d0zi.com Open in urlscan Pro
162.55.4.52 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://shop60.co.uk/rd568.php?32=1o07634d34a08b9e3_0vk3.ief9jks.A01j1r014301xq41l0_1m1136.0097tMGIwOGMwbW9xYnUx0p49bd
Effective URL:
https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-37eddb7e-d856e882&c=...
Submission: On October 17 via api (October 17th 2022, 3:45:25 pm UTC) from BE — Scanned from DE

Summary HTTP 34 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 6 countries across 13 domains to perform 34 HTTP transactions. The main IP is 162.55.4.52, located in Germany and belongs to HETZNER-AS, DE. The main domain is d0zi.com.
TLS certificate: Issued by R3 on October 4th 2022. Valid for: 3 months.

This is the only time d0zi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	208.77.151.100 208.77.151.100	40395 (VIRTBIZ-D...) (VIRTBIZ-DALLAS)
1	185.34.52.132 185.34.52.132	61053 (VPSNET-AS) (VPSNET-AS)
5	2606:4700:303... 2606:4700:3031::ac43:92ee	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700:303... 2606:4700:3030::ac43:bfdd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	65.60.58.179 65.60.58.179	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
6 9	51.68.82.147 51.68.82.147	16276 (OVH) (OVH)
3 3	34.141.137.168 34.141.137.168	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	139.59.49.76 139.59.49.76	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 1	34.91.234.242 34.91.234.242	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	162.55.4.52 162.55.4.52	24940 (HETZNER-AS) (HETZNER-AS)
34	8

1 208.77.151.100 (United States) 1 redirects

ASN40395 (VIRTBIZ-DALLAS, US)
PTR: shop60.co.uk

shop60.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.34.52.132 (Vilnius, Lithuania)

ASN61053 (VPSNET-AS, LT)

cigaretteborder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3031::ac43:92ee (United States)

ASN13335 (CLOUDFLARENET, US)

lynku.jukminung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zring.jukminung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3030::ac43:bfdd (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.addlnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 65.60.58.179 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

otto.sherlowcke.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ad.marootrack.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 51.68.82.147 (France) 6 redirects

ASN16276 (OVH, FR)

www.wewillserv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.141.137.168 (Groningen, Netherlands) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 168.137.141.34.bc.googleusercontent.com

admoustache.go2affise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

myofferplus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t.bl-easycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
surf.ueive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.59.49.76 (Bengaluru, India) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

139.59.49.76	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.91.234.242 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 242.234.91.34.bc.googleusercontent.com

aditmedia.g2afse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.55.4.52 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.52.4.55.162.clients.your-server.de

d0zi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	wewillserv.com 6 redirects www.wewillserv.com	18 KB
9	sherlowcke.com otto.sherlowcke.com	21 KB
5	addlnk.com cdn.addlnk.com — Cisco Umbrella Rank: 400192	5 KB
5	jukminung.com lynku.jukminung.com zring.jukminung.com	27 KB
4	ueive.com surf.ueive.com	24 KB
3	marootrack.co ad.marootrack.co	7 KB
3	go2affise.com 3 redirects admoustache.go2affise.com — Cisco Umbrella Rank: 591801	698 B
2	myofferplus.com myofferplus.com — Cisco Umbrella Rank: 745624	3 KB
1	d0zi.com d0zi.com	728 KB
1	g2afse.com 1 redirects aditmedia.g2afse.com — Cisco Umbrella Rank: 236198	342 B
1	bl-easycdn.com t.bl-easycdn.com	9 KB
1	cigaretteborder.com cigaretteborder.com	450 B
1	shop60.co.uk 1 redirects shop60.co.uk	430 B
34	13

	Domain	Requested by
9	www.wewillserv.com	6 redirects otto.sherlowcke.com
9	otto.sherlowcke.com	lynku.jukminung.com otto.sherlowcke.com myofferplus.com
5	cdn.addlnk.com	lynku.jukminung.com myofferplus.com zring.jukminung.com surf.ueive.com
4	surf.ueive.com	zring.jukminung.com cigaretteborder.com surf.ueive.com
4	lynku.jukminung.com	cigaretteborder.com lynku.jukminung.com
3	ad.marootrack.co	surf.ueive.com ad.marootrack.co
3	admoustache.go2affise.com	3 redirects
2	myofferplus.com	www.wewillserv.com
1	d0zi.com	ad.marootrack.co
1	aditmedia.g2afse.com	1 redirects
1	zring.jukminung.com	t.bl-easycdn.com
1	t.bl-easycdn.com	www.wewillserv.com
1	cigaretteborder.com
1	shop60.co.uk	1 redirects
34	14

This site contains no links.

