Submitted URL: https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
Effective URL: https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fe...
Submission: On February 25 via manual from PL — Scanned from NL

Summary

This website contacted 11 IPs in 4 countries across 12 domains to perform 29 HTTP transactions. The main IP is 2a06:98c1:3121::c, located in United States and belongs to CLOUDFLARENET, US. The main domain is redirecting3.eu. The Cisco Umbrella rank of the primary domain is 606840.
TLS certificate: Issued by E1 on January 4th 2023. Valid for: 3 months.
This is the only time redirecting3.eu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Apex Domain
Subdomains
Transfer
8 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 30
60 KB
6 redirecting3.eu
redirecting3.eu — Cisco Umbrella Rank: 606840
86 KB
3 jukminung.com
zring.jukminung.com
26 KB
3 onemortrk.pics
www.onemortrk.pics
5 KB
2 smapp.work
5d6fb6c62a.smapp.work
4 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 44
46 KB
1 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 398
2 KB
1 addlnk.com
cdn.addlnk.com — Cisco Umbrella Rank: 739430
1 KB
1 bl-easycdn.com
t.bl-easycdn.com
9 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
346 B
0 lucks4us.com Failed
lucks4us.com Failed
0 adjust.com Failed
view.adjust.com Failed
29 12
Domain Requested by
8 www.google-analytics.com redirecting3.eu
www.google-analytics.com
5d6fb6c62a.smapp.work
www.googletagmanager.com
6 redirecting3.eu redirecting3.eu
5d6fb6c62a.smapp.work
3 zring.jukminung.com t.bl-easycdn.com
redirecting3.eu
zring.jukminung.com
3 www.onemortrk.pics 2 redirects redirecting3.eu
2 5d6fb6c62a.smapp.work zring.jukminung.com
5d6fb6c62a.smapp.work
1 www.googletagmanager.com storage.googleapis.com
1 storage.googleapis.com 5d6fb6c62a.smapp.work
1 cdn.addlnk.com zring.jukminung.com
1 t.bl-easycdn.com www.onemortrk.pics
1 stats.g.doubleclick.net www.google-analytics.com
0 lucks4us.com Failed redirecting3.eu
0 view.adjust.com Failed storage.googleapis.com
29 12

This site contains no links.

Subject Issuer Validity Valid
*.redirecting3.eu
E1
2023-01-04 -
2023-04-04
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh
www.onemortrk.pics
R3
2023-01-14 -
2023-04-14
3 months crt.sh
*.bl-easycdn.com
GTS CA 1P5
2023-02-17 -
2023-05-18
3 months crt.sh
*.jukminung.com
E1
2023-01-20 -
2023-04-20
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-05-15 -
2023-05-15
a year crt.sh
*.smapp.work
Sectigo RSA Domain Validation Secure Server CA
2022-12-19 -
2024-01-19
a year crt.sh
storage.googleapis.com
GTS CA 1C3
2023-02-08 -
2023-05-03
3 months crt.sh

This page contains 3 frames:

Frame: https://lucks4us.com/?utm_source=1f0a2cb367c37dee&s1=166616&s2=1791271&s3=588016&click_id=mlClick-RbL9Fk0t&j1=1&j8=1
Frame ID: 3E185590CEDC4E0413D6AEBE1CFDC8E1
Requests: 24 HTTP requests in this frame

Frame: https://zring.jukminung.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1677355200
Frame ID: AD11F5D995239108D4CBF132F531ADCE
Requests: 3 HTTP requests in this frame

Frame: https://storage.googleapis.com/tmp-static/instal-impressions/impressions.html?data=eyJjb3VudHJ5IjogIk5MIiwgImNsaWNrX2lkIjogIjY2MjEzZTcwLTBlMjgtNDk4MC1iY2ExLTJkYTBmMDMwZWY0YjpkMGVkMTNhOWI4MTM1ZmZlNTMzNjBlNzUyYzQwMTdiOWZlZDUzZTEyIn0=
Frame ID: B983A7B78D174F153B2CB3E899506481
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://redirecting3.eu/p/C2GZ/tJsl/ZRJc Page URL
  2. https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673 Page URL
  3. https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=9d622f9e90f816972... HTTP 302
    https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=3&eyer=0.33845108... HTTP 302
    https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid= Page URL
  4. https://zring.jukminung.com/rc/22e841bd3c?affclick=23022523_01_371812_29e51669bab5c&pubid=a371812s&affe=... Page URL
  5. https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff... Page URL
  6. https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135f... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js

