.network

up.trkgenius.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.7.83 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

onwardinated.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.198.108.196 (Chicago, United States) 2 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

by.clickkmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 205.147.93.132 (United States)

ASN393676 (ZENEDGE - Oracle Corporation, US)

trafficsel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.76.175.101 (Singapore, Singapore) 3 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-76-175-101.ap-southeast-1.compute.amazonaws.com

tracking.adacts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.172.255.137 (France) 1 redirects

ASN12876 (Online SAS, FR)
PTR: 163-172-255-137.rev.poneytelecom.eu

163.172.255.137	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.69.52.12 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns517583.ip-158-69-52.net

ballista.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.46.106.103 (Nuremberg, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.103.106.46.78.clients.your-server.de

icon-library.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 158.69.26.44 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns516875.ip-158-69-26.net

t.instantpu.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	instantpu.sh t.instantpu.sh	485 B
4	trafficsel.com trafficsel.com	11 KB
3	adacts.com tracking.adacts.com Failed	981 B
3	trkgenius.com 1 redirects up.trkgenius.com	4 KB
3	wildbearads.bid 1 redirects offers.wildbearads.bid	4 KB
3	securedark.com 1 redirects links.securedark.com	5 KB
2	ballista.xyz ballista.xyz	417 KB
2	clickkmobi.com by.clickkmobi.com Failed	632 B
2	popprincesspenny.com 1 redirects link.popprincesspenny.com	1 KB
1	icon-library.net icon-library.net	2 KB
1	onwardinated.com onwardinated.com	4 KB
1	go2affise.com 1 redirects wildbearads.go2affise.com	291 B
1	wbamedia.com 1 redirects track.wbamedia.com	142 B
22	13

	Domain	Requested by
4	t.instantpu.sh	ballista.xyz
4	trafficsel.com	onwardinated.com trafficsel.com
3	tracking.adacts.com	trafficsel.com
3	up.trkgenius.com	1 redirects offers.wildbearads.bid up.trkgenius.com
3	offers.wildbearads.bid	1 redirects links.securedark.com offers.wildbearads.bid
3	links.securedark.com	1 redirects link.popprincesspenny.com links.securedark.com
2	ballista.xyz	trafficsel.com ballista.xyz
2	by.clickkmobi.com	onwardinated.com trafficsel.com
2	link.popprincesspenny.com	1 redirects
1	icon-library.net	ballista.xyz
1	onwardinated.com
1	wildbearads.go2affise.com	1 redirects
1	track.wbamedia.com	1 redirects
22	13

This site contains no links.

Subject Issuer	Validity	Valid
offers.wildbearads.bid Let's Encrypt Authority X3	`2019-12-11` - `2020-03-10`	3 months	crt.sh
up.trkgenius.com Let's Encrypt Authority X3	`2019-11-18` - `2020-02-16`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-15` - `2020-10-09`	a year	crt.sh
ballista.xyz Let's Encrypt Authority X3	`2019-10-28` - `2020-01-26`	3 months	crt.sh
icon-library.net Sectigo RSA Domain Validation Secure Server CA	`2019-05-13` - `2020-05-12`	a year	crt.sh
t.instantpu.sh Let's Encrypt Authority X3	`2019-12-07` - `2020-03-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
Frame ID: 94E7EDDB127A6BDDD71A02ECC1932AE8
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://link.popprincesspenny.com/oc/67039251b8474f80a7eab237f6fd8cb0.asp HTTP 302
http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&loca... Page URL
http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72 Page URL
http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
http://links.securedark.com/proc.php?3ae61fa216e843a383d4d179b4193c7dd547a353 HTTP 302
https://track.wbamedia.com/click?pid=14&offer_id=228&sub1=6772135588595236894&sub2=2704-7b4fdb2z&sub3=2... HTTP 302
https://wildbearads.go2affise.com/click?pid=14&offer_id=2015&sub1=&sub2=14_2704-7b4fdb2z&sub4=228 HTTP 302
https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobi... Page URL
https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
https://offers.wildbearads.bid/proc.php?443734d759fe3b283c64f6c2bff793d7ee4652de HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=677213558862879... Page URL
https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791... Page URL
https://up.trkgenius.com/out.php?v=c80804d9493e5d4f1af7cb022d429166 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee577... Page URL
https://by.clickkmobi.com/?cid=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&utm_medium=6856... HTTP 302
http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000 Page URL
http://trafficsel.com/15h78/F5ez48DtUwE/UJC59ai7DFiGL0wQrHRLb4ksetnBX0A?cp=lNL20AVRG090ee60000RS00... Page URL
https://by.clickkmobi.com/?cid=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&utm_medium=6856... HTTP 302
http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000 Page URL
http://trafficsel.com/space/optical-carrier/5dfb757275dc08.09898713?cp=lNL20AVRG0907880000RS0037O0... Page URL
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_i... HTTP 302
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_i... HTTP 302
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_i... HTTP 302
http://163.172.255.137:8329/a45b12cd-be38-48dd-9fcd-205fa4d3096f?tid=817208&subid=564_aFFicGw3eUxMRHM9_6... HTTP 302
https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM... Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

url /\.aspx?(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Page Statistics

