a4.unsub.click Open in urlscan Pro
52.76.7.111 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://news.streckenvermailing.de/unsubscribe?20247-453666-9050255-9023084-1258173706-8-999
Effective URL:
https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Submission: On July 05 via api (July 5th 2022, 5:06:11 pm UTC) from CH — Scanned from DE

Summary HTTP 34 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 19 IPs in 5 countries across 19 domains to perform 34 HTTP transactions. The main IP is 52.76.7.111, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is a4.unsub.click.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 10th 2022. Valid for: a year.

This is the only time a4.unsub.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	116.203.118.191 116.203.118.191	24940 (HETZNER-AS) (HETZNER-AS)
2	52.76.7.111 52.76.7.111	16509 (AMAZON-02) (AMAZON-02)
3	2a02:6ea0:c70... 2a02:6ea0:c700::10	60068 (CDN77 ^_^) (CDN77 ^_^)
1 2	2606:4700::68... 2606:4700::6810:7eaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (STACKPATH...) (STACKPATH-CDN)
3	139.45.197.239 139.45.197.239	9002 (RETN-AS) (RETN-AS)
1	2606:4700:20:... 2606:4700:20::681a:c76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	85.215.2.54 85.215.2.54	6786 (CRONON-BE...) (CRONON-BERLIN-AS)
1	2606:50c0:800... 2606:50c0:8003::154	54113 (FASTLY) (FASTLY)
1	139.45.197.234 139.45.197.234	9002 (RETN-AS) (RETN-AS)
1	2606:4700:303... 2606:4700:3034::ac43:cdf0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
2	18.140.98.203 18.140.98.203	16509 (AMAZON-02) (AMAZON-02)
1	139.45.197.243 139.45.197.243	9002 (RETN-AS) (RETN-AS)
1	2606:4700:303... 2606:4700:3032::6815:1358	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.195.254 139.45.195.254	9002 (RETN-AS) (RETN-AS)
2	2a02:6ea0:c70... 2a02:6ea0:c700::11	60068 (CDN77 ^_^) (CDN77 ^_^)
1 1	2a05:d014:943... 2a05:d014:943:a602:cf9:ba18:16cf:fdde	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::6816:319	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.197.153 139.45.197.153	9002 (RETN-AS) (RETN-AS)
34	19

1 116.203.118.191 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: lb04.brm24.de

news.streckenvermailing.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.76.7.111 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-76-7-111.ap-southeast-1.compute.amazonaws.com

a4.unsub.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6ea0:c700::10 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

cdn.mradmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7eaf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.197.239 (United Kingdom)

ASN9002 (RETN-AS, GB)

agaenteitor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:c76 (United States)

ASN13335 (CLOUDFLARENET, US)

iclickcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 85.215.2.54 (Germany)

ASN6786 (CRONON-BERLIN-AS, DE)
PTR: www2.adspirit.sbs.stratoserver.net

s7.bratashine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.mradmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8003::154 (United States)

ASN54113 (FASTLY, US)

raw.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.234 (United Kingdom)

ASN9002 (RETN-AS, GB)

bedrapiona.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:cdf0 (United States)

ASN13335 (CLOUDFLARENET, US)

tzegilo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.140.98.203 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-140-98-203.ap-southeast-1.compute.amazonaws.com

litrif.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.243 (United Kingdom)

ASN9002 (RETN-AS, GB)

onmarshtompor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::6815:1358 (United States)

ASN13335 (CLOUDFLARENET, US)

stedrabute.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.254 (United Kingdom)

ASN9002 (RETN-AS, GB)

fleraprt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6ea0:c700::11 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

cdn.bratashine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d014:943:a602:cf9:ba18:16cf:fdde (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

d.adup-tech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:319 (United States)

ASN13335 (CLOUDFLARENET, US)

m.adup-tech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.153 (United Kingdom)

ASN9002 (RETN-AS, GB)

static.cdnativepush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	mradmind.com cdn.mradmind.com c.mradmind.com	69 KB
5	bratashine.com s7.bratashine.com cdn.bratashine.com	14 KB
3	agaenteitor.com agaenteitor.com — Cisco Umbrella Rank: 554493	33 KB
2	adup-tech.com 1 redirects d.adup-tech.com — Cisco Umbrella Rank: 23847 m.adup-tech.com — Cisco Umbrella Rank: 57935	27 KB
2	litrif.com litrif.com	495 B
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 944	8 KB
2	unsub.click a4.unsub.click	6 KB
1	cdnativepush.com static.cdnativepush.com — Cisco Umbrella Rank: 23635	3 KB
1	fleraprt.com fleraprt.com — Cisco Umbrella Rank: 20258	484 B
1	stedrabute.com stedrabute.com
1	onmarshtompor.com onmarshtompor.com — Cisco Umbrella Rank: 63982	2 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11393	543 B
1	tzegilo.com tzegilo.com — Cisco Umbrella Rank: 22998	18 KB
1	bedrapiona.com bedrapiona.com — Cisco Umbrella Rank: 45978	2 KB
1	githubusercontent.com raw.githubusercontent.com — Cisco Umbrella Rank: 4620	589 KB
1	iclickcdn.com iclickcdn.com — Cisco Umbrella Rank: 87210	25 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 630	30 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 429	8 KB
1	streckenvermailing.de 1 redirects news.streckenvermailing.de	251 B
34	19