Page Statistics

29
Requests

86 %
HTTPS

80 %
IPv6

12
Domains

12
Subdomains

11
IPs

4
Countries

237 kB
Transfer

565 kB
Size

16
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://redirecting3.eu/p/C2GZ/tJsl/ZRJc Page URL
  2. https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673 Page URL
  3. https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=9d622f9e90f816972b9eeccf9cc9fba8&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu HTTP 302
    https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=3&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu HTTP 302
    https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid= Page URL
  4. https://zring.jukminung.com/rc/22e841bd3c?affclick=23022523_01_371812_29e51669bab5c&pubid=a371812s&affe=rdmfl Page URL
  5. https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s Page URL
  6. https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=9d622f9e90f816972b9eeccf9cc9fba8&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu HTTP 302
  • https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=3&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu HTTP 302
  • https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=

29 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
ZRJc
redirecting3.eu/p/C2GZ/tJsl/
49 KB
36 KB
Document
General
Full URL
https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d4a0f091a01eac965c9a2480735792f464d32657ad704eca019d2a9e0518699

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, private
cf-cache-status
DYNAMIC
cf-ray
79f3e276ebb9bb56-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 25 Feb 2023 22:30:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9up3ZY3yUc9vzuToEyneY3GY6JJgUr0xZ2bK6nfnj%2F4SYIGCccHNHDiHj%2BKPAzt3C99GQp4ahrk8ATbb1qO8v6Sq2h9zbo9%2BFu3BbQ%2Fs5z5BmAgAWbGSPdIS1uS7vYWHj6dOCpnT2F5oclyP9cU%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-robots-tag
noindex, nofollow
envoirment.js
redirecting3.eu/js/
32 KB
12 KB
Script
General
Full URL
https://redirecting3.eu/js/envoirment.js?id=a535a99b3fccb8f0756e
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2360f05aaa5110f0891046d08ab93ee8bfd6249debd8d8c1d173eac2dd5e172

Request headers

device-memory
8
Referer
https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:17 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 10 May 2022 11:24:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1591
etag
W/"627a4b7c-8078"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AdOxiQSx7%2F%2BUcnbynZw%2FPTeG1G1uEjMhIJXNRBK0WNljdmaY1RL3XKt7ARIIXSG0xb3jAv5O%2BV8enc40PfIRQyNlxeDfTbxGox2mS9ilNvC50BBIjM8rwDag2kRTzP%2BchvAU4L1pp6fqDfLHblA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
79f3e2789fc1bb56-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/
35 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c6de59ac3d3af5a933097175b25928d4540b04d1d233f34f5668ddfd1d8e640

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/png
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://redirecting3.eu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 25 Feb 2023 20:43:15 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
6422
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Sat, 25 Feb 2023 22:43:15 GMT
collect
www.google-analytics.com/j/
4 B
209 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1759582254&t=pageview&_s=1&dl=https%3A%2F%2Fredirecting3.eu%2Fp%2FC2GZ%2FtJsl%2FZRJc&ul=en-us&de=UTF-8&dt=redirecting3.eu&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1435604007&gjid=387509589&cid=1575629855.1677364218&tid=UA-110090096-2&_gid=579374348.1677364218&_r=1&_slc=1&z=381538284
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redirecting3.eu/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 25 Feb 2023 22:30:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redirecting3.eu
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
111 B
Ping
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redirecting3.eu/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Sat, 25 Feb 2023 22:30:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://redirecting3.eu
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
finger
redirecting3.eu/
20 B
504 B
XHR
General
Full URL
https://redirecting3.eu/finger
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/js/envoirment.js?id=a535a99b3fccb8f0756e
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

device-memory
8
Referer
https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
application/json