22
Requests

55 %
HTTPS

0 %
IPv6

13
Domains

13
Subdomains

10
IPs

6
Countries

447 kB
Transfer

479 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://link.popprincesspenny.com/oc/67039251b8474f80a7eab237f6fd8cb0.asp HTTP 302
http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U Page URL
http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72 Page URL
http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
http://links.securedark.com/proc.php?3ae61fa216e843a383d4d179b4193c7dd547a353 HTTP 302
https://track.wbamedia.com/click?pid=14&offer_id=228&sub1=6772135588595236894&sub2=2704-7b4fdb2z&sub3=2704&sub4=NL HTTP 302
https://wildbearads.go2affise.com/click?pid=14&offer_id=2015&sub1=&sub2=14_2704-7b4fdb2z&sub4=228 HTTP 302
https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19 Page URL
https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
https://offers.wildbearads.bid/proc.php?443734d759fe3b283c64f6c2bff793d7ee4652de HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855 Page URL
https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855&m=KGn7UHVlTW9UUgrTBf.eTHmri8LNzGVvSU47gsvPE6bk0HmiS3f3pK8jP334pzv_18QHz6CZdpCS_rfkzTyMKwNPieNMKw-ci6hqKsxAplyAid3l8p8G1xvkGHxQoWxvS-na82jljV0ljz8K12vKiehDF2bFpM Page URL
https://up.trkgenius.com/out.php?v=c80804d9493e5d4f1af7cb022d429166 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx Page URL
https://by.clickkmobi.com/?cid=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=SQQD_12D2GHvmSm1I3nW HTTP 302
http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000 Page URL
http://trafficsel.com/15h78/F5ez48DtUwE/UJC59ai7DFiGL0wQrHRLb4ksetnBX0A?cp=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&ori=16x&ex=1&pbi=5dfb7572161538.830977050 Page URL
https://by.clickkmobi.com/?cid=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=a0sNMlW_75VgGJCv2AcJ&nc=1 HTTP 302
http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000 Page URL
http://trafficsel.com/space/optical-carrier/5dfb757275dc08.09898713?cp=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&ori=36x&ex=1&pbi=5dfb7572767d77.918383560 Page URL
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=8855&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1 HTTP 302
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=8505&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1 HTTP 302
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=9079&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1 HTTP 302
http://163.172.255.137:8329/a45b12cd-be38-48dd-9fcd-205fa4d3096f?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25 HTTP 302
https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://link.popprincesspenny.com/oc/67039251b8474f80a7eab237f6fd8cb0.asp HTTP 302
http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U

Request Chain 3

http://links.securedark.com/proc.php?3ae61fa216e843a383d4d179b4193c7dd547a353 HTTP 302
https://track.wbamedia.com/click?pid=14&offer_id=228&sub1=6772135588595236894&sub2=2704-7b4fdb2z&sub3=2704&sub4=NL HTTP 302
https://wildbearads.go2affise.com/click?pid=14&offer_id=2015&sub1=&sub2=14_2704-7b4fdb2z&sub4=228 HTTP 302
https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19

Request Chain 5

https://offers.wildbearads.bid/proc.php?443734d759fe3b283c64f6c2bff793d7ee4652de HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855

Request Chain 7

https://up.trkgenius.com/out.php?v=c80804d9493e5d4f1af7cb022d429166 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx

Request Chain 9

https://by.clickkmobi.com/?cid=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=SQQD_12D2GHvmSm1I3nW HTTP 302
http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000

Request Chain 12

https://by.clickkmobi.com/?cid=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=a0sNMlW_75VgGJCv2AcJ&nc=1 HTTP 302
http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

unsubscribe Show response
link.popprincesspenny.com/c/
Redirect Chain

http://link.popprincesspenny.com/oc/67039251b8474f80a7eab237f6fd8cb0.asp
http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U

828 B
822 B

248ms
246ms

Document
text/html

51.38.33.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U

Protocol

HTTP/1.1

Server

51.38.33.240 , France, ASN16276 (OVH, FR),

Reverse DNS

mails1.popprincesspenny.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

b3093354cc2d5cfde6dfa1d9e9605a2fc837b24b6254cceebb16516f27e886c8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: link.popprincesspenny.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 19 Dec 2019 13:04:45 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip

Redirect headers

Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 19 Dec 2019 13:04:45 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Location: http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U

GET
H/1.1 200
OK Cookie set / Show response
links.securedark.com/ 3 KB
2 KB 271ms
218ms Document
text/html 198.143.165.221
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72
Requested by: Host: link.popprincesspenny.com
URL: http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U
Protocol: HTTP/1.1
Server: 198.143.165.221 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/7.3.4
Resource Hash: 9b4df0299353f41813f918c91291f83942ed7318c55f67acf7323bbfc17d24df

Request headers

Host: links.securedark.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://link.popprincesspenny.com/c/unsubscribe?email=jozef-dillen%40telenet.be&list=popprincesspenny.com&locale=nl_BE&e=e:VexIp4l7f_ErqJfe8M_4iDdTh-sH7SfCdApZqmKOE5U

Response headers

Server: nginx
Date: Thu, 19 Dec 2019 13:04:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.4
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: u=f29907e579cbd3503a15a862da647fd1; expires=Fri, 18-Dec-2020 13:04:48 GMT; Max-Age=31536000; path=/
Content-Encoding: gzip