	Domain	Requested by
6	c.mradmind.com	cdn.mradmind.com a4.unsub.click
3	s7.bratashine.com	a4.unsub.click cdn.bratashine.com
3	agaenteitor.com	a4.unsub.click agaenteitor.com
3	cdn.mradmind.com	a4.unsub.click cdn.mradmind.com
2	cdn.bratashine.com	s7.bratashine.com
2	litrif.com	cdn.jsdelivr.net
2	unpkg.com	1 redirects a4.unsub.click
2	a4.unsub.click	a4.unsub.click
1	static.cdnativepush.com	a4.unsub.click
1	m.adup-tech.com	a4.unsub.click
1	d.adup-tech.com	1 redirects
1	fleraprt.com	tzegilo.com
1	stedrabute.com	iclickcdn.com
1	onmarshtompor.com	iclickcdn.com
1	my.rtmark.net	iclickcdn.com
1	tzegilo.com	agaenteitor.com
1	bedrapiona.com	iclickcdn.com
1	raw.githubusercontent.com	a4.unsub.click
1	iclickcdn.com	a4.unsub.click
1	code.jquery.com	a4.unsub.click
1	cdn.jsdelivr.net	a4.unsub.click
1	news.streckenvermailing.de	1 redirects
34	22

This site contains links to these domains. Also see Links.

Domain
c.mradmind.com

Subject Issuer	Validity	Valid
a4.unsub.click Sectigo RSA Domain Validation Secure Server CA	`2022-02-10` - `2023-02-10`	a year	crt.sh
*.mradmind.com Thawte RSA CA 2018	`2021-08-03` - `2022-08-03`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
agaenteitor.com R3	`2022-06-18` - `2022-09-16`	3 months	crt.sh
s7.bratashine.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-07` - `2021-10-07`	a year	crt.sh
*.github.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-07` - `2023-04-07`	a year	crt.sh
bedrapiona.com R3	`2022-05-28` - `2022-08-26`	3 months	crt.sh
*.rtmark.net Sectigo RSA Domain Validation Secure Server CA	`2021-11-20` - `2022-11-26`	a year	crt.sh
litrif.com Sectigo RSA Domain Validation Secure Server CA	`2021-08-04` - `2022-08-04`	a year	crt.sh
onmarshtompor.com R3	`2022-05-30` - `2022-08-28`	3 months	crt.sh
*.stedrabute.com E1	`2022-06-20` - `2022-09-18`	3 months	crt.sh
fleraprt.com Sectigo RSA Domain Validation Secure Server CA	`2022-01-14` - `2023-01-14`	a year	crt.sh
cdn.bratashine.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-07` - `2021-10-07`	a year	crt.sh
cdnativepush.com R3	`2022-05-30` - `2022-08-28`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Frame ID: 31630F308657EDD34FA882FDF7D5C81A
Requests: 27 HTTP requests in this frame

Frame: https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Frame ID: ED28D56AE5C5E236BE362DA5DE370C3F
Requests: 2 HTTP requests in this frame

Frame: https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3369001657040766&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x3413750
Frame ID: 7837C61E9F33B1FAB36056F0939BBD0B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unsub Click

Page URL History Show full URLs

https://news.streckenvermailing.de/unsubscribe?20247-453666-9050255-9023084-1258173706-8-999 HTTP 302
https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e Page URL

Detected technologies

Axios (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

34
Requests

79 %
HTTPS

52 %
IPv6

19
Domains

22
Subdomains

19
IPs

5
Countries

835 kB
Transfer

1098 kB
Size

8
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://c.mradmind.com/adclick.php?tz=16570407665202328622&pid=5&kid=6&wmid=20&wsid=3&gdpr_consent=&sid=3&ord=1657040766&vlx=9cb&target1=https%3A%2F%2Fwww.shoplightia.com%2Fcollections%2Fall%3Futm_source%3DAudienceServ_Native%26utm_medium%3Dcpc%26utm_campaign%3DTEST_NATIVE_CPC

