urlscan.io logo urlscan.io
SecurityTrails logo

safe-offers.com Open in urlscan Pro
62.138.10.19  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=http%3a%2f%2f149.202....
Effective URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Submission: On December 16 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 5 countries across 12 domains to perform 20 HTTP transactions. The main IP is 62.138.10.19, located in Germany and belongs to GD-EMEA-DC-SXB1, DE. The main domain is safe-offers.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 6th 2019. Valid for: a year.
This is the only time safe-offers.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 176.114.9.149 56485 (THEHOST-AS)
2 2 209.205.219.178 55081 (24SHELLS)
1 2 95.211.229.247 60781 (LEASEWEB-...)
1 205.185.208.154 20446 (HIGHWINDS3)
1 1 62.138.8.8 8972 (GD-EMEA-D...)
2 62.138.10.19 8972 (GD-EMEA-D...)
1 2a00:1450:400... 15169 (GOOGLE)
5 23.210.249.12 16625 (AKAMAI-AS)
6 2a00:1450:400... 15169 (GOOGLE)
3 3 2a00:1450:400... 15169 (GOOGLE)
3 3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
20 8
1    176.114.9.149 (Ukraine)

ASN56485 (THEHOST-AS, UA)
PTR: dg.alekseev.freedomain.thehost.com.ua
176.114.9.149
2    209.205.219.178 (Piscataway, United States)

ASN55081 (24SHELLS - 24 SHELLS, US)
PTR: static-178-219-205-209.24shells.net
abc2.adtelligent.com
2    95.211.229.247 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
3556651.notifysrv.com
m.optvn.com
1    205.185.208.154 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip154.ssl.hwcdn.net
x9d2e8x9.ssl.hwcdn.net
1    62.138.8.8 (Germany)

ASN8972 (GD-EMEA-DC-SXB1, DE)
PTR: astra5001.startdedicated.net
trk.trusted-connection.com
2    62.138.10.19 (Germany)

ASN8972 (GD-EMEA-DC-SXB1, DE)
PTR: static-ip-62-138-10-19.inaddr.ip-pool.com
safe-offers.com
1    2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
5    23.210.249.12 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-249-12.deploy.static.akamaitechnologies.com
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com
6    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
3    2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
3    2a00:1450:4001:825::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
3    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
Domain Requested by
6 www.google-analytics.com safe-offers.com
5 d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com safe-offers.com
3 www.google.de safe-offers.com
3 www.google.com 3 redirects
3 stats.g.doubleclick.net 3 redirects
2 safe-offers.com ajax.googleapis.com
2 abc2.adtelligent.com 2 redirects
1 ajax.googleapis.com safe-offers.com
1 trk.trusted-connection.com 1 redirects
1 m.optvn.com 176.114.9.149
1 x9d2e8x9.ssl.hwcdn.net 176.114.9.149
1 3556651.notifysrv.com 1 redirects
20 12

This site contains links to these domains. Also see Links.

Domain
tracksrocket.com
Subject Issuer Validity Valid
*.ssl.hwcdn.net
COMODO RSA Domain Validation Secure Server CA		 2019-01-03 -
2020-01-20		 a year crt.sh
optvn.com
Let's Encrypt Authority X3		 2019-11-17 -
2020-02-15		 3 months crt.sh
safe-offers.com
Sectigo RSA Domain Validation Secure Server CA		 2019-03-06 -
2020-03-05		 a year crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh
*.ssl.cf1.rackcdn.com
DigiCert SHA2 Secure Server CA		 2019-03-20 -
2020-06-18		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh
www.google.de
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Frame ID: A6B87D3D0CACFC98704714559EEDB25D
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=h... Page URL
  2. https://abc2.adtelligent.com/tracking/pushclick?adid=02DEBD9755F7BA1E_389090_473927 HTTP 302
    https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvb... Page URL
  3. http://trk.trusted-connection.com/click.php?c=612&key=y32ok126z1q8ot0ysmp7q1om&1=ExoClick-Banner&9=2892156&6=E... HTTP 302
    https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

