urlscan.io logo urlscan.io
SecurityTrails logo

t82.afe.myftpupload.com Open in urlscan Pro
160.153.138.249  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://risu.io/St9f6/
Effective URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Submission: On April 17 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 5 countries across 11 domains to perform 36 HTTP transactions. The main IP is 160.153.138.249, located in Amsterdam, Netherlands and belongs to GODADDY-AMS, DE. The main domain is t82.afe.myftpupload.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on April 16th 2024. Valid for: a year.
This is the only time t82.afe.myftpupload.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 7 172.66.42.254 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 34.98.102.251 396982 (GOOGLE-CL...)
2 2a00:1450:400... 15169 (GOOGLE)
1 9 160.153.138.249 21501 (GODADDY-AMS)
2 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.184.232 15169 (GOOGLE)
2 216.58.212.163 15169 (GOOGLE)
1 172.217.18.100 15169 (GOOGLE)
3 104.16.87.20 13335 (CLOUDFLAR...)
3 104.18.10.207 13335 (CLOUDFLAR...)
1 2a04:4e42:400... 54113 (FASTLY)
36 14
7    172.66.42.254 (United States)

ASN13335 (CLOUDFLARENET, US)
risu.io
1    2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
2    34.98.102.251 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 251.102.98.34.bc.googleusercontent.com
assets.risu.io
2    2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
9    160.153.138.249 (Amsterdam, Netherlands)

ASN21501 (GODADDY-AMS, DE)
PTR: 249.138.153.160.host.secureserver.net
t82.afe.myftpupload.com
2    2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
region1.analytics.google.com
2    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    142.250.184.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f8.1e100.net
www.googletagmanager.com
2    216.58.212.163 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f163.1e100.net
www.google.de
1    172.217.18.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f4.1e100.net
www.google.com
3    104.16.87.20 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
3    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
1    2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
Apex Domain
Subdomains		 Transfer
9 myftpupload.com
t82.afe.myftpupload.com
34 KB
9 risu.io
risu.io
assets.risu.io
14 KB
3 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3015
48 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 320
106 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
region1.google-analytics.com — Cisco Umbrella Rank: 2404
21 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
251 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 7278
126 B
2 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2941
www.google.com — Cisco Umbrella Rank: 2
117 B
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 84
390 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 767
24 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 817
7 KB
36 11
Domain Requested by
9 t82.afe.myftpupload.com 1 redirects assets.risu.io
t82.afe.myftpupload.com
7 risu.io 1 redirects risu.io
static.cloudflareinsights.com
3 stackpath.bootstrapcdn.com t82.afe.myftpupload.com
3 cdn.jsdelivr.net t82.afe.myftpupload.com
cdn.jsdelivr.net
3 www.googletagmanager.com risu.io
www.googletagmanager.com
www.google-analytics.com
2 www.google.de
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 assets.risu.io risu.io
1 code.jquery.com t82.afe.myftpupload.com
1 www.google.com
1 region1.analytics.google.com www.googletagmanager.com
1 region1.google-analytics.com www.googletagmanager.com
1 static.cloudflareinsights.com risu.io
36 14

This site contains no links.

Subject Issuer Validity Valid
risu.io
GTS CA 1P5		 2024-02-23 -
2024-05-23		 3 months crt.sh
cloudflareinsights.com
GTS CA 1P5		 2024-03-10 -
2024-06-08		 3 months crt.sh
assets.risu.io
GTS CA 1D4		 2024-03-28 -
2024-06-26		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2024-03-18 -
2024-06-10		 3 months crt.sh
*.afe.myftpupload.com
Go Daddy Secure Certificate Authority - G2		 2024-04-16 -
2025-05-18		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
*.google.de
GTS CA 1C3		 2024-03-18 -
2024-06-10		 3 months crt.sh
*.google.com
GTS CA 1C3		 2024-03-18 -
2024-06-10		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
bootstrapcdn.com
GTS CA 1P5		 2024-03-27 -
2024-06-25		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh

This page contains 2 frames:

Primary Page: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Frame ID: D61F815569C35729972B8A856FAC19C8
Requests: 33 HTTP requests in this frame

Frame: https://risu.io/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
Frame ID: 2EEBBDE946E49C88F4F6362FDCBA5135
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login to Customer Portals and Tools | DHL |

Page URL History Show full URLs

  1. https://risu.io/St9f6/ Page URL
  2. https://t82.afe.myftpupload.com/inf/MYdhllde/ HTTP 302
    https://t82.afe.myftpupload.com/inf/MYdhllde/info.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

36
Requests

97 %
HTTPS

43 %
IPv6

11
Domains

14
Subdomains

14
IPs

5
Countries

505 kB
Transfer

1441 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://risu.io/St9f6/ Page URL
  2. https://t82.afe.myftpupload.com/inf/MYdhllde/ HTTP 302
    https://t82.afe.myftpupload.com/inf/MYdhllde/info.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://risu.io/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://risu.io/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js

36 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
risu.io/St9f6/ 		5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://risu.io/St9f6/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb6c31244db5c3a7ac01a4bcd3ebf1570251960e9638448b375739c69e7c0e8b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
875f5f42493a9007-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 17 Apr 2024 21:05:14 GMT
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
vary
Accept-Encoding
via
1.1 google
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
20053ec6-a3ff-447b-a726-2051486fc25d
x-runtime
0.045746
x-xss-protection
1; mode=block
rocket-loader.min.js
risu.io/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://risu.io/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: risu.io
URL: https://risu.io/St9f6/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/St9f6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 15 Apr 2024 08:31:34 GMT
server
cloudflare
etag
W/"661ce5e6-302c"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
875f5f449bbf9007-FRA
expires
Fri, 19 Apr 2024 21:05:14 GMT
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by
Host: risu.io
URL: https://risu.io/St9f6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Origin
https://risu.io
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
gzip
last-modified
Mon, 15 Apr 2024 22:09:58 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
875f5f44d9e89079-FRA
url_redirect-783f9e05338a4e26293395677999bbd16ece44428d5985ca2fc9986dd01694b8.js
assets.risu.io/assets/ 		95 B
299 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.risu.io/assets/url_redirect-783f9e05338a4e26293395677999bbd16ece44428d5985ca2fc9986dd01694b8.js
Requested by
Host: risu.io
URL: https://risu.io/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.102.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
251.102.98.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
783f9e05338a4e26293395677999bbd16ece44428d5985ca2fc9986dd01694b8

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 07:24:23 GMT
content-encoding
gzip
via
1.1 google
last-modified
Sat, 17 Feb 2024 07:03:57 GMT
server
nginx
age
49252
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
https://risu.io
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
94
main.js
risu.io/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/ Frame 2EEB
Redirect Chain
  • https://risu.io/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://risu.io/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://risu.io/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
Protocol
H3
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
x-content-type-options
nosniff
server
cloudflare
vary
accept-encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
875f5f457c709007-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Wed, 17 Apr 2024 21:05:15 GMT
server
cloudflare
vary
Accept-Encoding
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
875f5f453c479007-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
gtm.js
www.googletagmanager.com/ 		201 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MR8WJDJ
Requested by
Host: risu.io
URL: https://risu.io/St9f6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
73956
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 17 Apr 2024 21:05:15 GMT
logo-140d23c26269417067ca5c36ad591e3a13da19b3854209bc82ea477cc54e9986.png
assets.risu.io/assets/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://assets.risu.io/assets/logo-140d23c26269417067ca5c36ad591e3a13da19b3854209bc82ea477cc54e9986.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.102.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
251.102.98.34.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 19:43:12 GMT
via
1.1 google
last-modified
Sat, 17 Feb 2024 07:03:57 GMT
server
nginx
age
4923
content-type
image/png
access-control-allow-origin
https://risu.io
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1954
Primary Request info.php
t82.afe.myftpupload.com/inf/MYdhllde/
Redirect Chain
  • https://t82.afe.myftpupload.com/inf/MYdhllde/
  • https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Requested by
Host: assets.risu.io
URL: https://assets.risu.io/assets/url_redirect-783f9e05338a4e26293395677999bbd16ece44428d5985ca2fc9986dd01694b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
472d6c87b0fa1a2f0a1929d58a2149849a82fac2ffd0c490719af8d99c0e87a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://risu.io/St9f6/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
age
22116
content-encoding
gzip
content-length
2093
content-type
text/html; charset=UTF-8
date
Wed, 17 Apr 2024 21:05:18 GMT
server
openresty
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding, User-Agent
x-backend
varnish_ssl
x-cache
cached
x-cache-hit
HIT
x-cacheable
YES:Forced
x-cacheproxy-retries
0/2
x-content-type-options
nosniff
x-fawn-proc-count
1,12,24
x-php-version
7.4
x-xss-protection
1; mode=block