Search URL Search Domain Scan URL

URL: https://c.mradmind.com/adclick.php?tz=1657040766715185694&pid=7&kid=1&wmid=1&wsid=3&gdpr_consent=&sid=2&ord=1657040766&vlx=9cb&target1=https%3A%2F%2Fd.adup-tech.com%2Fnewsletter%2F%3Fp_id%3D4977%26s_id%3D2842%26key%3D%25token%25%26rank%3D1

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://news.streckenvermailing.de/unsubscribe?20247-453666-9050255-9023084-1258173706-8-999 HTTP 302
https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://unpkg.com/axios/dist/axios.min.js HTTP 302
https://unpkg.com/axios@0.27.2/dist/axios.min.js

Request Chain 27

https://d.adup-tech.com/newsletter/ad.jpg?p_id=4977&s_id=2842&key=%token%&rank=1 HTTP 302
https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg

34 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
a4.unsub.click/
Redirect Chain

https://news.streckenvermailing.de/unsubscribe?20247-453666-9050255-9023084-1258173706-8-999
https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

15 KB
4 KB

698ms
192ms

Document
text/html

52.76.7.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.76.7.111 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-7-111.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) / Express
Resource Hash: 333375bf3c66ea209927ca62a5f461f202f7bd01c005edaec556bc1dc22b95e2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: public, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 05 Jul 2022 17:06:05 GMT
ETag: W/"3d3c-181a4b7c3d6"
Last-Modified: Mon, 27 Jun 2022 10:31:55 GMT
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: Express

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 05 Jul 2022 17:06:05 GMT
Location: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Server: nginx/1.18.0
Transfer-Encoding: chunked

GET
H2 200 adasync.min.js Show response
cdn.mradmind.com/ 33 KB
8 KB 116ms
6ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mradmind.com/adasync.min.js
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: br
x-77-nzt-ray: M3QFKOmmFtI
x-cache: HIT
x-age: 7298
x-77-nzt: Abk73BDrtUL/ghwAAA
x-accel-expires: @1657119868
last-modified: Thu, 01 Apr 2021 12:06:58 GMT
server: CDN77-Turbo
etag: W/"3665562209"
x-77-cache: HIT
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-headers: range
expires: Wed, 24 Nov 2021 14:25:03 GMT

GET
H2

200

axios.min.js Show response
unpkg.com/axios@0.27.2/dist/
Redirect Chain

https://unpkg.com/axios/dist/axios.min.js
https://unpkg.com/axios@0.27.2/dist/axios.min.js

20 KB
7 KB

16ms
16ms

Script
application/javascript

2606:4700::6810:7eaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/axios@0.27.2/dist/axios.min.js

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

Server

2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:05 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3532517
fly-request-id: 01G3YCC481C7S1PP7PQKP7RDQT-fra
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"511b-FCNxITHKHBRxCXquG/QTMqrMtJE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7261b0731bbb6946-FRA

Redirect headers

date: Tue, 05 Jul 2022 17:06:05 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01G77N27YRN9QWA6B7XCHKVC25-fra
server: cloudflare
age: 151
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
location: /axios@0.27.2/dist/axios.min.js
cache-control: public, s-maxage=600, max-age=60
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 7261b072fb8c6946-FRA
access-control-allow-origin: *

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios/dist/ 20 KB
8 KB 91ms
59ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 42314
x-jsd-version: 0.27.2
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-iad-kiad7000064-IAD
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"511b-FCNxITHKHBRxCXquG/QTMqrMtJE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=msIIvsYrUpLdaEFaeFDnPNiSAg4RALO81MjvZN5DNJvCiD2a0A5OnYVaApBV%2FMWmQaC4o%2B68L2jx0al07f00sB4Wd9dN30JRGLdK0%2FdrJT0MhyE41b%2F%2FyzONBfWRiluUa26oHEYK5A8iMw8i%2FXI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 7261b07319c892b9-FRA
access-control-expose-headers: *

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 55ms
22ms Script
application/javascript 2001:4de0:ac18::1:a:2a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:05 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d84"
vary: Accept-Encoding
x-hw: 1657040765.dop135.am5.t,1657040765.cds316.am5.hn,1657040765.cds312.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H/1.1 200
OK main.js Show response
a4.unsub.click/js/ 3 KB
2 KB 192ms
191ms Script
application/javascript 52.76.7.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a4.unsub.click/js/main.js
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.76.7.111 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-76-7-111.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) / Express
Resource Hash: cc76630736ef83bdd794a081b0a820f69383861324bfac61f2926b7f6e466d81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 05 Jul 2022 17:06:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 26 Feb 2021 06:30:23 GMT
Server: nginx/1.10.3 (Ubuntu)
X-Powered-By: Express
ETag: W/"d4f-177dd07f89b"
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, max-age=0
Connection: keep-alive
Accept-Ranges: bytes

