deindealheute.de Open in urlscan Pro
2606:4700:3037::ac43:a485 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=...
Effective URL:
https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&sub...
Submission Tags: 6806130
Submission: On October 13 via api (October 13th 2020, 8:01:10 am UTC) from NL

Summary HTTP 44 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 13 IPs in 4 countries across 13 domains to perform 44 HTTP transactions. The main IP is 2606:4700:3037::ac43:a485, located in United States and belongs to CLOUDFLARENET, US. The main domain is deindealheute.de.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 12th 2020. Valid for: a year.

This is the only time deindealheute.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	31.170.100.125 31.170.100.125	201942 (SOLTIA) (SOLTIA)
1 4	67.212.173.78 67.212.173.78	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	116.202.159.172 116.202.159.172	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
1 1	52.70.54.205 52.70.54.205	14618 (AMAZON-AES) (AMAZON-AES)
22	2606:4700:303... 2606:4700:3037::ac43:a485	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE)
2	104.18.90.64 104.18.90.64	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:810c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1 3	104.111.238.139 104.111.238.139	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:206... 2600:9000:206e:3c00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
44	13

1 31.170.100.125 (Spain)

ASN201942 (SOLTIA, ES)

mobi.billiwa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 67.212.173.78 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

bxt1.shaperal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.159.172 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.172.159.202.116.clients.your-server.de

lion.chairhelmet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.54.205 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-54-205.compute-1.amazonaws.com

c.ratrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2606:4700:3037::ac43:a485 (United States)

ASN13335 (CLOUDFLARENET, US)

deindealheute.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.90.64 (United States)

ASN13335 (CLOUDFLARENET, US)

www.cdn925.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:810c (United States)

ASN13335 (CLOUDFLARENET, US)

www.clicken.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.238.139 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-139.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:3c00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	deindealheute.de deindealheute.de	464 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	165 KB
4	shaperal.com 1 redirects bxt1.shaperal.com	19 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com	3 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	google.com www.google.com	700 B
2	cdn925.com www.cdn925.com	7 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	31 KB
1	quantcount.com rules.quantcount.com	356 B
1	clicken.us www.clicken.us
1	ratrck.com 1 redirects c.ratrck.com	2 KB
1	chairhelmet.com lion.chairhelmet.com	1 KB
1	billiwa.com mobi.billiwa.com	453 B
44	13

	Domain	Requested by
22	deindealheute.de	lion.chairhelmet.com deindealheute.de
4	fonts.gstatic.com	fonts.googleapis.com
4	bxt1.shaperal.com	1 redirects bxt1.shaperal.com
3	sb.scorecardresearch.com	1 redirects deindealheute.de
2	www.google.com	deindealheute.de www.gstatic.com
2	www.cdn925.com	deindealheute.de
1	pixel.quantserve.com	deindealheute.de
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	deindealheute.de
1	www.gstatic.com	www.google.com
1	www.clicken.us	deindealheute.de
1	fonts.googleapis.com	deindealheute.de
1	c.ratrck.com	1 redirects
1	ajax.googleapis.com	lion.chairhelmet.com
1	lion.chairhelmet.com	bxt1.shaperal.com
1	mobi.billiwa.com
44	16

This site contains links to these domains. Also see Links.

Domain
contact.deindealheute.de
contact.nationalconsumerscenter.co.uk

Subject Issuer	Validity	Valid
ads.conscier.com Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
bxt1.shaperal.com Let's Encrypt Authority X3	`2020-09-16` - `2020-12-15`	3 months	crt.sh
njump.xmobistein.com Let's Encrypt Authority X3	`2020-08-14` - `2020-11-12`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-12` - `2021-07-12`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
sb.scorecardresearch.com DigiCert Secure Site ECC CA-1	`2020-07-17` - `2021-06-02`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Frame ID: FB97B3ACBA8C3184806465C44C9A35DC
Requests: 35 HTTP requests in this frame

Frame: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Frame ID: 5C0983E596A2BDCFAC8D1F94E575241E
Requests: 7 HTTP requests in this frame

Frame: https://www.clicken.us/tag/LocalStorageSetNew.html?1=1&vid=FdDcEjcUuYtOA0qwJ88nrg2
Frame ID: 2409B9C3F6D9FF9426F7A4DDD9549322
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdVFrgUAAAAAEMNq1ljl8HZSQ2sA8Hu6a8umPQr&co=aHR0cHM6Ly9kZWluZGVhbGhldXRlLmRlOjQ0Mw..&hl=en&v=48TunWH-ZrLteSwFVbw6tVnx&size=invisible&cb=8g1l2230c1i5
Frame ID: 8E4B4FB60839CD538191E7701848EC4E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e... Page URL
https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M... Page URL
https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
https://bxt1.shaperal.com/proc.php?001ea59e7db069e8ef10f958f596ed40c43ac6a0 HTTP 302
https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]... Page URL
https://c.ratrck.com/?OO=Z6BZFzXjjd0h8CHGuIySqLM3FYBrdlZRvQJDRoz7h5U%3d-JNRT5du4udM%3d&s2=1441_40... HTTP 302
https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amaz... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

44
Requests

100 %
HTTPS

57 %
IPv6

13
Domains

16
Subdomains

13
IPs

4
Countries

697 kB
Transfer

1342 kB
Size

4
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://contact.deindealheute.de/policies/privacy
Title: Datenschutz- und Cookie-Richtlinien

Search URL Search Domain Scan URL

URL: https://contact.nationalconsumerscenter.co.uk/policies/privacy
Title: Impressum