95 %
HTTPS

42 %
IPv6

12
Domains

12
Subdomains

8
IPs

5
Countries

131 kB
Transfer

228 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=http%3a%2f%2f149.202.65.142%2fmxjv5f%3fsub_id_1%3dmixeu_k2_tb Page URL
  2. https://abc2.adtelligent.com/tracking/pushclick?adid=02DEBD9755F7BA1E_389090_473927 HTTP 302
    https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvbi5jb20lMkZjbGljay5waHAlM0ZjJTNENjEyJTI2a2V5JTNEeTMyb2sxMjZ6MXE4b3QweXNtcDdxMW9tJTI2MSUzREV4b0NsaWNrLUJhbm5lciUyNjklM0QlN0JjYW1wYWlnbl9pZCU3RCUyNjYlM0RFeG8tQ2F0SUQlMjUzQSU3QmNhdGVnb3J5X2lkJTdEJTI2MTAlM0QlN0JzcmNfaG9zdG5hbWUlN0QlMjU3Q1pvbmVJRC0lN0J6b25lX2lkJTdEJTI2NyUzRHZhcmlhdGlvbl9pZC0lN0J2YXJpYXRpb25faWQlN0QlMjU3Q3ByaWNpbmdfbW9kZWwtJTdCcHJpY2luZ19tb2RlbCU3RCUyNTdDY29zdC0lN0Jjb3N0JTdEJTI1N0Nmb3JtYXQtJTdCZm9ybWF0JTdEJTI1N0NzaXRlX2lkLSU3QnNpdGVfaWQlN0QlMjU3Q2NvdW50cnktJTdCY291bnRyeSU3RCUyNjIlM0QyMzU0MjE0MjE1NF8xOTJ4MTkyLmpwZ3x8fDUyMzg2MDR8fDE1NzY1MDY3NDN8YWR0ZWxsaWdlbnQuY29tfDE0NC43Ni4xMDkuMzB8fDI3OTg3NzcyfDM1NTY2NTF8NTA4fHw1MnwyfDE2fDB8MHx8fDF8MXx8YjA5ZGQ0MzhmZTgyM2RlM3wzMzU5NjU4MnxkNDFkOGNkOThmMDBiMjA0ZTk4MDA5OThlY2Y4NDI3ZXwwfDJ8fDB8MHwwfCB8fDF8MHwwfDB8MHwwfDB8MHx8fDJ8Mjh8fDB8MHw3NHwwfDB8T0t8NmNjNmMwNzA4ZDhkMDY1ZjM1NTI1ZmI1NzU0ZTI2NDM%3D Page URL
  3. http://trk.trusted-connection.com/click.php?c=612&key=y32ok126z1q8ot0ysmp7q1om&1=ExoClick-Banner&9=2892156&6=Exo-CatID%3A508&10=adtelligent.com%7CZoneID-3556651&7=variation_id-27987772%7Cpricing_model-1%7Ccost-0.005%7Cformat-%7Csite_id-813591%7Ccountry-DEU&2=23542142154_192x192.jpg HTTP 302
    https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://abc2.adtelligent.com/tracking/icon?adid=02DEBD9755F7BA1E_389090_473927 HTTP 302
  • https://3556651.notifysrv.com/pn-img.php?data=H4sIAAAAAAAAA2VT23LjIAz9lR0/txmM73nufsFOnxkCssOsAx7AabM7++8rgeuk7RscgXR0jvS30DJCcSw4K4fnkj+X7Q82HCt+5FXxVKwBvDALxsu6PnTtoWTDoWIYUW610d8w8vLzFe9Gz9JOq5woWcMRCSaCOLsQrbwQKHWEeTYT2HhQ7pL+SH0FHw1WoRIDL3uW8GU9zSacE9zWTcWHBFNKRPqyaoYyIX+cJaRqmrZtMqSwockRtYb1Gbgs0kyWuuyxRtOmd1fpjYzGIc67oe+6jhPsAlHJT07evWVuPN01XI2iemyr5L2hMKObCaRThdTapk8CrCfkwKu+ZfVTcZXzCunp3pzwWfvU9B1Vq/dgFWn7+uuFtN4a+B6Bd3VG2UFEJx40Kz9HLMQ3538nXGoRb0vSjKqOzl9kLI52nWdq4vHpZrFw3kzGynn3+hzjIt4F/n2TXoOm0z3F4p1eVRR3HzjasHijjJ3ExWmgTOWWJ6RSQXkAKzwEN6/Zk5wuD6DGDyc2aF1X/Qg9rzSk6fSzOMtwxqiuS