Response headers

date
Sat, 25 Feb 2023 22:30:18 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CbPHAqKZydzFibGxJVSVLJwG5gdRZh%2BtGv0pv4bZQIVzdvtOMzy2CBJqqJ9SYf5ekZ7XleKSP2%2BjI6oBGy7ebnAuDSWvhalQny6w22gW1O%2FcrXYnEHDehMuDPQO2bD1Jy4BvVgDmjSGXcaSkPZQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cache-control
no-cache, private
cf-ray
79f3e279db212bb2-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
collect
stats.g.doubleclick.net/j/
1 B
346 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-110090096-2&cid=1575629855.1677364218&jid=1435604007&gjid=387509589&_gid=579374348.1677364218&_u=IEBAAEAAAAAAACAAI~&z=2111695998
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://redirecting3.eu/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Sat, 25 Feb 2023 22:30:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redirecting3.eu
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.onemortrk.pics/
4 KB
4 KB
Document
General
Full URL
https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/js/envoirment.js?id=a535a99b3fccb8f0756e
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.82.147 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://redirecting3.eu/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-CH
Sec-CH-UA-Platform-Version
Cache-Control
no-transform
Connection
keep-alive
Content-Type
text/html
Date
Sat, 25 Feb 2023 22:30:18 GMT
Transfer-Encoding
chunked
/
t.bl-easycdn.com/directclick/
Redirect Chain
  • https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=9d622f9e90f816972b9eeccf9cc9fba8&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu
  • https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673&eyeg=3&eyer=0.338451081464739&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=redirecting3.eu
  • https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=
25 KB
9 KB
Document
General
Full URL
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=
Requested by
Host: www.onemortrk.pics
URL: https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
954b9c3f5bec48f7e2569ff925ed96b5e2579305d104452b7f6ce89076de5f2a

Request headers

Referer
https://www.onemortrk.pics/?sl=5580325-f91d8&tag=mlClick-I0z4vbJG&website=637673
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
79f3e27d4d133a7e-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sat, 25 Feb 2023 22:30:18 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FjJMS0kqrdx5wc8w62hF%2Bxij2PvEb%2Bq%2F8hvt6nrEKxDqrM7CIM3WGjFchwf0%2Brbl%2Bmfr7Rhs408OhI35b%2BdbFUHL8gA7G3SDEIWpvWJXtD9KgBcpjEEAX%2FB%2FaOlSH6LiowMqyzCTolU0S%2Bf3zG48"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

Cache-Control
no-transform
Connection
keep-alive
Content-Length
0
Date
Sat, 25 Feb 2023 22:30:18 GMT
Location
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=
22e841bd3c
zring.jukminung.com/rc/
3 KB
2 KB
Document
General
Full URL
https://zring.jukminung.com/rc/22e841bd3c?affclick=23022523_01_371812_29e51669bab5c&pubid=a371812s&affe=rdmfl
Requested by
Host: t.bl-easycdn.com
URL: https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:1cae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7faf133961a7fb3fe48921f36a6dc46aa1ba9f906208ab2f32c802e5ee018b4c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
79f3e27eee07bb7d-FRA
content-encoding
br
content-language
en-us
content-type
text/html; charset=utf-8
date
Sat, 25 Feb 2023 22:30:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xH84TBCm5t6UKml4A0L8CKKDKkHNX9dHjerdFXUMMOyNSqtVAgm4WIuuNV2knDaAs8zh1hoMFoq2AE1i%2FSwDmq%2BT8NdceaQn7qQJ3ZIMpSbV0GcMAKovFkMA62idjkvjHqpIFUCDKjqLsc6tTwIpzB1I"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding, Accept-Language, Cookie
redirect.css
cdn.addlnk.com/
1 KB
1 KB
Stylesheet
General
Full URL
https://cdn.addlnk.com/redirect.css
Requested by
Host: zring.jukminung.com
URL: https://zring.jukminung.com/rc/22e841bd3c?affclick=23022523_01_371812_29e51669bab5c&pubid=a371812s&affe=rdmfl
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:9efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:18 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
1CDV1M9BTXYFXXX6
age
187
cf-polished
origSize=1680
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
PMqJM36lmduKnrjw0ab5/EeSo7UVLnFZbYvMRXRbbtLCXXjAbytlHc1uVHWuQ6A1qKwwnT/4gKuxNla4w4fDGg==
cf-bgj
minify
last-modified
Wed, 13 Mar 2019 00:03:12 GMT
server
cloudflare
etag
W/"3ae56d32551602b41f9046c14d1cfde2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xmb7Zq%2FT%2BQKMzR52bgIn9H7%2B8fa3tRHDsYGRz0qexbph7F9nywC3%2BmYdJrVHxl5kHSiVTEdFyj%2BPb035qkAdsXyOulYJsFlk0MCDS2XFyEC5xQlq8bys0FD7%2FLEQ15c6bPIxkfyN3KxNDdIrRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cf-ray
79f3e2804ec53a73-FRA
invisible.js
zring.jukminung.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame AD11
34 KB
15 KB
Script
General
Full URL
https://zring.jukminung.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1677355200
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/p/C2GZ/tJsl/ZRJc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:1cae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc3c94e0acd8fe58d6cb3fb55e143534d68394f670190657e2e03a7fa2b0d3ce

