lbg3ncntw5z2.com Open in urlscan Pro
188.114.96.9 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://f4f5aijphi1v.com/
Effective URL:
https://lbg3ncntw5z2.com/QMRB9g
Submission: On September 30 via api (September 30th 2024, 12:58:34 pm UTC) from IE — Scanned from NL

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 11 domains to perform 26 HTTP transactions. The main IP is 188.114.96.9, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is lbg3ncntw5z2.com.
TLS certificate: Issued by WE1 on September 26th 2024. Valid for: 3 months.

This is the only time lbg3ncntw5z2.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 13	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	193.108.118.16 193.108.118.16	63023 (AS-GLOBAL...) (AS-GLOBALTELEHOST)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2a01:4f8:10a:... 2a01:4f8:10a:26c7::2	24940 (HETZNER-AS) (HETZNER-AS)
2	142.250.185.99 142.250.185.99	15169 (GOOGLE) (GOOGLE)
1 1	176.9.1.39 176.9.1.39	24940 (HETZNER-AS) (HETZNER-AS)
1	193.108.118.133 193.108.118.133	63023 (AS-GLOBAL...) (AS-GLOBALTELEHOST)
3	188.114.96.9 188.114.96.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	10

3 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

f4f5aijphi1v.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

kordooso.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
epicdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.108.118.16 (Frankfurt am Main, Germany)

ASN63023 (AS-GLOBALTELEHOST, US)
PTR: 16-118-108-193.clients.gthost.com

news-zizipo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:10a:26c7::2 (Germany)

ASN24940 (HETZNER-AS, DE)

show.partners-show.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.1.39 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: push-house-cdn-119.t.push.house

img.cdn.house	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.108.118.133 (Frankfurt am Main, Germany)

ASN63023 (AS-GLOBALTELEHOST, US)
PTR: 133-118-108-193.clients.gthost.com

epics3.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 188.114.96.9 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

lbg3ncntw5z2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	kordooso.net kordooso.net	20 KB
3	lbg3ncntw5z2.com lbg3ncntw5z2.com	2 KB
3	f4f5aijphi1v.com f4f5aijphi1v.com — Cisco Umbrella Rank: 792653	22 KB
2	gstatic.com fonts.gstatic.com	36 KB
2	news-zizipo.com news-zizipo.com — Cisco Umbrella Rank: 827189	20 KB
1	epics3.net epics3.net	75 KB
1	epicdn.net 1 redirects epicdn.net — Cisco Umbrella Rank: 371103	451 B
1	cdn.house 1 redirects img.cdn.house — Cisco Umbrella Rank: 9178	938 B
1	partners-show.com show.partners-show.com — Cisco Umbrella Rank: 18006	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	1 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 8986	545 B
26	11

	Domain	Requested by
12	kordooso.net	f4f5aijphi1v.com kordooso.net
3	lbg3ncntw5z2.com	f4f5aijphi1v.com
3	f4f5aijphi1v.com	kordooso.net
2	fonts.gstatic.com	fonts.googleapis.com
2	news-zizipo.com	f4f5aijphi1v.com news-zizipo.com
1	epics3.net
1	epicdn.net	1 redirects
1	img.cdn.house	1 redirects
1	show.partners-show.com	news-zizipo.com
1	fonts.googleapis.com	client
1	my.rtmark.net	kordooso.net
26	11

This site contains no links.

Subject Issuer	Validity	Valid
f4f5aijphi1v.com WE1	`2024-08-24` - `2024-11-22`	3 months	crt.sh
kordooso.net WE1	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.news-zizipo.com E6	`2024-08-03` - `2024-11-01`	3 months	crt.sh
rtmark.net R11	`2024-08-30` - `2024-11-28`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
show.partners-show.com E6	`2024-09-13` - `2024-12-12`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
lbg3ncntw5z2.com WE1	`2024-09-26` - `2024-12-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lbg3ncntw5z2.com/QMRB9g
Frame ID: B3DF5421BC2FB2BB036C38583A885593
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

