postbnde.pigeon-sky.com Open in urlscan Pro
91.234.46.215 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://reflor.clickfunnels.com/optin3lwb0ias
Effective URL:
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Submission: On May 10 via manual (May 10th 2023, 7:33:09 am UTC) from DE — Scanned from DE

Summary HTTP 33 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 33 HTTP transactions. The main IP is 91.234.46.215, located in Croatia and belongs to DHH-AS, HR. The main domain is postbnde.pigeon-sky.com.
TLS certificate: Issued by R3 on May 8th 2023. Valid for: 3 months.

This is the only time postbnde.pigeon-sky.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 11	2606:4700::68... 2606:4700::6810:10c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:e2:... 2606:4700:e2::ac40:850f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2606:4700:440... 2606:4700:4400::ac40:944b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:dc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
1 1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	91.234.46.215 91.234.46.215	12417 (DHH-AS) (DHH-AS)
3	2600:9000:225... 2600:9000:2251:0:13:46b5:7d80:93a1	16509 (AMAZON-02) (AMAZON-02)
33	10

11 2606:4700::6810:10c2 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

reflor.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
classic.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e2::ac40:850f (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:944b (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:dc2 (United States)

ASN13335 (CLOUDFLARENET, US)

app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

scambinance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 91.234.46.215 (Croatia) 2 redirects

ASN12417 (DHH-AS, HR)
PTR: cp15.infonet.hr

postbnde.pigeon-sky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2251:0:13:46b5:7d80:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.deutsche-bank.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	clickfunnels.com 4 redirects reflor.clickfunnels.com app.clickfunnels.com — Cisco Umbrella Rank: 44201 images.clickfunnels.com — Cisco Umbrella Rank: 83278 www.clickfunnels.com — Cisco Umbrella Rank: 78543 classic.clickfunnels.com — Cisco Umbrella Rank: 163016	766 KB
7	pigeon-sky.com 2 redirects postbnde.pigeon-sky.com	479 KB
6	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 449	17 KB
3	deutsche-bank.de www.deutsche-bank.de — Cisco Umbrella Rank: 275727	53 KB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1039	17 KB
1	scambinance.com 1 redirects scambinance.com	476 B
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 266	392 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1018	7 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50	3 KB
0	addevent.com Failed track.addevent.com Failed
33	10

	Domain	Requested by
7	postbnde.pigeon-sky.com	2 redirects reflor.clickfunnels.com postbnde.pigeon-sky.com
6	js-agent.newrelic.com	reflor.clickfunnels.com
6	app.clickfunnels.com	1 redirects reflor.clickfunnels.com app.clickfunnels.com
3	www.deutsche-bank.de	postbnde.pigeon-sky.com www.deutsche-bank.de
3	reflor.clickfunnels.com	1 redirects static.cloudflareinsights.com
2	classic.clickfunnels.com	reflor.clickfunnels.com
2	www.clickfunnels.com	2 redirects
2	use.fontawesome.com	reflor.clickfunnels.com
1	scambinance.com	1 redirects
1	bam.nr-data.net	js-agent.newrelic.com
1	static.cloudflareinsights.com	reflor.clickfunnels.com
1	images.clickfunnels.com	reflor.clickfunnels.com
1	fonts.googleapis.com	reflor.clickfunnels.com
0	track.addevent.com Failed	reflor.clickfunnels.com
33	14

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-07-23` - `2023-07-23`	a year	crt.sh
use.fontawesome.com GTS CA 1P5	`2023-05-06` - `2023-08-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-04-13` - `2024-05-14`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-18` - `2023-12-19`	a year	crt.sh
postbnde.pigeon-sky.com R3	`2023-05-08` - `2023-08-06`	3 months	crt.sh
www.deutsche-bank.de DigiCert EV RSA CA G2	`2022-11-15` - `2023-11-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Frame ID: B8BA22FFDFAC9F29EA1886899FE03350
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://reflor.clickfunnels.com/optin3lwb0ias HTTP 302
https://reflor.clickfunnels.com/optin1683620496022 Page URL
https://scambinance.com/go.php?url=https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re HTTP 302
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re HTTP 301
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/ HTTP 302
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