GET
H/1.1 200
OK / Show response
links.securedark.com/ 7 KB
3 KB 243ms
243ms Document
text/html 198.143.165.221
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
Requested by: Host: links.securedark.com
URL: http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72
Protocol: HTTP/1.1
Server: 198.143.165.221 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/7.3.4
Resource Hash: c4c786f8e199f5a263373a9f8fbd5e3b200c0fa5eeb30e3626766423f7a828d9

Request headers

Host: links.securedark.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72
Accept-Encoding: gzip, deflate
Cookie: u=f29907e579cbd3503a15a862da647fd1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://links.securedark.com/?utm_medium=1825f7f8626bf29d7f48c762c1de1fbab4f0fd72

Response headers

Server: nginx
Date: Thu, 19 Dec 2019 13:04:48 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.4
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Encoding: gzip

GET
H2

200

/ Show response
offers.wildbearads.bid/
Redirect Chain

http://links.securedark.com/proc.php?3ae61fa216e843a383d4d179b4193c7dd547a353
https://track.wbamedia.com/click?pid=14&offer_id=228&sub1=6772135588595236894&sub2=2704-7b4fdb2z&sub3=2704&sub4=NL
https://wildbearads.go2affise.com/click?pid=14&offer_id=2015&sub1=&sub2=14_2704-7b4fdb2z&sub4=228
https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid...

3 KB
2 KB

346ms
117ms

Document
text/html

198.143.165.219
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19

Requested by

Host: links.securedark.com
URL: http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

198.143.165.219 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

0ae148d1c57eb41f392c5fb8f63988add4ea23603c6fa82f730c238998941005

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: offers.wildbearads.bid
:scheme: https
:path: /?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://links.securedark.com/?utm_term=6772135588595236894&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f

Response headers

status: 200
server: nginx
date: Thu, 19 Dec 2019 13:04:48 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=82b774bae0f60d9f0a255793ad6dd9ab; expires=Fri, 18-Dec-2020 13:04:48 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Thu, 19 Dec 2019 13:04:48 GMT
content-type: text/html; charset=utf-8
content-length: 261
location: https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122 Mobile Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19
set-cookie: afclick=5dfb7570e013ab0001532b19; Expires=Fri, 18 Dec 2020 13:04:48 GMT

GET
H2 200 / Show response
offers.wildbearads.bid/ 5 KB
2 KB 124ms
123ms Document
text/html 198.143.165.219
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f

Requested by

Host: offers.wildbearads.bid
URL: https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

198.143.165.219 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

bd5e1db903c785f6c8cd7cff63ec17465bfd885f3740a15c434f88b5d0c185a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: offers.wildbearads.bid
:scheme: https
:path: /?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19
accept-encoding: gzip, deflate, br
cookie: u=82b774bae0f60d9f0a255793ad6dd9ab
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://offers.wildbearads.bid/?utm_medium=38a5a0d06be36cb79cd92cd41d822f952ff7ff69&utm_campaign=122%20Mobile%20Mainstream&1=5dfb7570e013ab0001532b19&2=14_14_2704-7b4fdb2z&3=14_14_2704-7b4fdb2z&cid=5dfb7570e013ab0001532b19

Response headers

status: 200
server: nginx
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H2

200

in.html Show response
up.trkgenius.com/
Redirect Chain

https://offers.wildbearads.bid/proc.php?443734d759fe3b283c64f6c2bff793d7ee4652de
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855

6 KB
3 KB

89ms
28ms

Document
text/html

107.6.174.196

General

Check archive.org

Show headers Download Go to

Full URL

https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855

Requested by

Host: offers.wildbearads.bid
URL: https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

107.6.174.196 Amsterdam, Netherlands, ASN (),

Reverse DNS

bigfish.setupcentral.network

Software

nginx/1.16.1 /

Resource Hash

7e11348d49a8eb6e7584fca5405c42b697353d4c8b6946ac4d57c4e17b0e0eaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: up.trkgenius.com
:scheme: https
:path: /in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://offers.wildbearads.bid/?utm_term=6772135588628791419&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f

Response headers

status: 200
server: nginx/1.16.1
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html
last-modified: Sun, 27 Jan 2019 05:38:08 GMT
etag: W/"5c4d43c0-1605"
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html; charset=UTF-8
location: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;

GET
H2 200 in.php Show response
up.trkgenius.com/ 1 KB
984 B 40ms
39ms Document
text/html 107.6.174.196

General

Check archive.org

Show headers Download Go to

Full URL

https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855&m=KGn7UHVlTW9UUgrTBf.eTHmri8LNzGVvSU47gsvPE6bk0HmiS3f3pK8jP334pzv_18QHz6CZdpCS_rfkzTyMKwNPieNMKw-ci6hqKsxAplyAid3l8p8G1xvkGHxQoWxvS-na82jljV0ljz8K12vKiehDF2bFpM