404 Not Found

Page URL History Show full URLs

http://f4f5aijphi1v.com/ HTTP 307
https://f4f5aijphi1v.com/ Page URL
https://lbg3ncntw5z2.com/QMRB9g Page URL

Page Statistics

26
Requests

96 %
HTTPS

30 %
IPv6

11
Domains

11
Subdomains

10
IPs

4
Countries

180 kB
Transfer

356 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://f4f5aijphi1v.com/ HTTP 307
https://f4f5aijphi1v.com/ Page URL
https://lbg3ncntw5z2.com/QMRB9g Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://f4f5aijphi1v.com/ HTTP 307
https://f4f5aijphi1v.com/

Request Chain 21

https://img.cdn.house/i/1/GPqR43Wpg92GlQ-OhiR6DOdPSiGBGKsRA7J-z8pKa11g6f2YQYcbvacndW6GdNicCo1Btum3xuUJqwwQUA93dtW5NFN_NtVfL2lQPuVzyzCtVzU9MuJcmyuoz9lP1A0GU4swRHDZWjdR_FIIrPT-iyJWR_ggGwIAGQATa7Oovs8EsMz6DO6_X4BCIflf5Pt68DhcFfG4gFnxLQ0WtJS8ZTL_6RBu2-gjkRwiyJLosvI1w5vfHTKl8EGY2AbeNboqW_NWQE3-4eevA5roVMNLjhO1pwe6Nu7RN6ZAmUYARvoP5AI7qzOgEi-VQ1vfnxI_22G2qx__s7Br8_xCLr4w0y2mG0RYoieR9DN1ggq2VU_wBNpIvQgF6Rc9GEVnSA2AeqrP0qW9ERLSpPFURKjlXCt7bvARtGTLcxdK5Aw8dA4RC5-o_hj4JAMF3GbQ6wHcD4RqweJKlHHZV0yzctF3eLutSLxHNPUfh_De0UkBLcuKCFKBXj28nnh91ahINSyqNDvY7nmprTJR0U2VApps-35DBUP6tM34puozczgYO4dQ_S2enWxfpAJxm93L-AwH--zZK9zx2icSBoFGeoIEsXaKK4nCYF7rWF8filwEwYIjH-ffMNGCNfWXQv8MhQQr6nuONIFOvcFScm7faCUylcebbba8s_Bjr0mFkbzjoEKz_Gzo1YAMqS8DT3fnseBRgW-MR9-5C7ZocMDzRyc1s8ooFQrI79btDyz71OgOxrCvQncRXsc-m9GEsVPOvmPd7uxT9NUNQb4777eRjT4hl6xelFjgE6-a2ydLCoGDcr0R4RqlDllkBImIafZd2iM2tMRo3p6mYYo2Va71QineBY3jhC8bF1Th_Prx95AIsjzdEceH-gJMXIIkxrlqzJMlaH070yKfa0wcCX3ep3QiCCVIIbJTa94oRPONBDIeEAhKxM46ZsERsRC_ek-uxLdp2Q5d2dEZFWowXNI3MSDYf8B8v_gn95S8rFedQUUs1z_aj_sgzjrR5mqwcriy2qMW83P8-7l4pZH6zPEcqyZTIhE7A4_pvBCNh2RMOi9fSVRpfCNMvivXau4Fc6Xp3XUx8iPORoFKFQKyqhdRr