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/policies/terms
Title: Allgemeine Geschäftsbedingungen

Search URL Search Domain Scan URL

URL: http://contact.deindealheute.de/policies/page/rzu_germany_program_requirements
Title: Programmanforderungen

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/claimincentive
Title: Prämie anfordern

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/contact.aspx
Title: Mitglieder-Support

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/Account/Login?ReturnUrl=%2Fincentivestatus.aspx
Title: Prämienstatus

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/policies/faq
Title: Häufig gestellte Fragen

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/policies/page/impressum
Title: Impressum

Search URL Search Domain Scan URL

URL: https://contact.deindealheute.de/unsub
Title: Abmelden

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=sfrfrancemobile&externalid=LOTFI Page URL
https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M Page URL
https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d Page URL
https://bxt1.shaperal.com/proc.php?001ea59e7db069e8ef10f958f596ed40c43ac6a0 HTTP 302
https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14 Page URL
https://c.ratrck.com/?OO=Z6BZFzXjjd0h8CHGuIySqLM3FYBrdlZRvQJDRoz7h5U%3d-JNRT5du4udM%3d&s2=1441_4078_1_14t_5f7f6a780f33a_27x4078x5f855eb5c0c93__5f803e37dc18e&s1=4078-2SPvnmY6rt HTTP 302
https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://bxt1.shaperal.com/proc.php?001ea59e7db069e8ef10f958f596ed40c43ac6a0 HTTP 302
https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14

Request Chain 40

https://sb.scorecardresearch.com/b?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041&c9=https%3A%2F%2Fdeindealheute.de%2F%3FFlow%3D599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0%26isPrePop%3Dtrue%26reward%3Damazon500de%26o%3D211151%26subaff1%3D4078-2SPvnmY6rt%26subaff2%3D203968%26subaff3%3D142453%26subaff4%3DDE-amazon500de%26DVID%3D HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041&c9=https%3A%2F%2Fdeindealheute.de%2F%3FFlow%3D599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0%26isPrePop%3Dtrue%26reward%3Damazon500de%26o%3D211151%26subaff1%3D4078-2SPvnmY6rt%26subaff2%3D203968%26subaff3%3D142453%26subaff4%3DDE-amazon500de%26DVID%3D&cs_ak_ss=1

44 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5 Show response
mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/ 244 B
453 B 4456ms
4368ms Document
text/html 31.170.100.125
SOLTIA

General

Check archive.org

Show headers Download Go to

Full URL: https://mobi.billiwa.com/ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=sfrfrancemobile&externalid=LOTFI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 31.170.100.125 , Spain, ASN201942 (SOLTIA, ES),
Reverse DNS
Software: nginx /
Resource Hash: fadd4e57c1b24aa7e466ddfa335e3eac5d69a2c723913180de4b68e465fc9042

Request headers

:method: GET
:authority: mobi.billiwa.com
:scheme: https
:path: /ofc/a69d929e-10766432-66f28245-457e-01a4/18bc2db5-f71c75c6-cb8c833e-5a8e-c4e5?Subid=9&sub_pubid=sfrfrancemobile&externalid=LOTFI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 13 Oct 2020 08:00:52 GMT
content-type: text/html; charset=UTF-8
content-length: 206
access-control-allow-origin: *
access-control-allow-headers: Content-Type
cache-control: no-cache, private
content-encoding: gzip
x-device: desktop
accept-ranges: bytes
age: 0
tp-cache: MISS
vary: Accept-Encoding

GET
H2 200 / Show response
bxt1.shaperal.com/ 3 KB
2 KB 354ms
120ms Document
text/html 67.212.173.78
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.212.173.78 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.4.10

Resource Hash

870ad19adb746efa6dc0352b438182a8ac60c95b140091407025411512e9c6ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: bxt1.shaperal.com
:scheme: https
:path: /?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 13 Oct 2020 08:00:53 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.4.10
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=9637d6caa015ebb64e382c432525e58c; expires=Wed, 13-Oct-2021 08:00:53 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H2 200 / Show response
bxt1.shaperal.com/ 15 KB
5 KB 119ms
118ms Document
text/html 67.212.173.78
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d

Requested by

Host: bxt1.shaperal.com
URL: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.212.173.78 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.4.10

Resource Hash

14f6ad4b396ee40221f1db84e325e96c8de1263507d3d3d8d71a4c9b15c8dcbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: bxt1.shaperal.com
:scheme: https
:path: /?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: u=9637d6caa015ebb64e382c432525e58c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bxt1.shaperal.com/?utm_medium=f2a0c4f3fbe2823ee80dc4ba2e1e834b8d892f53&utm_campaign=Push&cid=M2020101308-ac74542ffd38ca69deb101a5f5fdf1aa&kw1=M999M

Response headers

status: 200
server: nginx
date: Tue, 13 Oct 2020 08:00:53 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.4.10
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H2 200 skip-button.jpg
bxt1.shaperal.com/20190821/ 12 KB
12 KB 110ms
109ms Image
image/jpeg 67.212.173.78
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bxt1.shaperal.com/20190821/skip-button.jpg

Requested by

Host: bxt1.shaperal.com
URL: https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.212.173.78 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx /

Resource Hash

f0eb9ece706d722ccab204bd08b56af28d95666e63d514c908a034243ceafa01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:53 GMT
last-modified: Wed, 21 Aug 2019 12:57:11 GMT
server: nginx
etag: "5d5d3fa7-2e32"
strict-transport-security: max-age=31536000; includeSubdomains;
content-type: image/jpeg
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 11826
expires: Wed, 14 Oct 2020 08:00:53 GMT