Subject Issuer	Validity	Valid
cigaretteborder.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-02` - `2022-12-21`	a year	crt.sh
*.jukminung.com E1	`2022-09-19` - `2022-12-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-15` - `2023-05-15`	a year	crt.sh
otto.sherlowcke.com R3	`2022-09-13` - `2022-12-12`	3 months	crt.sh
www.wewillserv.com R3	`2022-10-09` - `2023-01-07`	3 months	crt.sh
ad.marootrack.co R3	`2022-10-16` - `2023-01-14`	3 months	crt.sh
d0zi.com R3	`2022-10-04` - `2023-01-02`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Frame ID: 4FBF883374670A045373DA073F21BD6D
Requests: 29 HTTP requests in this frame

Frame: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Frame ID: 43179999FA2EB65007E8C2551608500B
Requests: 3 HTTP requests in this frame

Frame: https://surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Frame ID: 320C8AC8801C6730F523B4D11F838E6A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://shop60.co.uk/rd568.php?32=1o07634d34a08b9e3_0vk3.ief9jks.A01j1r014301xq41l0_1m1136.0097tM... HTTP 302
https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0... Page URL
https://lynku.jukminung.com/rc/9e8aef8068?affclick=1294761078&pubid=690066 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream... Page URL
https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949... Page URL
https://otto.sherlowcke.com/proc.php?2a60cb69f220b47eff572ae9b3de4e1902fee6d8 Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website... Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website... HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website... HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004450150169ef565647b6ec71e1e... HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream... Page URL
https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949... Page URL
https://otto.sherlowcke.com/proc.php?1193bceacabc03feeee8849ca63a711f4d8a661f Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3... HTTP 302
https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3... HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream... Page URL
https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1&utm_content=fdc2c69a9cafac9... Page URL
https://otto.sherlowcke.com/proc.php?163400bf92e7d03d5777e0991f141f3e46005eb9 Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website... HTTP 302
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b99... Page URL
https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=... Page URL
http://139.59.49.76/34363?click=pubb53715467e7d480ab9914d0f4ba6cc90&pubid=9f6cbb32 HTTP 302
https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363 Page URL
https://aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1=pubc3fd207cae5d440eab5566beee18e2eb&sub2=1... HTTP 302
https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLin... Page URL
https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949... Page URL
https://ad.marootrack.co/proc.php?369ecb00be035b76c7d3557fd93dd4f1483c013f Page URL
https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

34
Requests

100 %
HTTPS

27 %
IPv6

13
Domains

14
Subdomains

8
IPs

6
Countries

840 kB
Transfer

1515 kB
Size

18
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://shop60.co.uk/rd568.php?32=1o07634d34a08b9e3_0vk3.ief9jks.A01j1r014301xq41l0_1m1136.0097tMGIwOGMwbW9xYnUx0p49bd HTTP 302
https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb Page URL
https://lynku.jukminung.com/rc/9e8aef8068?affclick=1294761078&pubid=690066 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=caf2c4c2&cid=pub7a622028f44a4df996a63246b14bbedf&2=690066 Page URL
https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://otto.sherlowcke.com/proc.php?2a60cb69f220b47eff572ae9b3de4e1902fee6d8 Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e&eyeg=d2b1070815ca323381846114a2d75151&eyer=0.9013514716058457&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e&eyeg=3&eyer=0.9013514716058457&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004450150169ef565647b6ec71e1ee9a721017-202210-flb*5467509-4538f*M7155507925669118091*sl_5467509-4538f*5c7e5d062844ba55c0bccd3c7c453f42e40aea53*13260-d1f8b31e-69450eb0*13260 HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503 Page URL
https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://otto.sherlowcke.com/proc.php?1193bceacabc03feeee8849ca63a711f4d8a661f Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=9126d6437a150a601e29368fbea89b5d&eyer=0.9385889705382342&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=3&eyer=0.9385889705382342&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4abc37c4860bb5b48f0e8e0b22d2*13260-41ee3c25-b33b22ff*13260 HTTP 302
https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4abc37c4860bb5b48f0e8e0b22d2*13260-41ee3c25-b33b22ff*13260&sub2=&sub3=&sub4=5093&sub5=503 HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503 Page URL
https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503 Page URL
https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://otto.sherlowcke.com/proc.php?163400bf92e7d03d5777e0991f141f3e46005eb9 Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=209858feb4cd62ccdce27cb8ca4917b7&eyer=0.5950712455329819&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=3&eyer=0.5950712455329819&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb Page URL
https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=rdmfl Page URL
http://139.59.49.76/34363?click=pubb53715467e7d480ab9914d0f4ba6cc90&pubid=9f6cbb32 HTTP 302
https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363 Page URL
https://aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1=pubc3fd207cae5d440eab5566beee18e2eb&sub2=11213b3c_34363 HTTP 302
https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96 Page URL
https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL
https://ad.marootrack.co/proc.php?369ecb00be035b76c7d3557fd93dd4f1483c013f Page URL
https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://shop60.co.uk/rd568.php?32=1o07634d34a08b9e3_0vk3.ief9jks.A01j1r014301xq41l0_1m1136.0097tMGIwOGMwbW9xYnUx0p49bd HTTP 302
https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb

Request Chain 10

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e&eyeg=d2b1070815ca323381846114a2d75151&eyer=0.9013514716058457&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e&eyeg=3&eyer=0.9013514716058457&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004450150169ef565647b6ec71e1ee9a721017-202210-flb*5467509-4538f*M7155507925669118091*sl_5467509-4538f*5c7e5d062844ba55c0bccd3c7c453f42e40aea53*13260-d1f8b31e-69450eb0*13260 HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503

Request Chain 16

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=9126d6437a150a601e29368fbea89b5d&eyer=0.9385889705382342&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=3&eyer=0.9385889705382342&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4abc37c4860bb5b48f0e8e0b22d2*13260-41ee3c25-b33b22ff*13260 HTTP 302
https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4abc37c4860bb5b48f0e8e0b22d2*13260-41ee3c25-b33b22ff*13260&sub2=&sub3=&sub4=5093&sub5=503 HTTP 302
https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503

Request Chain 22

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=209858feb4cd62ccdce27cb8ca4917b7&eyer=0.5950712455329819&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d&eyeg=3&eyer=0.5950712455329819&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=otto.sherlowcke.com HTTP 302
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb

Request Chain 25

http://139.59.49.76/34363?click=pubb53715467e7d480ab9914d0f4ba6cc90&pubid=9f6cbb32 HTTP 302
https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363

Request Chain 28

https://aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1=pubc3fd207cae5d440eab5566beee18e2eb&sub2=11213b3c_34363 HTTP 302
https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96

34 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb
cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/
Redirect Chain

http://shop60.co.uk/rd568.php?32=1o07634d34a08b9e3_0vk3.ief9jks.A01j1r014301xq41l0_1m1136.0097tMGIwOGMwbW9xYnUx0p49bd
https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb

137 B
450 B

1374ms
356ms

Document
text/html

185.34.52.132
VPSNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.34.52.132 Vilnius, Lithuania, ASN61053 (VPSNET-AS, LT),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 137
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Oct 2022 15:45:15 GMT
Server: Apache

Redirect headers

Connection: Keep-Alive
Content-Length: 211
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Oct 2022 15:45:14 GMT
Keep-Alive: timeout=5, max=100
Location: https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m|0b08c|0097t|o07634d34a08b9e3_0vk3|0moqbu1|90364|01j1r01430|A|1oc17vb
Server
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H2 200 9e8aef8068 Show response
lynku.jukminung.com/rc/ 3 KB
2 KB 183ms
114ms Document
text/html 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1294761078&pubid=690066
Requested by: Host: cigaretteborder.com
URL: https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a29df1c70cdb5614ce21a51d8b1c971795b293093e720cfb26e35571bd7f7c49

Request headers

Referer: https://cigaretteborder.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75ba290bcea4916a-FRA
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c54wOMUnEZObIq%2BmlpzkAT88HaRyiej2V3KnfeowI5L1SvwYXO9eDezv087KkEy3PR9NHzreMnzaqY6j%2BRVBaZ9Lmq1OJcuwJ2072mpVliUQgKoBczEBWnv7nF%2BvXNhM7rU1xlSi1S3O0zWUtRajxydo"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

GET
H2 200 redirect.css
cdn.addlnk.com/ 1 KB
1 KB 121ms
44ms Stylesheet
text/css 2606:4700:3030::ac43:bfdd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1294761078&pubid=690066
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: NG3WEQ5NJ4PQVZ4F
age: 5563
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: QxX22n6jD9gBrjBZ6ohlWbPu+une0ezSYrlZ/gpY7cQk926tnR/U/t0VdL75pShx4aODRqNqN5k=
cf-bgj: minify
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dsWtIZXv7FMb%2BYw5Bemym4Ap21sHvN9nuiUpqSsSI15YdP7JEeuiDNWB6XRq3Ea9DxihsXkgj%2BIm5rhu4EUONW4L0bRbkHQ9JI1SJoQCx8v%2F5ARcqx%2F3q6UO%2BKa1KGsATVJPpkYCXji7ZmO19w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 75ba290cfc0a9280-FRA

GET
H2 200 invisible.js Show response
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 4317 48 KB
17 KB 32ms
31ms Script
application/javascript 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Requested by: Host: cigaretteborder.com
URL: https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df6ee8e0378d34143210a6ee0aad3f11b85e4e4ea451df1247347b228b63c26d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KQ1oBLgEBlu1j31nIA4rX47O5Bx34EKrU%2B7gdMpqdnYDXfTUyFiECV%2FRUH42GdZTuZ1o4c4XRY2oDpgKy1RkT%2BE5O7QuxDCAEsPWhIMd8EMgpG1nOInKiUrPIPlLmIhUf0H9DLInxINprDNTapAyfdgB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75ba290d5ad2916a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pica.js
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 4317 18 KB
7 KB 29ms
29ms Other
application/javascript 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3bb67716e374ff4487fcf1c283fd51e03637d812cc622a39f3dc99996507236f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=raBWdfLJ4HnsGaWdHWg8%2BE1ZMOrLQoHDXEfow7Zbk%2BVKHAorYawOoQEU2y9go01JabtQ991w4Qge5F47FLKovK8XtZ%2FzeR4ylWq0bJFRfnHyE3VKXsr%2BECxoJ0oxV6tcMvwDjjFR4dR9FrU96bYUFpMs"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75ba290dab9b916a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 /
otto.sherlowcke.com/ 3 KB
2 KB 605ms
129ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=caf2c4c2&cid=pub7a622028f44a4df996a63246b14bbedf&2=690066