1Y2riaJaDoGn4OZ5M6G2E1fAvz-8RV6aaEPTaSL9uULJZkQBG6vNxrj9wKyIJ6Mrm_JnGpJy3h5mdji1qsnDQF4KjOrywHSsXaeSHuXYAqb3l1UohkjoP8MfnNyNAeumoyGUorxQ7c4jbPLXJlnjyVghwLNvBjqXgrjYPJS9x8NOUTCK8kVnZs8ACak-hG5WfckemIwyXnWXOFGK9R5Cgfs6jNoaD4flnNpBlJx9cBgoweHgGVCFf5QEZxqhhCWsDD83ClomagF6XBWaa4K32Xjpj47tXnWuIb54d1-JPvl3LcOQXmkMhVn_gpeCvx2VTV2MZ3bDxCsscWKF7P8u5DihydRYfGzBiStBILTbURGqr7_5e7JG0qDVCESJhevd5kYqVf_TNt2pjoY8i1d7EbeTIoAHDk7clA5eVOtN_2saLdjy7Q1OQTRHGvtvKEZJ25sJdoZ7PQVUxWpOClXFcw7PIBp7S3htK2qN2gKaHH8aFOjiH9K-O6aIpPx0_ZdZk0lTeLt4LZdwPbWfEmV HTTP 307
https://epicdn.net/cdn/?id=eyJhY2NlcHRfbGFuZ3VhZ2UiOiJubCIsImFkdl91c2VyX2lkIjoxMjQsImFkdmVydGlzZW1lbnRfaWQiOiI4MTMiLCJicm93c2VyIjoiQ2hyb21lIiwiY2FtcGFpZ25fY2F0ZWdvcnkiOjEyLCJjYW1wYWlnbl9pZCI6IjM5MSIsImNpdHlfZ2VvbmFtZV9pZCI6MCwiY2xpY2tfcHJpY2UiOjAuMDAwMSwiY29ubmVjdGlvbl90eXBlIjoiV2lGaSIsImNvdW50cnlfaXNvIjoiTkwiLCJkZXZpY2VfdHlwZSI6IkRlc2t0b3AiLCJkc3BfaWQiOjIsImZvcm1hdCI6IkluUGFnZSIsImlfdCI6MTcyNzcwMTExMCwiaWNvbiI6ImEvaW1nLzcwLzEyNC8zOTEvcFNRcmw1ZmwxOWxSMEJBdnFhdlVFWGJ6N3NveGRicEE0cGlVMVpwTS5wbmciLCJpcCI6IjIwMDE6MWFmODo1MDAwOmEwMjY6NTo6MTEiLCJpc3AiOiJMZWFzZVdlYiBOZXRoZXJsYW5kcyBCLlYuIiwibGFuZGluZ19pZCI6MCwib3MiOiJMaW51eCIsIm9zX3ZlcnNpb24iOiJ4ODZfNjQiLCJwYXltZW50X21vZGVsIjoiQ1BDIiwicmVkaXJlY3RfdXJsIjoiIiwic291cmNlX2lkIjozODAsInNzcF9pZCI6MCwic3ViMSI6IiIsInN1YjIiOiIiLCJzdWIzIjoiIiwic3ViNCI6IiIsInN1YnNjcmliZWRfYXQiOjE3Mjc3MDExMTAsInN1YnNjcmlwdGlvbl9pZCI6MCwidHJhZmZpY19jaGFubmVsIjoiRFNQIiwidWFfdmVyc2lvbiI6MTI5LCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI5LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ3ZWJfdXNlcl9pZCI6MTQyfQ== HTTP 301
https://epics3.net/epic/a/img/70/124/391/pSQrl5fl19lR0BAvqavUEXbz7soxdbpA4piU1ZpM.png