GET
H2 200 4697450 Show response
agaenteitor.com/400/ 78 KB
30 KB 70ms
25ms Script
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://agaenteitor.com/400/4697450

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

f35d60c59bfe5ab6d0d07ab01f3e44ed0284200c63907036e2666d006d2cb014

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-trace-id: 91ff163b8a5fb1248781a84bf0de141d
pragma: no-cache
date: Tue, 05 Jul 2022 17:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 tag.min.js Show response
iclickcdn.com/ 70 KB
25 KB 44ms
19ms Script
text/javascript 2606:4700:20::681a:c76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://iclickcdn.com/tag.min.js
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:c76 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f2812d14878506b997cf3f5085a6c0a752455059575762e39853569487808c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:05 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: *
age: 47459
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
x-trace-id: 6f90ef4082fdaddbdfb56bf059d1d543
pragma: no-cache
last-modified: Tue, 28 Jun 2022 12:08:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ClkHwuDshFnehTFNG8ygLXXCUiueEtOXUAU1HJhBTZfTcJUJ10OipCW2C1iFhlMkOdq7M9%2F837fxyjud7n8Vw9FEBd9T2rRiQdZ5oinMf9TDsN%2FXAQnPYxJthhnrpgLTTnjvYR2KrOHifrk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 7261b0732dc99253-FRA
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
expires: Wed, 06 Jul 2022 03:55:06 GMT

GET
H/1.1 200
OK adframe.php Show response
s7.bratashine.com/ Frame ED28 3 KB
3 KB 393ms
68ms Document
text/html 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

73b7e210d33fcede9305ce33b0cab78ee58e9b3de8636b73e81ea72e5fa4f673

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://a4.unsub.click/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-length: 2703
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 17:06:06 GMT
expires: 0
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
pragma: no-cache
server: Apache
x-xss-protection: 0

GET
H2 200 demo-bg.jpg
raw.githubusercontent.com/JulianLaval/canvas-particle-network/master/img/ 588 KB
589 KB 28ms
8ms Image
image/jpeg 2606:50c0:8003::154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/JulianLaval/canvas-particle-network/master/img/demo-bg.jpg

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

56531fd7df750f3e1d52f3aba06c01d9199c7a316188eba97d599611d1991838

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-fastly-request-id: 25c4bc15c2496a7c8a87159d53e8554f095336fa
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding,Origin
content-length: 602293
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4028-HHN
x-github-request-id: F83E:43BE:5292DC:57CF34:62C46DA4
x-timer: S1657040766.938901,VS0,VE1
x-frame-options: deny
date: Tue, 05 Jul 2022 17:06:05 GMT
source-age: 70
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"3c709cb6d2a1042f364744951944bf5739ac73318a5a3d1aa2e9302b7648f72a"
accept-ranges: bytes
expires: Tue, 05 Jul 2022 17:11:05 GMT

GET
H2 200 / Show response
bedrapiona.com/5/4697451/ 3 KB
2 KB 63ms
16ms XHR
application/json 139.45.197.234
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bedrapiona.com/5/4697451/?oo=1&js_build=iclick-v1.401.0
Requested by: Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 563c660fcc16a1b80c89970d868d6f34e9dc08178ea308be9368fe2e83f757e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-trace-id: d3a5f35a0676ebbee61de5c4d031426c
pragma: no-cache, no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: gzip
server: nginx
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://a4.unsub.click
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 stattag.js Show response
tzegilo.com/ 49 KB
18 KB 78ms
35ms Script
application/javascript 2606:4700:3034::ac43:cdf0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tzegilo.com/stattag.js
Requested by: Host: agaenteitor.com
URL: https://agaenteitor.com/400/4697450
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:cdf0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3676e16a1358628756bda4274db53b7a9f299e3dfa82ec22301c83ba142ad774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4826
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 09 Jun 2022 09:20:35 GMT
server: cloudflare
etag: W/"62a1bb63-c24f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LdQpqcX0yOIVwUb7%2B9yJkzSLujLDfZK3IP%2BYn%2FCC8%2BzLyzT%2FgrVZH%2FIrfomysR9DxlpBy60qQo1xzvAYdVqP7kuAAXnODZMAr8Pefv4mB2xvXEUz2i9eVOjI4q9ZeH3dB%2Bh162dCwpx8tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7261b073fab39c01-FRA
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
543 B 51ms
12ms XHR
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?userId=a2f0c73ef7874bacac59428a62b9d70f