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:18 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GTx1CujW0u4qXSAIQz%2Bm%2FGEI4dMWELwUO4t8JoyVm2CciIFdz84fhDTlMX7VNvnJ4IGCfFajA8GBeSoh6ePdIcBW9tVXVHJMDMuMAQQtwh0kLz%2BtULoX2c0xqrH9wUJsEOlk9nmlVv4cfg13rIthgTXJ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
79f3e280989abb7d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
zring.jukminung.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame AD11
22 KB
9 KB
Other
General
Full URL
https://zring.jukminung.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:1cae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0a61867ea5d06a07adb9abd2ba696fad294d70f6b9d156f25a7dc75cbded190

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:19 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qbqU6JSU8NM7ul%2B9sYubP61xDPJoo3sLgAcEnylazmPyg2%2B%2B78D%2FLcOtoDqBY7slvxwbxn1vRmF39B6YgspUYwk7AbAa%2BtAIXqq18JEu%2BX%2BgHqEMlM4FgzmCKZwfpKtTcp7rhXQz2vpGmeY5UCykI90i"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
79f3e280d8edbb7d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
5d6fb6c62a.smapp.work/trkclk/
4 KB
4 KB
Document
General
Full URL
https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
Requested by
Host: zring.jukminung.com
URL: https://zring.jukminung.com/rc/22e841bd3c?affclick=23022523_01_371812_29e51669bab5c&pubid=a371812s&affe=rdmfl
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.250.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.250.186.35.bc.googleusercontent.com
Software
TornadoServer/5.1.1 /
Resource Hash
418aa3630c3d599c2a87969a20195ee76253e07c93aed3c1948597e9cb0b02da
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
clickid
66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 25 Feb 2023 22:30:19 GMT
etag
W/"8e83581e466c630e1623f2abdaee47b050f2b132"
server
TornadoServer/5.1.1
via
1.1 google
x-frame-options
SAMEORIGIN
x-service-version
2.0.1
79f3e27eee07bb7d
zring.jukminung.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame AD11
0
0