Requested by

Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/rc/9e8aef8068?affclick=1294761078&pubid=690066

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:16 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

POST
H3 200 75ba290bcea4916a
lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 4317 2 B
696 B 67ms
66ms XHR
text/plain 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/cv/result/75ba290bcea4916a
Requested by: Host: lynku.jukminung.com
URL: https://lynku.jukminung.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 17 Oct 2022 15:45:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Bza0PRnfhrQzyQiTlLq1pY2Hp7bNOvfYgPgCTHRQpw0PCo8rBMEhy1UNgqLNo9PHZIYSc%2Fxf0WQvJmJg8vogH%2FQMvHgowBn4T8fRATt1gEneZZVUnq1gcEc3SetIHJyopRjv7fR5VmrTQzAqWVbW%2BBw"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 75ba2910fa3d9a12-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
otto.sherlowcke.com/ 9 KB
3 KB 144ms
144ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=caf2c4c2&cid=pub7a622028f44a4df996a63246b14bbedf&2=690066

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

16c459c4e8995d091aecdfea869edff2c5487734c443a912503531df4e4bc6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=caf2c4c2&cid=pub7a622028f44a4df996a63246b14bbedf&2=690066
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:17 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 proc.php
otto.sherlowcke.com/ 4 KB
2 KB 132ms
131ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/proc.php?2a60cb69f220b47eff572ae9b3de4e1902fee6d8

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_term=7155507925669118091&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:17 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H/1.1 200
OK /
www.wewillserv.com/ 5 KB
5 KB 112ms
26ms Document
text/html 51.68.82.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e
Requested by: Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/proc.php?2a60cb69f220b47eff572ae9b3de4e1902fee6d8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.68.82.147 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://otto.sherlowcke.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Type: text/html
Date: Mon, 17 Oct 2022 15:45:17 GMT
Transfer-Encoding: chunked

GET
H2

200

a91581ead4 Show response
myofferplus.com/rc/
Redirect Chain

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004450150169ef565647b6ec71e1ee9a721017-202210-flb*5467509-4538f*M7155507925669118091*sl_5467509-4538f*5c7e5d062844ba...
https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503

1 KB
1 KB

453ms
84ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503
Requested by: Host: www.wewillserv.com
URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ce218650fe902efa68dc5703f0ea403d654272a99f4c64bd863faafd8db3824

Request headers

Referer: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507925669118091&website=13260-d1f8b31e-69450eb0&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889bf8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9e
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75ba2919198c9b8c-FRA
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6tRUfxL4tCXNvjlCJd6zkD%2F5iz7QfzXVSrIyx2IAV%2FDbS%2B1kZstWZDjDjfeaSQxHxuzN%2FnJP7fSP%2FgnN%2FD7wwOXvokNbPxelcJ85CeXFaoooyfIlIlsaL4WTvB2TxMtHmcOF3hknVCFeJRLkHg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

Redirect headers

access-control-allow-origin: *
content-length: 0
date: Mon, 17 Oct 2022 15:45:17 GMT
location: https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503
server: nginx

GET
H3 200 redirect.css
cdn.addlnk.com/ 1 KB
1 KB 80ms
40ms Stylesheet
text/css 2606:4700:3030::ac43:bfdd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: myofferplus.com
URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:18 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: DPH6BFRFCDDVEGFB
age: 3746
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: e+5JOf0SWV5VxcS9uVMqd708supEUU2ISJHW0+Vj2Du5t+wQlYSEH235XreHFd6yoKdN67QUsNA=
cf-bgj: minify
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AYQWN5yx%2BvrVoFDEVKx2cAp%2B5nqI1%2F3fDpkx4Y1UhGPps1E40wgDu2EdR1L7gCmcgypoaCkpt71stC%2B0ySTlWffjhtX1sT3HBstJK4S7vajTKYbTBioM843NuQUATto2xImu5gsmhkhPD2rNmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 75ba2919efe17a55-DUS

GET
H2 200 /
otto.sherlowcke.com/ 3 KB
2 KB 129ms
128ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503

Requested by

Host: myofferplus.com
URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788dd25a00000122d7b2&pubid=503

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:18 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 / Show response
otto.sherlowcke.com/ 9 KB
3 KB 180ms
179ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

8704a087f2b308cff3429b3a77cf6a01bc033fd7497d175f75c465b76d84e02a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:18 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 proc.php
otto.sherlowcke.com/ 4 KB
2 KB 130ms
129ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/proc.php?1193bceacabc03feeee8849ca63a711f4d8a661f

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:19 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H/1.1 200
OK /
www.wewillserv.com/ 5 KB
5 KB 26ms
25ms Document
text/html 51.68.82.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Requested by: Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/proc.php?1193bceacabc03feeee8849ca63a711f4d8a661f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.68.82.147 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://otto.sherlowcke.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Type: text/html
Date: Mon, 17 Oct 2022 15:45:19 GMT
Transfer-Encoding: chunked

