urlscan.io logo urlscan.io
SecurityTrails logo

s1.proxyfly.org Open in urlscan Pro
139.162.69.65  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474...
Effective URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474...
Submission Tags: falconsandbox
Submission: On October 09 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 8 domains to perform 23 HTTP transactions. The main IP is 139.162.69.65, located in Tokyo, Japan and belongs to LINODE-AP Linode, LLC, US. The main domain is s1.proxyfly.org.
TLS certificate: Issued by R3 on August 19th 2021. Valid for: 3 months.
This is the only time s1.proxyfly.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 11 139.162.69.65 63949 (LINODE-AP...)
2 142.250.74.200 15169 (GOOGLE)
1 185.94.236.247 42567 (MOJHOST-EU)
1 13.224.193.35 16509 (AMAZON-02)
1 45.57.91.1 40027 (NETFLIX-ASN)
1 205.185.216.42 20446 (HIGHWINDS3)
2 185.94.237.101 42567 (MOJHOST-EU)
2 172.217.16.142 15169 (GOOGLE)
2 69.16.175.42 33438 (HIGHWINDS2)
23 10
11    139.162.69.65 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1549-65.members.linode.com
s1.proxyfly.org
2    142.250.74.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f8.1e100.net
www.googletagmanager.com
1    185.94.236.247 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
poweredby.jads.co
1    13.224.193.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-35.fra2.r.cloudfront.net
js.juicyads.com
1    45.57.91.1 (United States)

ASN40027 (NETFLIX-ASN, US)
PTR: occ.a.nflxso.net
assets.nflxext.com
1    205.185.216.42 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
a.exdynsrv.com
2    185.94.237.101 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
adserver.juicyads.com
2    172.217.16.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f14.1e100.net
www.google-analytics.com
2    69.16.175.42 (United States)

ASN33438 (HIGHWINDS2, US)
PTR: tlb.hwcdn.net
ads.juicyads.me
Domain Requested by
11 s1.proxyfly.org 1 redirects s1.proxyfly.org
2 ads.juicyads.me adserver.juicyads.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 adserver.juicyads.com poweredby.jads.co
2 www.googletagmanager.com s1.proxyfly.org
www.googletagmanager.com
1 a.exdynsrv.com s1.proxyfly.org
1 assets.nflxext.com s1.proxyfly.org
1 js.juicyads.com s1.proxyfly.org
1 poweredby.jads.co s1.proxyfly.org
23 9

This site contains links to these domains. Also see Links.

Domain
proxybot.cc
Subject Issuer Validity Valid
proxyfly.org
R3		 2021-08-19 -
2021-11-17		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.jads.co
Sectigo RSA Domain Validation Secure Server CA		 2020-11-27 -
2021-12-28		 a year crt.sh
*.juicyads.com
Sectigo RSA Domain Validation Secure Server CA		 2020-01-20 -
2022-04-23		 2 years crt.sh
*.1.nflxso.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-19 -
2021-10-18		 a month crt.sh
exdynsrv.com
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh
*.juicyads.me
Sectigo RSA Domain Validation Secure Server CA		 2021-05-24 -
2022-05-24		 a year crt.sh

This page contains 2 frames:

Primary Page: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Frame ID: CB1BEA85617471BE8EF7B8826D1D0190
Requests: 20 HTTP requests in this frame

Frame: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Frame ID: 7311AE12E7140082D1434318AE6122A2
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e777777463225... HTTP 301
    https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e777777463225... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

23
Requests

96 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

10
IPs

3
Countries

839 kB
Transfer

1578 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468 HTTP 301
    https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set 7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
s1.proxyfly.org/o/
Redirect Chain
  • http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f...
  • https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772...
363 KB
77 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
5beac614e32f860ff77039fc7d71faa9a2b3c99424b4845e343aae53f8c536ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport

Request headers

Host
s1.proxyfly.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Status
200 OK
via
1.1 i-00e709d251881df4a (us-west-2)
x-request-id
1c442d26-0ef9-4ca7-a22f-f58e54478577
expires
0
x-content-type-options
nosniff
Set-Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D;
x-b3-traceid
6f3de1ff49f17314
x-originating-url
http://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
158
x-netflix_proxy_execution-time
429
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-decorator-operation
lo_svc
x-netflix_nfstatus
1_1
date
Sat, 09 Oct 2021 01:32:34 GMT
x-frame-options
DENY
x-xss-protection
1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Sat, 09 Oct 2021 01:32:33 GMT
Content-Type
text/html
Content-Length
178
Connection
keep-alive
Location
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
656e6f6e2f657572742f6b63622f4d303833313045322d3259324c323633553237335732643330306b30373062335832483235304b3252323230633361302f322f736a2e7061727473746f6f624337256e6f6d6d6f632c736a2e7061727473746f6f6...
s1.proxyfly.org/o/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f6b63622f4d303833313045322d3259324c323633553237335732643330306b30373062335832483235304b3252323230633361302f322f736a2e7061727473746f6f624337256e6f6d6d6f632c736a2e7061727473746f6f622f736a2f736a2f3561363065303830762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
fbe1be6e0af4a8caa059e7ef09e0c00246737ab198f69a4336c0049d61b1fa5a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:37 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
888392aa-1f1b-4edb-98ad-b2b32fcd91b1
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Mon, 11 Apr 2022 15:04:55 GMT
656e6f6e2f657572742f6c2f4d303833313045322d3259324c323633553237335732643330306b30373062335832483235304b3252323230633361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c4337257...
s1.proxyfly.org/o/ 		114 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f6c2f4d303833313045322d3259324c323633553237335732643330306b30373062335832483235304b3252323230633361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c43372573746e656e6f706d6f632f736a2f736a2f3561363065303830762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:36 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
5b32f341-b259-461c-9d9f-29a8ee5bf095
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Mon, 11 Apr 2022 15:09:55 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-156489712-1
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.74.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
df3c000535fd52d52b3c24864750f4c6df3a1c95412b1c28c8836c32c7aae6cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:38 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39242
x-xss-protection
0
last-modified
Sat, 09 Oct 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 09 Oct 2021 01:32:38 GMT
6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f6...
s1.proxyfly.org/o/ 		0
0
736a2e627574534b4453746f2f736574616c706d65747470697263732f67726f2e77616c65696b6f6f632e6e64632f2f3a7370747468
s1.proxyfly.org/o/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/736a2e627574534b4453746f2f736574616c706d65747470697263732f67726f2e77616c65696b6f6f632e6e64632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
strict-transport-security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
BC5xsXKGgJbQbCzkLNvwBQ==
age
5380904
Transfer-Encoding
chunked
Status
200 OK
Connection
keep-alive
x-ms-lease-status
unlocked
Server
nginx
date
Sat, 09 Oct 2021 01:32:36 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Content-Type
application/javascript
access-control-allow-origin
*
x-ms-request-id
d4d1285d-f01e-0084-5abd-8b8ece000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
69b3db2809db0ad0-NRT
656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e656761702d726f72726543372565726f634337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f6...
s1.proxyfly.org/o/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e656761702d726f72726543372565726f634337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
9e91f69e993bcc64d54ff7c336900975e5e83b3c57f9744b403c6be5143c84b5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:37 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
4d786ece-3881-451e-b30e-31e5a052b534
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Mon, 11 Apr 2022 16:12:53 GMT
656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f73736...
s1.proxyfly.org/o/ 		134 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
38e7ddfb569757aa78f50ad6a53b9e585f23d6bccbdfeb532f1d28b81991d32a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:37 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
80baa60b-55fa-4bbd-85c7-7925dd145ede
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Mon, 11 Apr 2022 23:01:41 GMT
jfc.js
poweredby.jads.co/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://poweredby.jads.co/js/jfc.js
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.236.247 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
c8630ae7042704a3a000e88c6ca1041715eaf37b17af0d4b0629c61dacf25371