GET
H/1.1

200
OK

Cookie set / Show response
lion.chairhelmet.com/
Redirect Chain

https://bxt1.shaperal.com/proc.php?001ea59e7db069e8ef10f958f596ed40c43ac6a0
https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14

2 KB
1 KB

81ms
50ms

Document
text/html

116.202.159.172
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14
Requested by: Host: bxt1.shaperal.com
URL: https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.202.159.172 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.172.159.202.116.clients.your-server.de
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: 41bc57b7e16aaf1929e3ba6d4760af470fe7e181e6ba7b07fe2d7e10d66852fe

Request headers

Host: lion.chairhelmet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bxt1.shaperal.com/?utm_term=6883011737004540160&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb2b2b186b68485ab9b9899f2fef2f9e1f0f1e1f3bae4e78386899b97efddeda58c8f868a82c4ac9498d6f9cccbfccfc6f3f0f182858190cacbf9c9fff9fcfdc2f2f2f1f6c7c4c54d#

Response headers

Server: nginx/1.16.1 (Ubuntu)
Date: Tue, 13 Oct 2020 08:00:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: jarr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Content-Encoding: gzip

Redirect headers

status: 302
server: nginx
date: Tue, 13 Oct 2020 08:00:53 GMT
content-type: text/html; charset=UTF-8
location: https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14
x-powered-by: PHP/7.4.10
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: lion.chairhelmet.com
URL: https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 06:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5744
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Oct 2021 06:25:09 GMT

GET
H2

200

Primary Request / Show response
deindealheute.de/
Redirect Chain

https://c.ratrck.com/?OO=Z6BZFzXjjd0h8CHGuIySqLM3FYBrdlZRvQJDRoz7h5U%3d-JNRT5du4udM%3d&s2=1441_4078_1_14t_5f7f6a780f33a_27x4078x5f855eb5c0c93__5f803e37dc18e&s1=4078-2SPvnmY6rt
https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=

44 KB
11 KB

272ms
248ms

Document
text/html

2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Requested by: Host: lion.chairhelmet.com
URL: https://lion.chairhelmet.com/?jp=5f803e37dc18e&subid=6883011737004540160&p=976&creativeid=[[creative_id]]&linkref=4078_1_14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 24268e8a786679a57c7015081af7758ab42cf052b97e910a8bd3b8ce856ef2bb

Request headers

:method: GET
:authority: deindealheute.de
:scheme: https
:path: /?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://lion.chairhelmet.com/?jp=5f803e37dc18e&linkref=4078_1_14&z=30&bb=b&subid=6883011737004540160&creativeid=[[creative_id]]
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://lion.chairhelmet.com/?jp=5f803e37dc18e&linkref=4078_1_14&z=30&bb=b&subid=6883011737004540160&creativeid=[[creative_id]]

Response headers

status: 200
date: Tue, 13 Oct 2020 08:00:54 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d90194dae59f00357e6415d8bc52e410e1602576054; expires=Thu, 12-Nov-20 08:00:54 GMT; path=/; domain=.deindealheute.de; HttpOnly; SameSite=Lax ASP.NET_SessionId=ntewgdws4u5lrtwsrp4yx0dv; path=/; HttpOnly; SameSite=Lax AF3_Cookie=; expires=Wed, 13-Oct-2021 08:00:54 GMT; path=/
cache-control: private
vary: Accept-Encoding
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
cf-request-id: 05c293101e0000bec9f7862200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5e1787936d07bec9-FRA
content-encoding: br

Redirect headers

Content-Length: 255
Content-Type: text/html; charset=utf-8
Date: Tue, 13 Oct 2020 08:00:54 GMT
Location: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Set-Cookie: trk=8txK8oHSQahOJnd39tWgB4dSD3qGIX1Oz63Ub+XQU+IaD3LXlfqeAl5j71HmHGWA9InRvJObzOQ=; Domain=.ratrck.com; Expires=Thu, 13 Oct 2022 08:00:54 GMT; HttpOnly sid=8txK8oHSQahOJnd39tWgB45mzQMNI5L4z63Ub+XQU+KIOt2fWV50eF5j71HmHGWAlgDJwpjxrOw=; Domain=.ratrck.com; HttpOnly x211151=YJJH2p2VZ+Qe/UPbaDEjmgA0TUdmw6o1Qe5oF3oUI9/aQXOr9nd2xYzR8nXAAOXzOEyxGkrszjUMGBDXLhfXahwy9lCBRy0ytsjP6F6dS7kftdsrmU/NhW50eDifWvxBw8QCAUTKPwTcARzPsvgX8vtPUDDVcw519E0fQMz3xQobIg6Pfgn5wemzNWl3IYYoN4ivtIoQRGoSknYG/k4QHOb2pbkuV+AUgCufXR0NnRFRjG3ZpTEiymleMrRj+v8Nx1nRhNxidNfdnrZhwrOWwv/tKx/Jk4Ok0Y5ACWDKlmp2yFHQP/8RGySposnh41Tv6vGaM1sfmTG/KhAJNzF76n+QlxoQQ8rMPCJvES8C9FeHbOdY1/9Ik+IZ1ENITsbQBwIrtY7Uavf7igYw7HRTqDHKBy3SP/4RvrdQo0Oj9FpfEhg0sGibnqsu0OxsOuFJXZAwf4RYfEcrB9Alr4HepAnoRcdY+HA1IFkBWoqQ0DcTEac0MFucFNjJudRezzMUM419uoRjh/Rhz04ExHAu5kls7R0SRSO7NbvpVQSz/FuIAowhh3E2y3uuIB2D3FjxGxzEJGnIXTictub9KcF0/hXugFPrB1TmJqXTm/7qWW/LWqXWolmPtqerhjCkl78d/Rj2xccobWzeCHfISGkuI7TkSIsUwei2pYNSQ4M1YXTsrJB2c/Wlz2L7f7L2P8wf4Sql+M6HlCi+8XFOzXgNe0bIg04dlnwQ80KkwsRMFDd3rQVQl4X0KZmSAYEWkF/Lxeg+X+bjHP538zuJTW1+DoByts7ZB61GAzm5rNV2xM3griaBkRfBaqMVDxcomR7LDq0QDTbOfUDT2ypcTqR0uTBoCfczEQLzxg4zqAOUfwLmDewXnHQOOi7xWk4PQWOlHyQ1E8ZkPP5OFaylIwrm6IsOFgluUPwdThWspSMK5uiAdGQPbnWZRUKc5IRYgmwpyHJ4h7np3GEQXzIN0uPpwF2QSVXcETmeUZ7C+SqPMmCwuW2nCL0ndPLcSvKB0kGoTiZ3d/bVoAdHHo+8WXRuaaVp97fTJ8OH2oXmmw4sMrdAgkbrT3+5nypgxUJAp62Yhdu6pQxychITNY4B6XLa6VReDS/m2riG24mIUMo6C5M=; Domain=.ratrck.com; Expires=Thu, 12 Nov 2020 08:00:54 GMT; HttpOnly
X-Ckt: bu2ltdnp049ck2h7tnsg
X-Ray: bu2ltdnp049ck2h7tnqg
Connection: close