confirm.js
5d6fb6c62a.smapp.work/api/v1/click/
0
102 B
Script
General
Full URL
https://5d6fb6c62a.smapp.work/api/v1/click/confirm.js?data=gAAAAABj-ov7BwxC_TliMuv3UB9zv8esnD7hXnlwnESVPe1RqBe7H2rCR9la7Af4HDG9RZYJhh5a9jRpd0ArVN_XffVr9Z_Ik1FFlZoBLg4R2o0mvgq3YXZL7RuF9Vj9Jfqt1bsi8dQmGa3Iaz9JmCh7fGUUooUuLaj1U81hvceEURUKlClgVsYsEDA98awRrsuKrzUzh0GaDHTYd09AJdBogsOQ-z3_mN1oud3ZaRqDks3ElhU5WZo9IulQnOitEtLOdTPEJfLEtoIE-tRNr6z8CC0Y8gYeUEgP8NjVl67LKLUUbq-C_XOHiJnLd8kS2nyNpiRW4xPagFHNdb_dhJ1yA4ueZWp0651AwNAKidr52TrHz68DfPErqvlIbelezlGjUflj5eSoI8cYFkEfrC_dLZKm4ltyU9uYXypnMv_CKaGO2yloQS2_T3TZRAW2nY1DMBHWb82pvbo7pzr8-9RdburjeGk83Z_iRdeByul6Bv_qL3pcpvMW033QRGEWeevdnA_-CK04H4LvjBOcfNyu864HcOz6OGGNJ5dldsVC0PQhgRgEzQQL2a6rn-uk6RU-s9FHYaCPlnzP-W_AblrTBxIDqlJkFRuHxb4Ab6CkhCnEfMyDw_ZKIv4n-rmwEnu6vOJiNMdZA1Po2rioeJV_qW-H-rD9UOXGwjbQyElT2McudUY-1pBHcwFK0aBXRojSdQ4TgmODQKQuwLtwaZ0SyJ1bMR_MCf_BU4770JKID5cQUo4ppqXTpctfBg9FEpw8qjQUqxTxaa8Z13sSSgiUCtIH5mnIsjf-CAfb3f9Z-lWhdyqhP-xEiU9LSWvUHSACgE9WT327RfIE_h_4ZqnKZMEjuGQVY0ZRfDKV-l6BB_HBPpWJDc-YlqEpgs8ZWyzKKhOorUKGBCKUiLKs8ykb1AO682vU7lswUichAHed03ghv6LUKB85OxOq3gl3uKLunELpfWhbZoa0zYl0Fo6P3eSNLSQAJ-OLnSFZomNJdyrZazv9Y6uS3TgYmk0nKC-eA67ThvdA49Nh38KClYbS5bP1p3G14LFQGc4I31TQaL5mmT9UYXDrazvnPeLK3bi7yAXHJxKdbjXOcPIwDcpMP-5-BW7oqnH8FpLGXeuqhjwGGiuGrRq_KCkta-xe1xVaQ6ZIfyxsUs6GZcSt_UVhKPBo_hbS3cD7aEq77BnVRg0FPqgHYIL8kGIqjNqp3TzCRvEnaO8LgmLyr3raIKsOzirjUb8tscBz_jh4eIzxc1cROWBx_FOP4ezDQQQDK9dmIvGUDDvPcR9B-rBehi68YZqf9eCaZeyKRmpT9vAzGK6A1puuQmZJLZZQU3FDwqtM9zVho9BDIkuJT7gu7GkHVX9i8F-SlZKgpD_YfTN7rhznfOKgehUr61uWNnMgouyV6W2f9MLEKVrxRfZ2oD-Bz7d1rISSta6HotCUwJsVWyAuRQ8ZXig_oT5gatMo3nDDUXr1eXzgn0XTbHtVdJ4DrQ6n7z3SrNtgH4nS02sgzmvEQyLQYFMKeFpsIaH5ZyxEb4MZCneIM-A5_u8ZwgFg6g_bppE0wO5s71jDmhxVsCk22Mghyy1BL4vKC6fAiNX_h7c8KvZApsV2XFVWqNmBD9s2Df6LMTfPGpjozwZf3L0UA8_DsBN8ZiQB71ngVxh4vJSoi0FaFAU-5io-3YBPez7YOZzZdArt8fFRig0t_ps8q4Or-rzL8v-TEDAB8agfNnw9m9M8N7Vt8KWQ85j-QeNeWfroHkSW61XY2d8Zf1dbP1egdblj2feIm_0VeKhQKtO5JIeXGxm4VvApfOGHGE9FAyHOaF7HVjONeaV-E8ckGrP_mkRLRTduuO5aX-P4sHVpkbA-CiF-b_WGjU1fJvxvKNG2dHTtvvn-aRW01wfcTLk0R3QMUOwev5VnfTQZQB9aGIRUjDubcm2aE7_3HnUnQHJnHYAUof3l9swX13xl49ZT9opdSzhB4aYsmDeH0Vo051qxJasdYVL88VJ-xuIw6UBkLab6xMx7F3UTMQPGqqH117VyyL7iESF9mkU7CNbOBo4zUS488CKvvfyqMszZYxAPcpMyxH0HoK35bHPfxPbitdUBAYqiMbxKRcoz8j5V-EqxZ5kGy6YVj8eHyRORuFb2SrQ4SEvfhZCsaEGpKniNbm3pMnb5YFcfpKRzIdv28lepOu4dtFLukckt7s5FvjcAssCzfu5CnmeRfU028lRPx0L8z3p8Cis5Nn7Em3c0Qaob7CNpERXfgLut4IV6Ih_zdB2mSteIPxsEDzXVepmD4Lk4lWdZJ4fUplvxeAGFgkstXzxHO6v2NohSUCou_-iS0MOiYYxTQVCy9ky6LxzntkOOAhlLzLdUJzyYL0FX0iCDugDg3ca73S33yU5FQ5r4RQBRcBt66W1McJoTNIbIAVVjmisO1lTSBkm8Ce7qIS8e9Pwn9OdCxc40Ht7JAi5M_n2x40nvBiU2AJTPSbYmbost9x4paW1QLufE-SQPVw6e4CH666QboJfjCMeQiGOmteZ92-QpFRrIOP6v-42Vq-75cNXtEEJi8jgmu8xoMa9FF2FPA90przNTt4jOdVhjs2D32ZFOmlC2AGySUISzT-6ddmgZJ-o9zIpsC07ncHkivwnvf0Lb4w1rqvhsjdLOhNtpOBNhfBI8uWitpmVbIRwoNAf_M44wViMUGUaR1xppHRDBSlPuk_Kqki_7HjkM_g%3D%3D
Requested by
Host: 5d6fb6c62a.smapp.work
URL: https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.250.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.250.186.35.bc.googleusercontent.com
Software
TornadoServer/5.1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:19 GMT
via
1.1 google
server
TornadoServer/5.1.1
etag
"da39a3ee5e6b4b0d3255bfef95601890afd80709"
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
application/javascript; charset=utf-8
impressions.html
storage.googleapis.com/tmp-static/instal-impressions/ Frame B983
1 KB
2 KB
Document
General
Full URL
https://storage.googleapis.com/tmp-static/instal-impressions/impressions.html?data=eyJjb3VudHJ5IjogIk5MIiwgImNsaWNrX2lkIjogIjY2MjEzZTcwLTBlMjgtNDk4MC1iY2ExLTJkYTBmMDMwZWY0YjpkMGVkMTNhOWI4MTM1ZmZlNTMzNjBlNzUyYzQwMTdiOWZlZDUzZTEyIn0=
Requested by
Host: 5d6fb6c62a.smapp.work
URL: https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2010 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c7f94d1b21fdadbcc934c2d31503832763070136eafd23d65cec53f6e49b5634