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sat, 09 Oct 2021 01:32:36 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Aug 2018 17:13:26 GMT
Server
nginx
ETag
W/"5b730db6-1a94"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Connection
close
jp.php
js.juicyads.com/ 		93 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.juicyads.com/jp.php?c=3454y213q256y2o2q29443&u=http%3A%2F%2Fwww.juicyads.rocks
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-35.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
2d2b9ef3d04f6657721fa53773508efe415e09ce7b4b634af7fb748ccb75747d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
cache
date
Sat, 09 Oct 2021 01:32:36 GMT
via
1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
max-age=900
x-amz-cf-id
HxmbKtk5Ke9boaVk480oQm2syVjjQ3l24cbFCkWZ4M_d5Kw5VDoINw==
expires
Sat, 09 Oct 2021 01:47:36 GMT
JP-en-20211004-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/9b3267c9-5086-4550-92f1-eddc22a1f78e/cb7059fd-6d10-4040-98c9-4f116d279aae/ 		361 KB
361 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/vlv3/9b3267c9-5086-4550-92f1-eddc22a1f78e/cb7059fd-6d10-4040-98c9-4f116d279aae/JP-en-20211004-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.57.91.1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
occ.a.nflxso.net
Software
nginx /
Resource Hash
5b434b434fcfdd59cdb6ca1451dcd6b8a9535151a9b71d46cafb9f616e468380

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sat, 09 Oct 2021 01:32:38 GMT
Last-Modified
Wed, 06 Oct 2021 13:00:41 GMT
Server
nginx
Content-MD5
93CQv5TQPrioyAFNQBfWLw==
Content-Type
image/jpeg
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
369202
Expires
Sat, 16 Oct 2021 01:32:39 GMT
676e702e37355f65756c625f5f6f676f4c2d662d42462f736567616d692f6e69676f6c2f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
s1.proxyfly.org/o/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.proxyfly.org/o/676e702e37355f65756c625f5f6f676f4c2d662d42462f736567616d692f6e69676f6c2f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:39 GMT
Content-Encoding
gzip
Server
nginx
content-md5
ozykfvEQtuPsUIa4d2QH0w==
Vary
Accept-Encoding
Content-Type
image/png
Status
200 OK
cache-control
max-age=604801
Transfer-Encoding
chunked
Connection
keep-alive
expires
Sat, 16 Oct 2021 01:32:40 GMT
popunder1000.js
a.exdynsrv.com/ 		94 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.exdynsrv.com/popunder1000.js
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
nginx /
Resource Hash
569af0d58a2df0af2da77aaebaaf00b84c15334c5e9af0b77ba4c81a62db5d40