90rPfQjYyfOahh6xoahBzX2Ne+A/LosmD9gchGijGvIvt1RY9Ejo5GFDGkqngoPI3hk8HWWCxLyNDv1ezPfjeM+CLgImlpd0jIw8gJU6kpEQ99LGgKHOVOjZZosGaXCzaAk9cNsieBWr3Ia61Ams9zdsspN1qDBJOoHGiHEDWDUwER1J3DEPClJxb17v+0qPCcGi/TRwu6jMvH29RsOh1QrBXKCbZBIF+y3+P5AQ2ac+nwQTVzTUn02Rc7zFwtC8kA5G6WxtC4P41HkBeOJGB6qfEjlPogVO3C3bQN2AtuKZ6CjPd1sJC/S0LN//wG3rcaHJQUAAA==&img=H4sIAAAAAAAAAwXBiQ2AIAwAwI0oVAXqNpQWnxhChETd3rt9jNZXgJcENb5ker/M/mSppuqA6+A73R84QhctlOiDdREdFZ5YfCLLmgMuPonMjAsXtaJqzrb95j8rX1oAAAA=&t=1576506743 HTTP 302
  • https://x9d2e8x9.ssl.hwcdn.net/library/192180/f867018219fb3bd6a90bec7256add4b25bfe0dee.jpg
Request Chain 2
  • https://abc2.adtelligent.com/tracking/pushclick?adid=02DEBD9755F7BA1E_389090_473927 HTTP 302
  • https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvbi5jb20lMkZjbGljay5waHAlM0ZjJTNENjEyJTI2a2V5JTNEeTMyb2sxMjZ6MXE4b3QweXNtcDdxMW9tJTI2MSUzREV4b0NsaWNrLUJhbm5lciUyNjklM0QlN0JjYW1wYWlnbl9pZCU3RCUyNjYlM0RFeG8tQ2F0SUQlMjUzQSU3QmNhdGVnb3J5X2lkJTdEJTI2MTAlM0QlN0JzcmNfaG9zdG5hbWUlN0QlMjU3Q1pvbmVJRC0lN0J6b25lX2lkJTdEJTI2NyUzRHZhcmlhdGlvbl9pZC0lN0J2YXJpYXRpb25faWQlN0QlMjU3Q3ByaWNpbmdfbW9kZWwtJTdCcHJpY2luZ19tb2RlbCU3RCUyNTdDY29zdC0lN0Jjb3N0JTdEJTI1N0Nmb3JtYXQtJTdCZm9ybWF0JTdEJTI1N0NzaXRlX2lkLSU3QnNpdGVfaWQlN0QlMjU3Q2NvdW50cnktJTdCY291bnRyeSU3RCUyNjIlM0QyMzU0MjE0MjE1NF8xOTJ4MTkyLmpwZ3x8fDUyMzg2MDR8fDE1NzY1MDY3NDN8YWR0ZWxsaWdlbnQuY29tfDE0NC43Ni4xMDkuMzB8fDI3OTg3NzcyfDM1NTY2NTF8NTA4fHw1MnwyfDE2fDB8MHx8fDF8MXx8YjA5ZGQ0MzhmZTgyM2RlM3wzMzU5NjU4MnxkNDFkOGNkOThmMDBiMjA0ZTk4MDA5OThlY2Y4NDI3ZXwwfDJ8fDB8MHwwfCB8fDF8MHwwfDB8MHwwfDB8MHx8fDJ8Mjh8fDB8MHw3NHwwfDB8T0t8NmNjNmMwNzA4ZDhkMDY1ZjM1NTI1ZmI1NzU0ZTI2NDM%3D
Request Chain 11
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&gjid=1131538616&_gid=204287501.1576506745&_u=IGBAgEAB~&z=748316877 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877&slf_rd=1&random=2419158244
Request Chain 15
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&gjid=1994716196&_gid=204287501.1576506745&_u=KGBAgEAB~&z=924732434 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434&slf_rd=1&random=2004579248
Request Chain 18
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&gjid=420930709&_gid=204287501.1576506745&_u=KGBAgEAB~&z=469105356 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356&slf_rd=1&random=789943380