GET
H2 200 Site.css
deindealheute.de/CSS/ 684 B
413 B 20ms
16ms Stylesheet
text/css 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/CSS/Site.css
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 773647c4a0546b6b79a1dc5c8992964fa377ccfb5a5cde07d8084942a690231e

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7870200000001
last-modified: Mon, 17 Mar 2014 14:17:22 GMT
server: cloudflare
etag: W/"cd26ec9ceb41cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5e1787951d9fbec9-FRA

GET
H2 200 flybox.css
deindealheute.de/CSS/ 1 KB
528 B 21ms
17ms Stylesheet
text/css 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/CSS/flybox.css
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 3444cd973ee58f19da7ea798d5e1b73c087f48017dc01c03d6d55011293cf2c4

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7871200000001
last-modified: Mon, 17 Mar 2014 14:17:22 GMT
server: cloudflare
etag: W/"693ceb9ceb41cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5e1787951da1bec9-FRA

GET
H2 200 colorbox.css
deindealheute.de/CSS/ 4 KB
1 KB 22ms
18ms Stylesheet
text/css 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/CSS/colorbox.css
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 6ed0d7b87ea29f9c157a2fec78b8177495f069211b5e5c4550a8497cfec1c1ae

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7872200000001
last-modified: Tue, 17 Feb 2015 15:15:05 GMT
server: cloudflare
etag: W/"80e21182c44ad01:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5e1787951da2bec9-FRA

GET
H2 200 jquery-1.8.2.min.js Show response
deindealheute.de/JS/ 91 KB
32 KB 34ms
31ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f23d4b309b72743aa8afe1f8c98a25b3ee31246fa572c66d9d8cb1982cae4fbc

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-int-pingora-origin-digest: {"ext_ip":"162.158.91.105","ext_port":39218,"upstream_rtt":95,"upstream_reused":false,"http_version":1}
cf-request-id: 05c293112d0000bec9f7873200000001
last-modified: Mon, 17 Mar 2014 14:18:05 GMT
server: cloudflare
etag: W/"808c61b6eb41cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da3bec9-FRA

GET
H2 200 ExternalLibrary.js Show response
deindealheute.de/JS/ 60 KB
14 KB 25ms
22ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/ExternalLibrary.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b1f73cdf418db0fb3758307e4e83c858f1e91d50c750fc65d0a3d54d966a9106

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7874200000001
last-modified: Wed, 07 Oct 2020 00:48:13 GMT
server: cloudflare
etag: W/"80c4b89439cd61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da4bec9-FRA

GET
H2 200 InternalLibrary.js Show response
deindealheute.de/JS/ 103 KB
18 KB 31ms
28ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/InternalLibrary.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 6e1f86eae2a33c0f0e5f5b149545536900e257f964feeb22b201021d908dd582

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7875200000001
last-modified: Thu, 27 Aug 2020 21:55:11 GMT
server: cloudflare
etag: W/"80495ebcbc7cd61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da5bec9-FRA

GET
H2 200 SystemConvert.js Show response
deindealheute.de/JS/ 28 KB
4 KB 32ms
29ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/SystemConvert.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f758cf71bff52e983f82b4643f230a8adfec570eca671bc1c06011e747f66c52

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7876200000001
last-modified: Thu, 06 Feb 2020 16:17:17 GMT
server: cloudflare
etag: W/"802444e68ddd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da6bec9-FRA

GET
H2 200 jquery.autotab.js Show response
deindealheute.de/JS/ 9 KB
2 KB 23ms
21ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/jquery.autotab.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: d0401ccef3aad28475290a3540dcbf35cf798e414d9b6cc612dba8731bd0ea51

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7877200000001
last-modified: Mon, 17 Mar 2014 14:18:05 GMT
server: cloudflare
etag: W/"808c61b6eb41cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da7bec9-FRA