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sat, 09 Oct 2021 01:32:38 GMT
Content-Encoding
gzip
Server
nginx
etag
W/"f744f0d2317398d07acc666b278"
X-HW
1633743158.dop242.fr8.t,1633743158.cds065.fr8.shn,1633743158.dop242.fr8.t,1633743158.cds103.fr8.c
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
40039
Cookie set WebsiteDetect
s1.proxyfly.org/personalization/cl2/freeform/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 i-0b325fe825b721207 (us-west-2)
x-content-type-options
nosniff
Transfer-Encoding
chunked
x-netflix_proxy_execution-time
666
Status
200 OK
Connection
keep-alive
x-xss-protection
1; mode=block
allow
GET, POST, OPTIONS
Server
nginx
date
Sat, 09 Oct 2021 01:32:36 GMT
x-netflix_nfstatus
1_1
x-frame-options
DENY
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
http://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?modalView=login&source=wwwhead&fetchType=js
access-control-allow-origin
https://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
max-age=0
access-control-allow-credentials
true
Set-Cookie
memclid=422b4b3d-6971-46b0-9438-691ee9a6cc2d; nfvdid=BQFmAAEBEI26oHTDpGsq%2FhXNx3Pa4sZAaMQylGrSvZTtcetNvzE7d5ViuJ%2Fe4YdzrEHJfquPFv468ORtW%2FgtxLrqJifxk%2Fn64dVBchw9EIuc%2F9VKlSYSYg%3D%3D;
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
Fri, 08 Oct 2021 01:32:37 GMT
Cookie set WebsiteScreen
s1.proxyfly.org/personalization/cl2/freeform/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 i-04fe1f6709ef13ab4 (us-west-2)
x-content-type-options
nosniff
Transfer-Encoding
chunked
x-netflix_proxy_execution-time
262
Status
200 OK
Connection
keep-alive
x-xss-protection
1; mode=block
allow
GET, POST, OPTIONS
Server
nginx
date
Sat, 09 Oct 2021 01:32:36 GMT
x-netflix_nfstatus
1_1
x-frame-options
DENY
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
http://www.netflix.com/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&screenh=1200&screenw=1600&winh=1200&ratio=1
access-control-allow-origin
https://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
max-age=0
access-control-allow-credentials
true
Set-Cookie
memclid=c9d144a1-a895-40c0-8e4d-0b5f334ab729; nfvdid=BQFmAAEBEEodVwJ8q11qQUB8OaIE7FlAnN9WRq3CNDIGetUoNj4g3m3g73m4fMdIM5%2BP%2BAja0j1gRCAvi3tUk2%2BnXESHffAcQIazkX9UhfOy1bF3YuuvGw%3D%3D;
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
Fri, 08 Oct 2021 01:32:37 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-156489712-3&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-156489712-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.74.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
4fd0db712ecb067b5d793d8d26cc2568a3dc66384d12cbd8479e81c6423acbcd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:38 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39240
x-xss-protection
0
last-modified
Sat, 09 Oct 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 09 Oct 2021 01:32:38 GMT
66666f772e33392d31762d6e6f63692d666e2f73746e6f662f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
s1.proxyfly.org/o/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/66666f772e33392d31762d6e6f63692d666e2f73746e6f662f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://s1.proxyfly.org
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Cookie
flwssn=46c866f1-d6e3-473a-b7eb-5fe1990137bc; memclid=b87e87e3-727d-446c-a390-d25a77c97afd; NetflixId=v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630; nfvdid=BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
Connection
keep-alive
Referer
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3561363065303830762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Origin
https://s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:38 GMT
Content-Encoding
gzip
Server
nginx
content-md5
fPYVbMSBJEtaJUNi17c/AA==
Status
200 OK
Vary
Accept-Encoding
Content-Type
text/plain
access-control-allow-origin
*
cache-control
max-age=604801
Transfer-Encoding
chunked
Connection
keep-alive
expires
Sat, 16 Oct 2021 01:32:39 GMT
fadeinbox.js
adserver.juicyads.com/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adserver.juicyads.com/js/fadeinbox.js
Requested by
Host: poweredby.jads.co
URL: https://poweredby.jads.co/js/jfc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.237.101 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
43799418c7a36f766db96b168104db592e151fc6e7ec6d9d613a0c99ddf9f9d6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sat, 09 Oct 2021 01:32:38 GMT
Content-Encoding
gzip
Last-Modified
Sat, 06 Dec 2014 15:18:42 GMT
Server
nginx
ETag
W/"54831e52-fa8"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Connection
close
Cookie set adshow.php
adserver.juicyads.com/ Frame 7311 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Requested by
Host: poweredby.jads.co
URL: https://poweredby.jads.co/js/jfc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.237.101 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx / PHP/5.6.40
Resource Hash
7b6d7fb29dca2c5fafd4d909c1d32bca422e618fc13c7c32f322a3bbeb354cb8

Request headers

Host
adserver.juicyads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://s1.proxyfly.org/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/

Response headers

Server
nginx
Date
Sat, 09 Oct 2021 01:32:39 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
X-Powered-By
PHP/5.6.40
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie
surferid=34436cdf05bb0595148bd94b1f5baac8; expires=Sun, 09-Oct-2022 01:32:38 GMT; Max-Age=31536000; path=/; domain=.juicyads.com imps61=1; expires=Sun, 10-Oct-2021 01:32:39 GMT; Max-Age=86400; path=/; domain=.juicyads.com juicy_data_1=YToxOntpOjExOTY5MzY7aToxNjM0MDAyMzU4O30%3D; expires=Tue, 12-Oct-2021 01:32:38 GMT; Max-Age=259199; domain=juicyads.com juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Tue, 12-Oct-2021 01:32:38 GMT; Max-Age=259199; domain=juicyads.com
Content-Encoding
gzip
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-156489712-3&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
5492
date
Sat, 09 Oct 2021 00:01:06 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Sat, 09 Oct 2021 02:01:06 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1909816176&t=pageview&_s=1&dl=https%3A%2F%2Fs1.proxyfly.org%2Fo%2F7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468&ul=en-us&de=UTF-8&dt=Netflix&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1860921851&gjid=1554222983&cid=362220705.1633743158&tid=UA-156489712-3&_gid=1834135566.1633743158&_r=1&gtm=2oua60&z=220768504
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.16.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://s1.proxyfly.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 09 Oct 2021 01:32:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://s1.proxyfly.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
juicyads_black.gif
ads.juicyads.me/ads/ Frame 7311 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.juicyads.me/ads/juicyads_black.gif
Requested by
Host: adserver.juicyads.com
URL: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
tlb.hwcdn.net
Software
/
Resource Hash
b1e12c59a9b1d3e8447d6a7aeb584101c71751561b98f3f0162f58f1e617c7fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://adserver.juicyads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:39 GMT
last-modified
Wed, 02 Mar 2016 17:54:59 GMT
etag
"1456941299"
x-hw
1633743159.dop242.fr8.t,1633743159.cds286.fr8.hn,1633743159.cds161.fr8.c
content-type
image/gif
cache-control
max-age=21946109
accept-ranges
bytes
content-length
2193
61-1480791161.gif
ads.juicyads.me/network/user33/ Frame 7311 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.juicyads.me/network/user33/61-1480791161.gif
Requested by
Host: adserver.juicyads.com
URL: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
tlb.hwcdn.net
Software
/
Resource Hash
925d52340c624311ece14c4c41013b9878508f4116b1f0767c7d8af83c33e034

