myshinyinc.com Open in urlscan Pro
2606:4700:3033::ac43:d1ab Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/Nv5wFP7N54
Effective URL:
https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Submission: On August 25 via api (August 25th 2022, 8:48:21 pm UTC) from BE — Scanned from DE

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 17 IPs in 6 countries across 21 domains to perform 25 HTTP transactions. The main IP is 2606:4700:3033::ac43:d1ab, located in United States and belongs to CLOUDFLARENET, US. The main domain is myshinyinc.com.
TLS certificate: Issued by E1 on August 22nd 2022. Valid for: 3 months.

This is the only time myshinyinc.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	52.217.175.48 52.217.175.48	16509 (AMAZON-02) (AMAZON-02)
1 1	78.24.185.75 78.24.185.75	41075 (ATW-AS) (ATW-AS)
1	51.158.43.12 51.158.43.12	12876 (Online SAS) (Online SAS)
3	2606:4700:303... 2606:4700:3031::ac43:92ee	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3033::6815:1446	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	65.60.58.179 65.60.58.179	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
2 3	51.68.85.158 51.68.85.158	16276 (OVH) (OVH)
1 1	34.90.46.36 34.90.46.36	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	51.161.115.163 51.161.115.163	16276 (OVH) (OVH)
1 2	51.83.143.92 51.83.143.92	16276 (OVH) (OVH)
2 4	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	34.194.66.161 34.194.66.161	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2 3	35.186.193.41 35.186.193.41	15169 (GOOGLE) (GOOGLE)
1 1	34.141.179.97 34.141.179.97	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700:303... 2606:4700:3033::ac43:d1ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.26.25 172.67.26.25	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:20:... 2606:4700:20::681a:6e4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:20:... 2606:4700:20::ac43:4809	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.199.13 172.67.199.13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	17

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.217.175.48 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.24.185.75 (Hungary) 1 redirects

ASN41075 (ATW-AS, HU)
PTR: ruling-under.tonictar.com

metanik.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.158.43.12 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: 51-158-43-12.rev.poneytelecom.eu

exceptionalcalm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3031::ac43:92ee (United States)

ASN13335 (CLOUDFLARENET, US)

lynku.jukminung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:1446 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.addlnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.60.58.179 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

otto.sherlowcke.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 51.68.85.158 (France) 2 redirects

ASN16276 (OVH, FR)

www.offermyvist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.90.46.36 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 36.46.90.34.bc.googleusercontent.com

admoustache.go2affise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.161.115.163 (Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: ns572483.ip-51-161-115.net

t2.blowingwnd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.83.143.92 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ns3155458.ip-51-83-143.eu

pollo.trffcsource.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a06:98c1:3121::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

popmyads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.194.66.161 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-194-66-161.compute-1.amazonaws.com

pritha-ner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.193.41 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 41.193.186.35.bc.googleusercontent.com

www.linkonclick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.141.179.97 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 97.179.141.34.bc.googleusercontent.com

offer.advotionhot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:d1ab (United States)

ASN13335 (CLOUDFLARENET, US)

myshinyinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.26.25 (United States)

ASN13335 (CLOUDFLARENET, US)

feed.r-tb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:6e4 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.ocmhood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4809 (United States)

ASN13335 (CLOUDFLARENET, US)

t.ocmhood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.199.13 (United States)

ASN13335 (CLOUDFLARENET, US)

t.c-rtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	popmyads.com 2 redirects popmyads.com — Cisco Umbrella Rank: 262869	4 KB
3	ocmhood.com cdn.ocmhood.com — Cisco Umbrella Rank: 24874 t.ocmhood.com — Cisco Umbrella Rank: 9189	12 KB
3	linkonclick.com 2 redirects www.linkonclick.com — Cisco Umbrella Rank: 278566	4 KB
3	offermyvist.com 2 redirects www.offermyvist.com	6 KB
3	sherlowcke.com otto.sherlowcke.com	7 KB
3	jukminung.com lynku.jukminung.com	22 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 45	20 KB
2	trffcsource.com 1 redirects pollo.trffcsource.com	1 KB
1	c-rtb.com t.c-rtb.com
1	r-tb.com feed.r-tb.com — Cisco Umbrella Rank: 89208	621 B
1	myshinyinc.com myshinyinc.com	58 KB
1	advotionhot.com 1 redirects offer.advotionhot.com — Cisco Umbrella Rank: 194829	319 B
1	pritha-ner.com 1 redirects pritha-ner.com	495 B
1	blowingwnd.com 1 redirects t2.blowingwnd.com	293 B
1	go2affise.com 1 redirects admoustache.go2affise.com — Cisco Umbrella Rank: 368153	234 B
1	addlnk.com cdn.addlnk.com — Cisco Umbrella Rank: 350326	1 KB
1	exceptionalcalm.com exceptionalcalm.com	450 B
1	metanik.com 1 redirects metanik.com	309 B
1	amazonaws.com s3.amazonaws.com	452 B
1	t.co t.co — Cisco Umbrella Rank: 489	597 B
0	amung.us Failed widgets.amung.us Failed
25	21