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
offer
176.114.9.149/ 		800 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=http%3a%2f%2f149.202.65.142%2fmxjv5f%3fsub_id_1%3dmixeu_k2_tb
Protocol
HTTP/1.1
Server
176.114.9.149 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
dg.alekseev.freedomain.thehost.com.ua
Software
fasthttp /
Resource Hash
b3ce1dca565f6ff5e73267e9e45d66d403527326b85a85239f6f3a7d6be9886e

Request headers

Host
176.114.9.149
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
fasthttp
Date
Mon, 16 Dec 2019 14:32:24 GMT
Content-Type
text/html
Content-Length
800
Access-Control-Allow-Methods
OPTIONS,GET,POST
Access-Control-Allow-Headers
*
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
close
f867018219fb3bd6a90bec7256add4b25bfe0dee.jpg
x9d2e8x9.ssl.hwcdn.net/library/192180/
Redirect Chain
  • https://abc2.adtelligent.com/tracking/icon?adid=02DEBD9755F7BA1E_389090_473927
  • https://3556651.notifysrv.com/pn-img.php?data=H4sIAAAAAAAAA2VT23LjIAz9lR0/txmM73nufsFOnxkCssOsAx7AabM7++8rgeuk7RscgXR0jvS30DJCcSw4K4fnkj+X7Q82HCt+5FXxVKwBvDALxsu6PnTtoWTDoWIYUW610d8w8vLzFe9Gz9JOq5w...
  • https://x9d2e8x9.ssl.hwcdn.net/library/192180/f867018219fb3bd6a90bec7256add4b25bfe0dee.jpg
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x9d2e8x9.ssl.hwcdn.net/library/192180/f867018219fb3bd6a90bec7256add4b25bfe0dee.jpg
Requested by
Host: 176.114.9.149
URL: http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=http%3a%2f%2f149.202.65.142%2fmxjv5f%3fsub_id_1%3dmixeu_k2_tb
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.208.154 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip154.ssl.hwcdn.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:24 GMT
Last-Modified
Mon, 25 Feb 2019 15:31:09 GMT
ETag
"1551108669"
X-HW
1576506744.dop001.fr8.t,1576506744.cds002.fr8.shn,1576506744.dop001.fr8.t,1576506744.cds133.fr8.c
Content-Type
image/jpeg
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
16129