Requested by

Host: up.trkgenius.com
URL: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

107.6.174.196 Amsterdam, Netherlands, ASN (),

Reverse DNS

bigfish.setupcentral.network

Software

nginx/1.16.1 /

Resource Hash

5110eaaf4ce1ecb1d1dbf79df86b8725c7ec7c7111e93ea728376b025975e831

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: up.trkgenius.com
:scheme: https
:path: /in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855&m=KGn7UHVlTW9UUgrTBf.eTHmri8LNzGVvSU47gsvPE6bk0HmiS3f3pK8jP334pzv_18QHz6CZdpCS_rfkzTyMKwNPieNMKw-ci6hqKsxAplyAid3l8p8G1xvkGHxQoWxvS-na82jljV0ljz8K12vKiehDF2bFpM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855

Response headers

status: 200
server: nginx/1.16.1
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
pragma: no-cache
expires: 0
surrogate-control: no-store
refresh: 0; url=out.php?v=c80804d9493e5d4f1af7cb022d429166
set-cookie: t=3468bd03482f24c8
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2

200

5a37c8ad-f104-11e5-9f1f-0626cc8adced Show response
onwardinated.com/c/
Redirect Chain

https://up.trkgenius.com/out.php?v=c80804d9493e5d4f1af7cb022d429166
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx

6 KB
4 KB

127ms
81ms

Document
text/html

104.26.7.83
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.83 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f5dab940b08648d433c8d60a6c0f0b1d38f7f6ec0bd997ba1a9b607d568c691

Request headers

:method: GET
:authority: onwardinated.com
:scheme: https
:path: /c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855&m=KGn7UHVlTW9UUgrTBf.eTHmri8LNzGVvSU47gsvPE6bk0HmiS3f3pK8jP334pzv_18QHz6CZdpCS_rfkzTyMKwNPieNMKw-ci6hqKsxAplyAid3l8p8G1xvkGHxQoWxvS-na82jljV0ljz8K12vKiehDF2bFpM
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6772135588628791419&pubid=5855&m=KGn7UHVlTW9UUgrTBf.eTHmri8LNzGVvSU47gsvPE6bk0HmiS3f3pK8jP334pzv_18QHz6CZdpCS_rfkzTyMKwNPieNMKw-ci6hqKsxAplyAid3l8p8G1xvkGHxQoWxvS-na82jljV0ljz8K12vKiehDF2bFpM

Response headers

status: 200
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=ddcd3df0bb93817765a23030e0afbfdec1576760689; expires=Sat, 18-Jan-20 13:04:49 GMT; path=/; domain=.onwardinated.com; HttpOnly; SameSite=Lax; Secure hK0ctfHxdYFF5S3EBZj8HME2kqs7jyS%2FcZbJO1clXNk%3D=9ba52ff9f6f96a8370f2b1a21d018de9_1576760689.5238; domain=onwardinated.com; path=/; expires=Sun, 16-Dec-2029 13:04:49 UTC P1Q%2B3W3pzWcqnG4d7bhTG44ocU3PyJaN%2F6PPYBiVfCA%3D=1576760689.5327; domain=onwardinated.com; path=/; expires=Sun, 16-Dec-2029 13:04:49 UTC gE4KpkNN1Gi3IcjDpFr%2FAsteG2QErOJ0TJ%2Fi90EWWsc%3D=WHlvZ1RKeTY5eW1UQkpKSmh1Sjl3WUl5My9oS2w5THZkQVBzOFpTWnI5M3luRXNMYnBJaFVmTVdFOGl0ZWVWMQ%3D%3D; domain=onwardinated.com; path=/; expires=Sun, 16-Dec-2029 13:04:49 UTC 9ba52ff9f6f96a8370f2b1a21d018de9_1576760689.5238_ck=ZmxjSURsVlN3U0pCSGd2Mzkyc0xMaGtzQzFzSXZXSVhuamxCWHpzMi8raVhiZExPMnJxNEUxWG5Ma3o0OUJocTVtWEplcGFDL2QyQUtwM3dNMlozMm5IYWxka0pCRGFQQ2FpRGFSUEMreElrVDA4TVdHM2JLam1tV3BGYks3aFlMQ2E3NzBUUEdpcXZ0cFpmV1hXUFhBRUFldkZCUWJTTVJ1REVQQ3NTMG8wRk5OOFpBSTRlYW1NSVErdUVpRGpad0ZhYWVBMHB1aWluSUlCV1BoVFNHNnJYME01cHpDVWdhbDVrblIyaVNSSTVsRWFGVFI2SFJyaTUrOWg5UGFsWXpwNmx1djNUcTdiZ2p6Wko3OEVXVnNMMnRORWMrcFpIYWVaMlRtSUw1NmdOZmswSlVDNk1acWxMOTJQaEJkYzRmOHVkU292c2ZVSVBaNUtycmtPN1RYaDEwaUV2ejRNbFdKUzgzSkpKdmFMUFU1bC8rRWhra0pSckpHbTZyRFZ2d2M4RStPdnBSTGFvZDU3bG9QOXFNajE1bmxneDBvSlVtUlB2MTlYVFNkdVJrVGNTKytBQWp4RmpKNUNqYS8wVUZBWXNmZFdydGtFSnhobXdVKzh4VysxTlhWUDU4ampRMGQyRlltNThjWEwzQXpHNlo5KzF2YjBTdmg3Ymthb2lDbEhTZkxNNjVtcncwQWV0TU9sQ0FObEtLdGpwRExFTWszenQyRzBQeVpMMkozQkFmM3hUeXFQTXFBMFQ1dVE3NkNnS0FSbzFTZ1NyVlhuWDAwZ0o5dFZNL0hETWFGMTZLbkNJRVlIcnJTeGJmUCttN04ycDZrZXlrZzlVdXh5RENKOTdnKzJma0dEdDJOanJ1cy9sL2tOdVhlNnV6UWorcjg4NFF1ODdvY1A3UHhaSWgwVkVWbnBMbmlsU0hlSUdHS2tZTU5Ed1h3YmJ5dGs0QWRBU3AyRHJBK1c0ZFVBUFp2T01rUC81NHVQRXNubENLRnRzVEw5YlQwNldiWTNpcG5qSDgyKzliU1BESnk5VlpwTU16cHBIMGZ5VHZJdXNwQlIyQ1I5Q0xSTGRHVC9LM0FYUEZmYVdVVmRzQUhOZXR1cGxsTmZiVm1na2N0QURWbFMxNU85dEY1TWZoZDRROW9KVEtOQlNLL1pWL0hHanFkMlBlKzVqQXNSajZhVnljbFlJU1lpSUFvMmdTbTN5MkU5Z01uaStnVllJSkZBenI4RU5vMkJXVVA3a3N5VS9KYTVpY3hmQnU0NjdlMHZGTlIrK285Z2ZyZ1VZUEZzUVlKZXcwL3ZWWGU1V3ovR2JnNUJVL0tQK29oVT0%3D; domain=onwardinated.com; path=/; expires=Sun, 16-Dec-2029 13:04:49 UTC jMXpTJjt569n5ssk1X%2FbdSpmpn%2Bcw3Zy7cYBeFXyloA%3D=NEFkTzVlYWpKYVVWQnRYQWNKWngrM0hmNUx6bXd1ak9lNDhsZDQwbW4yRHVVZzhPd2l5L2ZJSkpCaTR3Z242UlMrbWx4WXlTTWdqMVZzRGgwcWVpVnZvN0F4SEozS2dqVkRJaktNc3RqL2M9; domain=onwardinated.com; path=/; expires=Thu, 19-Dec-2019 14:09:49 UTC SERVERID=sfc7; path=/
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 547995a55c0fd8bd-AMS