33
Requests

82 %
HTTPS

73 %
IPv6

10
Domains

14
Subdomains

10
IPs

3
Countries

1340 kB
Transfer

3506 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://reflor.clickfunnels.com/optin3lwb0ias HTTP 302
https://reflor.clickfunnels.com/optin1683620496022 Page URL
https://scambinance.com/go.php?url=https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re HTTP 302
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re HTTP 301
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/ HTTP 302
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://reflor.clickfunnels.com/optin3lwb0ias HTTP 302
https://reflor.clickfunnels.com/optin1683620496022

Request Chain 11

https://app.clickfunnels.com/cf.js HTTP 301
https://www.clickfunnels.com/cf.js HTTP 301
https://classic.clickfunnels.com/cf.js

Request Chain 15

https://www.clickfunnels.com/images/closemodal.png HTTP 301
https://classic.clickfunnels.com/images/closemodal.png

33 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

optin1683620496022 Show response
reflor.clickfunnels.com/
Redirect Chain

https://reflor.clickfunnels.com/optin3lwb0ias
https://reflor.clickfunnels.com/optin1683620496022

63 KB
19 KB

155ms
155ms

Document
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

302b5fb1a20a09324147a30a7b4c1b1b49c780eca362b6fa7320c8720aa2995d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
cache-control: max-age=60, public, s-maxage=600, r-maxage=10
cf-cache-status: HIT
cf-ray: 7c507de72966994b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 10 May 2023 07:33:03 GMT
last-modified: Tue, 09 May 2023 08:23:44 GMT
server: cloudflare
status: 200 OK
strict-transport-security: max-age=0
vary: Accept-Encoding
x-content-digest: 3445164366b51abd06ad1298062ec95df13099a7
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: stale, valid, store
x-request-id: 50773ae5072417f9c49df99d20965883
x-runtime: 0.340302

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
cache-control: no-cache
cf-cache-status: MISS
cf-ray: 7c507de5982b994b-FRA
content-type: text/html; charset=utf-8
date: Wed, 10 May 2023 07:33:03 GMT
location: https://reflor.clickfunnels.com/optin1683620496022
server: cloudflare
status: 302 Found
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss
x-request-id: 92da7defdc25d153fc5d1d9d7f6135f0
x-runtime: 0.073875

GET
H2 200 lander.css
app.clickfunnels.com/assets/ 425 KB
70 KB 106ms
98ms Stylesheet
text/css 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.css

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 428
last-modified: Wed, 03 May 2023 22:23:50 GMT
server: cloudflare
etag: W/"6452def6-6a514"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c507de83a23994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 07:53:03 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.9.0/css/ 55 KB
13 KB 81ms
32ms Stylesheet
text/css 2606:4700:e2::ac40:850f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by: Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 6F4C87DZXFN7GDB9
age: 440234
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: xEqB7llcR7T8Az/pPeXngMS05hikMnyvi0MYYsPXoY55qYouzk5ZLwgBdiTKOdZLE4Kuuqg3G78=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"dbf9d822cefe851ba6f66e1ad57e8987"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YALM04gx9w1rh9dPGpa4DBfwovdruI%2B%2FSGlwyVXQtiKt4JwNRMGY2lH9NojMlSSbrDpwdgvO2o9GZAy%2FLGwPwZN3K6xn2E2RQsvWHrXlSwM1LY%2BcXhLzQEyTIbYxo2zsFS3dnwd7%2FiTuhqDg8bDlu7Kh"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 7c507de87bed360b-FRA