	Domain	Requested by
4	popmyads.com	2 redirects pollo.trffcsource.com
3	www.linkonclick.com	2 redirects popmyads.com
3	www.offermyvist.com	2 redirects otto.sherlowcke.com
3	otto.sherlowcke.com	lynku.jukminung.com otto.sherlowcke.com
3	lynku.jukminung.com	exceptionalcalm.com t.co lynku.jukminung.com
2	t.ocmhood.com	cdn.ocmhood.com
2	www.google-analytics.com	popmyads.com www.google-analytics.com
2	pollo.trffcsource.com	1 redirects www.offermyvist.com
1	t.c-rtb.com	myshinyinc.com
1	cdn.ocmhood.com	myshinyinc.com
1	feed.r-tb.com	myshinyinc.com
1	myshinyinc.com	www.linkonclick.com
1	offer.advotionhot.com	1 redirects
1	pritha-ner.com	1 redirects
1	t2.blowingwnd.com	1 redirects
1	admoustache.go2affise.com	1 redirects
1	cdn.addlnk.com	lynku.jukminung.com
1	exceptionalcalm.com	s3.amazonaws.com
1	metanik.com	1 redirects
1	s3.amazonaws.com	t.co
1	t.co
0	widgets.amung.us Failed
25	22

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
s3.amazonaws.com Amazon	`2022-04-01` - `2023-03-30`	a year	crt.sh
exceptionalcalm.com Sectigo RSA Domain Validation Secure Server CA	`2022-01-18` - `2023-02-17`	a year	crt.sh
*.jukminung.com E1	`2022-07-20` - `2022-10-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-15` - `2023-05-15`	a year	crt.sh
otto.sherlowcke.com R3	`2022-07-05` - `2022-10-03`	3 months	crt.sh
www.offermyvist.com R3	`2022-07-03` - `2022-10-01`	3 months	crt.sh
lone-star.landingtrack.com R3	`2022-08-03` - `2022-11-01`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.myshinyinc.com E1	`2022-08-22` - `2022-11-20`	3 months	crt.sh
ocmhood.com Cloudflare Inc ECC CA-3	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.c-rtb.com GTS CA 1P5	`2022-08-25` - `2022-11-23`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Frame ID: B88FB7F5731C27E2734259A8E74D4082
Requests: 24 HTTP requests in this frame

Frame: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1661457600
Frame ID: 49A25F48057527FDA431751AC6F36147
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Click Allow if you're not a robot

Page URL History Show full URLs

https://t.co/Nv5wFP7N54 Page URL
https://s3.amazonaws.com/lfgf2vvle95emt923om9/0swecgtf8g026a9.html Page URL
http://metanik.com/qs=r-ajjeghacaffkebbcacafefheababacajgadghaceadiijacdjhacekijbacb HTTP 302
https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_277... Page URL
https://lynku.jukminung.com/rc/9e8aef8068?affclick=1281723575&pubid=690494 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream... Page URL
https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949... Page URL
https://otto.sherlowcke.com/proc.php?5fc9e021d11e283fecb744ef90cc12602967d404 Page URL
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website... Page URL
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website... HTTP 302
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website... HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330007c09fb21cd862dde3eb6c4be734... HTTP 302
https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6307e011a00dbc000... HTTP 302
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503 Page URL
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503&bv=1 HTTP 302
https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20= Page URL
https://popmyads.com/gget HTTP 302
http://pritha-ner.com/0646613250?adTagId=20111650-aa5d-11e6-a4a9-0e855f2e0669&fallbackUrl=https://... HTTP 302
https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd Page URL
https://popmyads.com/returngo/MTY2MTQ2MDQ5OEFtTndWeEw3UmNHUk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA... HTTP 302
http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250 Page URL
http://www.linkonclick.com/jump/next.php?stamat=m%257C%252Cso2fvI2MqB1dQO0dEdHP3xP.ff6%252CS0kXXHXf2ck-... HTTP 302
http://www.linkonclick.com/script/i.php?stamat=m%257C%252C%252Cwja_o2LqoGU3B0-GH0dEdHP3xP.4ea%252CeOBdh... HTTP 302
https://offer.advotionhot.com/click?pid=6&offer_id=2301&sub1=166146049910000TDETV432397757844Vcc&sub3=1041... HTTP 302
https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&si... Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