Redirect headers

age
0
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 17 Apr 2024 21:05:16 GMT
location
info.php
server
openresty
strict-transport-security
max-age=31536000; includeSubDomains
vary
User-Agent
x-backend
varnish_ssl
x-cache
uncached
x-cache-hit
MISS
x-cacheable
YES:Forced
x-cacheproxy-retries
0/2
x-content-type-options
nosniff
x-fawn-proc-count
1,1,24
x-php-version
7.4
x-xss-protection
1; mode=block
rum
risu.io/cdn-cgi/ 		0
135 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://risu.io/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://risu.io/St9f6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type
application/json

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://risu.io
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
875f5f456c679007-FRA
875f5f42493a9007
risu.io/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2EEB 		0
310 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://risu.io/cdn-cgi/challenge-platform/h/g/jsd/r/875f5f42493a9007
Requested by
Host: risu.io
URL: https://risu.io/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
server
cloudflare
cf-ray
875f5f45ece49007-FRA
alt-svc
h3=":443"; ma=86400
content-type
text/plain; charset=UTF-8
875f5f42493a9007
risu.io/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2EEB 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://risu.io/cdn-cgi/challenge-platform/h/g/jsd/r/875f5f42493a9007
Requested by
Host: risu.io
URL: https://risu.io/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.42.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
server
cloudflare
cf-ray
875f5f463d209007-FRA
alt-svc
h3=":443"; ma=86400
content-type
text/plain; charset=UTF-8
js
www.googletagmanager.com/gtag/ 		260 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-H814P3QJ03&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MR8WJDJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92383
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 17 Apr 2024 21:05:15 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MR8WJDJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 17 Apr 2024 19:48:08 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
4627
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 17 Apr 2024 21:48:08 GMT
collect
region1.google-analytics.com/g/ 		0
248 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-H814P3QJ03&gtm=45je44f0v883701885z8812733088za200&_p=1713387915068&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=606763452.1713387915&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713387915&sct=1&seg=0&dl=https%3A%2F%2Frisu.io%2FSt9f6%2F&dt=%E7%9F%AD%E7%B6%B2%E5%9D%80%E3%80%82%E8%A1%8C%E9%8A%B7%E3%80%82%E5%88%86%E6%9E%90%20-%20Risu.io&en=page_view&_fv=1&_nsi=1&_ss=1&_c=1&tfd=765
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H814P3QJ03&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://risu.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		16 B
216 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2135740263&t=pageview&_s=1&dl=https%3A%2F%2Frisu.io%2FSt9f6%2F&ul=de-de&de=UTF-8&dt=%E7%9F%AD%E7%B6%B2%E5%9D%80%E3%80%82%E8%A1%8C%E9%8A%B7%E3%80%82%E5%88%86%E6%9E%90%20-%20Risu.io&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=267663680&gjid=2050459156&cid=606763452.1713387915&tid=UA-146086888-1&_gid=1877334599.1713387915&_r=1&_slc=1&gtm=45He44f0n81MR8WJDJv812733088za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=763122590
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://risu.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
343 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-146086888-1&cid=606763452.1713387915&jid=267663680&gjid=2050459156&_gid=1877334599.1713387915&npa=1&_u=YADAAEAAAAAAACAAI~&z=198605308
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://risu.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		247 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-ZH634PL121&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:15 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
90008
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 17 Apr 2024 21:05:15 GMT
collect
region1.analytics.google.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-ZH634PL121&gtm=45je44f0v9134562597za200&_p=1713387915068&_gaz=1&gcd=13l3l3l2l3&npa=1&dma_cps=sypham&dma=1&ul=de-de&sr=1600x1200&cid=606763452.1713387915&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Frisu.io%2FSt9f6%2F&dt=%E7%9F%AD%E7%B6%B2%E5%9D%80%E3%80%82%E8%A1%8C%E9%8A%B7%E3%80%82%E5%88%86%E6%9E%90%20-%20Risu.io&sid=1713387915&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=909