GET
H2 200 jquery.colorbox-min.js Show response
deindealheute.de/JS/ 31 KB
8 KB 29ms
28ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/jquery.colorbox-min.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 1e8cdf8b6b76616f6e721a0f53dfab323db16cc7eddfd7136135c5d5382ff126

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3576
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293112d0000bec9f7878200000001
last-modified: Wed, 29 Oct 2014 18:02:54 GMT
server: cloudflare
etag: W/"01bcf8fa2f3cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787951da8bec9-FRA

GET
H2 200 css
fonts.googleapis.com/ 9 KB
785 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap

Requested by

Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b299b5262cd9041a16aac3f05ba09ae64cb2c6351c0af1b9f832dbe3bc668286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 13 Oct 2020 08:00:54 GMT
server: ESF
date: Tue, 13 Oct 2020 08:00:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 13 Oct 2020 08:00:54 GMT

GET
H2 200 pramien_logo%20_white.svg
www.cdn925.com/CampImg/14484/ 15 KB
6 KB 99ms
47ms Image
image/svg+xml 104.18.90.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cdn925.com/CampImg/14484/pramien_logo%20_white.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.90.64 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b4175fcf2886812d3bcfa1800229b6ee3176826bc7a82e702f978f8872b1dc28

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 689
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29311860000cd873f967200000001
last-modified: Mon, 24 Aug 2020 18:27:54 GMT
server: cloudflare
etag: W/"946e2248447ad61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 5e178795acb4cd87-CDG
expires: Tue, 13 Oct 2020 12:00:54 GMT

GET
H2 200 check.svg
deindealheute.de/CampImg/13225/ 249 B
297 B 17ms
17ms Image
image/svg+xml 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/13225/check.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 6c33aedbd514f4a2df2657fb3061b3cec130cb55511fa51a6724468e689b18b6

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2018
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29311600000bec9f787b200000001
last-modified: Tue, 13 Aug 2019 16:49:10 GMT
server: cloudflare
etag: W/"479de37f751d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 5e1787956dc4bec9-FRA

GET
H2 200 pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v13/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v13/pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://deindealheute.de
Referer: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:54:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:01 GMT
server: sffe
age: 576402
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
expires: Wed, 06 Oct 2021 15:54:12 GMT

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v13/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v13/pxiByp8kv8JHgFVrLCz7Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://deindealheute.de
Referer: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 12 Oct 2020 17:51:43 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:13 GMT
server: sffe
age: 50951
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7832
x-xss-protection: 0
expires: Tue, 12 Oct 2021 17:51:43 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v13/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v13/pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://deindealheute.de
Referer: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 18:26:06 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:08:52 GMT
server: sffe
age: 567288
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7776
x-xss-protection: 0
expires: Wed, 06 Oct 2021 18:26:06 GMT

GET
H2 200 arrow.svg
deindealheute.de/CampImg/13225/ 317 B
594 B 24ms
23ms Image
image/svg+xml 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/13225/arrow.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: cacd64fdd4ece9fd09c455b35d320bbbd6fd773e89265f8e3c26da5de774aaef

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5738
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c293118e0000bec9f7882200000001
last-modified: Tue, 13 Aug 2019 18:59:55 GMT
server: cloudflare
etag: W/"3e56a04b952d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 5e178795bddebec9-FRA

GET
H2 200 email-decode.min.js Show response
deindealheute.de/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
878 B 10ms
9ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://deindealheute.de/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: gzip
vary: Accept-Encoding
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05c293118b0000bec9f7881200000001
last-modified: Mon, 12 Oct 2020 17:43:31 GMT
server: cloudflare
etag: W/"5f8495c3-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5e178795adddbec9-FRA
expires: Thu, 15 Oct 2020 08:00:54 GMT

GET
H2 200 de-logo.svg
www.cdn925.com/CampImg/13418/ 1 KB
679 B 40ms
39ms Image
image/svg+xml 104.18.90.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cdn925.com/CampImg/13418/de-logo.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.90.64 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: d6db6766abe3a2ca0d44e7ccd73d8d5ab9cf57f8d0203ee8d2fb0d2d40c11aab

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1666
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29311900000cd873f969200000001
last-modified: Mon, 14 Oct 2019 21:16:06 GMT
server: cloudflare
etag: W/"4bef5597d482d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 5e178795bccacd87-CDG
expires: Tue, 13 Oct 2020 12:00:54 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 941 B
700 B 24ms
24ms Script
text/javascript 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=6LdVFrgUAAAAAEMNq1ljl8HZSQ2sA8Hu6a8umPQr

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

00553cbef139c01c0c540fee26fe9c1c965c2fdf0246ce87d9d15d791de4429a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 608
x-xss-protection: 1; mode=block
expires: Tue, 13 Oct 2020 08:00:54 GMT

GET
H2 200 check-big.svg
deindealheute.de/CampImg/13069/ 230 B
320 B 14ms
14ms Image
image/svg+xml 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/13069/check-big.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a21703f977e30db26b4192f12a0f100bb1e1b3458bcf3373b6342f56d90d17d6

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2660
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29311950000bec9f7883200000001
last-modified: Tue, 25 Jun 2019 15:04:43 GMT
server: cloudflare
etag: W/"b7e04d52672bd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 5e178795bde2bec9-FRA

GET
H3-Q050 200 pxiByp8kv8JHgFVrLDD4Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v13/ 8 KB
8 KB 29ms
14ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v13/pxiByp8kv8JHgFVrLDD4Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e28d860a51754d183f6f97432fd94046cd31afb7ce65c8ea179b0ff63b3d84fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://deindealheute.de
Referer: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700,800,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 18:39:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
age: 566463
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7844
x-xss-protection: 0
expires: Wed, 06 Oct 2021 18:39:51 GMT