25
Requests

88 %
HTTPS

33 %
IPv6

21
Domains

22
Subdomains

17
IPs

6
Countries

134 kB
Transfer

296 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/Nv5wFP7N54 Page URL
https://s3.amazonaws.com/lfgf2vvle95emt923om9/0swecgtf8g026a9.html Page URL
http://metanik.com/qs=r-ajjeghacaffkebbcacafefheababacajgadghaceadiijacdjhacekijbacb HTTP 302
https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85 Page URL
https://lynku.jukminung.com/rc/9e8aef8068?affclick=1281723575&pubid=690494 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=fbbb5665&cid=pub1ea224f876aa4e40a82e9edb99014603&2=690494 Page URL
https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90 Page URL
https://otto.sherlowcke.com/proc.php?5fc9e021d11e283fecb744ef90cc12602967d404 Page URL
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90 Page URL
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=d408f1f71b8b49ff9b6e9cbebd616255&eyer=0.16838512036228193&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=3&eyer=0.16838512036228193&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330007c09fb21cd862dde3eb6c4be7348298e0825-202208-flb*5533050-eafc0*M7135918489637748818*sl_5533050-eafc0*c9ec7fd02aa1b61895cb69f6fe35da56aea66e05*13260-0b0f7687-faf0a26d*13260 HTTP 302
https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6307e011a00dbc0001d5c61b&s=503 HTTP 302
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503 Page URL
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503&bv=1 HTTP 302
https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20= Page URL
https://popmyads.com/gget HTTP 302
http://pritha-ner.com/0646613250?adTagId=20111650-aa5d-11e6-a4a9-0e855f2e0669&fallbackUrl=https://popmyads.com/return/30 HTTP 302
https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd Page URL
https://popmyads.com/returngo/MTY2MTQ2MDQ5OEFtTndWeEw3UmNHUk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDQuMC41MTEyLjEwMSBTYWZhcmkvNTM3LjM2/30/1600x1200/8/4/0 HTTP 302
http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250 Page URL
http://www.linkonclick.com/jump/next.php?stamat=m%257C%252Cso2fvI2MqB1dQO0dEdHP3xP.ff6%252CS0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM8JUm5HksBtX5-SSJ8vLRk6sQQdGgDhC8DO2lEpOlLseA%252C%252C&cbpage=http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250&cbur=0.9696839479361332&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref= HTTP 302
http://www.linkonclick.com/script/i.php?stamat=m%257C%252C%252Cwja_o2LqoGU3B0-GH0dEdHP3xP.4ea%252CeOBdhw80cXa5V-hvMhK8UpgWbSpZLR2be-ZFcWFg6nIoHw0lJqzEsitBxZQJR_n9NVXTTQYJ1njAUErPZEqYT9mnze8OpLfJgOKkkZHk9YbMclmOhpkct229_3G-qDq_LI-ehl_NjDAqBmsKnAHBw9vmUmJrkI7ROKqRevS7iSMK2PX5LnOU5EKrbpwvYx64P0QRXEE-yT6-LNZRgh7rtnwzK9TmN7EPcr7nKE3DzUn5HjxqbRExJzBhHJ037vQMNmtKO-Ky_UsLngkS6Q8sX3KNCKHOzm2MAYRJgHCSfvGKJOmXMTU1h8IKpC0ogAr-iR47_CVD4thY5fVarVlPPLsdN86utehfXJa2NG4p2VmAMevpMChICeEypStURbqtTnTKHeui85rueyOC_NJBeKOV8MJMMu1DC6rA5GO5t8UCcspzPX68g7XTHRDugKVyqyd_5agEeETqG3349-Kau6qL2JiXe5xtmEolgem1SYZr7e1q5PBthGsFWUyCBJD5WJUFHncEwxeQAtZ4udaMS1x18fEJfgTIjAatJ1_giEUbUgA7_Hbxrsipa7a7vZLAYaCuNbCznNtI9sT-r9E6c-j7cClQtfg9Q-QavzrM3VI%252C HTTP 302
https://offer.advotionhot.com/click?pid=6&offer_id=2301&sub1=166146049910000TDETV432397757844Vcc&sub3=1041905-329088980-0 HTTP 302
https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://metanik.com/qs=r-ajjeghacaffkebbcacafefheababacajgadghaceadiijacdjhacekijbacb HTTP 302
https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85

Request Chain 12

https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=d408f1f71b8b49ff9b6e9cbebd616255&eyer=0.16838512036228193&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=3&eyer=0.16838512036228193&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330007c09fb21cd862dde3eb6c4be7348298e0825-202208-flb*5533050-eafc0*M7135918489637748818*sl_5533050-eafc0*c9ec7fd02aa1b61895cb69f6fe35da56aea66e05*13260-0b0f7687-faf0a26d*13260 HTTP 302
https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6307e011a00dbc0001d5c61b&s=503 HTTP 302
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503

Request Chain 13

https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503&bv=1 HTTP 302
https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=

Request Chain 14

https://whos.amung.us/swidget/popmyads.png HTTP 307
https://widgets.amung.us/small/32/3238.png

Request Chain 15

https://popmyads.com/gget HTTP 302
http://pritha-ner.com/0646613250?adTagId=20111650-aa5d-11e6-a4a9-0e855f2e0669&fallbackUrl=https://popmyads.com/return/30 HTTP 302
https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd

Request Chain 17

https://popmyads.com/returngo/MTY2MTQ2MDQ5OEFtTndWeEw3UmNHUk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDQuMC41MTEyLjEwMSBTYWZhcmkvNTM3LjM2/30/1600x1200/8/4/0 HTTP 302
http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250

25 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Nv5wFP7N54
t.co/ 552 B
597 B 249ms
205ms Document
text/html 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/Nv5wFP7N54

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 264
content-type: text/html; charset=utf-8
date: Thu, 25 Aug 2022 20:48:12 GMT
expires: Thu, 25 Aug 2022 20:53:12 GMT
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 6b15007f7227ebb6f8960a24765d34d2961fc2c05521b5c328dab8e2af901c91
x-response-time: 178
x-xss-protection: 0

GET
H/1.1 200
OK 0swecgtf8g026a9.html
s3.amazonaws.com/lfgf2vvle95emt923om9/ 97 B
452 B 467ms
130ms Document
text/html 52.217.175.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/lfgf2vvle95emt923om9/0swecgtf8g026a9.html
Requested by: Host: t.co
URL: https://t.co/Nv5wFP7N54
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.175.48 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Content-Length: 97
Content-Type: text/html
Date: Thu, 25 Aug 2022 20:48:14 GMT
ETag: "aed7d9e5941518213c0c3e7afb8c843f"
Last-Modified: Thu, 18 Aug 2022 14:02:58 GMT
Server: AmazonS3
x-amz-id-2: yNCQpr5F6GLOLfWeeL3xKRV9R6IBIhJ82LCxhunLe9OCauTNJ/DVcTZ0tbyfnbvFDyjTuALstco=
x-amz-request-id: QSNJN9978CAMSYB4

GET
H/1.1

200
OK

85
exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/
Redirect Chain

http://metanik.com/qs=r-ajjeghacaffkebbcacafefheababacajgadghaceadiijacdjhacekijbacb
https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85

137 B
450 B

1473ms
442ms

Document
text/html

51.158.43.12
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/lfgf2vvle95emt923om9/0swecgtf8g026a9.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.158.43.12 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: 51-158-43-12.rev.poneytelecom.eu
Software: Apache /
Resource Hash

Request headers

Referer: https://s3.amazonaws.com/lfgf2vvle95emt923om9/0swecgtf8g026a9.html#qs=r-ajjeghacaffkebbcacafefheababacajgadghaceadiijacdjhacekijbacb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 137
Content-Type: text/html; charset=UTF-8
Date: Thu, 25 Aug 2022 20:48:14 GMT
Server: Apache

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Thu, 25 Aug 2022 20:48:13 GMT
Server: nginx
Transfer-Encoding: chunked
X-Powered-By: PHP/5.4.16
location: https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85

GET
H2 200 9e8aef8068 Show response
lynku.jukminung.com/rc/ 3 KB
2 KB 186ms
114ms Document
text/html 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1281723575&pubid=690494
Requested by: Host: exceptionalcalm.com
URL: https://exceptionalcalm.com/1765150d4edb5938000/43463_1_13/88356_1_0_0_1_4493001_85_1286_139780_1_10_2778/85
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92dc952ddc3f6e176bc563b1e2248c8536671619edaf75211221f75de611b3d3

Request headers

Referer: https://exceptionalcalm.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 74072ffd9d0783a0-MXP
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Thu, 25 Aug 2022 20:48:15 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KOaWCfRAH%2FWbtcoVd47XNHaZRO%2FD%2BCgzKXiwZzsQ3EVYDyAEJpmKVdxqtYUwVsP4N32EtJg1a%2Fe1gJW5pA42opO8Boc2t%2BjOoGRhJ72UqAoUj3Wi326WGOBw3K3WLdIzpgRr5ut02TqF0pY58f%2FG%2BzLN"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

GET
H2 200 redirect.css
cdn.addlnk.com/ 1 KB
1 KB 133ms
42ms Stylesheet
text/css 2606:4700:3033::6815:1446
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1281723575&pubid=690494
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1446 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 245
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 145A9WDQZ6KZEM5G
x-amz-id-2: oH2Z6AiyurqdqXtt/ggqOVbTiu0x5FocEeAgETB4VZJUiY/cfUS7OAmzQeLuQ3eAJ1yTqJdl/MlMcrXjrywTpA==
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lObQmXOeVIcqeJEAjnFPzSQLxpATv9W950ZC5miSZBRWkSmX8okRshTCFYkrBwVY1XN711%2BlVEaazNdH60LdYCafglL1MqHFx3zY2AnjklUPNMo8ZF3u6WfjEoATpxzRKYpxqOyL2csv1aYL%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 74072ffeeff0bb05-MXP
cf-bgj: minify