Requested by

Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

29763a79915fdde2d636166374052d84787c88bbac000752dc57b0cd54b7b90c

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://a4.unsub.click
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H/1.1 200
OK adscript.php Show response
c.mradmind.com/ 2 KB
3 KB 258ms
52ms Script
text/javascript 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.mradmind.com/adscript.php?async=p99725x0&wpcn=asm66785523x1657040766055&ref=https%3A%2F%2Fa4.unsub.click%2F%3Fbinfo%3D8-20247-9050255-1258173706-d89055e1e&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1657040766056&pid=5&gdpr_consent=[consentstring]

Requested by

Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

20bcc08e903eadff5d31e812e7d3de37f8ffeefbc863ff452f5cc22730316c1d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: text/javascript; charset=utf-8
content-length: 2350
x-xss-protection: 0
expires: 0

GET
H/1.1 200
OK adscript.php Show response
c.mradmind.com/ 316 B
762 B 275ms
58ms Script
text/javascript 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.mradmind.com/adscript.php?async=p93701x1&wpcn=asm66785523x1657040766055&ref=https%3A%2F%2Fa4.unsub.click%2F%3Fbinfo%3D8-20247-9050255-1258173706-d89055e1e&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1657040766056&pid=6&gdpr_consent=[consentstring]

Requested by

Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

abaa6383f6376909bdbc15e25c5716dd1c3a32b253c3efa074e9031c96ab4391

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: text/javascript; charset=utf-8
content-length: 316
x-xss-protection: 0
expires: 0

GET
H/1.1 200
OK adscript.php Show response
c.mradmind.com/ 2 KB
3 KB 273ms
56ms Script
text/javascript 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.mradmind.com/adscript.php?async=p77888x2&wpcn=asm66785523x1657040766055&ref=https%3A%2F%2Fa4.unsub.click%2F%3Fbinfo%3D8-20247-9050255-1258173706-d89055e1e&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1657040766056&pid=7&gdpr_consent=[consentstring]

Requested by

Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

ca1d243042e77471f0b075de6158511ff3227e1831ad699e313c49b5ee8c8d38

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: text/javascript; charset=utf-8
content-length: 2179
x-xss-protection: 0
expires: 0

OPTIONS
H/1.1 204
No Content whereami
litrif.com/cnty/ Frame 0
0 626ms
199ms Preflight 18.140.98.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://litrif.com/cnty/whereami
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.140.98.203 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-140-98-203.ap-southeast-1.compute.amazonaws.com
Software: nginx / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://a4.unsub.click
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Access-Control-Allow-Headers: authorization
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 0
Date: Tue, 05 Jul 2022 17:06:06 GMT
Server: nginx
Vary: Access-Control-Request-Headers
X-Powered-By: Express

GET
H/1.1 200
OK whereami Show response
litrif.com/cnty/ 235 B
495 B 199ms
199ms XHR
application/json 18.140.98.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://litrif.com/cnty/whereami
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.140.98.203 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-140-98-203.ap-southeast-1.compute.amazonaws.com
Software: nginx / Express
Resource Hash: 7323301421801aaec7e3c66685de4404b44852a2aad7ac1871d4420a1696a6eb

Request headers

Accept: application/json, text/plain, */*
Referer: https://a4.unsub.click/
authorization: Basic c21zbHV4LmRlOjEyMzQ1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 05 Jul 2022 17:06:06 GMT
ETag: W/"eb-8wIaktYUjZftfcNmcbKqJxevIAQ"
Server: nginx
X-Powered-By: Express
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 235

GET
H2 200 / Show response
onmarshtompor.com/ 2 KB
2 KB 50ms
16ms Fetch
application/json 139.45.197.243
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://onmarshtompor.com/?rb=vYXrxCQYKexgPx8NkoaduV7vZtzim7hITiC9qmYvplwAfXLjxjR0a3aNu8C6BE8gfuZD3bBi4oEqz924zoipI_3sd3DS77rbL6zSARulKF5bxxT9wvg-7B2k31BRnM5ib4i4-O0tQl7o13LJjFcTALGt7KpTu48yISW9os-ib38CaCWNXRFY-UwP1j3wpSqscainlKhPDL4leRSNxnvSfhK_gwo0mPS6Q9BfNi8hFa12eDtM9C57kttfJ2imKX7RlllqviTbrj3OF3h7U-VHhbA3odEiWWTQ4H5fXA%3D%3D&request_ab2=82002&zoneid=4697451&js_build=iclick-v1.401.0&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fa4.unsub.click%2F%3Fbinfo%3D8-20247-9050255-1258173706-d89055e1e&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.401.0&os=other&os_version=other&bs=6e4c833c-599c-42a3-a288-700f8a77e93e&userId=a2f0c73ef7874bacac59428a62b9d70f&m=link