POST
H2 200 BrowserInfo.ashx Show response
deindealheute.de/Services/ 0
100 B 209ms
208ms XHR
text/plain 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/Services/BrowserInfo.ashx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&windowx=1600&windowy=1200&resolutionx=1600&resolutiony=1200
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
status: 200
cache-control: private
cf-ray: 5e178795fdf9bec9-FRA
content-length: 0
cf-request-id: 05c29311bf0000bec9f7886200000001

GET
H2 200 PixelEventLogIframe.aspx Show response
deindealheute.de/ Frame 5C09 2 KB
722 B 214ms
213ms Document
text/html 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 7a78cf987682b80293009751a69b82ed0be139fbd436cee4da44b9ef8e1c30f7

Request headers

:method: GET
:authority: deindealheute.de
:scheme: https
:path: /PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d90194dae59f00357e6415d8bc52e410e1602576054; ASP.NET_SessionId=ntewgdws4u5lrtwsrp4yx0dv; AF3_Cookie=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=

Response headers

status: 200
date: Tue, 13 Oct 2020 08:00:54 GMT
content-type: text/html; charset=utf-8
cache-control: private
vary: Accept-Encoding
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
cf-request-id: 05c29311cf0000bec9f7887200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5e1787961e02bec9-FRA
content-encoding: br

GET
H2 200 GetRewardValue.ashx Show response
deindealheute.de/Services/ 433 B
412 B 208ms
207ms XHR
text/plain 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/Services/GetRewardValue.ashx?c=28&Value=amazon500de
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: ead7dff7eb83750b2d9f0868376c8c01a30f4f827070d33ad92a55d5d050be64

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:54 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29311d00000bec9f7888200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: private
cf-ray: 5e1787961e03bec9-FRA

GET
H/1.1 200
OK Cookie set LocalStorageSetNew.html
www.clicken.us/tag/ Frame 2409 0
0 148ms
121ms Document
text/html 2606:4700::6812:810c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clicken.us/tag/LocalStorageSetNew.html?1=1&vid=FdDcEjcUuYtOA0qwJ88nrg2
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:810c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash

Request headers

Host: www.clicken.us
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=

Response headers

Date: Tue, 13 Oct 2020 08:00:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=ddea29a54f4bcda1ad99eeee4d977067f1602576054; expires=Thu, 12-Nov-20 08:00:54 GMT; path=/; domain=.clicken.us; HttpOnly; SameSite=Lax
Last-Modified: Tue, 26 Mar 2019 18:08:29 GMT
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
Via: 1.1 google
CF-Cache-Status: DYNAMIC
cf-request-id: 05c29311f1000005ede99b6200000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 5e1787964cd205ed-FRA
Content-Encoding: gzip

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/48TunWH-ZrLteSwFVbw6tVnx/ 341 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/48TunWH-ZrLteSwFVbw6tVnx/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=6LdVFrgUAAAAAEMNq1ljl8HZSQ2sA8Hu6a8umPQr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68575ad691a70cbdbe9e806567291969d2813ac54ae3a6e26f4778ba568b522e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://deindealheute.de
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 07:05:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3341
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136438
x-xss-protection: 0
last-modified: Mon, 05 Oct 2020 17:20:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Oct 2021 07:05:13 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 8E4B 0
0 28ms
27ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdVFrgUAAAAAEMNq1ljl8HZSQ2sA8Hu6a8umPQr&co=aHR0cHM6Ly9kZWluZGVhbGhldXRlLmRlOjQ0Mw..&hl=en&v=48TunWH-ZrLteSwFVbw6tVnx&size=invisible&cb=8g1l2230c1i5

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/48TunWH-ZrLteSwFVbw6tVnx/recaptcha__en.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dvsbohUPra0HpUKZQm+xuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LdVFrgUAAAAAEMNq1ljl8HZSQ2sA8Hu6a8umPQr&co=aHR0cHM6Ly9kZWluZGVhbGhldXRlLmRlOjQ0Mw..&hl=en&v=48TunWH-ZrLteSwFVbw6tVnx&size=invisible&cb=8g1l2230c1i5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 13 Oct 2020 08:00:54 GMT
content-security-policy: script-src 'report-sample' 'nonce-dvsbohUPra0HpUKZQm+xuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10361
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 girl.jpg
deindealheute.de/CampImg/13225/ 134 KB
134 KB 30ms
29ms Image
image/jpeg 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/13225/girl.jpg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 65fd4de6f0187fc8f5ce7382a7ef93ba75fbc6c2fee525daf84cd362b878d796

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5249
x-powered-by: ASP.NET
status: 200
content-length: 136992
cf-request-id: 05c29312c90000bec9f788f200000001
last-modified: Tue, 13 Aug 2019 18:51:45 GMT
server: cloudflare
etag: "512f8b27852d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e178797ae80bec9-FRA

GET
H2 200 amazon500de.png
deindealheute.de/CampImg/1718/SuperDynamic/genericimg/ 202 KB
203 KB 22ms
21ms Image
image/png 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/1718/SuperDynamic/genericimg/amazon500de.png
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: aa73d10cdc1ac83c61b4a5eb3e2bf3007b0b6734c46f465ccc8f393a91e4e64d

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 277
x-powered-by: ASP.NET
status: 200
content-length: 207195
cf-request-id: 05c29312ca0000bec9f7890200000001
last-modified: Fri, 15 Nov 2019 21:19:03 GMT
server: cloudflare
etag: "25aa744efa9bd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e178797ae81bec9-FRA