GET
H2 200 invisible.js Show response
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 49A2 36 KB
13 KB 35ms
34ms Script
application/javascript 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1661457600
Requested by: Host: t.co
URL: https://t.co/Nv5wFP7N54
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b45df2ed8c5c56273cf9c3181aa3b45a6a402c5936b73bca9604c1ae377fbd6d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:15 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TVJLcSgc8YQnFoXPlcsRnPmagyZNk5ouvCwEwJjKDjYI9Cxi0hJvgMap3acrBg8V5%2Fwms8kGsr5JwODI7%2B9q1pKziUSXQi8Z0VD3BEP6qCDUKGPRc2YOOO9%2BIhaL1wdnpFq1CdIYxKVKamNZ5T2BzW2E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74072fff788383a0-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pica.js
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 49A2 19 KB
7 KB 36ms
36ms Other
application/javascript 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:15 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UonLrpk9L87so0aFOCw0Ok7YxvWRppq1S2ACcMV1QhE6Dh6qzO%2BW7Q%2BJkKiR7vfLm9yoGRgCkGD1BPl55GIdUInlMYGvYerpGlBcztYzvttVSNnEEcNNHwBhbe1mOWN8sqZrFgP%2Bn3hTkNFHcqeEPlkm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74072fffc91f83a0-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
otto.sherlowcke.com/ 3 KB
2 KB 387ms
123ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=fbbb5665&cid=pub1ea224f876aa4e40a82e9edb99014603&2=690494

Requested by

Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1281723575&pubid=690494

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

d4bec2284651b2d056cd83cc89160a76d1e74b41a81b8d3594851a1f07117ed0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 25 Aug 2022 20:48:15 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

POST 74072ffd9d0783a0
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 49A2 0
0

GET
H2 200 / Show response
otto.sherlowcke.com/ 8 KB
3 KB 130ms
127ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=fbbb5665&cid=pub1ea224f876aa4e40a82e9edb99014603&2=690494

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

5043a891a4cb4ef0eadb68291fefe03bee448bf3b9e4b0e52c27ed3938226809

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=fbbb5665&cid=pub1ea224f876aa4e40a82e9edb99014603&2=690494
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 25 Aug 2022 20:48:15 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 proc.php
otto.sherlowcke.com/ 4 KB
2 KB 127ms
125ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/proc.php?5fc9e021d11e283fecb744ef90cc12602967d404

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_term=7135918489637748818&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 25 Aug 2022 20:48:16 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H/1.1 200
OK /
www.offermyvist.com/ 5 KB
5 KB 834ms
28ms Document
text/html 51.68.85.158
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Requested by: Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/proc.php?5fc9e021d11e283fecb744ef90cc12602967d404
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.68.85.158 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://otto.sherlowcke.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Type: text/html
Date: Thu, 25 Aug 2022 20:48:17 GMT
Transfer-Encoding: chunked

GET
H/1.1

200
OK

p.php
pollo.trffcsource.com/
Redirect Chain

https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8cc...
https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8cc...
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330007c09fb21cd862dde3eb6c4be7348298e0825-202208-flb*5533050-eafc0*M7135918489637748818*sl_5533050-eafc0*c9ec7fd02aa1b6...
https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6307e011a00dbc0001d5c61b&s=503
https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503

884 B
859 B

205ms
41ms

Document
text/html

51.83.143.92
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503
Requested by: Host: www.offermyvist.com
URL: https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.83.143.92 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3155458.ip-51-83-143.eu
Software: nginx /
Resource Hash

Request headers

Referer: https://www.offermyvist.com/?sl=5533050-eafc0&data1=Track1&data2=Track2&tag=M7135918489637748818&website=13260-0b0f7687-faf0a26d&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 25 Aug 2022 20:48:18 GMT
Server: nginx
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 25 Aug 2022 20:48:17 GMT
Location: https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503
Raund: 19t
Round: 1217p3t0dz
Server: nginx

GET
H2

200

aHR0cDovL3RyYWZmaXgxMy5jb20=
popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/
Redirect Chain

https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503&bv=1
https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=

2 KB
1 KB

161ms
74ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=

Requested by

Host: pollo.trffcsource.com
URL: https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.1.33

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Frame-Options	DENY

Request headers

Referer: https://pollo.trffcsource.com/p.php?p=c:9qopki6xy15aicnnk&d=603611c5b7eaf46891533240&s=ys-503
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 740730127c38bab8-MXP
content-encoding: br
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Thu, 25 Aug 2022 20:48:18 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VKE0Ve38P9AqWLUoXoi0Nc4yKRuAgrZJTHRKfJx04XGNeNVqZOKKvEiakcdC%2BeJ%2Bv%2Bj4eaa%2FrSXN%2Bz6hKaJjJJlOPSH7griuQWdWXMU9XtrmR4Nh8N%2F%2FB8enpszRLnHflHYu4bzHYNNnPl0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: DENY
x-powered-by: PHP/7.1.33