Redirect headers

Location
https://x9d2e8x9.ssl.hwcdn.net/library/192180/f867018219fb3bd6a90bec7256add4b25bfe0dee.jpg
Date
Mon, 16 Dec 2019 14:32:24 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cookie set click.php
m.optvn.com/
Redirect Chain
  • https://abc2.adtelligent.com/tracking/pushclick?adid=02DEBD9755F7BA1E_389090_473927
  • https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvbi5jb20lMkZjbGljay5waHAlM0ZjJTNENjEyJTI2a2V5JTNEeTMyb2sxMjZ6MXE4b3QweXNtcDdxMW9tJTI2MSUzREV4b0NsaWNrLU...
409 B
1000 B 		Document
General
Check archive.org
Download Go to
Full URL
https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvbi5jb20lMkZjbGljay5waHAlM0ZjJTNENjEyJTI2a2V5JTNEeTMyb2sxMjZ6MXE4b3QweXNtcDdxMW9tJTI2MSUzREV4b0NsaWNrLUJhbm5lciUyNjklM0QlN0JjYW1wYWlnbl9pZCU3RCUyNjYlM0RFeG8tQ2F0SUQlMjUzQSU3QmNhdGVnb3J5X2lkJTdEJTI2MTAlM0QlN0JzcmNfaG9zdG5hbWUlN0QlMjU3Q1pvbmVJRC0lN0J6b25lX2lkJTdEJTI2NyUzRHZhcmlhdGlvbl9pZC0lN0J2YXJpYXRpb25faWQlN0QlMjU3Q3ByaWNpbmdfbW9kZWwtJTdCcHJpY2luZ19tb2RlbCU3RCUyNTdDY29zdC0lN0Jjb3N0JTdEJTI1N0Nmb3JtYXQtJTdCZm9ybWF0JTdEJTI1N0NzaXRlX2lkLSU3QnNpdGVfaWQlN0QlMjU3Q2NvdW50cnktJTdCY291bnRyeSU3RCUyNjIlM0QyMzU0MjE0MjE1NF8xOTJ4MTkyLmpwZ3x8fDUyMzg2MDR8fDE1NzY1MDY3NDN8YWR0ZWxsaWdlbnQuY29tfDE0NC43Ni4xMDkuMzB8fDI3OTg3NzcyfDM1NTY2NTF8NTA4fHw1MnwyfDE2fDB8MHx8fDF8MXx8YjA5ZGQ0MzhmZTgyM2RlM3wzMzU5NjU4MnxkNDFkOGNkOThmMDBiMjA0ZTk4MDA5OThlY2Y4NDI3ZXwwfDJ8fDB8MHwwfCB8fDF8MHwwfDB8MHwwfDB8MHx8fDJ8Mjh8fDB8MHw3NHwwfDB8T0t8NmNjNmMwNzA4ZDhkMDY1ZjM1NTI1ZmI1NzU0ZTI2NDM%3D
Requested by
Host: 176.114.9.149
URL: http://176.114.9.149/offer?sid=mixeu_k2&keys=find+closest+number+in+unsorted+array&lan=de&redir=http%3a%2f%2f149.202.65.142%2fmxjv5f%3fsub_id_1%3dmixeu_k2_tb
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.211.229.247 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
17672f066841a3e537c0201654721b6874249af770ccf37cb0080418910d0893

Request headers

Host
m.optvn.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Mon, 16 Dec 2019 14:32:24 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
c-2892156-27987772=2892156-27987772; expires=Tue, 17-Dec-2019 14:32:24 GMT; Max-Age=86400; path=/; domain=.optvn.com tag=v3%7C144.76.109.30%7CDEU%7C3556651%7C27987772%7C0%7C%7C508%7C52%7C2%7C16%7C0%7C0%7C0%7C33596582%7C0%7C0%7C0%7C0%7C2%7C2%7C0%7C0%7C1%7C0%7C0%7C1%7Cb09dd438fe823de3%7Cd41d8cd98f00b204e9800998ecf8427e%7C5238604%7C%7C%7C%7C28%7C0%7C0%7C74%7C0%7C0%7Cok; expires=Tue, 17-Dec-2019 14:32:24 GMT; Max-Age=86400; path=/; domain=.optvn.com
Content-Encoding
gzip