GET
H2 200 exit.svg
deindealheute.de/CampImg/13069/assets/ 302 B
290 B 25ms
25ms Image
image/svg+xml 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://deindealheute.de/CampImg/13069/assets/exit.svg
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: abd900b6dd12e8461b9e75553623192c07621e46a3f9f96b02bbbb4827e9f86d

Request headers

Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 876
x-powered-by: ASP.NET
status: 200
cf-request-id: 05c29313380000bec9f7899200000001
last-modified: Tue, 25 Feb 2020 20:32:53 GMT
server: cloudflare
etag: W/"a54692c11aecd51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 5e1787985ec6bec9-FRA

GET
H2 200 jquery-1.8.2.min.js Show response
deindealheute.de/JS/ Frame 5C09 91 KB
32 KB 19ms
18ms Script
application/javascript 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f23d4b309b72743aa8afe1f8c98a25b3ee31246fa572c66d9d8cb1982cae4fbc

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3577
x-powered-by: ASP.NET
status: 200
cf-int-pingora-origin-digest: {"ext_ip":"162.158.91.105","ext_port":39218,"upstream_rtt":95,"upstream_reused":false,"http_version":1}
cf-request-id: 05c293133c0000bec9f789a200000001
last-modified: Mon, 17 Mar 2014 14:18:05 GMT
server: cloudflare
etag: W/"808c61b6eb41cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5e1787986ec9bec9-FRA

GET
H2 200 quant.js Show response
secure.quantserve.com/ Frame 5C09 23 KB
9 KB 210ms
66ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 20 Oct 2020 08:00:55 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ Frame 5C09 1 KB
1 KB 61ms
20ms Script
application/x-javascript 104.111.238.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-238-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 13 Oct 2020 08:00:55 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 884
Expires: Wed, 14 Oct 2020 08:00:55 GMT

POST
H2 200 Rctp.ashx Show response
deindealheute.de/Services/ 3 B
102 B 246ms
246ms XHR
text/plain 2606:4700:3037::ac43:a485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://deindealheute.de/Services/Rctp.ashx
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/JS/jquery-1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 221764976efe04132774d96b0253cc31434c5261737469324f222621baf34b20

Request headers

Accept: */*
Referer: https://deindealheute.de/?Flow=599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0&isPrePop=true&reward=amazon500de&o=211151&subaff1=4078-2SPvnmY6rt&subaff2=203968&subaff3=142453&subaff4=DE-amazon500de&DVID=
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 13 Oct 2020 08:00:55 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602576055"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
status: 200
cache-control: private
cf-ray: 5e178798ef06bec9-FRA
cf-request-id: 05c29313910000bec9f789c200000001

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/ Frame 5C09
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUu...
https://sb.scorecardresearch.com/b2?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcU...

0
528 B

20ms
20ms

Image
text/plain

104.111.238.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041&c9=https%3A%2F%2Fdeindealheute.de%2F%3FFlow%3D599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0%26isPrePop%3Dtrue%26reward%3Damazon500de%26o%3D211151%26subaff1%3D4078-2SPvnmY6rt%26subaff2%3D203968%26subaff3%3D142453%26subaff4%3DDE-amazon500de%26DVID%3D&cs_ak_ss=1
Requested by: Host: deindealheute.de
URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-238-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 13 Oct 2020 08:00:55 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=24608197&ns__t=1602576055227&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041&c9=https%3A%2F%2Fdeindealheute.de%2F%3FFlow%3D599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0%26isPrePop%3Dtrue%26reward%3Damazon500de%26o%3D211151%26subaff1%3D4078-2SPvnmY6rt%26subaff2%3D203968%26subaff3%3D142453%26subaff4%3DDE-amazon500de%26DVID%3D&cs_ak_ss=1
Pragma: no-cache
Date: Tue, 13 Oct 2020 08:00:55 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-GYKC8ztuNQmWF.js Show response
rules.quantcount.com/ Frame 5C09 3 B
356 B 169ms
132ms Script
application/x-javascript 2600:9000:206e:3c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-GYKC8ztuNQmWF.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 07:59:59 GMT
via: 1.1 e2fae56164d235b42cd2d6ea7e62d0af.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 57
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: 39JsEhITpDETlurTqFfVrm6cwVTaRUC2XlUMLGvvjMkGjTxfPc-xJg==

GET
H2 200 pixel;r=822555650;rf=0;uht=2;a=p-GYKC8ztuNQmWF;url=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041;ref=https%3A%2F%2F...
pixel.quantserve.com/ Frame 5C09 35 B
371 B 26ms
24ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=822555650;rf=0;uht=2;a=p-GYKC8ztuNQmWF;url=https%3A%2F%2Fdeindealheute.de%2FPixelEventLogIframe.aspx%3FFlowID%3D47081%26VID%3DFdDcEjcUuYtOA0qwJ88nrg2%26PixelEvtID%3D16041;ref=https%3A%2F%2Fdeindealheute.de%2F%3FFlow%3D599059EA-8CC8-7947-1F7A-B6F003E658C7F163B7F0%26isPrePop%3Dtrue%26reward%3Damazon500de%26o%3D211151%26subaff1%3D4078-2SPvnmY6rt%26subaff2%3D203968%26subaff3%3D142453%26subaff4%3DDE-amazon500de%26DVID%3D;fpan=1;fpa=P0-1165078730-1602576055555;ns=1;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;d=deindealheute.de;je=0;sr=1600x1200x24;dst=1;et=1602576055554;tzo=-120;ogl=