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZH634PL121&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://risu.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
47 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZH634PL121&cid=606763452.1713387915&gtm=45je44f0v9134562597za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l3&npa=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZH634PL121&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://risu.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZH634PL121&cid=606763452.1713387915&gtm=45je44f0v9134562597za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l3&npa=1&z=1583433670
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f163.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-146086888-1&cid=606763452.1713387915&jid=267663680&npa=1&_u=YADAAEAAAAAAACAAI~&z=495254233
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f4.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-146086888-1&cid=606763452.1713387915&jid=267663680&npa=1&_u=YADAAEAAAAAAACAAI~&z=495254233
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f163.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://risu.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 17 Apr 2024 21:05:15 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 		64 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3043937
x-jsd-version
1.5.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230101-FRA, cache-lga21952-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mki1yvAOY8w0YG7LC5wD%2FRVZwRhWQmBhjNv%2BHjBpoXQsAGb9a7MeyMZx1dmHK4bq9oAXcZ0dqVCsmV%2Bw3Wi11h%2BEv%2FIEGK5cNrJXhSLfXe2i%2BfOLdTsj0kGS59rPd9Czb28%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
875f5f5d2b751b9f-FRA
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
1078
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
2317402
cdn-cachedat
03/18/2024 12:28:12
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"269550530cc127b6aa5a35925a7de6ce"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
9e01696f4dd85a48838a9ea9ee82ef4a
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
875f5f5d3b5c3651-FRA
cdn-requestpullsuccess
True
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
1055
age
3030254
cdn-cachedat
07/07/2023 01:23:40
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver
1.03
cdn-requestpullcode
200
server
cloudflare
etag
W/"816af0eddd3b4822c2756227c7e7b7ee"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
11f873f6646fa46b819bbd06b011b0c8
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
875f5f5d3b5e3651-FRA
cdn-requestpullsuccess
True
posta.css
t82.afe.myftpupload.com/inf/MYdhllde/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/css/posta.css
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
1e6dc7cf70a8f91906f1d63e9d8ddd70c0235cc0afc1356eb0198b57deafa4ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-cacheable
YES
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
2203
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:50:26 GMT
server
openresty
x-php-version
7.4
etag
"3503-5fb2c68076080-gzip"
vary
Accept-Encoding
content-type
text/css
x-cache-hit
HIT
accept-ranges
bytes
dhl-logo.svg
t82.afe.myftpupload.com/inf/MYdhllde/image/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/image/dhl-logo.svg
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-cacheable
YES:Forced
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
1603
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:50:26 GMT
server
openresty
x-php-version
7.4
etag
"643-5fb2c68076080"
vary
User-Agent
content-type
image/svg+xml
access-control-allow-origin
*
x-cache-hit
HIT
accept-ranges
bytes
camion.png
t82.afe.myftpupload.com/inf/MYdhllde/image/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/image/camion.png
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
9749654bdfcce79bc06740ed18ce854c5bc56fd419a8d59fc590777ba942105e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-cacheable
YES
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
6755
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:48:36 GMT
server
openresty
x-php-version
7.4
etag
"1a63-5fb2c6178e900"
content-type
image/png
x-cache-hit
HIT
accept-ranges
bytes
group.svg
t82.afe.myftpupload.com/inf/MYdhllde/image/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/image/group.svg
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-cacheable
YES:Forced