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 26 KB
4 KB 83ms
35ms Stylesheet
text/css 2606:4700:e2::ac40:850f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by: Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 6F40C694Q614C19X
age: 440230
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: kHcpC8WS6K4jW6PdK3CEVgyJIM2pgd/eOQr0rlz+iO93RHLvxDafyAJXEB9Uz/E/9+IWHlRf9GU=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"e140a7d32f343530f016095df3cc2ae4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j7FaKkqgcuNEIi8BPXwzIZ3u2M1KBqA9o6Mh%2FV3bJTjUeYPWbUptpWFAvlSE5pMdN35sG9IURf%2FmxmKYwPM6mP4SOcAX1YGG6DAmOiLc8LscXG5QmTCl5YHJ09rOYMKmmqLaNXOrP%2BkGfGplCAz2frKy"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 7c507de87bef360b-FRA

GET
H2 200 css
fonts.googleapis.com/ 47 KB
3 KB 82ms
30ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

40dfc86a731622d863ae9d7f5858685ff512bd79b2353b4620125c72c84373f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 10 May 2023 07:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 10 May 2023 06:44:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 10 May 2023 07:33:03 GMT

GET
H2 200 application.js Show response
app.clickfunnels.com/assets/userevents/ 5 KB
2 KB 76ms
75ms Script
application/x-javascript 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/userevents/application.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a696b734193371073510c87df68430499c2f424ad3f7be42f586dc6aff78567b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 483
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-147c"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c507de90ae7994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 07:53:03 GMT

GET
H2 200 lander.js Show response
app.clickfunnels.com/assets/ 2 MB
660 KB 70ms
62ms Script
application/x-javascript 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23eb4278d4cfdfd99216ea683676c2131cd30f1f21f9d5fee91ff2331c2ebc33

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 491
last-modified: Wed, 03 May 2023 22:24:48 GMT
server: cloudflare
etag: W/"6452df30-23811d"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c507de83a24994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 07:53:03 GMT

GET
H2 200 ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ 5 KB
6 KB 56ms
47ms Image
image/webp 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by: Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
cf-cache-status: HIT
x-amz-request-id: ZFW03QJB2HS0SDTP
age: 4389
cf-polished: origFmt=png, origSize=9030
content-disposition: inline; filename="ClickfunnelsTag.webp"
content-length: 5276
x-amz-id-2: zhg7MrZkG+IOndfzsAJyOmaWlNlB4AhbMpnZxV5mILwTwq7IBxDdhATLwH722qVmbHTtOjNKiYDBqCp97Kzw+XHcfIGIR/BL+Ste8FVjUzQ=
cf-bgj: imgq:85,h2pri
last-modified: Fri, 03 Jan 2020 17:41:49 GMT
server: cloudflare
etag: "a633777156a5ffeb58c92d3d59fa4e34"
vary: Accept
content-type: image/webp
cache-control: public, max-age=2073600
accept-ranges: bytes
cf-ray: 7c507de92aff994b-FRA
expires: Sat, 03 Jun 2023 07:33:03 GMT

GET
H2 200 pushcrew.js Show response
app.clickfunnels.com/assets/ 637 B
460 B 81ms
80ms Script
application/x-javascript 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/pushcrew.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 752
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-27d"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c507de91af4994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 07:53:03 GMT

GET
H2 200 v52afc6f149f6479b8c77fa569edb01181681764108816 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 114ms
63ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816
Requested by: Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13a548e040a1ec08f77911fed1d559b95e5daae0ee227e632140e003c7268e7b

Request headers

Referer: https://reflor.clickfunnels.com/
Origin: https://reflor.clickfunnels.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
content-encoding: gzip
last-modified: Mon, 17 Apr 2023 20:41:48 GMT
server: cloudflare
etag: W/2023.4.2
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7c507de96f903a78-FRA

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

cf.js Show response
classic.clickfunnels.com/
Redirect Chain

https://app.clickfunnels.com/cf.js
https://www.clickfunnels.com/cf.js
https://classic.clickfunnels.com/cf.js

18 KB
6 KB

78ms
69ms

Script
application/x-javascript

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://classic.clickfunnels.com/cf.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:03 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 6753
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-476a"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
access-control-max-age: 1728000
access-control-allow-credentials: true
cf-ray: 7c507deb6d21994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