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://adserver.juicyads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 09 Oct 2021 01:32:39 GMT
last-modified
Sat, 03 Dec 2016 18:52:42 GMT
etag
"1480791162"
x-hw
1633743159.dop242.fr8.t,1633743159.cds286.fr8.hn,1633743159.cds275.fr8.c
content-type
image/gif
cache-control
max-age=5764860
accept-ranges
bytes
content-length
50379

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s1.proxyfly.org
URL
https://s1.proxyfly.org/o/6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f632e78696c6674656e2e7777772f2f3a7370747468

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

87 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| gtag object| dataLayer undefined| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups function| OptanonWrapper object| google_tag_manager object| netflix string| juicy_adzone string| isMobile string| adsrv string| containerStyle string| iframeDim string| frameWidth string| frameHeight string| fibSrc function| strip_alpha_chars function| domready object| juicy_tags function| f488 function| Q888 function| n800 function| s488 function| y7vv function| R7qq function| v799 function| T799 string| a7213ffe56 function| t0xx object| JuicyPop string| __public_path__ object| Codex object| C object| global object| process string| ad_idzone boolean| ad_popup_fallback boolean| ad_popup_force boolean| ad_chrome_enabled boolean| ad_new_tab number| ad_frequency_period number| ad_frequency_count number| ad_trigger_method function| F7ss function| x233 function| M5GG function| C7ss string| e94dfadd0 object| exoJsPop101 string| ad_sub string| ad_sub2 string| ad_sub3 string| ad_cat string| ad_trigger_class string| ad_tags string| ad_el boolean| ad_t_venor boolean| ad_cookieconsent object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData string| displaymode string| enablefade object| autohidebox string| showonscroll number| IEfadelength number| Mozfadedegree number| random_num function| displayfadeinbox function| mozfadefx function| staticfadebox function| hidefadebox function| controlledhidebox function| initfunction function| get_cookie number| offset object| iebody object| objref number| docheight number| objheight number| showonscrollvar