26 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
f4f5aijphi1v.com/
Redirect Chain

http://f4f5aijphi1v.com/
https://f4f5aijphi1v.com/

47 KB
21 KB

398ms
311ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://f4f5aijphi1v.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.4.16
Resource Hash: 83ef03f3025122620be1d3f8ba428f3dc241b4698ad9c1a83aac1591910ab42f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8cb4627dea2d9007-FRA
content-encoding: br
content-type: text/html
date: Mon, 30 Sep 2024 12:58:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJxC0rF8Ko2euuzdmLnm1QZgFA4KpqNkKuwMEWrY6kNOzEjTkKx%2FYFO0YQ7U22Tw%2BKmvKSdoh4ZhAiq556UiQ6NUuOJuG1jUQ25Y1byo%2FP7NE1qRjxhtVPMJQb1KtzSXmeguoHs5gcy3eNjtWK8I"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-powered-by: PHP/5.4.16

Redirect headers

Location: https://f4f5aijphi1v.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 speculation
f4f5aijphi1v.com/cdn-cgi/ 128 B
469 B 26ms
26ms Other
application/speculationrules+json 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://f4f5aijphi1v.com/cdn-cgi/speculation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://f4f5aijphi1v.com
Referer: https://f4f5aijphi1v.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zmSLHFor6FKjwy6BHKgHzCY7ma2fEhZjiHFP1imGltkQBABERX%2Bn0Zxr7uo2iJ0CMqPsqGCc4Ff3Tf0T%2Fst6fmJoTERHwkbLGc1rBW8Jq13QnxxPUYBSX9hz44CqSK6xYDh0C%2B5elocXdeczIAMT"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb462802c8e9007-FRA
access-control-allow-origin: https://f4f5aijphi1v.com
content-length: 128
date: Mon, 30 Sep 2024 12:58:29 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 micro.tag.min.js Show response
kordooso.net/pfe/current/ 44 KB
18 KB 114ms
61ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Requested by: Host: f4f5aijphi1v.com
URL: https://f4f5aijphi1v.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 403eab57f3f705694d11605c729d605960bf6b84d07bc4db8a5b5c9e71938998

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: MISS
etag: W/"66f66832-b13b"
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T1sXcBr%2ByWRrJxhSrhNMkr4MoK5j%2BVfPI4kLvt%2FQyTJy%2BzdKPyKhb9BAePuQ7VTB0U3yMXuLCnDSUIYCeW1Jk9HcL5CfQPDccmzKQ6DCvte%2BlPuhdIRU%2Butpg7%2BR4VI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb46280cdb6364d-FRA
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Sep 2024 12:58:29 GMT
content-type: application/javascript
last-modified: Fri, 27 Sep 2024 08:09:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ 19 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6678fbb34f3ef18c5649c7cfc1302c671ff5b1c8e9f4365fb51f3d629dab2924

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 process.js Show response
news-zizipo.com/ 26 KB
10 KB 138ms
53ms Script
application/javascript 193.108.118.16
AS-GLOBALTELEHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://news-zizipo.com/process.js?id=1221409973&p1=&p2=
Requested by: Host: f4f5aijphi1v.com
URL: https://f4f5aijphi1v.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.108.118.16 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS: 16-118-108-193.clients.gthost.com
Software: nginx /
Resource Hash: da11116670eb42e3dd75a6169a18ecf41d138979ad53d139a0e125aac662ced2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
expires: 0
date: Mon, 30 Sep 2024 12:58:29 GMT
content-type: application/javascript; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx

GET
H2 200 sw-check-permissions-ea38e.js
f4f5aijphi1v.com/ 0
714 B 314ms
309ms Other
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://f4f5aijphi1v.com/sw-check-permissions-ea38e.js?var=null&ymid=null&zoneId=3259275
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: MISS
etag: W/"620bebcf-236"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3auwStFSi6ITwGmQLNFbOdujbve3i7NvZmaGS5c5Czh7b63Zq4krSYDApq%2FoUAgC0M%2BXRp7EmsWi%2FnB9Ry1%2FZl3J3iqrT3KszPgeeoT0JhENbTyYqRC38ta0H4jcbxtwNSHpS8XMqL3Ek6w0r0%2F"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb462818e2d9007-FRA
expires: Tue, 01 Oct 2024 12:58:30 GMT
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: application/javascript
last-modified: Tue, 15 Feb 2022 18:07:11 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 200 zone
kordooso.net/ 0
563 B 67ms
64ms Ping
text/plain 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kordooso.net/zone?pub=0&zone_id=3259275&is_mobile=false&domain=f4f5aijphi1v.com&var=null&ymid=null&var_3=&var_4=&dsig=&tg=1&sw=3.1.559&trace_id=97e1b7b2-baea-4322-a233-a684eeb59ff0&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=&drf=

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

strict-transport-security: max-age=1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0KZf6sps9lyZjaXVmRxN8%2F8Rtd4LtygXCddNJ9gG%2FndUZe4K5%2FOG6XnBlArNx5%2BXiV773MWcgnOmmKpLJ5lpxXpBXMSeIT0AAh4gsHiZQTnQs4kTsbjRIzd7tJCJwpA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb462818ed6364d-FRA
access-control-allow-origin: https://f4f5aijphi1v.com
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 30 Sep 2024 12:58:30 GMT
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept

POST
H3 200 event
kordooso.net/ 0
0 55ms
52ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
545 B 137ms
38ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=3259275&checkDuplicate=true&ymid=null&var=null&source=pusher

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

41eb4c322a97034a21d447f9c607c0acb2c1dc12b2bea815bf450858648c2894

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

strict-transport-security: max-age=1
access-control-expose-headers: Authorization
timing-allow-origin: *, *
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
x-content-type-options: nosniff
access-control-allow-origin: https://f4f5aijphi1v.com
content-length: 65
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: application/json; charset=utf-8
server: nginx
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token

POST
H3 200 event
kordooso.net/ 0
0 74ms
68ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 62ms
57ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 56ms
51ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 50ms
44ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

GET
H2 200 314.js Show response
news-zizipo.com/ 99 KB
11 KB 25ms
21ms Script
application/javascript 193.108.118.16
AS-GLOBALTELEHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://news-zizipo.com/314.js
Requested by: Host: news-zizipo.com
URL: https://news-zizipo.com/process.js?id=1221409973&p1=&p2=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.108.118.16 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),
Reverse DNS: 16-118-108-193.clients.gthost.com
Software: nginx /
Resource Hash: bc029b9f4a962448d145a3c8336e236332fd34c8646d390d0245c3199af271e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

content-encoding: gzip
etag: "66f4007d-29f8"
accept-ranges: bytes
content-length: 10744
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 25 Sep 2024 12:22:21 GMT
server: nginx

GET
H3 200 zone Show response
kordooso.net/ 567 B
957 B 80ms
79ms Fetch
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kordooso.net/zone?pub=0&zone_id=3259275&is_mobile=false&domain=f4f5aijphi1v.com&var=null&ymid=null&var_3=&var_4=&dsig=&tg=1&sw=3.1.559&trace_id=97e1b7b2-baea-4322-a233-a684eeb59ff0&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3918c1c3b8fdc9c3e17eea340b5d609de41413bed48de7eb73f2c287446e0377

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

strict-transport-security: max-age=1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WnvgtFkeuh0%2FGN0CPTWdRM9R1ZEka43ANEWe6c7HQ%2B9DZIvE5ss1OebqHz6AytqkZYF%2Burwb31BHF%2FzIMPOa0x6vccXUv3VIpaH%2Fcgw%2B3auPDDkZs9%2FD94xZtqusDms%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb46282284a364d-FRA
access-control-allow-origin: https://f4f5aijphi1v.com
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: application/json; charset=utf-8
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept

POST
H3 200 event
kordooso.net/ 0
0 74ms
71ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
1 KB 105ms
33ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;600;700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b09b0920822a9385cac1bb34a1df9f96489dbbef839a5f33cf73c84b730410b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:58:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 30 Sep 2024 11:20:12 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

POST
H/1.1 200
OK / Show response
show.partners-show.com/api/v1/inpage/show/ 4 KB
3 KB 251ms
163ms Fetch
application/json 2a01:4f8:10a:26c7::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://show.partners-show.com/api/v1/inpage/show/?uid=136422&subacc=1221409973&adult=true&traffic=2&traceId=50a1d81c-8f2b-4bbb-9931-7c985ca1919b&limit=1
Requested by: Host: news-zizipo.com
URL: https://news-zizipo.com/process.js?id=1221409973&p1=&p2=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a01:4f8:10a:26c7::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: 0e2d8646e86917bb604455ab2182d7006a33e0dddb00929c50bd77064890dd97

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

Transfer-Encoding: chunked
Content-Encoding: br
Connection: close
Access-Control-Allow-Origin: https://f4f5aijphi1v.com
Date: Mon, 30 Sep 2024 12:58:30 GMT
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H3 200 event
kordooso.net/ 0
0 72ms
70ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 47ms
45ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 67ms
23ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;600;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://f4f5aijphi1v.com
Referer: https://fonts.googleapis.com/

Response headers

age: 311326
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 22:29:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Sep 2024 22:29:44 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H2