GET
H3

200

a91581ead4 Show response
myofferplus.com/rc/
Redirect Chain

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4a...
https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=503&sub1=33000b7ca2775737cae5758ceab951e3d7c591017-202210-flb*5467509-4538f*M7155507934259052628*sl_5467509-4538f*89c63559cbde4a...
https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503

1 KB
1 KB

125ms
79ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503
Requested by: Host: www.wewillserv.com
URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40de9eb9ea0f84117123966a043857441dbbcef18075495b94db73006b19e5e3

Request headers

Referer: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75ba292018537a3d-DUS
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALxTXQY9fC19tS48pBV%2BhIPDA9UoB6HsFPhDvECKcd%2BXdH8%2BV7gFmgbymaEXZA0bCfYCHUPXKlqQrY6P2%2FMCOlEGBPpDlsU3FGdxtqdxnYrsaj%2FMvYar8btMhlvKKWHxspOBpy9wSyqRDMTzXYA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

Redirect headers

access-control-allow-origin: *
content-length: 0
date: Mon, 17 Oct 2022 15:45:19 GMT
location: https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503
server: nginx

GET
H3 200 redirect.css
cdn.addlnk.com/ 1 KB
1015 B 41ms
40ms Stylesheet
text/css 2606:4700:3030::ac43:bfdd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: myofferplus.com
URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:19 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: DPH6BFRFCDDVEGFB
age: 3747
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: e+5JOf0SWV5VxcS9uVMqd708supEUU2ISJHW0+Vj2Du5t+wQlYSEH235XreHFd6yoKdN67QUsNA=
cf-bgj: minify
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=248oK%2FQuOE%2Fw7DGxAhCECKMJ5R9HqLNgUhAdYuAYguSgJkc8OcdeW%2F4nhLUv00mFoZ7cJdn20q1K49HT12IxOn9R2QnePlrscF7dRPeKu3%2BLICdv6XuGod1N%2BKLUwME4Sc6FR%2FyNP1K00o22pA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 75ba292099b87a55-DUS

GET
H2 200 /
otto.sherlowcke.com/ 3 KB
2 KB 128ms
128ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503

Requested by

Host: myofferplus.com
URL: https://myofferplus.com/rc/a91581ead4?affclick=634d788f46cb830001b43645&pubid=503

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:19 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 / Show response
otto.sherlowcke.com/ 9 KB
3 KB 129ms
129ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

8ec82fd2eaad229b062518aeddf150cac1add807464a05e3187204fa5624873c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_medium=2c1d6fcd4cc55c1538e271f58234122bd508fe6f&utm_campaign=mainstream_redirect&1=81b90edf&cid=pubd697c4e5b45f452bb415a488fe55b270&2=503
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:19 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 proc.php
otto.sherlowcke.com/ 4 KB
2 KB 129ms
128ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://otto.sherlowcke.com/proc.php?163400bf92e7d03d5777e0991f141f3e46005eb9

Requested by

Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://otto.sherlowcke.com/?utm_term=7155507934259052628&ver=4viyaptcjo&c=1&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:20 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H/1.1 200
OK /
www.wewillserv.com/ 5 KB
5 KB 25ms
24ms Document
text/html 51.68.82.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Requested by: Host: otto.sherlowcke.com
URL: https://otto.sherlowcke.com/proc.php?163400bf92e7d03d5777e0991f141f3e46005eb9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.68.82.147 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://otto.sherlowcke.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Type: text/html
Date: Mon, 17 Oct 2022 15:45:20 GMT
Transfer-Encoding: chunked

GET
H2

200

/ Show response
t.bl-easycdn.com/directclick/
Redirect Chain

https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccb...
https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb

25 KB
9 KB

517ms
176ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb
Requested by: Host: www.wewillserv.com
URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61add28defd9bf37ac040b73b5ad336dde60451c168c73d330cc1e804297f6c8

Request headers

Referer: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7155507934259052628&website=13260-41ee3c25-b33b22ff&placement=13260&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 75ba29288bcf90e8-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:20 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5HejQALBYJTDZt081rLLc6oPlgmukmX1wCrdKyXMAATskj7dK6%2F98zxWxjVV2rm0kFpnohOgcuogA8Ynhhfc5a14YuPIbl%2FpChdhjSHNE5BNegFkzpkl%2BwmI%2BxNZPsjsYSsOJ35Gw%2FXUHFWuMhqN"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Cache-Control: no-transform
Connection: keep-alive
Content-Length: 0
Date: Mon, 17 Oct 2022 15:45:20 GMT
Location: https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb

GET
H2 200 22e841bd3c Show response
zring.jukminung.com/rc/ 1 KB
1 KB 168ms
150ms Document
text/html 2606:4700:3031::ac43:92ee
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=rdmfl
Requested by: Host: t.bl-easycdn.com
URL: https://t.bl-easycdn.com/directclick/?pid=CLBghSztLMxKnP7sw-K3orR0VUY1&wsid=a3df2769bdb6839950a155b998f8e5d41017-202210-flb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:92ee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ed635927760abf3349ddf9ca83d37006b9dbef47f9b4b0bf537de494f7871f6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75ba2929e987916a-FRA
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BmfX0cN8LsTgBOdN6DDHW580Gx4vbvvkuVcUAYGcdunWXquJIklMUWvOjJdr8N%2B392ykUZc1FV%2BMYrJ2IpeKXOoEVZFRPBJnAEifpslUvzQJ4NluCPoSWOegt1P38EexZd3SfGZ5Jgh4MrwmWZArC9r%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

GET
H3 200 redirect.css
cdn.addlnk.com/ 1 KB
1017 B 40ms
40ms Stylesheet
text/css 2606:4700:3030::ac43:bfdd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: zring.jukminung.com
URL: https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=rdmfl
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:21 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: DPH6BFRFCDDVEGFB
age: 3749
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: e+5JOf0SWV5VxcS9uVMqd708supEUU2ISJHW0+Vj2Du5t+wQlYSEH235XreHFd6yoKdN67QUsNA=
cf-bgj: minify
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tosaCSRL3Q3AvI%2BXlO5TKYYFG%2B17xsD6yP7FiqKLO7lqQ0V7xFdjdqYMczKjHmYLSPspkIWHEaPTMM3fOPnm73aKjgCp%2FV6Dxnj%2BABUNqZaOpiD6uGbg%2BaWbUytBqFP6qFnPUT1t2ieubGuqFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 75ba292aec9d7a55-DUS

GET
H2

200

736006a179 Show response
surf.ueive.com/rc/
Redirect Chain

http://139.59.49.76/34363?click=pubb53715467e7d480ab9914d0f4ba6cc90&pubid=9f6cbb32
https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363

3 KB
2 KB

182ms
104ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363
Requested by: Host: zring.jukminung.com
URL: https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=rdmfl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 849416ce860a4b7c0d3781001dbeb7568edf05d2d07555aafeff062ee82ad4e7

Request headers

Referer: https://zring.jukminung.com/rc/22e841bd3c?affclick=22101717_01_371812_aca25c6fa92c9&pubid=a371812s&affe=rdmfl
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75ba292e7b6ebb35-FRA
content-encoding: br
content-language: en-us
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=usNFpM%2BzYKy808IcJX%2F6JCBasV00KPypGx6PfRwK%2F2Ft%2FmMC2w%2BlARnlkqVOwojWbwyyxcsFgRkUghSSjrMAI%2BAtIox6udRBvLH73LwPyTszpzBilM1gz0R5YX5thguXD2iL%2BqrG2QEZXoaJJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Accept-Language, Cookie

Redirect headers

cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
content-length: 226
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:21 GMT
expires: 0
location: https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363
pragma: no-cache
surrogate-control: no-store
vary: Accept, Accept-Encoding
x-powered-by: Express

GET
H3 200 redirect.css
cdn.addlnk.com/ 1 KB
1023 B 47ms
46ms Stylesheet
text/css 2606:4700:3030::ac43:bfdd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addlnk.com/redirect.css
Requested by: Host: surf.ueive.com
URL: https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:21 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: DPH6BFRFCDDVEGFB
age: 3749
cf-polished: origSize=1680
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: e+5JOf0SWV5VxcS9uVMqd708supEUU2ISJHW0+Vj2Du5t+wQlYSEH235XreHFd6yoKdN67QUsNA=
cf-bgj: minify
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
server: cloudflare
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Imq3vC%2BevSR9%2BwW07QF6blFByxjbxY64mC%2FwYuJKn3%2FCsAo4zn0Pf0936GDSRVwQPvWzWe%2FGY0zVQDv1T1f7ZE4KhMoVqEIVTyEsKx3wFMleLDUMHDbVBRO1E%2BqQf9e7e%2BkNJZo%2B6HEhzMh%2FWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 75ba292f28b87a55-DUS

GET
H3 200 invisible.js
surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 320C 40 KB
14 KB 65ms
30ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Requested by: Host: cigaretteborder.com
URL: https://cigaretteborder.com/17615f005f82a5b4000/berrzqq_073eajn/_1m%7C0b08c%7C0097t%7Co07634d34a08b9e3_0vk3%7C0moqbu1%7C90364%7C01j1r01430%7CA%7C1oc17vb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:21 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3XFI6UHsZAIVrh%2FJEXBMoBhTh%2F9FJ%2F83mLAEeQdDr23qZCaGcDSKDH2IjmSXKuRKUdCWWfUueQMz7XWerp0wsVXJw9ab1SIMKtSvKWzOzd4DwQGErS3472UaOtIlcuhYJ62CpW70c1AR3HnCPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75ba292fbbf69b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

200

/
ad.marootrack.co/
Redirect Chain

https://aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1=pubc3fd207cae5d440eab5566beee18e2eb&sub2=11213b3c_34363
https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96