Redirect headers

Server
VertaMedia 1.0
Date
Mon, 16 Dec 2019 14:32:24 GMT
Content-Length
0
Location
https://m.optvn.com/click.php?data=IHwyODkyMTU2fHxodHRwJTNBJTJGJTJGdHJrLnRydXN0ZWQtY29ubmVjdGlvbi5jb20lMkZjbGljay5waHAlM0ZjJTNENjEyJTI2a2V5JTNEeTMyb2sxMjZ6MXE4b3QweXNtcDdxMW9tJTI2MSUzREV4b0NsaWNrLUJhbm5lciUyNjklM0QlN0JjYW1wYWlnbl9pZCU3RCUyNjYlM0RFeG8tQ2F0SUQlMjUzQSU3QmNhdGVnb3J5X2lkJTdEJTI2MTAlM0QlN0JzcmNfaG9zdG5hbWUlN0QlMjU3Q1pvbmVJRC0lN0J6b25lX2lkJTdEJTI2NyUzRHZhcmlhdGlvbl9pZC0lN0J2YXJpYXRpb25faWQlN0QlMjU3Q3ByaWNpbmdfbW9kZWwtJTdCcHJpY2luZ19tb2RlbCU3RCUyNTdDY29zdC0lN0Jjb3N0JTdEJTI1N0Nmb3JtYXQtJTdCZm9ybWF0JTdEJTI1N0NzaXRlX2lkLSU3QnNpdGVfaWQlN0QlMjU3Q2NvdW50cnktJTdCY291bnRyeSU3RCUyNjIlM0QyMzU0MjE0MjE1NF8xOTJ4MTkyLmpwZ3x8fDUyMzg2MDR8fDE1NzY1MDY3NDN8YWR0ZWxsaWdlbnQuY29tfDE0NC43Ni4xMDkuMzB8fDI3OTg3NzcyfDM1NTY2NTF8NTA4fHw1MnwyfDE2fDB8MHx8fDF8MXx8YjA5ZGQ0MzhmZTgyM2RlM3wzMzU5NjU4MnxkNDFkOGNkOThmMDBiMjA0ZTk4MDA5OThlY2Y4NDI3ZXwwfDJ8fDB8MHwwfCB8fDF8MHwwfDB8MHwwfDB8MHx8fDJ8Mjh8fDB8MHw3NHwwfDB8T0t8NmNjNmMwNzA4ZDhkMDY1ZjM1NTI1ZmI1NzU0ZTI2NDM%3D
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Keep-Alive
timeout=7200
Primary Request index.php
safe-offers.com/8y4f8rweer/
Redirect Chain
  • http://trk.trusted-connection.com/click.php?c=612&key=y32ok126z1q8ot0ysmp7q1om&1=ExoClick-Banner&9=2892156&6=Exo-CatID%3A508&10=adtelligent.com%7CZoneID-3556651&7=variation_id-27987772%7Cpricing_mo...
  • https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
11 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.138.10.19 , Germany, ASN8972 (GD-EMEA-DC-SXB1, DE),
Reverse DNS
static-ip-62-138-10-19.inaddr.ip-pool.com
Software
nginx/1.6.3 / PHP/5.6.40
Resource Hash
7d88ccc3d6e06968edd9fc03512c1dea70ec329aef5333f34069eeec3172e23e

Request headers

Host
safe-offers.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx/1.6.3
Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.6.40
Content-Encoding
gzip

Redirect headers

Server
nginx/1.6.3
Date
Mon, 16 Dec 2019 14:32:24 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.6.40
Location
https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.2/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.2/jquery.min.js
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 21 Nov 2019 07:05:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2186812
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
34009
x-xss-protection
0
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Nov 2020 07:05:33 GMT
style2.css
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/style2.css
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.12 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-12.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
efb80014f3e07ee2c048b0c43c8a5f69a05f636abcd49c16f4a47c066451cf5c