200

pSQrl5fl19lR0BAvqavUEXbz7soxdbpA4piU1ZpM.png
epics3.net/epic/a/img/70/124/391/
Redirect Chain

https://img.cdn.house/i/1/GPqR43Wpg92GlQ-OhiR6DOdPSiGBGKsRA7J-z8pKa11g6f2YQYcbvacndW6GdNicCo1Btum3xuUJqwwQUA93dtW5NFN_NtVfL2lQPuVzyzCtVzU9MuJcmyuoz9lP1A0GU4swRHDZWjdR_FIIrPT-iyJWR_ggGwIAGQATa7Oovs8...
https://epicdn.net/cdn/?id=eyJhY2NlcHRfbGFuZ3VhZ2UiOiJubCIsImFkdl91c2VyX2lkIjoxMjQsImFkdmVydGlzZW1lbnRfaWQiOiI4MTMiLCJicm93c2VyIjoiQ2hyb21lIiwiY2FtcGFpZ25fY2F0ZWdvcnkiOjEyLCJjYW1wYWlnbl9pZCI6IjM5MS...
https://epics3.net/epic/a/img/70/124/391/pSQrl5fl19lR0BAvqavUEXbz7soxdbpA4piU1ZpM.png

74 KB
75 KB

97ms
42ms

Image
image/png

193.108.118.133
AS-GLOBALTELEHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://epics3.net/epic/a/img/70/124/391/pSQrl5fl19lR0BAvqavUEXbz7soxdbpA4piU1ZpM.png

Protocol

Server

193.108.118.133 Frankfurt am Main, Germany, ASN63023 (AS-GLOBALTELEHOST, US),

Reverse DNS

133-118-108-193.clients.gthost.com

Software

MinIO /

Resource Hash

2f4619c6786796e83b7e6755acdf2d3739b8751c7bf8335f1f75e487046881bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://f4f5aijphi1v.com/

Response headers

x-amz-id-2: fe1ceedf105df23ddcf0982b29ad937d4e3c578fec067933dbb14be7f915dd27
strict-transport-security: max-age=31536000; includeSubDomains
etag: "5700d0b8a43d33538c3714b2d723c7cf"
x-content-type-options: nosniff
x-amz-request-id: 17FA0701A2A677F7
accept-ranges: bytes
x-amz-meta-mm-source-mtime: 2024-06-25T19:56:41.809Z
content-length: 76175
x-amz-bucket-region: eu-west-1
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:58:30 GMT
content-type: image/png
last-modified: Tue, 25 Jun 2024 19:56:42 GMT
server: MinIO
vary: Origin, Accept-Encoding

Redirect headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location: https://epics3.net/epic/a/img/70/124/391/pSQrl5fl19lR0BAvqavUEXbz7soxdbpA4piU1ZpM.png
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MYZfH8sg1G91oq0yLET8%2Fo1Sn%2FMF8ctINjCAkIcsK%2Fnq50mooP7d07VWiWxgBRWlQRxSTlbZkI38DNaC8ixdggfHHz5OMXpC8LWrKH4VaOxJbK7joXCLh1fFIeG0"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb46284da9d9b46-FRA
content-length: 0
date: Mon, 30 Sep 2024 12:58:30 GMT
server: cloudflare

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 20ms
20ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;600;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://f4f5aijphi1v.com
Referer: https://fonts.googleapis.com/

Response headers

age: 363375
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 08:02:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Sep 2024 08:02:15 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

POST
H3 200 event
kordooso.net/ 0
0 39ms
37ms Ping
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3259275&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://f4f5aijphi1v.com/

Response headers

GET
H3 404 Primary Request QMRB9g Show response
lbg3ncntw5z2.com/ 147 B
598 B 113ms
66ms Document
text/html 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lbg3ncntw5z2.com/QMRB9g
Requested by: Host: f4f5aijphi1v.com
URL: https://f4f5aijphi1v.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54

Request headers

Referer: https://f4f5aijphi1v.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8cb4628e4e323808-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 30 Sep 2024 12:58:32 GMT
expires: Mon, 30 Sep 2024 12:58:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCIebwgNUqPqh8nF%2BoqYQ55ILCwBKR6x%2FzSJnodIFAxmxdEIlJz6CRhj%2Bnsmr4vAtCIH6FeyJ5Z10K0hyBznC9VRYlA6xVqN8f3jbU8Y%2FuG7LgCIbOT2okNe9B5Bixt8RD2j"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