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 25 Aug 2022 20:48:18 GMT
Location: https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=
Raund: 2g2
Round: 11kgq037yu
Server: nginx

GET

3238.png
widgets.amung.us/small/32/
Redirect Chain

https://whos.amung.us/swidget/popmyads.png
https://widgets.amung.us/small/32/3238.png

0
0

GET
H3

200

30
popmyads.com/return/
Redirect Chain

https://popmyads.com/gget
http://pritha-ner.com/0646613250?adTagId=20111650-aa5d-11e6-a4a9-0e855f2e0669&fallbackUrl=https://popmyads.com/return/30
https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd

1 KB
1 KB

64ms
64ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.1.33
Resource Hash

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://popmyads.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 740730154d8b5a37-MXP
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 25 Aug 2022 20:48:18 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6FhphDkvrEm2FKx%2B0dk65ggWW0FfgZnZF4bcGQEVLqtdx7XIJSBbN8Cvg6gWPPCOQSQ7ChR%2FjCYItorCANwzJRowoPo8mvgYlUvoNVfRaUJ2jRF%2FXYbgsDAOnonyIKXIcny%2Bv%2FvhBeq6rM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.1.33

Redirect headers

Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 25 Aug 2022 20:48:18 GMT
Location: https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd
Server: EcuvnHey
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

GET
H2 200 analytics.js
www.google-analytics.com/ 49 KB
20 KB 63ms
19ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: popmyads.com
URL: https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://popmyads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 6141
date: Thu, 25 Aug 2022 19:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 25 Aug 2022 21:05:57 GMT

GET
H/1.1

200
OK

next.php
www.linkonclick.com/jump/
Redirect Chain

https://popmyads.com/returngo/MTY2MTQ2MDQ5OEFtTndWeEw3UmNHUk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDQuMC41MTEyLjEwMSB...
http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250

7 KB
3 KB

179ms
147ms

Document
text/html

35.186.193.41
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250
Requested by: Host: popmyads.com
URL: https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd
Protocol: HTTP/1.1
Server: 35.186.193.41 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 41.193.186.35.bc.googleusercontent.com
Software: openresty /
Resource Hash

Request headers

Referer: https://popmyads.com/return/30?clickid=3fd62f95-24b7-11ed-a19f-0af17bce03dd
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Aug 2022 20:48:19 GMT
Server: openresty
Transfer-Encoding: chunked
Via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 74073015ce5f5a37-MXP
content-type: text/html; charset=UTF-8
date: Thu, 25 Aug 2022 20:48:18 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NahK3quk%2FRMrr0PsIFcpq4Fvo%2F0kcGLWF%2BmKyobWR7CdBZ7fqNSRZxFSHrylztye2lWBWGmlhyW%2B3EAjcPlqGjo8PZDVZnbVfN%2Bx0mZNTGuzW9RVYQkCHGi5j1q6PDmwY8v5WeZI6q0GI20%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.1.33

POST
H3 200 collect
www.google-analytics.com/j/ 2 B
22 B 58ms
24ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=854996281&t=pageview&_s=1&dl=https%3A%2F%2Fpopmyads.com%2Freturn%2F30%3Fclickid%3D3fd62f95-24b7-11ed-a19f-0af17bce03dd&ul=en-us&de=UTF-8&dt=PopMyAds%20Redirecting...&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=924834387&gjid=1958949345&cid=150819790.1661460496&tid=UA-43135408-1&_gid=646044505.1661460496&_r=1&_slc=1&z=721628454

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://popmyads.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 25 Aug 2022 20:48:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://popmyads.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Primary Request / Show response
myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/
Redirect Chain

http://www.linkonclick.com/jump/next.php?stamat=m%257C%252Cso2fvI2MqB1dQO0dEdHP3xP.ff6%252CS0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM8JUm5HksBtX5-SSJ8vLRk6sQQdGgDhC8DO2lEpOlLseA%252C%252C&cbpage=ht...
http://www.linkonclick.com/script/i.php?stamat=m%257C%252C%252Cwja_o2LqoGU3B0-GH0dEdHP3xP.4ea%252CeOBdhw80cXa5V-hvMhK8UpgWbSpZLR2be-ZFcWFg6nIoHw0lJqzEsitBxZQJR_n9NVXTTQYJ1njAUErPZEqYT9mnze8OpLfJgOK...
https://offer.advotionhot.com/click?pid=6&offer_id=2301&sub1=166146049910000TDETV432397757844Vcc&sub3=1041905-329088980-0
https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0

125 KB
58 KB

372ms
258ms

Document
text/html

2606:4700:3033::ac43:d1ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Requested by: Host: www.linkonclick.com
URL: http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:d1ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 52bfd2d35ebbe9d080c6069dbecfd846911b8fb9cf6613fb50f0e7b27c44add4