Redirect headers

date: Wed, 10 May 2023 07:33:03 GMT
server: cloudflare
vary: Accept-Encoding
location: https://classic.clickfunnels.com/cf.js
cache-control: max-age=3600
cf-ray: 7c507deb1af71e18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 10 May 2023 08:33:03 GMT

GET /
track.addevent.com/atc/ 0
0

GET
H2 200 async-api.8f89c105-1.231.0.min.js Show response
js-agent.newrelic.com/ 2 KB
2 KB 79ms
26ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/async-api.8f89c105-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

67f99ac35e1f837e5571b596248acd66df2dddedb17e20ba4527c825ec957ced

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: mU67jycgcinZxIFlMFQSe3f.nxc8alvQ
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKT2XJ7JTX5MPMSZ
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 1293
x-amz-id-2: /WGmaZ3hA8gp9LjeOdhyediyH/LOz04SRqkceduv3XEheyhrYD0bDGdonRnINdeCPugA2XdOGAI=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.039288,VS0,VE0
etag: "c795d925c282d627e664bd4811db2c5f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 3898

GET
H2 200 lazy-loader.67423d16-1.231.0.min.js Show response
js-agent.newrelic.com/ 928 B
619 B 80ms
26ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/lazy-loader.67423d16-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: T3hyF0giIyFMr4zq18cu84rHhrcGImyr
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKT17FV4BT381NMH
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 414
x-amz-id-2: 6GZBx4TFOr1bTnsl71I8LBI3/PUeK1zbeGYNAp0Pm+AQdToZTLOKgxbuM8d5j06zUpQkEebK03Q=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.039896,VS0,VE0
etag: "5c71e603fdc4b5e7eb31a10d4bf90768"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4466

GET
H2

200

closemodal.png
classic.clickfunnels.com/images/
Redirect Chain

https://www.clickfunnels.com/images/closemodal.png
https://classic.clickfunnels.com/images/closemodal.png

672 B
920 B

76ms
76ms

Image
image/webp

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://classic.clickfunnels.com/images/closemodal.png

Protocol

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=0
cf-cache-status: HIT
age: 483640
cf-polished: origFmt=png, origSize=788
content-disposition: inline; filename="closemodal.webp"
content-length: 672
last-modified: Mon, 01 May 2023 12:10:46 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "644fac46-314"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
access-control-allow-credentials: true
access-control-max-age: 1728000
accept-ranges: bytes
cf-ray: 7c507dec8e49994b-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Sat, 10 Jun 2023 07:33:04 GMT

Redirect headers

date: Wed, 10 May 2023 07:33:03 GMT
server: cloudflare
vary: Accept-Encoding
location: https://classic.clickfunnels.com/images/closemodal.png
cache-control: max-age=3600
cf-ray: 7c507debebf41e18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 10 May 2023 08:33:03 GMT

GET
H2 200 track Show response
app.clickfunnels.com/v1/ 118 B
853 B 275ms
226ms XHR
text/javascript 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/v1/track?_unique=0.005520875671441106&_uniqueVisitorID=null&_type=WINDOW&_location=ttps%3A//reflor.clickfunnels.com/optin1683620496022&_title=Hilfe%20%26%20Kontakt%20-%20Postbank%20BestSign&_key=rzaqvkch&_page_key=25t8yqllku44xtu8&_fid=12967470&_fspos=1&_fvrs=1&_funnel_stat=1&_location=https://reflor.clickfunnels.com/optin1683620496022&_referrer=

Requested by

Host: app.clickfunnels.com
URL: https://app.clickfunnels.com/cf.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

72bc9bf017d25d46e375132af60ac5c98b6742fb5d767c8f2eea2bdd34e9195b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=0
access-control-request-method: *
cf-cache-status: BYPASS
content-encoding: br
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 200 OK
x-request-id: b2fc5bf6dc27b76f97848a165f93542a
x-runtime: 0.022514
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c507dec3be63a8a-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-frame-options: ALLOWALL
x-rack-cache: miss