Requested by

Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.243 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

c07164207722f6fce576ba0b3141e7aca486753bc1bff5d7c5324e0b2fec667f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 86400
x-trace-id: 32434e5e69493c173d78e645c0b7942a
pragma: no-cache
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://a4.unsub.click
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 204 favicon.ico
stedrabute.com/ 0
0 52ms
19ms Fetch 2606:4700:3032::6815:1358
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stedrabute.com/favicon.ico

Requested by

Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6815:1358 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5560
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GiIuuGY1QNxZUfOkRw9JFm199VBcCrqLCF4LvbnYicH%2F%2F6uCrNK28aPQGr4V4J13Df9pbcnk3koKnrLAPRjiFex5z9YxuxVx9XwWT3xPsX7yYVyWNs7krYPmHxg2vc5BzuGNvQGDLAdb2TPrFA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=86400
cf-ray: 7261b0751f6a8ff8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 4697450 Show response
agaenteitor.com/500/ 4 KB
3 KB 129ms
128ms XHR
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://agaenteitor.com/500/4697450?excludes=&oaid=a2f0c73ef7874bacac59428a62b9d70f&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fa4.unsub.click%2F%3Fbinfo%3D8-20247-9050255-1258173706-d89055e1e&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Requested by

Host: agaenteitor.com
URL: https://agaenteitor.com/400/4697450

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ea605a6b0b73425d1047b481d06f321c8b3a6395d32ed8a62a786b15e2f54ae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://a4.unsub.click/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: d7de012ecff7f39dbc3c525389d89c22
pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://a4.unsub.click
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

OPTIONS
H2 200 4697450
agaenteitor.com/500/ Frame 0
0 181ms
13ms Preflight 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://a4.unsub.click
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://a4.unsub.click
access-control-max-age: 600
allow: GET, OPTIONS
content-length: 0
date: Tue, 05 Jul 2022 17:06:06 GMT
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: *
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options: nosniff

POST
H/1.1 200
OK add Show response
fleraprt.com/log/ 12 B
484 B 47ms
15ms Fetch
application/json 139.45.195.254
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
Requested by: Host: tzegilo.com
URL: https://tzegilo.com/stattag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.195.254 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Referer: https://a4.unsub.click/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 05 Jul 2022 17:06:33 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://a4.unsub.click
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 12

GET
H2 200 adasync.min.js Show response
cdn.bratashine.com/ Frame ED28 33 KB
8 KB 96ms
7ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bratashine.com/adasync.min.js
Requested by: Host: s7.bratashine.com
URL: https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s7.bratashine.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: br
x-77-nzt-ray: 4LJI4WvFP9A
x-cache: HIT
x-age: 8635
x-77-nzt: AcO1rgUu9urvuyEAAA
x-accel-expires: @1657118531
last-modified: Thu, 01 Apr 2021 12:06:58 GMT
server: CDN77-Turbo
etag: W/"3665562209"
x-77-cache: HIT
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-headers: range
expires: Tue, 05 Jul 2022 12:28:16 GMT

GET
H2 200 asm_pageview.min.js Show response
cdn.mradmind.com/banner/ 2 KB
1 KB 7ms
6ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mradmind.com/banner/asm_pageview.min.js
Requested by: Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: br
x-77-nzt-ray: ugIv010iZeY
x-cache: HIT
x-age: 4950
x-77-nzt: Abk73BBMV1b/VhMAAA
x-accel-expires: @1657122216
last-modified: Tue, 11 Jun 2019 08:31:43 GMT
server: CDN77-Turbo
etag: W/"3762381252"
x-77-cache: HIT
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-headers: range
expires: Fri, 26 Nov 2021 08:05:43 GMT

GET
H/1.1 200
OK adview.php
c.mradmind.com/ 43 B
467 B 43ms
42ms Image
image/gif 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.mradmind.com/adview.php?tz=165704076662457395tzmacro&&pid=5&kid=6&wmid=20&gdpr_consent=&sid=3&nvc=1&target=-

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 43
x-xss-protection: 0
expires: 0

GET
H2 200 0_PF_Lightia_10__Rabatt.jpg
cdn.mradmind.com/banner/mradmind/6/2022-04-13/ 52 KB
52 KB 9ms
9ms Image
image/jpeg 2a02:6ea0:c700::10
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mradmind.com/banner/mradmind/6/2022-04-13/0_PF_Lightia_10__Rabatt.jpg
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 8feb1ad5167b023bcc30d3fcebd60df76923e654edac3cf3d9f27d4ac7227b13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 05 Jul 2022 17:06:06 GMT
x-77-nzt-ray: nKFmUcVe7eU
x-cache: HIT
x-age: 9721
content-length: 53093
x-77-nzt: Abk73BC4oCT/+SUAAA
x-accel-expires: @1657117445
last-modified: Wed, 13 Apr 2022 15:05:09 GMT
server: CDN77-Turbo
etag: "1331925080"
x-77-cache: HIT
access-control-allow-methods: GET, POST, HEAD
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
access-control-allow-headers: range
expires: Fri, 15 Apr 2022 09:23:05 GMT