Requested by

Host: deindealheute.de
URL: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://deindealheute.de/PixelEventLogIframe.aspx?FlowID=47081&VID=FdDcEjcUuYtOA0qwJ88nrg2&PixelEvtID=16041
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 13 Oct 2020 08:00:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Verdicts & Comments Add Verdict or Comment

132 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deindealheute.de/	1970-01-19 22:34:04	Name: __qca Value: P0-1165078730-1602576055555
deindealheute.de/	1970-01-19 21:55:12	Name: AF3_Cookie Value:
deindealheute.de/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: ntewgdws4u5lrtwsrp4yx0dv
.deindealheute.de/	1970-01-19 13:52:48	Name: __cfduid Value: d90194dae59f00357e6415d8bc52e410e1602576054

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bxt1.shaperal.com
c.ratrck.com
deindealheute.de
fonts.googleapis.com
fonts.gstatic.com
lion.chairhelmet.com
mobi.billiwa.com
pixel.quantserve.com
rules.quantcount.com
sb.scorecardresearch.com
secure.quantserve.com
www.cdn925.com
www.clicken.us
www.google.com
www.gstatic.com
104.111.238.139
104.18.90.64
116.202.159.172
2600:9000:206e:3c00:6:44e3:f8c0:93a1
2606:4700:3037::ac43:a485
2606:4700::6812:810c
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:80b::2003
2a00:1450:4001:81c::2004
2a00:1450:4001:820::200a
2a00:1450:4001:825::200a
31.170.100.125
52.70.54.205
67.212.173.78
00553cbef139c01c0c540fee26fe9c1c965c2fdf0246ce87d9d15d791de4429a
14f6ad4b396ee40221f1db84e325e96c8de1263507d3d3d8d71a4c9b15c8dcbe
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1e8cdf8b6b76616f6e721a0f53dfab323db16cc7eddfd7136135c5d5382ff126
221764976efe04132774d96b0253cc31434c5261737469324f222621baf34b20
24268e8a786679a57c7015081af7758ab42cf052b97e910a8bd3b8ce856ef2bb
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
3444cd973ee58f19da7ea798d5e1b73c087f48017dc01c03d6d55011293cf2c4
41bc57b7e16aaf1929e3ba6d4760af470fe7e181e6ba7b07fe2d7e10d66852fe
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
65fd4de6f0187fc8f5ce7382a7ef93ba75fbc6c2fee525daf84cd362b878d796
68575ad691a70cbdbe9e806567291969d2813ac54ae3a6e26f4778ba568b522e
6c33aedbd514f4a2df2657fb3061b3cec130cb55511fa51a6724468e689b18b6
6e1f86eae2a33c0f0e5f5b149545536900e257f964feeb22b201021d908dd582
6ed0d7b87ea29f9c157a2fec78b8177495f069211b5e5c4550a8497cfec1c1ae
773647c4a0546b6b79a1dc5c8992964fa377ccfb5a5cde07d8084942a690231e
7a78cf987682b80293009751a69b82ed0be139fbd436cee4da44b9ef8e1c30f7
870ad19adb746efa6dc0352b438182a8ac60c95b140091407025411512e9c6ff
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a21703f977e30db26b4192f12a0f100bb1e1b3458bcf3373b6342f56d90d17d6
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
aa73d10cdc1ac83c61b4a5eb3e2bf3007b0b6734c46f465ccc8f393a91e4e64d
abd900b6dd12e8461b9e75553623192c07621e46a3f9f96b02bbbb4827e9f86d
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f
b1f73cdf418db0fb3758307e4e83c858f1e91d50c750fc65d0a3d54d966a9106
b299b5262cd9041a16aac3f05ba09ae64cb2c6351c0af1b9f832dbe3bc668286
b4175fcf2886812d3bcfa1800229b6ee3176826bc7a82e702f978f8872b1dc28
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cacd64fdd4ece9fd09c455b35d320bbbd6fd773e89265f8e3c26da5de774aaef
d0401ccef3aad28475290a3540dcbf35cf798e414d9b6cc612dba8731bd0ea51
d6db6766abe3a2ca0d44e7ccd73d8d5ab9cf57f8d0203ee8d2fb0d2d40c11aab
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
e28d860a51754d183f6f97432fd94046cd31afb7ce65c8ea179b0ff63b3d84fa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ead7dff7eb83750b2d9f0868376c8c01a30f4f827070d33ad92a55d5d050be64
f0eb9ece706d722ccab204bd08b56af28d95666e63d514c908a034243ceafa01
f23d4b309b72743aa8afe1f8c98a25b3ee31246fa572c66d9d8cb1982cae4fbc
f758cf71bff52e983f82b4643f230a8adfec570eca671bc1c06011e747f66c52
fadd4e57c1b24aa7e466ddfa335e3eac5d69a2c723913180de4b68e465fc9042

deindealheute.de Open in urlscan Pro 2606:4700:3037::ac43:a485 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

44 Requests

100 %HTTPS

57 %IPv6

13 Domains

16 Subdomains

13 IPs

4 Countries

697 kBTransfer

1342 kBSize

4 Cookies

10 Outgoing links

Page URL History

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

deindealheute.de Open in urlscan Pro
2606:4700:3037::ac43:a485 Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

100 %
HTTPS

57 %
IPv6

13
Domains

16
Subdomains

13
IPs

4
Countries

697 kB
Transfer

1342 kB
Size

4
Cookies

44 HTTP transactions
0 data transactions