Redirect headers

status: 302
server: nginx/1.16.1
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html; charset=UTF-8
location: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
pragma: no-cache
expires: 0
surrogate-control: no-store
strict-transport-security: max-age=31536000; includeSubDomains

GET /
by.clickkmobi.com/ 0
0

GET
H/1.1

200
OK

lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000 Show response
trafficsel.com/recollect/
Redirect Chain

https://by.clickkmobi.com/?cid=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=SQQD_12D2GHvmSm1I3nW
http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000

9 KB
3 KB

126ms
34ms

Document
text/html

205.147.93.132
Oracle Corporation

General

Check archive.org

Show headers Download Go to

Full URL: http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000
Requested by: Host: onwardinated.com
URL: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=1cc8b5bdf7e83ac712f793fd55ee5777&pubid=dvx
Protocol: HTTP/1.1
Server: 205.147.93.132 , United States, ASN393676 (ZENEDGE - Oracle Corporation, US),
Reverse DNS
Software: ZENEDGE /
Resource Hash: 9c298f289739d6d233686e1a6e21bd51711f172b5b3744b52611db7d702216d2

Request headers

Host: trafficsel.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://onwardinated.com/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://onwardinated.com/

Response headers

Date: Thu, 19 Dec 2019 13:04:50 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
set-cookie: 5O%2ByexcV9rWuvtrB3%2BGU%2F0qICj9NbX%2BzT9%2FA0gNyduc%3D=ec9eedf563481f48a940cd33cef397dc_1576760690.0874; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.0876; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC ec9eedf563481f48a940cd33cef397dc_1576760690.0874_cc=enable; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC SERVERID=sfc16; path=/
X-Zen-Fury: 57edbcaaf5d179dbaec4d79e12c8a7e5d4a1a3e5
Server: ZENEDGE
X-Cache-Status: NOTCACHED
Content-Encoding: gzip

Redirect headers

status: 302
server: nginx
date: Thu, 19 Dec 2019 13:04:49 GMT
content-type: text/html; charset=UTF-8
location: http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=4ffabd18ba68b9a07ebf97ab8258991d; expires=Fri, 18-Dec-2020 13:04:49 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;

GET
H/1.1 200
OK UJC59ai7DFiGL0wQrHRLb4ksetnBX0A Show response
trafficsel.com/15h78/F5ez48DtUwE/ 6 KB
2 KB 79ms
78ms Document
text/html 205.147.93.132
Oracle Corporation

General

Check archive.org

Show headers Download Go to

Full URL: http://trafficsel.com/15h78/F5ez48DtUwE/UJC59ai7DFiGL0wQrHRLb4ksetnBX0A?cp=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&ori=16x&ex=1&pbi=5dfb7572161538.830977050
Requested by: Host: trafficsel.com
URL: http://trafficsel.com/recollect/lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000
Protocol: HTTP/1.1
Server: 205.147.93.132 , United States, ASN393676 (ZENEDGE - Oracle Corporation, US),
Reverse DNS
Software: ZENEDGE /
Resource Hash: 21102d8febc367d52f5cfdd83afdb91ad2ba6fca7b0115bcc6788bbf5488a454