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
11968
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:48:36 GMT
server
openresty
x-php-version
7.4
etag
"2ec0-5fb2c6178e900"
vary
User-Agent
content-type
image/svg+xml
access-control-allow-origin
*
x-cache-hit
HIT
accept-ranges
bytes
socio.png
t82.afe.myftpupload.com/inf/MYdhllde/image/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/image/socio.png
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
39b5e1fdc845a00e044f1d5136d4d365e319d79caae542b2abef7e9a7eb7d786
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-cacheable
YES
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
1292
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:48:36 GMT
server
openresty
x-php-version
7.4
etag
"50c-5fb2c6178e900"
content-type
image/png
x-cache-hit
HIT
accept-ranges
bytes
jquery-3.5.1.slim.min.js
code.jquery.com/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
5306414
x-cache
HIT, HIT
content-length
24606
x-served-by
cache-lga21954-LGA, cache-fra-etou8220039-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1713387919.934366,VS0,VE0
etag
W/"28feccc0-11abc"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
17, 20117
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/popper.min.js
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3030243
x-jsd-version
2.9.2
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230074-FRA, cache-lga21952-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"48a2-jut79x6Kl4uCoaGYAV8U1z0upZI"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WitFBJPssyDi8XjAaOYMrHiYRbPmeiwFAefki60S5pvZVXSsBpz3pUqgK0o3xtwzFHgp3eHuCWnWq2NiSNYTc944bsMigVoJmSa2wcoFe9a%2Bgqx1g1lwG5Jsb7m9QucxZ3E%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
875f5f5d2b721b9f-FRA
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
864
age
3039754
cdn-cachedat
08/20/2022 02:35:31
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver
1.02
cdn-requestpullcode
200
server
cloudflare
etag
W/"02d223393e00c273efdcb1ade8f4f8b1"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
a6bc14db3a88cabcd6b3bc56a77879ef
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
875f5f5d3b593651-FRA
cdn-requestpullsuccess
True
jquery.mask.js
t82.afe.myftpupload.com/inf/MYdhllde/js/ 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/js/jquery.mask.js
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
ef8043017d97d077f4c17a0c990ece7becedc9bb64170eb3fd1a4401c509c446
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/info.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-cacheable
YES
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
5884
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:50:26 GMT
server
openresty
x-php-version
7.4
etag
"5dc3-5fb2c68076080-gzip"
vary
Accept-Encoding
content-type
text/javascript
x-cache-hit
HIT
accept-ranges
bytes
titiza.png
t82.afe.myftpupload.com/inf/MYdhllde/image/ 		83 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t82.afe.myftpupload.com/inf/MYdhllde/image/titiza.png
Requested by
Host: t82.afe.myftpupload.com
URL: https://t82.afe.myftpupload.com/inf/MYdhllde/css/posta.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
160.153.138.249 Amsterdam, Netherlands, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
249.138.153.160.host.secureserver.net
Software
openresty /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://t82.afe.myftpupload.com/inf/MYdhllde/css/posta.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-cacheable
YES
x-backend
varnish_ssl
age
22111
x-cache
cached
x-cacheproxy-retries
0/2
content-length
1694457
x-xss-protection
1; mode=block
last-modified
Mon, 08 May 2023 10:48:36 GMT
server
openresty
x-php-version
7.4
etag
"19daf9-5fb2c6178e900"
content-type
image/png
x-cache-hit
HIT
accept-ranges
bytes
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 		88 KB
89 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Origin
https://t82.afe.myftpupload.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 17 Apr 2024 21:05:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3035112
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
90528
x-served-by
cache-fra-eddf8230031-FRA, cache-lga21952-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PdE1fqkJl4ExHKrdoJicpIxeD%2Fvq2kcQni%2FAIJj9VQ%2BBrStMk9x8e6QguGTLVQz%2FU51%2Bd3DpQhC3opAhdhwMcgivI5p68N8azjfu1yUz31AeBfR6QQGz5g8ZskngPSi6nwQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
cf-ray
875f5f614eeb65d1-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| Popper object| bootstrap

