zlk.the-dell.me Open in urlscan Pro
178.170.39.105  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Page URL
2. http://zlk.the-dell.me/opt.php?d=0&l=0&c=0&cr=13352&em= Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	greunsb.html invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/	678 B 1 KB	942ms 238ms	Document text/html	3.5.234.171 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.5.234.171 São Paulo, Brazil, ASN16509 (AMAZON-02, US), Reverse DNS s3-sa-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Content-Length 678 Content-Type text/html Date Fri, 26 Aug 2022 22:55:27 GMT ETag "b7dffcce604aacbe4b6b8db0649ca520" Last-Modified Fri, 26 Aug 2022 16:14:55 GMT Server AmazonS3 x-amz-id-2 c0LEBrsq4kSU9TqSB8gcTsQ/hn6z1OLa3cFGTkvBQZdNNe739vNnzedJUZGMh/B0RtzZYF/eNya3vHI+WlxC7Q== x-amz-request-id TG3H6SXJHP4XFXWN
GET H/1.1	200 OK	Primary Request opt.php Show response zlk.the-dell.me/	10 KB 10 KB	89ms 19ms	Document text/html	178.170.39.105 IKOULA
General Check archive.org Show headers Download Go to Full URL http://zlk.the-dell.me/opt.php?d=0&l=0&c=0&cr=13352&em= Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol HTTP/1.1 Server 178.170.39.105 , France, ASN21409 (IKOULA, FR), Reverse DNS fujitsu.sbs Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / PHP/5.4.16 Resource Hash c67a0aaf866fc55574df90b676a834d1037ee667c52c4d7dc9c9a4ebb4a20669 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Fri, 26 Aug 2022 22:55:26 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Transfer-Encoding chunked X-Powered-By PHP/5.4.16
GET H2	200	tag.min.js Show response iptautup.com/pfe/current/	15 KB 6 KB	73ms 13ms	Script application/javascript	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/pfe/current/tag.min.js?z=3129050 Requested by Host: zlk.the-dell.me URL: http://zlk.the-dell.me/opt.php?d=0&l=0&c=0&cr=13352&em= Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash d625629118237abaad5fefb48e104a7220d26759d022955c9ee584285328de2a Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers pragma no-cache date Fri, 26 Aug 2022 22:55:26 GMT content-encoding gzip last-modified Mon, 22 Aug 2022 12:18:11 GMT server nginx etag W/"63037403-3a38" content-type application/javascript cache-control no-cache access-control-allow-credentials true
GET H2	200	zone Show response iptautup.com/	693 B 980 B	16ms 15ms	Fetch application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/zone?pub=0&zone_id=3129050&is_mobile=false&domain=zlk.the-dell.me&var=&ymid=&var_3= Requested by Host: iptautup.com URL: https://iptautup.com/pfe/current/tag.min.js?z=3129050 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash ce387ca499e5ddaebcc016a88cdf882461de40c3f69fceb548853d346f0a35b4 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers x-trace-id 0376a84aacb3f30587b255b8961daa89 date Fri, 26 Aug 2022 22:55:26 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=1 content-type application/json; charset=utf-8 access-control-allow-origin http://zlk.the-dell.me access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 693
GET H2	200	universal.min.js Show response iptautup.com/pfe/current/	129 KB 46 KB	40ms 13ms	Fetch application/javascript	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/pfe/current/universal.min.js?v=3.1.391 Requested by Host: iptautup.com URL: https://iptautup.com/pfe/current/tag.min.js?z=3129050 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash bcaf286ed6b75bfa5e38c062a3d9fef4be65f2479f10a1a2be463d44a5ec8e5b Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers pragma no-cache date Fri, 26 Aug 2022 22:55:26 GMT content-encoding gzip last-modified Mon, 22 Aug 2022 12:18:11 GMT server nginx etag W/"63037403-20481" content-type application/javascript access-control-allow-origin http://zlk.the-dell.me cache-control no-cache access-control-allow-credentials true
OPTIONS H2	200	custom iptautup.com/ Frame	0 0	13ms 13ms	Preflight text/plain	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin http://zlk.the-dell.me Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin http://zlk.the-dell.me access-control-max-age 86400 content-length 0 content-type text/plain; charset=utf-8 date Fri, 26 Aug 2022 22:55:26 GMT server nginx
OPTIONS H2	200	custom iptautup.com/ Frame	0 0	13ms 13ms	Preflight text/plain	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin http://zlk.the-dell.me Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin http://zlk.the-dell.me access-control-max-age 86400 content-length 0 content-type text/plain; charset=utf-8 date Fri, 26 Aug 2022 22:55:26 GMT server nginx