Request headers

Referer
https://5d6fb6c62a.smapp.work/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=3600
content-length
1357
content-type
text/html
date
Sat, 25 Feb 2023 22:30:19 GMT
etag
"54f99c9e98a5b4f17b219e94417e6d2f"
expires
Sat, 25 Feb 2023 23:30:19 GMT
last-modified
Mon, 10 Jun 2019 16:09:51 GMT
server
UploadServer
x-goog-generation
1560182991115409
x-goog-hash
crc32c=+7k9hA== md5=VPmcnpiltPF7IZ6UQX5tLw==
x-goog-metageneration
2
x-goog-storage-class
MULTI_REGIONAL
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1357
x-guploader-uploadid
ADPycdt2n68OZ5ExyyudePgT6WIVU_NDm52BIveSSt5qKLnzyCqFDMdC7hmvc2rme2bXKL0ZWimJqo1dzHNP9e5w6f5KHw
gtm.js
www.googletagmanager.com/ Frame B983
117 KB
46 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WKCGS93
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/tmp-static/instal-impressions/impressions.html?data=eyJjb3VudHJ5IjogIk5MIiwgImNsaWNrX2lkIjogIjY2MjEzZTcwLTBlMjgtNDk4MC1iY2ExLTJkYTBmMDMwZWY0YjpkMGVkMTNhOWI4MTM1ZmZlNTMzNjBlNzUyYzQwMTdiOWZlZDUzZTEyIn0=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://storage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46575
x-xss-protection
0
last-modified
Sat, 25 Feb 2023 21:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 25 Feb 2023 22:30:19 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: 5d6fb6c62a.smapp.work
URL: https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://5d6fb6c62a.smapp.work/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 25 Feb 2023 21:14:06 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
4573
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Sat, 25 Feb 2023 23:14:06 GMT
Primary Request vh1h
redirecting3.eu/p/ci0W/wLuk/
34 KB
25 KB
Document
General
Full URL
https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s
Requested by
Host: 5d6fb6c62a.smapp.work
URL: https://5d6fb6c62a.smapp.work/trkclk/?pid=6944&cid=3287930&custom1=pub11167ce0ee9a4db6ae3bd428edc9248e&aff_sub_id=f07fc6c6_a371812s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b6a21c213193d72aa80bd2756fa916f243a4360d826546bf316345c66f1073c

Request headers

Referer
https://5d6fb6c62a.smapp.work/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, private
cf-cache-status
DYNAMIC
cf-ray
79f3e28558692bb2-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 25 Feb 2023 22:30:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I2q8mdloOEp7w7cDcyn9cZFjhO1FG%2BJU8IGsWjYjH4oq4LL0ch%2BDp0VrEiFP6SHlcGtPsPXWHKVMij5SIi3iZvIl38ALK4o3m9ANkg8NHHpZ6aRss8Vd3KRiuwcJm360NTePsiTWocND4Isu5Qc%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-robots-tag
noindex, nofollow
collect
www.google-analytics.com/j/
3 B
23 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=10218538&t=pageview&_s=1&dl=https%3A%2F%2F5d6fb6c62a.smapp.work%2Ftrkclk%2F%3Fpid%3D6944%26cid%3D3287930%26custom1%3Dpub11167ce0ee9a4db6ae3bd428edc9248e%26aff_sub_id%3Df07fc6c6_a371812s&ul=en-us&de=UTF-8&dt=Loading...&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=56974205&gjid=338483247&cid=700954893.1677364220&tid=UA-44620901-4&_gid=1033214827.1677364220&_r=1&_slc=1&z=251203701
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://5d6fb6c62a.smapp.work/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 25 Feb 2023 22:30:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://5d6fb6c62a.smapp.work
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ Frame B983
0
0