Request headers

Referer: http://www.linkonclick.com/jump/next.php?r=1041905&sub1=0646613250
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7407301bcfb6ba9d-MXP
content-encoding: br
content-type: text/html
date: Thu, 25 Aug 2022 20:48:20 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vAiZuhPaihEkHEjaaImUI9CxlQ5DNMxqNzs7JTHtGDSLiZhnu036GO6iK18QgLXDFwWIMmbKYv%2BjzdmkrPcQrduyd3uHgCeisbcOgjAX8nJ67B32Dbm6GZawcEUVt0SohlnoBOrFLlwBYiv2mA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

access-control-allow-origin: *
content-length: 0
date: Thu, 25 Aug 2022 20:48:19 GMT
location: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
server: nginx

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AFU1kAAPatM Show response
feed.r-tb.com/v1/native/ 642 B
621 B 269ms
205ms Fetch
application/json 172.67.26.25
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://feed.r-tb.com/v1/native/AFU1kAAPatM?subid=52679&uid=da712928-ce56-41af-9a40-cb64e4841d98&kw=download%20install
Requested by: Host: myshinyinc.com
URL: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.26.25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acbba4f880a23ed3335d8515194d582e55dc66cfdd8b83210ae3c2b7ee7d2cd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://myshinyinc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:20 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
model
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 7407301f28669164-FRA

GET
H2 200 hood.js Show response
cdn.ocmhood.com/sdk/ 26 KB
11 KB 122ms
43ms Script
application/javascript 2606:4700:20::681a:6e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ocmhood.com/sdk/hood.js?hf=Hood
Requested by: Host: myshinyinc.com
URL: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:6e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0605a6f06ab4dbbb5b33d119fbd09dfeac10a06b851a5b57d8f76d9546cada9b

Request headers

Referer: https://myshinyinc.com/
Origin: https://myshinyinc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:20 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6494
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
service-worker-allowed: /
last-modified: Mon, 15 Aug 2022 12:17:06 GMT
server: cloudflare
etag: W/"62fa3942-2a53"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t3vmkYCDLd5F4w%2B5OjImhv066EV5LEhM%2BuOQhQDiSGhiLF%2BnagxxG%2BQB%2BdC6RfdeNodJrT1hIYhfPUC5teVwBGI71bfMIdlhcmrW%2BhyWS47e03bXE9I1YPmDspM6tL%2BtgOtZBdCaRuktWKbSbw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 7407301f497e83b8-MXP

GET
DATA 200
OK truncated
/ 748 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 201 activity
t.ocmhood.com/v2/ 0
267 B 142ms
55ms Ping
application/octet-stream 2606:4700:20::ac43:4809
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t.ocmhood.com/v2/activity
Requested by: Host: cdn.ocmhood.com
URL: https://cdn.ocmhood.com/sdk/hood.js?hf=Hood
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4809 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://myshinyinc.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 25 Aug 2022 20:48:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GzwI2xpCznxVJ7rmBeMdXCDJ4m3GuDViBWyHqwDzN1FRvnGkvJcgraSTTZc04tMHpAhq0uaChVQ%2BrV3k36U%2BBoG%2F21yAaIF3WkWEnaLkUp7E7cGDlq7CnpguZDiN1M62q7fOxc4eq%2F4aiRs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: no-cache
cf-ray: 7407302029a9374f-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H2 201 activity
t.ocmhood.com/v2/ 0
534 B 138ms
53ms Ping
application/octet-stream 2606:4700:20::ac43:4809
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t.ocmhood.com/v2/activity
Requested by: Host: cdn.ocmhood.com
URL: https://cdn.ocmhood.com/sdk/hood.js?hf=Hood
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4809 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://myshinyinc.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 25 Aug 2022 20:48:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NvLBESR%2F%2BGd5aDuydBA1MFYFpy2OJWGkLdL10bA%2BCS2QIwGnwgI%2Bt7I3m%2Fn6ljrbIGKREPkJPYCNwa9iumb%2F31OH4GGIDLp8V9pvh2N%2FR4gAPr%2F1O%2BQ2faFgdlmUwjyCX0I822m6J8loH0Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: no-cache
cf-ray: 7407302029aa374f-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 imp
t.c-rtb.com/ 0
0 107ms
38ms Fetch 172.67.199.13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t.c-rtb.com/imp?l2=9xyIfYLb7UTrKW3UJ8hUdgWk9bCKMBHAGG7618datFrIm7tZ-WITecncl9Bh1YxQCfZf_NjOT15qdTMAWXHtfdRHwJDpkhzVhGQEwX8qmIqJQMhd0AclMqyDXzF5Ap8ziNcVj5GrjdEyT9lKsTZEkh0gKqOgExxkjxMAQGUlli8ADqdIO6MLfubtU_O1YqrT
Requested by: Host: myshinyinc.com
URL: https://myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM/?cid=6307e013208dbe0001c8ecb7&sid=1041905-329088980-0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.199.13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://myshinyinc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 25 Aug 2022 20:48:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7Csg%2BxxgsCu4ed4V8q9j7TnpLWyBxjI84yhj3lKwrWLQDkNf67phaTWxpol6gXTv7xPRUbSbHUidsRryu8%2F0lZdp6CDkt6Tfg3DvDyNIy%2B5uxDVOB2GvzIK6uCUZA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 74073020ee1ab79d-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lynku.jukminung.com
URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/74072ffd9d0783a0