Request headers

Host: trafficsel.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://trafficsel.com/
Accept-Encoding: gzip, deflate
Cookie: 5O%2ByexcV9rWuvtrB3%2BGU%2F0qICj9NbX%2BzT9%2FA0gNyduc%3D=ec9eedf563481f48a940cd33cef397dc_1576760690.0874; OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.0876; ec9eedf563481f48a940cd33cef397dc_1576760690.0874_cc=enable; SERVERID=sfc16
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://trafficsel.com/

Response headers

Date: Thu, 19 Dec 2019 13:04:50 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
set-cookie: OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.1615; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC h0Ruyij13GSFdk%2FlmuTzOaHThf3lIWkuVCsM4ckKGVA%3D=WlVabU5ZSHNJZm1rZUdUTEQ1eWUzd3g1NGF3SzY1TzZ4MkVpYk5qM2VETGIyTlNMeWNoSXRQK1lxUUpic3Z6Uk1hK2pZWjRJV25uc3JFaFRJeko1dVEweGdzekZhZ21ySDVQbDdieW5LOFU9; domain=trafficsel.com; path=/; expires=Thu, 19-Dec-2019 14:09:50 UTC
X-Zen-Fury: 57edbcaaf5d179dbaec4d79e12c8a7e5d4a1a3e5
Server: ZENEDGE
X-Cache-Status: NOTCACHED
Content-Encoding: gzip

GET /
by.clickkmobi.com/ 0
0

GET
H/1.1

200
OK

lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000 Show response
trafficsel.com/recollect/
Redirect Chain

https://by.clickkmobi.com/?cid=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=a0sNMlW_75VgGJCv2AcJ&nc=1
http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000

9 KB
3 KB

30ms
30ms

Document
text/html

205.147.93.132
Oracle Corporation

General

Check archive.org

Show headers Download Go to

Full URL: http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000
Requested by: Host: trafficsel.com
URL: http://trafficsel.com/15h78/F5ez48DtUwE/UJC59ai7DFiGL0wQrHRLb4ksetnBX0A?cp=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&ori=16x&ex=1&pbi=5dfb7572161538.830977050
Protocol: HTTP/1.1
Server: 205.147.93.132 , United States, ASN393676 (ZENEDGE - Oracle Corporation, US),
Reverse DNS
Software: ZENEDGE /
Resource Hash: 9ae2a9d5ba66d27285f4473915f1d7578be0980955be7351d10859d3fc99af8a

Request headers

Host: trafficsel.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://trafficsel.com/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://trafficsel.com/

Response headers

Date: Thu, 19 Dec 2019 13:04:50 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
set-cookie: 5O%2ByexcV9rWuvtrB3%2BGU%2F0qICj9NbX%2BzT9%2FA0gNyduc%3D=e1ca6a8df4636c8291cd695529bf1c0e_1576760690.4824; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.4826; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC e1ca6a8df4636c8291cd695529bf1c0e_1576760690.4824_cc=enable; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC SERVERID=sfc36; path=/
X-Zen-Fury: 57edbcaaf5d179dbaec4d79e12c8a7e5d4a1a3e5
Server: ZENEDGE
X-Cache-Status: NOTCACHED
Content-Encoding: gzip

Redirect headers

status: 302
server: nginx
date: Thu, 19 Dec 2019 13:04:50 GMT
content-type: text/html; charset=UTF-8
location: http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;

GET
H/1.1 200
OK 5dfb757275dc08.09898713 Show response
trafficsel.com/space/optical-carrier/ 5 KB
2 KB 62ms
60ms Document
text/html 205.147.93.132
Oracle Corporation

General

Check archive.org

Show headers Download Go to

Full URL: http://trafficsel.com/space/optical-carrier/5dfb757275dc08.09898713?cp=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&ori=36x&ex=1&pbi=5dfb7572767d77.918383560
Requested by: Host: trafficsel.com
URL: http://trafficsel.com/recollect/lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000
Protocol: HTTP/1.1
Server: 205.147.93.132 , United States, ASN393676 (ZENEDGE - Oracle Corporation, US),
Reverse DNS
Software: ZENEDGE /
Resource Hash: 63faa2021b28b30a759615c60404670c6ff284720008b8ffe276c3edfb42dea4

Request headers

Host: trafficsel.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://trafficsel.com/
Accept-Encoding: gzip, deflate
Cookie: 5O%2ByexcV9rWuvtrB3%2BGU%2F0qICj9NbX%2BzT9%2FA0gNyduc%3D=e1ca6a8df4636c8291cd695529bf1c0e_1576760690.4824; OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.4826; e1ca6a8df4636c8291cd695529bf1c0e_1576760690.4824_cc=enable; SERVERID=sfc36
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://trafficsel.com/