10 Cookies

Domain/Path Name / Value
risu.io/ Name: ahoy_visitor
Value: b824d1eb-0cab-4ddd-a544-f076604f83d2
risu.io/ Name: ahoy_visit
Value: 1c1ef6db-874b-4a89-ae24-4e2721ff95e7
risu.io/ Name: _risu_session
Value: X3jiu3K6QoF%2B82Vm0JIIdXW7yewBZ%2BHd1JWL1foLCmNI5b2XQLQSmz%2F2clT2a78TC%2FtcB94ZqfJeD34ur3UOJl1sGvZKict2MYSZ--G%2B34XLnD09JHTyFQ--MjJnrlVerOcxnzjX1N1jhw%3D%3D
.risu.io/ Name: __cf_bm
Value: IOHG4ANl6ZpTBGqzSTSGKXo3YSpo0MaK5txNM0nDB2o-1713387914-1.0.1.1-PfStkYcW0HbEFUX8PN1UNqXVSft8mO8JqsxHW19LMt2NH74jCmg_raazl.EgDs9PpJVA1Yx0rHsQIi8OFVKDTw
.risu.io/ Name: cf_clearance
Value: QEukWya0FQfntHeoQ0zi1D9SmYn4IJvSiD1NVsSTzL0-1713387915-1.0.1.1-mgqlwb0VHN2y2rz44dwNn3ywqmbCOWdFHTa6vZcDOH.LWg6HX4R4qHvRVv.qlbsY3na2H4H5rvCQsCTiQ.iriA
.risu.io/ Name: _ga
Value: GA1.2.606763452.1713387915
.risu.io/ Name: _gid
Value: GA1.2.1877334599.1713387915
.risu.io/ Name: _gat_UA-146086888-1
Value: 1
.risu.io/ Name: _ga_ZH634PL121
Value: GS1.2.1713387915.1.0.1713387915.60.0.0
.risu.io/ Name: _ga_H814P3QJ03
Value: GS1.1.1713387915.1.0.1713387918.0.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.risu.io
cdn.jsdelivr.net
code.jquery.com
region1.analytics.google.com
region1.google-analytics.com
risu.io
stackpath.bootstrapcdn.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t82.afe.myftpupload.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
104.16.87.20
104.18.10.207
142.250.184.232
160.153.138.249
172.217.18.100
172.66.42.254
2001:4860:4802:34::36
216.58.212.163
2606:4700::6810:5049
2a00:1450:4001:831::2008
2a00:1450:4001:831::200e
2a00:1450:400c:c00::9b
2a04:4e42:400::649
34.98.102.251
1e6dc7cf70a8f91906f1d63e9d8ddd70c0235cc0afc1356eb0198b57deafa4ed
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
39b5e1fdc845a00e044f1d5136d4d365e319d79caae542b2abef7e9a7eb7d786
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
472d6c87b0fa1a2f0a1929d58a2149849a82fac2ffd0c490719af8d99c0e87a0
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
783f9e05338a4e26293395677999bbd16ece44428d5985ca2fc9986dd01694b8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
9749654bdfcce79bc06740ed18ce854c5bc56fd419a8d59fc590777ba942105e
cb6c31244db5c3a7ac01a4bcd3ebf1570251960e9638448b375739c69e7c0e8b
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
ef8043017d97d077f4c17a0c990ece7becedc9bb64170eb3fd1a4401c509c446