Domain: widgets.amung.us
URL: https://widgets.amung.us/small/32/3238.png

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
myshinyinc.com/OriEdB8PYcy_36lO5u0QEUCXre99Hi0u-h9bGoIrHXM	1969-12-31 23:59:59	Name: session Value: rdSlkzzyZzlEn7Hiqemnj3RbCAi-JBhD
.t.co/	1970-01-20 15:01:14	Name: muc Value: 71f094da-2258-46c4-8b1b-2f4d0831aed4
exceptionalcalm.com/	1970-01-20 06:14:12	Name: uid15295 Value: 1281723575-20220825164814-b60c3a3f7737a92d6b37f3b85c47ccbe-
lynku.jukminung.com/	1970-01-20 05:41:05	Name: AWSALB Value: 94vvAcoVH1jYpjS2ZpEH9iW3wJ6kBIfTUS5Na1GCnKuvuhG21RVxSsqiid0dgVcoG2rJ834tBk1CLX/wvL94xdSW2B7UcwbDAjsnnMlkIaNo4CEmE2f2ogncDDNl
otto.sherlowcke.com/	1970-01-20 14:16:36	Name: u Value: 401f1aab45be7b349df7c71561d10eab
admoustache.go2affise.com/	1970-01-20 14:16:36	Name: afclick Value: 6307e011a00dbc0001d5c61b
.popmyads.com/	1970-01-20 15:07:00	Name: _ga Value: GA1.2.150819790.1661460496
.popmyads.com/	1970-01-20 05:32:26	Name: _gid Value: GA1.2.646044505.1661460496
.popmyads.com/	1970-01-20 05:31:00	Name: _gat Value: 1
offer.advotionhot.com/	1970-01-20 14:16:36	Name: afclick Value: 6307e013208dbe0001c8ecb7
offer.advotionhot.com/	1970-01-20 14:16:36	Name: afoffers Value: {"2301":1661460499}

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

admoustache.go2affise.com
cdn.addlnk.com
cdn.ocmhood.com
exceptionalcalm.com
feed.r-tb.com
lynku.jukminung.com
metanik.com
myshinyinc.com
offer.advotionhot.com
otto.sherlowcke.com
pollo.trffcsource.com
popmyads.com
pritha-ner.com
s3.amazonaws.com
t.c-rtb.com
t.co
t.ocmhood.com
t2.blowingwnd.com
widgets.amung.us
www.google-analytics.com
www.linkonclick.com
www.offermyvist.com
lynku.jukminung.com
widgets.amung.us
104.244.42.69
172.67.199.13
172.67.26.25
2606:4700:20::681a:6e4
2606:4700:20::ac43:4809
2606:4700:3031::ac43:92ee
2606:4700:3033::6815:1446
2606:4700:3033::ac43:d1ab
2a00:1450:4001:82a::200e
2a06:98c1:3121::3
34.141.179.97
34.194.66.161
34.90.46.36
35.186.193.41
51.158.43.12
51.161.115.163
51.68.85.158
51.83.143.92
52.217.175.48
65.60.58.179
78.24.185.75
0605a6f06ab4dbbb5b33d119fbd09dfeac10a06b851a5b57d8f76d9546cada9b
5043a891a4cb4ef0eadb68291fefe03bee448bf3b9e4b0e52c27ed3938226809
52bfd2d35ebbe9d080c6069dbecfd846911b8fb9cf6613fb50f0e7b27c44add4
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1
92dc952ddc3f6e176bc563b1e2248c8536671619edaf75211221f75de611b3d3
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
acbba4f880a23ed3335d8515194d582e55dc66cfdd8b83210ae3c2b7ee7d2cd6
b45df2ed8c5c56273cf9c3181aa3b45a6a402c5936b73bca9604c1ae377fbd6d
d4bec2284651b2d056cd83cc89160a76d1e74b41a81b8d3594851a1f07117ed0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2

myshinyinc.com Open in urlscan Pro 2606:4700:3033::ac43:d1ab Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

88 %HTTPS

33 %IPv6

21 Domains

22 Subdomains

17 IPs

6 Countries

134 kBTransfer

296 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

myshinyinc.com Open in urlscan Pro
2606:4700:3033::ac43:d1ab Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

88 %
HTTPS

33 %
IPv6

21
Domains

22
Subdomains

17
IPs

6
Countries

134 kB
Transfer

296 kB
Size

11
Cookies

25 HTTP transactions
2 data transactions