txljmn
view.adjust.com/impression/ Frame B983
0
0

envoirment.js
redirecting3.eu/js/
32 KB
12 KB
Script
General
Full URL
https://redirecting3.eu/js/envoirment.js?id=a535a99b3fccb8f0756e
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2360f05aaa5110f0891046d08ab93ee8bfd6249debd8d8c1d173eac2dd5e172

Request headers

device-memory
8
Referer
https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Sat, 25 Feb 2023 22:30:19 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 10 May 2022 11:24:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
140
etag
W/"627a4b7c-8078"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gg0B5wyzEvkJNDrNXxsAhrWC3P9Y%2F%2BnYoBX%2F8sPtK%2FrEc6hxYp9L2ucz4FVq24%2FOcHpe1%2B7F4ZU2F2dLcgxUxKtOUxmF2kZ%2BaVjs5LQxnhsxycfZTjYaCuSFfe4No7AqHz7p6QDCJ1d1V6grpK4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
79f3e2869a662bb2-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/
23 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a4ce6cb3e7f66149f5e2535fa036403f68bf41c5e491a4d54f499714696733d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/png
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://redirecting3.eu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 25 Feb 2023 21:14:06 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
4573
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Sat, 25 Feb 2023 23:14:06 GMT
collect
www.google-analytics.com/j/
3 B
23 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1129128684&t=pageview&_s=1&dl=https%3A%2F%2Fredirecting3.eu%2Fp%2Fci0W%2FwLuk%2Fvh1h%3Fml_sub1%3D66213e70-0e28-4980-bca1-2da0f030ef4b%3Ad0ed13a9b8135ffe53360e752c4017b9fed53e12%26ml_sub2%3D6944_f07fc6c6_a371812s&dr=https%3A%2F%2F5d6fb6c62a.smapp.work%2F&ul=en-us&de=UTF-8&dt=redirecting3.eu&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=AACAAEABAAAAACAAI~&jid=&gjid=&cid=1575629855.1677364218&tid=UA-110090096-2&_gid=579374348.1677364218&_slc=1&z=1753888065
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redirecting3.eu/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 25 Feb 2023 22:30:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redirecting3.eu
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Ping
General
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redirecting3.eu/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Sat, 25 Feb 2023 22:30:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://redirecting3.eu
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
finger
redirecting3.eu/
20 B
474 B
XHR
General
Full URL
https://redirecting3.eu/finger
Requested by
Host: redirecting3.eu
URL: https://redirecting3.eu/js/envoirment.js?id=a535a99b3fccb8f0756e
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

device-memory
8
Referer
https://redirecting3.eu/p/ci0W/wLuk/vh1h?ml_sub1=66213e70-0e28-4980-bca1-2da0f030ef4b:d0ed13a9b8135ffe53360e752c4017b9fed53e12&ml_sub2=6944_f07fc6c6_a371812s
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
application/json

Response headers

date
Sat, 25 Feb 2023 22:30:20 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2BS%2FLm%2BDJa2hmtO5kjRttXJ8xK1g%2FfYnmPCrlytw9P%2BoAzy50qd0iRgSFdmfyZWVJLxNPkBIRQ1%2BKpDf7MKCYwca888LDrbDkagJ9O0wH2sfqZ%2FWl3rTWs%2FK7AHzx4RHRfvRzVnZxrzemKVa%2Bfw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cache-control
no-cache, private
cf-ray
79f3e287ac272bb2-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
lucks4us.com/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
zring.jukminung.com
URL
https://zring.jukminung.com/cdn-cgi/challenge-platform/h/g/cv/result/79f3e27eee07bb7d
Domain
www.google-analytics.com
URL
https://www.google-analytics.com/analytics.js
Domain
view.adjust.com
URL
https://view.adjust.com/impression/txljmn?gtmcb=1982291190
Domain
lucks4us.com
URL
https://lucks4us.com/?utm_source=1f0a2cb367c37dee&s1=166616&s2=1791271&s3=588016&click_id=mlClick-RbL9Fk0t&j1=1&j8=1