Response headers

Date: Thu, 19 Dec 2019 13:04:50 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
set-cookie: OC0ExUTGUFq1h1VDi70UXz%2BrO7wg6%2FCu96lof1x27lE%3D=1576760690.5394; domain=trafficsel.com; path=/; expires=Sun, 16-Dec-2029 13:04:50 UTC h0Ruyij13GSFdk%2FlmuTzOaHThf3lIWkuVCsM4ckKGVA%3D=WlVabU5ZSHNJZm1rZUdUTEQ1eWUzLzFsbE0yc1BTd2k0QmhtTVB4T05YM1RNM1pDNkdhSzJjbEhMZm5BSTFQMlMvcWw0cXBicnloRkZQYkJBaGtNZkpTd3duVlBXU2N4MTRKaEwxNnQ2dk09; domain=trafficsel.com; path=/; expires=Thu, 19-Dec-2019 14:09:50 UTC
X-Zen-Fury: 57edbcaaf5d179dbaec4d79e12c8a7e5d4a1a3e5
Server: ZENEDGE
X-Cache-Status: NOTCACHED
Content-Encoding: gzip

GET click
tracking.adacts.com/ 0
0

GET
H2

200

Primary Request c65d8036-9e85-433e-bafa-3572ea58a4ec Show response
ballista.xyz/lp/
Redirect Chain

https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=8855&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=8505&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1
https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=9079&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1
http://163.172.255.137:8329/a45b12cd-be38-48dd-9fcd-205fa4d3096f?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25

1 KB
862 B

330ms
126ms

Document
text/html

158.69.52.12
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25

Requested by

Host: trafficsel.com
URL: http://trafficsel.com/space/optical-carrier/5dfb757275dc08.09898713?cp=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&ori=36x&ex=1&pbi=5dfb7572767d77.918383560

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.52.12 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns517583.ip-158-69-52.net

Software

nginx/1.15.6 / Express

Resource Hash

8f92c6c6957f78fa27c4d2fde64593ce2ec96ab20879b85f84d8d4375c4c900b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: ballista.xyz
:scheme: https
:path: /lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://trafficsel.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://trafficsel.com/

Response headers

status: 200
server: nginx/1.15.6
date: Thu, 19 Dec 2019 13:04:51 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-powered-by: Express
access-control-allow-origin: *
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip

Redirect headers

X-Powered-By: Express
Location: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
Vary: Accept
Content-Type: text/html; charset=utf-8
Content-Length: 378
Date: Thu, 19 Dec 2019 13:04:51 GMT
Connection: keep-alive

GET
H2 200 push.js Show response
ballista.xyz/ 415 KB
417 KB 107ms
106ms Script
text/javascript 158.69.52.12
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://ballista.xyz/push.js?a=61&l=14&p=0&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&lp=1&count=0&postbackToken=c65d8036-9e85-433e-bafa-3572ea58a4ec

Requested by

Host: ballista.xyz
URL: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.52.12 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns517583.ip-158-69-52.net

Software

nginx/1.15.6 / Express

Resource Hash

6bf35e86f6c736caf27ff1efb016772e7c3f5bd6bb19e05a8c22c681f729d0e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 13:04:52 GMT
server: nginx/1.15.6
access-control-allow-origin: *
x-powered-by: Express
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/javascript; charset=utf-8
status: 200
content-length: 425362

GET
H/1.1 200
OK progress-bar-icon-png-18.jpg
icon-library.net/images/progress-bar-icon-png/ 2 KB
2 KB 121ms
26ms Image
image/jpeg 78.46.106.103
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icon-library.net/images/progress-bar-icon-png/progress-bar-icon-png-18.jpg
Requested by: Host: ballista.xyz
URL: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 78.46.106.103 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.103.106.46.78.clients.your-server.de
Software: nginx/1.2.1 /
Resource Hash: 741e03af09da8355fca4b8fa0c371f424a93ff271716945c9193bcc0d800c0d6

Request headers

Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 19 Dec 2019 13:04:52 GMT
Last-Modified: Tue, 09 Jul 2019 08:40:22 GMT
Server: nginx/1.2.1
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1788
Content-Type: image/jpeg

OPTIONS
H2 204 track Show response
t.instantpu.sh/ 0
243 B 3708ms
443ms Fetch 158.69.26.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://t.instantpu.sh/track

Requested by

Host: ballista.xyz
URL: https://ballista.xyz/push.js?a=61&l=14&p=0&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&lp=1&count=0&postbackToken=c65d8036-9e85-433e-bafa-3572ea58a4ec

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.26.44 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns516875.ip-158-69-26.net

Software

nginx/1.15.6 / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Access-Control-Request-Method: POST
Origin: https://ballista.xyz
Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Thu, 19 Dec 2019 13:04:55 GMT
server: nginx/1.15.6
access-control-allow-origin: *
x-powered-by: Express
vary: Access-Control-Request-Headers
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
status: 204
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-headers: content-type

OPTIONS
H2 204 track Show response
t.instantpu.sh/ 0
242 B 3702ms
443ms Fetch 158.69.26.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://t.instantpu.sh/track

Requested by

Host: ballista.xyz
URL: https://ballista.xyz/push.js?a=61&l=14&p=0&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&lp=1&count=0&postbackToken=c65d8036-9e85-433e-bafa-3572ea58a4ec

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.26.44 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns516875.ip-158-69-26.net