3 KB
2 KB

838ms
130ms

Document
text/html

65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96

Requested by

Host: surf.ueive.com
URL: https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://surf.ueive.com/rc/736006a179?affclick=22J17211521A034363012829AuuCY&pubid=34363
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:22 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

Redirect headers

access-control-allow-origin: *
content-length: 0
date: Mon, 17 Oct 2022 15:45:22 GMT
location: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96
server: nginx

GET
H3 200 pica.js
surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 320C 19 KB
7 KB 57ms
56ms Other
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 15:45:21 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cAdnloj34M7ix8cr4iQMqEtXMsXCBO8ZfV5IyUkrHTdyE2FrTtxAwNxtH1cR9GNXT2SjI%2B7nOmmV4hgXrB4yd%2FG9F7DOUIbHNBxtX6N3DlfBxvPIY%2FbxzAKdqfJ%2BYD3Hpo19m7BVPqduGfochg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75ba29301cda9b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 75ba292e7b6ebb35
surf.ueive.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 320C 2 B
658 B 59ms
59ms XHR
text/plain 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://surf.ueive.com/cdn-cgi/challenge-platform/h/b/cv/result/75ba292e7b6ebb35
Requested by: Host: surf.ueive.com
URL: https://surf.ueive.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 17 Oct 2022 15:45:22 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wIX2dd%2F3NFT0xekAPdqO%2BgekgGsDlSMyJj5btquypBhO3gaPd0ZHPXj6VQVJXPIXK1Jsryt0ua8JOmZTnjmKuauPaLM7xoCQtR1B6dqqRtn7dkGL9o19Rw6FBHRfkdoB9q%2FB35bnz%2FShS8%2Fuqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 75ba29328b039b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
ad.marootrack.co/ 8 KB
3 KB 142ms
141ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Requested by

Host: ad.marootrack.co
URL: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

b62bc650756af9e8671a9e57417ed4b2968ec3591e43acb15bdb7736ecccee44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_11213b3c_34363&cid=634d78929551f500012a6c96
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 17 Oct 2022 15:45:22 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H2 200 proc.php
ad.marootrack.co/ 4 KB
2 KB 128ms
127ms Document
text/html 65.60.58.179
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.marootrack.co/proc.php?369ecb00be035b76c7d3557fd93dd4f1483c013f

Requested by

Host: ad.marootrack.co
URL: https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

65.60.58.179 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/8.1.9

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://ad.marootrack.co/?utm_term=7155507951438921839&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 15:45:23 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubdomains;
vary: Accept-Encoding
x-powered-by: PHP/8.1.9

GET
H/1.1 302
Found Primary Request go.php Show response
d0zi.com/ 728 KB
728 KB 417ms
349ms Document
text/html 162.55.4.52
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://d0zi.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7155507951438921839&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf8f4f3f3f2fce2eeeee8ede7e9ee9d

Requested by

Host: ad.marootrack.co
URL: https://ad.marootrack.co/proc.php?369ecb00be035b76c7d3557fd93dd4f1483c013f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

162.55.4.52 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.52.4.55.162.clients.your-server.de

Software

nginx/1.20.1 /

Resource Hash

da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ad.marootrack.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Oct 2022 15:45:23 GMT
Server: nginx/1.20.1
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked

GET
DATA 200
OK truncated
/ 546 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62576fdef07eb0dd51f1c09fa4808b8fb2fe9c201197f6ff5a8fb31c3c1b9884