Request headers

Referer
https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Oct 2015 11:17:34 GMT
ETag
ec73edf9674bfa36a32a84986e227b57
Vary
Accept-Encoding
Content-Type
text/css
X-Timestamp
1446117453.55516
Cache-Control
public, max-age=90895
Content-Length
1207
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx6adacc85ee4d473d86f5a-005b3cc04bdfw1
Expires
Tue, 17 Dec 2019 15:47:20 GMT
showHide.js
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/showHide.js
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.12 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-12.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6cec7f256ce341c4f5b50b85eb66edd7cc07c021ff914f86b2aa5e19734503e9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Oct 2015 11:17:29 GMT
ETag
953da630bbc1eb86d1c1417db7bef507
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Timestamp
1446117448.79291
Cache-Control
public, max-age=36996
Content-Length
615
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx3d9152f17808434fa8daa-005b3cc04bdfw1
Expires
Tue, 17 Dec 2019 00:49:01 GMT
13.jpg
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/13.jpg
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.12 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-12.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fc13ec867286df87bb19a9602a09a15a1e4c345fb6657e615a78e27108c147bf

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Last-Modified
Thu, 29 Oct 2015 11:17:27 GMT
ETag
03487375bb06f25e4c43933a2c80acd3
Content-Type
image/jpeg
X-Timestamp
1446117446.15458
Cache-Control
public, max-age=131748
Content-Length
49038
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx416d474568c84103b151d-005b3cc04bdfw1
Expires
Wed, 18 Dec 2019 03:08:13 GMT
backfix.min.js
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/backfix.min.js
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.12 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-12.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bd5e4386811053daf69bc87735cc03ca201f6bc65e2d11bda8634d79cb2abc2e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Jun 2016 19:15:31 GMT
ETag
af35e27c48d7797c731b3653ade42ba0
Vary
Accept-Encoding
Content-Type
application/javascript
X-Timestamp
1466968530.57036
Cache-Control
public, max-age=61641
Content-Length
637
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx8c29327d724045e88813f-005b3cbd31dfw1
Expires
Tue, 17 Dec 2019 07:39:46 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
7128
date
Mon, 16 Dec 2019 12:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Mon, 16 Dec 2019 14:33:37 GMT
style2.css
d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/style2.css
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.12 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-12.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://d25ffea4cdf701d5913d-582d0fd3db061369e23ba2a955641933.ssl.cf1.rackcdn.com/r-lp/DE/56-5/include/style2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Oct 2015 11:17:34 GMT
ETag
ec73edf9674bfa36a32a84986e227b57
Vary
Accept-Encoding
Content-Type
text/css
X-Timestamp
1446117453.55516
Cache-Control
public, max-age=90895
Content-Length
1207
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx6adacc85ee4d473d86f5a-005b3cc04bdfw1
Expires
Tue, 17 Dec 2019 15:47:20 GMT
collect
www.google-analytics.com/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=369223242&t=pageview&_s=1&dl=https%3A%2F%2Fsafe-offers.com%2F8y4f8rweer%2Findex.php%3Fhgty1%3D11102642861&ul=en-us&de=UTF-8&dt=Finden%20Sie%20kostenlose%20Sex!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&cs=ExoClick&cm=Paid&ck=23542142154_192x192.jpg&_u=IGBAgEAB~&jid=154550587&gjid=1131538616&cid=1053529736.1576506745&tid=UA-22211580-45&_gid=204287501.1576506745&cd1=11102642861&cd2=144.76.109.30&cd3=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&z=1741082875
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 23:35:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2127409
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&gjid=1131538616&_gid=204287501.1576506745&_u=IGBAgEAB~&z=748316877
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877&slf_rd=1&random=2419158244
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877&slf_rd=1&random=2419158244
Requested by
Host: safe-offers.com
URL: https://safe-offers.com/8y4f8rweer/index.php?hgty1=11102642861
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=154550587&_v=j79&z=748316877&slf_rd=1&random=2419158244
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
api.php
safe-offers.com/r-lp/EN/autoptimize/ 		0
250 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://safe-offers.com/r-lp/EN/autoptimize/api.php?function=update_script_user_end_time&subid=11102642861&time=1576506745544
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.2/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.138.10.19 , Germany, ASN8972 (GD-EMEA-DC-SXB1, DE),
Reverse DNS
static-ip-62-138-10-19.inaddr.ip-pool.com
Software
nginx/1.6.3 / PHP/5.6.40
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
text/html, */*; q=0.01
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-Requested-With
XMLHttpRequest