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

16 Cookies

Domain/Path Name / Value
redirecting3.eu/ Name: 15c1c3073e5c3cda0308b87e66c0c1e4
Value: 15c1c3073e5c3cda0308b87e66c0c1e4
.redirecting3.eu/ Name: _ga
Value: GA1.2.1575629855.1677364218
.redirecting3.eu/ Name: _gid
Value: GA1.2.579374348.1677364218
.redirecting3.eu/ Name: _gat
Value: 1
.bl-easycdn.com/ Name: checkkeks
Value: 1
.bl-easycdn.com/ Name: eTag
Value: ec45cea8f189a89c3584b5c09d1797b8
.bl-easycdn.com/ Name: ck_uniques
Value: 1677450617%3A24589-115227
.bl-easycdn.com/ Name: ck_uniquesPa
Value: 1677450617%3A89322
.bl-easycdn.com/ Name: ck_sys_uniques_3
Value: 1
.bl-easycdn.com/ Name: u_current_ads_view
Value: 89322----
zring.jukminung.com/ Name: AWSALB
Value: 3ycMs1ByQyoP6TMQ4kiNciLFzrwBEAHly/h45NTmSYIvDw4R6XEryTOtOGc4kzn5ET0EyuQ76Pveu8AYRgDQK0jLHO3nXSfC53jhNNRU8+W6oVvWHteap4oW4K+3
5d6fb6c62a.smapp.work/ Name: cx_ntsl_i
Value: c5c666d3-95fb-49a5-9717-244512cb6fad
5d6fb6c62a.smapp.work/ Name: instal-cookie
Value: "2|1:0|10:1677364219|13:instal-cookie|124:eyIzMjg3OTMwIjogIjY2MjEzZTcwLTBlMjgtNDk4MC1iY2ExLTJkYTBmMDMwZWY0YjpkMGVkMTNhOWI4MTM1ZmZlNTMzNjBlNzUyYzQwMTdiOWZlZDUzZTEyIn0=|ab19cc418cf6412bffb5a78e66caf17b3f5c13ab2d3f87db71cb3cfedf626128"
.smapp.work/ Name: _ga
Value: GA1.2.700954893.1677364220
.smapp.work/ Name: _gid
Value: GA1.2.1033214827.1677364220
.smapp.work/ Name: _gat
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5d6fb6c62a.smapp.work
cdn.addlnk.com
lucks4us.com
redirecting3.eu
stats.g.doubleclick.net
storage.googleapis.com
t.bl-easycdn.com
view.adjust.com
www.google-analytics.com
www.googletagmanager.com
www.onemortrk.pics
zring.jukminung.com
lucks4us.com
view.adjust.com
www.google-analytics.com
zring.jukminung.com
2001:4860:4802:36::178
2606:4700:3032::6815:1cae
2606:4700:3035::ac43:9efb
2a00:1450:400c:c06::9c
2a00:1450:400d:803::2008
2a00:1450:400d:806::2010
2a06:98c1:3120::c
2a06:98c1:3121::c
35.186.250.143
51.68.82.147
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
3c6de59ac3d3af5a933097175b25928d4540b04d1d233f34f5668ddfd1d8e640
418aa3630c3d599c2a87969a20195ee76253e07c93aed3c1948597e9cb0b02da
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a4ce6cb3e7f66149f5e2535fa036403f68bf41c5e491a4d54f499714696733d
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d4a0f091a01eac965c9a2480735792f464d32657ad704eca019d2a9e0518699
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1
7b6a21c213193d72aa80bd2756fa916f243a4360d826546bf316345c66f1073c
7faf133961a7fb3fe48921f36a6dc46aa1ba9f906208ab2f32c802e5ee018b4c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
954b9c3f5bec48f7e2569ff925ed96b5e2579305d104452b7f6ce89076de5f2a
a2360f05aaa5110f0891046d08ab93ee8bfd6249debd8d8c1d173eac2dd5e172
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c7f94d1b21fdadbcc934c2d31503832763070136eafd23d65cec53f6e49b5634
cc3c94e0acd8fe58d6cb3fb55e143534d68394f670190657e2e03a7fa2b0d3ce
e0a61867ea5d06a07adb9abd2ba696fad294d70f6b9d156f25a7dc75cbded190
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855