12 Cookies

Domain/Path Name / Value
s1.proxyfly.org/personalization/cl2/freeform Name: memclid
Value: 422b4b3d-6971-46b0-9438-691ee9a6cc2d
s1.proxyfly.org/personalization/cl2/freeform Name: nfvdid
Value: BQFmAAEBEI26oHTDpGsq%2FhXNx3Pa4sZAaMQylGrSvZTtcetNvzE7d5ViuJ%2Fe4YdzrEHJfquPFv468ORtW%2FgtxLrqJifxk%2Fn64dVBchw9EIuc%2F9VKlSYSYg%3D%3D
s1.proxyfly.org/o Name: flwssn
Value: 46c866f1-d6e3-473a-b7eb-5fe1990137bc
s1.proxyfly.org/o Name: memclid
Value: b87e87e3-727d-446c-a390-d25a77c97afd
s1.proxyfly.org/o Name: NetflixId
Value: v%3D2%26ct%3DBQAOAAEBENty-Rj0qoz1uzqDy9x2cP6BAHGRPigpeFps6N6nYsho2iiKFkXEGq2nJ9Eo6h-_Bf2GR2uh0dCn7i2gNvx2inwX9oOWrzaz8nSPTwHmPg7tshdNVsyprCBIanzMipSV4MxwBKMn9PbtfJsW5Z0r4pUqFZlB9H3tH828rwmi5Z9W4YzICrer6FNbLM4YqrgXimOtmi7tes0XsN1VUkE2fn4ykM3JHVOAHSIEDP-Kj5sTzLSIug1BxlEE0nJSXy4H14J-63O8J6Y5Rag-kDUz30VI-PHrhpdy1oE1g4x2iW6jt3kPyLWX1DGFsFNmw8r7c8aYKUs7uVS5GxDpf8K78Gfl-l2Hpdp5wYGSmQcci1rXf28.%26bt%3Ddev%26mac%3DAQEAEAABABR0BkXsJtLqn9cqCafq7Fq7Z5j0czwNDH8.
s1.proxyfly.org/o Name: SameSite
Value: Lax
s1.proxyfly.org/o Name: SecureNetflixId
Value: v%3D2%26mac%3DAQEAEQABABRt6tOdc7a3m37IJ6KmB_4iH5yzcjIcguI.%26dt%3D1633743154630
s1.proxyfly.org/o Name: nfvdid
Value: BQFmAAEBEOa9-t11YhESlNXqid77IlhAB2qOVgXS99DVf0Ct7ZoMeHOLrsuuuFOXiv6iEd7NL612XGVnPnbUl_lJMAmg9JZOznn2Le8S7p4wKTOeNfnBrA%3D%3D
s1.proxyfly.org/o Name: juicy_fadedin
Value: yes
.proxyfly.org/ Name: _ga
Value: GA1.2.362220705.1633743158
.proxyfly.org/ Name: _gid
Value: GA1.2.1834135566.1633743158
.proxyfly.org/ Name: _gat_gtag_UA_156489712_3
Value: 1

2 Console Messages

Source Level URL
Text
security error URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Message:
Refused to apply style from 'https://s1.proxyfly.org/o/6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f632e78696c6674656e2e7777772f2f3a7370747468' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://s1.proxyfly.org/o/656e6f6e2f657572742f6c2f4d303833313045322d3259324c323633553237335732643330306b30373062335832483235304b3252323230633361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c43372573746e656e6f706d6f632f736a2f736a2f3561363065303830762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Message:
Failed to load resource: net::ERR_INCOMPLETE_CHUNKED_ENCODING

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.exdynsrv.com
ads.juicyads.me
adserver.juicyads.com
assets.nflxext.com
js.juicyads.com
poweredby.jads.co
s1.proxyfly.org
www.google-analytics.com
www.googletagmanager.com
s1.proxyfly.org
13.224.193.35
139.162.69.65
142.250.74.200
172.217.16.142
185.94.236.247
185.94.237.101
205.185.216.42
45.57.91.1
69.16.175.42
0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616
2d2b9ef3d04f6657721fa53773508efe415e09ce7b4b634af7fb748ccb75747d
38e7ddfb569757aa78f50ad6a53b9e585f23d6bccbdfeb532f1d28b81991d32a
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
43799418c7a36f766db96b168104db592e151fc6e7ec6d9d613a0c99ddf9f9d6
4fd0db712ecb067b5d793d8d26cc2568a3dc66384d12cbd8479e81c6423acbcd
569af0d58a2df0af2da77aaebaaf00b84c15334c5e9af0b77ba4c81a62db5d40
5b434b434fcfdd59cdb6ca1451dcd6b8a9535151a9b71d46cafb9f616e468380
5beac614e32f860ff77039fc7d71faa9a2b3c99424b4845e343aae53f8c536ca
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7b6d7fb29dca2c5fafd4d909c1d32bca422e618fc13c7c32f322a3bbeb354cb8
925d52340c624311ece14c4c41013b9878508f4116b1f0767c7d8af83c33e034
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9e91f69e993bcc64d54ff7c336900975e5e83b3c57f9744b403c6be5143c84b5
b1e12c59a9b1d3e8447d6a7aeb584101c71751561b98f3f0162f58f1e617c7fb
c8630ae7042704a3a000e88c6ca1041715eaf37b17af0d4b0629c61dacf25371
df3c000535fd52d52b3c24864750f4c6df3a1c95412b1c28c8836c32c7aae6cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fbe1be6e0af4a8caa059e7ef09e0c00246737ab198f69a4336c0049d61b1fa5a
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62