Response headers

Date
Mon, 16 Dec 2019 14:32:25 GMT
Content-Encoding
gzip
Server
nginx/1.6.3
Connection
keep-alive
X-Powered-By
PHP/5.6.40
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
collect
www.google-analytics.com/ 		35 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=369223242&t=event&_s=2&dl=https%3A%2F%2Fsafe-offers.com%2F8y4f8rweer%2Findex.php%3Fhgty1%3D11102642861&ul=en-us&de=UTF-8&dt=Finden%20Sie%20kostenlose%20Sex!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=JavaScript&ea=Timeout&el=300%20milliseconds&_u=KGBAgEAB~&jid=&gjid=&cid=1053529736.1576506745&tid=UA-22211580-45&_gid=204287501.1576506745&z=1940052711
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 23:35:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2127409
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=369223242&t=event&_s=3&dl=https%3A%2F%2Fsafe-offers.com%2F8y4f8rweer%2Findex.php%3Fhgty1%3D11102642861&ul=en-us&de=UTF-8&dt=Finden%20Sie%20kostenlose%20Sex!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=JavaScript&ea=Timeout&el=1000%20milliseconds&_u=KGBAgEAB~&jid=1223474253&gjid=1994716196&cid=1053529736.1576506745&tid=UA-22211580-45&_gid=204287501.1576506745&z=1000637655
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 23:35:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2127410
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&gjid=1994716196&_gid=204287501.1576506745&_u=KGBAgEAB~&z=924732434
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434&slf_rd=1&random=2004579248
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434&slf_rd=1&random=2004579248
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:26 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1223474253&_v=j79&z=924732434&slf_rd=1&random=2004579248
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=369223242&t=event&_s=4&dl=https%3A%2F%2Fsafe-offers.com%2F8y4f8rweer%2Findex.php%3Fhgty1%3D11102642861&ul=en-us&de=UTF-8&dt=Finden%20Sie%20kostenlose%20Sex!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=JavaScript&ea=Timeout&el=3000%20milliseconds&_u=KGBAgEAB~&jid=&gjid=&cid=1053529736.1576506745&tid=UA-22211580-45&_gid=204287501.1576506745&z=659865901
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 23:35:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2127412
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=369223242&t=event&_s=5&dl=https%3A%2F%2Fsafe-offers.com%2F8y4f8rweer%2Findex.php%3Fhgty1%3D11102642861&ul=en-us&de=UTF-8&dt=Finden%20Sie%20kostenlose%20Sex!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=JavaScript&ea=Timeout&el=10000%20milliseconds&_u=KGBAgEAB~&jid=1690519882&gjid=420930709&cid=1053529736.1576506745&tid=UA-22211580-45&_gid=204287501.1576506745&z=138825174
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 23:35:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2127419
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&gjid=420930709&_gid=204287501.1576506745&_u=KGBAgEAB~&z=469105356
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356&slf_rd=1&random=789943380
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356&slf_rd=1&random=789943380
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:35 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Dec 2019 14:32:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22211580-45&cid=1053529736.1576506745&jid=1690519882&_v=j79&z=469105356&slf_rd=1&random=789943380
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| setLPClicked function| getParameterByName number| st3 number| st10 number| st30 number| st100 number| st200 number| st300 string| GoogleAnalyticsObject function| ga object| bajb_backdetect object| jQuery112203299078818865657 object| google_tag_data object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.safe-offers.com/ Name: _gat
Value: 1
.safe-offers.com/ Name: _gid
Value: GA1.2.204287501.1576506745
.safe-offers.com/ Name: _ga
Value: GA1.2.1053529736.1576506745