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
cigaretteborder.com/	1970-01-20 07:30:13	Name: uid15295 Value: 1294761078-20221017114515-6d54bc7be306b3d8143c3fc4cac49528-
lynku.jukminung.com/	1970-01-20 06:57:06	Name: AWSALB Value: /ao6vo1DYUC2u1i4W3vpT6cJK3leDWfMzwGyQTdvQT3MDWEOzwsed9k+h6f+5hv6ZpiABrdyLed2z2UApqQo75wLYaWta6DAYt1DmhjmP5Im1tmHk+owcUKTEc+s
.jukminung.com/	1970-01-20 06:47:03	Name: __cf_bm Value: 9IMAwMDGMSBNAUFm0a38865Bt93SqB0hVUV3E2GM2Fg-1666021516-0-AbWPdRmLwHIl324WnWjBYXzlCZ3G1CF5JhIQykGa8FupWZCZm6UOryEJjePHwEWSJOCidH53yVvapqGNidLvtT098LIIcEQHChpDoqdK0nuBk1iT2/FVQFAtU6y+THEJ3A==
otto.sherlowcke.com/	1970-01-20 15:32:37	Name: u Value: dc1684a8a12eae6fb186fb2ee0170690
admoustache.go2affise.com/	1970-01-20 15:32:37	Name: afclick Value: 634d788f46cb830001b43645
myofferplus.com/	1970-01-20 06:57:06	Name: AWSALB Value: l4St+nGL2Dc0yL9hQPgGee77QjJ1FAzs5LWCN6uuHIB8UDjaRC8WBd8OTCn8KuJSg6utODyN4bc0Sp6f2atFSA33r8YF6k1KmMQk3e93OmAki1U3HjqZqXYLkqBu
.bl-easycdn.com/	1970-01-20 15:32:37	Name: checkkeks Value: 1
.bl-easycdn.com/	1970-01-20 06:48:27	Name: eTag Value: a4559d46e63ec5712030a9fccb2ebebc
.bl-easycdn.com/	1970-01-20 15:32:37	Name: ck_uniques Value: 1666107919%3A24589-115227
.bl-easycdn.com/	1970-01-20 15:32:37	Name: ck_uniquesPa Value: 1666107919%3A89322
.bl-easycdn.com/	1970-01-20 06:48:27	Name: ck_sys_uniques_3 Value: 1
.bl-easycdn.com/	1970-01-20 06:48:27	Name: u_current_ads_view Value: 89322----
zring.jukminung.com/	1970-01-20 06:57:06	Name: AWSALB Value: vhGbnK4DZF5y+EIi79KOaUOJrON9KkAVHK0W5DZdUQDK61HGLghL0XKoXmiMw3OaNnt9a8azn7u0u1DluOmzQ1kEONm7VlM1Z8twR7H5giiJ4sfYGkJ96eoV2xXU
surf.ueive.com/	1970-01-20 06:57:06	Name: AWSALB Value: T0CwWybA8AiC9NQfcCC0BCSPZoM2SVdyfA3yI5Q5MYT5sv/LJc4Vu7ho964e/rp9PhpDYOrF4vsOOoQZsaa++PVrxfelfQJrSkypr+mmyRsNt1pwmB/NX9nhFKFG
aditmedia.g2afse.com/	1970-01-20 15:32:37	Name: afclick Value: 634d78929551f500012a6c96
aditmedia.g2afse.com/	1970-01-20 15:32:37	Name: afoffers Value: {"18720":1666021522}
.ueive.com/	1970-01-20 06:47:03	Name: __cf_bm Value: zHncV7WU4mGuO3kqeSe4v6QHAVc3_ve2TLMt_zv4CQ8-1666021522-0-AT6YoVEjEtLwRwuP+uXgWfx2NcR3TtQaIdklDN/LT1UtGoMAWT5U5mcU+DlGvqsP7fN6KMTED8ipYsQmw4XkO3FwVv86pmEVpFVWAwUEUJ9SS0XsORFN7Qws1Cqvsz6zYg==
ad.marootrack.co/	1970-01-20 15:32:37	Name: u Value: 0fb6d4d03063478f6c7d80ab4e286f92

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.marootrack.co
aditmedia.g2afse.com
admoustache.go2affise.com
cdn.addlnk.com
cigaretteborder.com
d0zi.com
lynku.jukminung.com
myofferplus.com
otto.sherlowcke.com
shop60.co.uk
surf.ueive.com
t.bl-easycdn.com
www.wewillserv.com
zring.jukminung.com
139.59.49.76
162.55.4.52
185.34.52.132
208.77.151.100
2606:4700:3030::ac43:bfdd
2606:4700:3031::ac43:92ee
2a06:98c1:3120::3
34.141.137.168
34.91.234.242
51.68.82.147
65.60.58.179
16c459c4e8995d091aecdfea869edff2c5487734c443a912503531df4e4bc6ef
3bb67716e374ff4487fcf1c283fd51e03637d812cc622a39f3dc99996507236f
40de9eb9ea0f84117123966a043857441dbbcef18075495b94db73006b19e5e3
61add28defd9bf37ac040b73b5ad336dde60451c168c73d330cc1e804297f6c8
62576fdef07eb0dd51f1c09fa4808b8fb2fe9c201197f6ff5a8fb31c3c1b9884
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1
849416ce860a4b7c0d3781001dbeb7568edf05d2d07555aafeff062ee82ad4e7
8704a087f2b308cff3429b3a77cf6a01bc033fd7497d175f75c465b76d84e02a
8ce218650fe902efa68dc5703f0ea403d654272a99f4c64bd863faafd8db3824
8ec82fd2eaad229b062518aeddf150cac1add807464a05e3187204fa5624873c
8ed635927760abf3349ddf9ca83d37006b9dbef47f9b4b0bf537de494f7871f6
a29df1c70cdb5614ce21a51d8b1c971795b293093e720cfb26e35571bd7f7c49
b62bc650756af9e8671a9e57417ed4b2968ec3591e43acb15bdb7736ecccee44
da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef
df6ee8e0378d34143210a6ee0aad3f11b85e4e4ea451df1247347b228b63c26d

d0zi.com Open in urlscan Pro 162.55.4.52 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

100 %HTTPS

27 %IPv6

13 Domains

14 Subdomains

8 IPs

6 Countries

840 kBTransfer

1515 kBSize

18 Cookies

0 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

d0zi.com Open in urlscan Pro
162.55.4.52 Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

100 %
HTTPS

27 %
IPv6

13
Domains

14
Subdomains

8
IPs

6
Countries

840 kB
Transfer

1515 kB
Size

18
Cookies

34 HTTP transactions
1 data transactions