Software

nginx/1.15.6 / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Access-Control-Request-Method: POST
Origin: https://ballista.xyz
Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Thu, 19 Dec 2019 13:04:55 GMT
server: nginx/1.15.6
access-control-allow-origin: *
x-powered-by: Express
vary: Access-Control-Request-Headers
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
status: 204
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-headers: content-type

POST
H2 200 track
t.instantpu.sh/ 0
0 424ms
423ms Fetch 158.69.26.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://t.instantpu.sh/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.26.44 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns516875.ip-158-69-26.net

Software

nginx/1.15.6 / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
Origin: https://ballista.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

status: 200
date: Thu, 19 Dec 2019 13:04:56 GMT
server: nginx/1.15.6
access-control-allow-origin: *
x-powered-by: Express
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains

POST
H2 200 track
t.instantpu.sh/ 0
0 457ms
457ms Fetch 158.69.26.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://t.instantpu.sh/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.26.44 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns516875.ip-158-69-26.net

Software

nginx/1.15.6 / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://ballista.xyz/lp/c65d8036-9e85-433e-bafa-3572ea58a4ec?tid=817208&subid=564_aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&puid=1010758ce81e994a6beedb2377ccfb25
Origin: https://ballista.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

status: 200
date: Thu, 19 Dec 2019 13:04:56 GMT
server: nginx/1.15.6
access-control-allow-origin: *
x-powered-by: Express
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: by.clickkmobi.com
URL: https://by.clickkmobi.com/?cid=lNL20AVRG090ee60000RS00E660YNHO047593I0AHJ0475900000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=SQQD_12D2GHvmSm1I3nW&

Domain: by.clickkmobi.com
URL: https://by.clickkmobi.com/?cid=lNL20AVRG0907880000RS0037O0YNHO00UKCVV0AR100UKC00000000&utm_medium=6856411e09f0fc6f4a0e21fab76b877f7226acc1&utm_campaign=main-agg&1=195885&2=a0sNMlW_75VgGJCv2AcJ&nc=1&

Domain: tracking.adacts.com
URL: https://tracking.adacts.com/click?aff_sub1=lNL20AVRG0907690007PS0037O0ZG0H00UKC3D0AOT00UKC00000000&aff_id=564&offer_id=8855&aff_sub2=aFFicGw3eUxMRHM9_6_a0sNMlW_75VgGJCv2AcJ&nc=1&

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ballista.xyz/	1969-12-31 23:59:59	Name: uID Value: 1005449a-a81c-4424-9306-c96e88e4c68b

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ballista.xyz
by.clickkmobi.com
icon-library.net
link.popprincesspenny.com
links.securedark.com
offers.wildbearads.bid
onwardinated.com
t.instantpu.sh
track.wbamedia.com
tracking.adacts.com
trafficsel.com
up.trkgenius.com
wildbearads.go2affise.com
by.clickkmobi.com
tracking.adacts.com
104.26.7.83
107.6.174.196
158.69.26.44
158.69.52.12
163.172.255.137
198.143.165.219
198.143.165.221
205.147.93.132
212.32.252.92
51.38.33.240
52.76.175.101
78.46.106.103
99.198.108.196
0ae148d1c57eb41f392c5fb8f63988add4ea23603c6fa82f730c238998941005
21102d8febc367d52f5cfdd83afdb91ad2ba6fca7b0115bcc6788bbf5488a454
5110eaaf4ce1ecb1d1dbf79df86b8725c7ec7c7111e93ea728376b025975e831
63faa2021b28b30a759615c60404670c6ff284720008b8ffe276c3edfb42dea4
6bf35e86f6c736caf27ff1efb016772e7c3f5bd6bb19e05a8c22c681f729d0e8
6f5dab940b08648d433c8d60a6c0f0b1d38f7f6ec0bd997ba1a9b607d568c691
741e03af09da8355fca4b8fa0c371f424a93ff271716945c9193bcc0d800c0d6
7e11348d49a8eb6e7584fca5405c42b697353d4c8b6946ac4d57c4e17b0e0eaf
8f92c6c6957f78fa27c4d2fde64593ce2ec96ab20879b85f84d8d4375c4c900b
9ae2a9d5ba66d27285f4473915f1d7578be0980955be7351d10859d3fc99af8a
9b4df0299353f41813f918c91291f83942ed7318c55f67acf7323bbfc17d24df
9c298f289739d6d233686e1a6e21bd51711f172b5b3744b52611db7d702216d2
b3093354cc2d5cfde6dfa1d9e9605a2fc837b24b6254cceebb16516f27e886c8
bd5e1db903c785f6c8cd7cff63ec17465bfd885f3740a15c434f88b5d0c185a9
c4c786f8e199f5a263373a9f8fbd5e3b200c0fa5eeb30e3626766423f7a828d9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

ballista.xyz Open in urlscan Pro 158.69.52.12 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

55 %HTTPS

0 %IPv6

13 Domains

13 Subdomains

10 IPs

6 Countries

447 kBTransfer

479 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

ballista.xyz Open in urlscan Pro
158.69.52.12 Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

55 %
HTTPS

0 %
IPv6

13
Domains

13
Subdomains

10
IPs

6
Countries

447 kB
Transfer

479 kB
Size

1
Cookies

22 HTTP transactions
0 data transactions