GET
H/1.1 200
OK adview.php
c.mradmind.com/ 43 B
467 B 41ms
40ms Image
image/gif 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.mradmind.com/adview.php?tz=165704076648426147tzmacro&&pid=7&kid=1&wmid=1&gdpr_consent=&sid=2&nvc=1&target=-

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 43
x-xss-protection: 0
expires: 0

GET
H2

200

56f86a78.jpg
m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/
Redirect Chain

https://d.adup-tech.com/newsletter/ad.jpg?p_id=4977&s_id=2842&key=%token%&rank=1
https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg

26 KB
27 KB

66ms
21ms

Image
image/jpeg

2606:4700:10::6816:319
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Server: 2606:4700:10::6816:319 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65a2b88a8544c4a924453a990b01b225ff8ff80a58652365d32cd19e50215bd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
via: 1.1 210c8ad3e752d602af05a2de06eb2ff8.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 25884
cf-polished: origSize=31675, status=webp_bigger
cf-ray: 7261b076ddd9bc01-FRA
x-cache: Miss from cloudfront
content-length: 26967
x-amz-expiration: expiry-date="Tue, 16 Aug 2022 00:00:00 GMT", rule-id="cleanup nl"
last-modified: Tue, 17 May 2022 18:54:26 GMT
server: cloudflare
etag: "18591a83ba29d3be986c23892f674eea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: public, max-age=31536000
x-amz-cf-pop: MUC50-P2
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: FlfOH3WVR9QjHj_hLasbHlXvEt40Bi2hXDEuvLFgxSRKW2TGcJjSDA==
cf-bgj: imgq:100,h2pri

Redirect headers

location: https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg
date: Tue, 05 Jul 2022 17:06:06 GMT
server: nginx
content-length: 396
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK adframe.php Show response
s7.bratashine.com/ Frame 7837 620 B
1 KB 91ms
91ms Document
text/html 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3369001657040766&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x3413750

Requested by

Host: cdn.bratashine.com
URL: https://cdn.bratashine.com/adasync.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

5f572c626b596472a76284a90fde2bb00cd412f2012d096c587bb404dd6a135e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-length: 620
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 17:06:06 GMT
expires: 0
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
pragma: no-cache
server: Apache
x-xss-protection: 0

GET
H/1.1 200
OK adpageview.php
c.mradmind.com/ 43 B
467 B 33ms
33ms Image
image/gif 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.mradmind.com/adpageview.php?&wsid=3&sid=3&sid2=0&sid3=0&gdpr_consent=&tz=1657040766491

Requested by

Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 43
x-xss-protection: 0
expires: 0

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 2 KB
3 KB 46ms
12ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: a4.unsub.click
URL: https://a4.unsub.click/?binfo=8-20247-9050255-1258173706-d89055e1e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4.unsub.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Thu, 01 Jul 2021 09:13:54 GMT
server: nginx
etag: "60dd8752-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H2 200 asm_pageview.min.js Show response
cdn.bratashine.com/banner/ Frame 7837 2 KB
1 KB 21ms
20ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bratashine.com/banner/asm_pageview.min.js
Requested by: Host: s7.bratashine.com
URL: https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3369001657040766&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x3413750
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s7.bratashine.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 05 Jul 2022 17:06:06 GMT
content-encoding: br
x-77-nzt-ray: WPtXxfjtf6Y
x-cache: HIT
x-age: 8635
x-77-nzt: AcO1rgW2YCPvuyEAAA
x-accel-expires: @1657118531
last-modified: Tue, 11 Jun 2019 08:31:43 GMT
server: CDN77-Turbo
etag: W/"3762381252"
x-77-cache: HIT
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-headers: range
expires: Tue, 05 Jul 2022 12:28:17 GMT

GET
H/1.1 200
OK adpageview.php
s7.bratashine.com/ Frame 7837 43 B
467 B 37ms
36ms Image
image/gif 85.215.2.54
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s7.bratashine.com/adpageview.php?&wsid=2&sid=2&sid2=0&sid3=0&gdpr_consent=&tz=1657040766689

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.215.2.54 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),

Reverse DNS

www2.adspirit.sbs.stratoserver.net

Software

Apache /

Resource Hash

5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3369001657040766&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x3413750
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 17:06:06 GMT
last-modified: Tue, 05 Jul 2022 17:06:06 GMT
server: Apache
p3p: policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 43
x-xss-protection: 0
expires: 0