POST H2	200	custom Show response iptautup.com/	39 B 324 B	17ms 16ms	Fetch application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Referer http://zlk.the-dell.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Content-Type application/json Response headers x-trace-id bef0d00cbfaec0f2766faf7ed2a13f3e date Fri, 26 Aug 2022 22:55:26 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=1 content-type application/json; charset=utf-8 access-control-allow-origin http://zlk.the-dell.me access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 39
POST H2	200	custom Show response iptautup.com/	39 B 325 B	14ms 14ms	Fetch application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Referer http://zlk.the-dell.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Content-Type application/json Response headers x-trace-id ee684300072ea58aeb3e8a094e4f30dd date Fri, 26 Aug 2022 22:55:26 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=1 content-type application/json; charset=utf-8 access-control-allow-origin http://zlk.the-dell.me access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 39
GET H2	200	gid.js Show response my.rtmark.net/	65 B 544 B	86ms 33ms	Fetch application/json	139.45.195.8 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://my.rtmark.net/gid.js?pub=0&userId=27bccce56acd4f888cbfbfe764ca41ec&zoneId=3129050&checkDuplicate=true&ymid=&var= Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash 441f49fcf702bc6f0d92258a3617802eef24a40076d818d8158d1095e04946fb Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 22:55:27 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=1 access-control-allow-methods POST, GET, OPTIONS, PUT, DELETE content-type application/json; charset=utf-8 access-control-allow-origin http://zlk.the-dell.me access-control-expose-headers Authorization access-control-allow-credentials true timing-allow-origin *, * access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token content-length 65
GET H2	200	defaultSkin.min.js Show response iptautup.com/pfe/current/	56 KB 19 KB	16ms 15ms	Fetch application/javascript	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/pfe/current/defaultSkin.min.js Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash 7b23e3a7155161323573e58616ff1bfdaffd0560483db31315d181f6b394ddd5 Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers pragma no-cache date Fri, 26 Aug 2022 22:55:27 GMT content-encoding gzip last-modified Mon, 22 Aug 2022 12:18:11 GMT server nginx etag W/"63037403-df63" content-type application/javascript access-control-allow-origin http://zlk.the-dell.me cache-control no-cache access-control-allow-credentials true
GET DATA	200 OK	truncated / Frame 7D07	255 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24 Request headers accept-language de-DE,de;q=0.9 Referer http://zlk.the-dell.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/svg+xml
POST H2	200	custom Show response iptautup.com/	39 B 325 B	14ms 14ms	Fetch application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Requested by Host: invasionafter.s3.sa-east-1.amazonaws.com URL: https://invasionafter.s3.sa-east-1.amazonaws.com/Independence/trakingus/12355/south/greunsb.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Referer http://zlk.the-dell.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Content-Type application/json Response headers x-trace-id de7705c3343fefb65950d9fcf68efa00 date Fri, 26 Aug 2022 22:55:27 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=1 content-type application/json; charset=utf-8 access-control-allow-origin http://zlk.the-dell.me access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 39
OPTIONS H2	200	custom iptautup.com/ Frame	0 0	15ms 15ms	Preflight text/plain	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://iptautup.com/custom Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin http://zlk.the-dell.me Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin http://zlk.the-dell.me access-control-max-age 86400 content-length 0 content-type text/plain; charset=utf-8 date Fri, 26 Aug 2022 22:55:27 GMT server nginx

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| zfgformats object| sdk boolean| installOnFly boolean| zfgloadedpush boolean| zfgloadedpushopt boolean| zfgloadedpushcode object| onClickExcludes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			my.rtmark.net/	1970-01-20 14:18:10	Name: ID Value: 27bccce56acd4f888cbfbfe764ca41ec

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

invasionafter.s3.sa-east-1.amazonaws.com
iptautup.com
my.rtmark.net
zlk.the-dell.me
139.45.195.8
139.45.197.251
178.170.39.105
3.5.234.171
441f49fcf702bc6f0d92258a3617802eef24a40076d818d8158d1095e04946fb
7b23e3a7155161323573e58616ff1bfdaffd0560483db31315d181f6b394ddd5
ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24
bcaf286ed6b75bfa5e38c062a3d9fef4be65f2479f10a1a2be463d44a5ec8e5b
c67a0aaf866fc55574df90b676a834d1037ee667c52c4d7dc9c9a4ebb4a20669
ce387ca499e5ddaebcc016a88cdf882461de40c3f69fceb548853d346f0a35b4
d625629118237abaad5fefb48e104a7220d26759d022955c9ee584285328de2a
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881