GET
H3 200 speculation
lbg3ncntw5z2.com/cdn-cgi/ 128 B
538 B 36ms
34ms Other
application/speculationrules+json 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lbg3ncntw5z2.com/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://lbg3ncntw5z2.com
Referer: https://lbg3ncntw5z2.com/QMRB9g

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnpldUiDviHS4uUfgdfZ2kjZ3AJ2fiGFwZqozejUDO0%2FZ1r3GPBXAQNbYyUNvVoqqbsPRQFnh79BdICggJ%2BwRlZ5CcIhihA97Dn2LsgTBVB4J3jtT3bme5XOGTWQ5b%2Bdextp"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4628ecee43808-FRA
access-control-allow-origin: https://lbg3ncntw5z2.com
content-length: 128
date: Mon, 30 Sep 2024 12:58:32 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 404 favicon.ico
lbg3ncntw5z2.com/ 548 B
565 B 70ms
69ms Other
text/html 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lbg3ncntw5z2.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://lbg3ncntw5z2.com/QMRB9g

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wyXwsK23dbNvDp60iJyTaQ0BHYxTRucgKn%2BPRReHvYQrCrT9pQTrUQ1avM8Ya706gpgUTaDnZ%2B0HBQ5pXrzd35Lk6IFs7gUXooKk2yWrMX0i9tIHOXUqBaL%2F9FcpHCkc6%2Be0"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4628f9fd43808-FRA
date: Mon, 30 Sep 2024 12:58:32 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			my.rtmark.net/	1970-01-21 08:40:37	Name: ID Value: 0180e7f46cda4823e3662c624fa27a20

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lbg3ncntw5z2.com/QMRB9g Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lbg3ncntw5z2.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

epicdn.net
epics3.net
f4f5aijphi1v.com
fonts.googleapis.com
fonts.gstatic.com
img.cdn.house
kordooso.net
lbg3ncntw5z2.com
my.rtmark.net
news-zizipo.com
show.partners-show.com
139.45.195.8
142.250.185.99
176.9.1.39
188.114.96.9
188.114.97.3
193.108.118.133
193.108.118.16
2a00:1450:4001:81c::200a
2a01:4f8:10a:26c7::2
2a06:98c1:3120::3
0e2d8646e86917bb604455ab2182d7006a33e0dddb00929c50bd77064890dd97
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
2f4619c6786796e83b7e6755acdf2d3739b8751c7bf8335f1f75e487046881bf
3918c1c3b8fdc9c3e17eea340b5d609de41413bed48de7eb73f2c287446e0377
403eab57f3f705694d11605c729d605960bf6b84d07bc4db8a5b5c9e71938998
41eb4c322a97034a21d447f9c607c0acb2c1dc12b2bea815bf450858648c2894
6678fbb34f3ef18c5649c7cfc1302c671ff5b1c8e9f4365fb51f3d629dab2924
83ef03f3025122620be1d3f8ba428f3dc241b4698ad9c1a83aac1591910ab42f
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
b09b0920822a9385cac1bb34a1df9f96489dbbef839a5f33cf73c84b730410b5
bc029b9f4a962448d145a3c8336e236332fd34c8646d390d0245c3199af271e3
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
da11116670eb42e3dd75a6169a18ecf41d138979ad53d139a0e125aac662ced2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54

lbg3ncntw5z2.com Open in urlscan Pro 188.114.96.9 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

26 Requests

96 %HTTPS

30 %IPv6

11 Domains

11 Subdomains

10 IPs

4 Countries

180 kBTransfer

356 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

lbg3ncntw5z2.com Open in urlscan Pro
188.114.96.9 Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

96 %
HTTPS

30 %
IPv6

11
Domains

11
Subdomains

10
IPs

4
Countries

180 kB
Transfer

356 kB
Size

1
Cookies

26 HTTP transactions
1 data transactions