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bedrapiona.com/	1970-01-20 13:02:56	Name: OAID Value: a2f0c73ef7874bacac59428a62b9d70f
bedrapiona.com/	1970-01-20 13:02:56	Name: oaidts Value: 1657040766
my.rtmark.net/	1970-01-20 13:02:56	Name: ID Value: a2f0c73ef7874bacac59428a62b9d70f
a4.unsub.click/	1970-01-20 04:17:20	Name: prefetchAd_4697451 Value: true
onmarshtompor.com/	1970-01-20 13:02:56	Name: OAID Value: a2f0c73ef7874bacac59428a62b9d70f
onmarshtompor.com/	1970-01-20 13:02:56	Name: oaidts Value: 1657040766
onmarshtompor.com/	1970-01-20 04:27:25	Name: syncedCookie Value: true
agaenteitor.com/	1970-01-20 13:02:56	Name: OAID Value: a2f0c73ef7874bacac59428a62b9d70f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a4.unsub.click
agaenteitor.com
bedrapiona.com
c.mradmind.com
cdn.bratashine.com
cdn.jsdelivr.net
cdn.mradmind.com
code.jquery.com
d.adup-tech.com
fleraprt.com
iclickcdn.com
litrif.com
m.adup-tech.com
my.rtmark.net
news.streckenvermailing.de
onmarshtompor.com
raw.githubusercontent.com
s7.bratashine.com
static.cdnativepush.com
stedrabute.com
tzegilo.com
unpkg.com
116.203.118.191
139.45.195.254
139.45.195.8
139.45.197.153
139.45.197.234
139.45.197.239
139.45.197.243
18.140.98.203
2001:4de0:ac18::1:a:2a
2606:4700:10::6816:319
2606:4700:20::681a:c76
2606:4700:3032::6815:1358
2606:4700:3034::ac43:cdf0
2606:4700::6810:5714
2606:4700::6810:7eaf
2606:50c0:8003::154
2a02:6ea0:c700::10
2a02:6ea0:c700::11
2a05:d014:943:a602:cf9:ba18:16cf:fdde
52.76.7.111
85.215.2.54
20bcc08e903eadff5d31e812e7d3de37f8ffeefbc863ff452f5cc22730316c1d
29763a79915fdde2d636166374052d84787c88bbac000752dc57b0cd54b7b90c
333375bf3c66ea209927ca62a5f461f202f7bd01c005edaec556bc1dc22b95e2
3676e16a1358628756bda4274db53b7a9f299e3dfa82ec22301c83ba142ad774
563c660fcc16a1b80c89970d868d6f34e9dc08178ea308be9368fe2e83f757e5
56531fd7df750f3e1d52f3aba06c01d9199c7a316188eba97d599611d1991838
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e
5f572c626b596472a76284a90fde2bb00cd412f2012d096c587bb404dd6a135e
65a2b88a8544c4a924453a990b01b225ff8ff80a58652365d32cd19e50215bd6
7323301421801aaec7e3c66685de4404b44852a2aad7ac1871d4420a1696a6eb
73b7e210d33fcede9305ce33b0cab78ee58e9b3de8636b73e81ea72e5fa4f673
87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b
8feb1ad5167b023bcc30d3fcebd60df76923e654edac3cf3d9f27d4ac7227b13
9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46
9f2812d14878506b997cf3f5085a6c0a752455059575762e39853569487808c3
abaa6383f6376909bdbc15e25c5716dd1c3a32b253c3efa074e9031c96ab4391
b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022
c07164207722f6fce576ba0b3141e7aca486753bc1bff5d7c5324e0b2fec667f
ca1d243042e77471f0b075de6158511ff3227e1831ad699e313c49b5ee8c8d38
cc76630736ef83bdd794a081b0a820f69383861324bfac61f2926b7f6e466d81
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
ea605a6b0b73425d1047b481d06f321c8b3a6395d32ed8a62a786b15e2f54ae9
f35d60c59bfe5ab6d0d07ab01f3e44ed0284200c63907036e2666d006d2cb014
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

a4.unsub.click Open in urlscan Pro 52.76.7.111 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

79 %HTTPS

52 %IPv6

19 Domains

22 Subdomains

19 IPs

5 Countries

835 kBTransfer

1098 kBSize

8 Cookies

2 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

a4.unsub.click Open in urlscan Pro
52.76.7.111 Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

79 %
HTTPS

52 %
IPv6

19
Domains

22
Subdomains

19
IPs

5
Countries

835 kB
Transfer

1098 kB
Size

8
Cookies

34 HTTP transactions
0 data transactions