POST
H2 204 rum Show response
reflor.clickfunnels.com/cdn-cgi/ 0
156 B 40ms
39ms XHR
text/plain 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://reflor.clickfunnels.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://reflor.clickfunnels.com/optin1683620496022
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type: application/json

Response headers

date: Wed, 10 May 2023 07:33:04 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://reflor.clickfunnels.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7c507dec8e47994b-FRA

GET
H2 200 862.04af29e3-1.231.0.min.js Show response
js-agent.newrelic.com/ 9 KB
4 KB 23ms
22ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/862.04af29e3-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

03c8ef299748fad241484cddf509b6e90b394949882a72f9174dc97da671f151

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: F3uiK5YwfyYXl9HDrytyVd85M_NbPJob
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKTB1WS4PPQ44TVB
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 3627
x-amz-id-2: eDA+Z7KVAgH55hS6H1e1liK21YG6R/Ybg0KZ0lnC1hZK321YiSZvAlpf4c1qj6628LARnXRhMuM=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.400804,VS0,VE0
etag: "8ff6f8d3b9281c2834e211ce2228757e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4173

GET
H2 200 page_view_event-aggregate.8cf0450e-1.231.0.min.js Show response
js-agent.newrelic.com/ 11 KB
4 KB 23ms
22ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/page_view_event-aggregate.8cf0450e-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9c52fb85b7798d62e60aee232ae9b2a224c88d52cd6405bac28a3a2a18d11642

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: YL5vYhsqsLDVb5Z0VzI.0IKZ9oVf.jnj
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKTAQFAR4NTDM159
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 4107
x-amz-id-2: 7yHsLjO5G3auBO8B7GwuXxX4yrmvR8/S/W3D9dJYuDfyLLeE3ApD86dZJhlEyzUplMTYEhlDj4E=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.400876,VS0,VE0
etag: "927ef57448f4e9500b6ddd704625d0b2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4461

GET
H2 200 page_view_timing-aggregate.a30a53ff-1.231.0.min.js Show response
js-agent.newrelic.com/ 12 KB
5 KB 24ms
24ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/page_view_timing-aggregate.a30a53ff-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

53350e307f02d76f2b5b69ad7ec7f53e6d32e84d2718f03ddd4b8fcd752f454b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: tXajjyfh__GTM5HYavqt0WCAqFhJIRAd
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKTE48A84Z7DFC04
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 4637
x-amz-id-2: uiPQ9Zjw8Wedv1ULWgI/sRAyd52gpD1RnkjvHWUM2X7UGSuxne7MerTxmOgE/kYRfsqGPUMf0Ko=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.401108,VS0,VE0
etag: "81350454b5ae22caf77cada88c68cd10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4480

GET
H2 200 metrics-aggregate.78efb4d5-1.231.0.min.js Show response
js-agent.newrelic.com/ 4 KB
2 KB 25ms
25ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/metrics-aggregate.78efb4d5-1.231.0.min.js

Requested by

Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

e54f6dd45ddca0b2de26ce3ba1622eb755f28fd5c4a36b4cc95ee1df44430c05

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: GnoOJSNFMPBLvvU2loT.6gfpbCRyQb8e
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 07:33:04 GMT
strict-transport-security: max-age=300
x-amz-request-id: GKTBHCPMNM1V9M1K
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 1587
x-amz-id-2: E1pOkiJqh6mqDAMQiQzA8kUyZQt8uVd4QGozj5jxBDK2amh7fFKJeoua2QcxKMEE1vckSeo6GXs=
x-served-by: cache-fra-etou8220025-FRA
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683703984.401030,VS0,VE0
etag: "25879f97e7abf9cd89e027ff5a41ed81"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4445

GET
H/1.1 200
OK NRJS-fc902efb332119fff33
bam.nr-data.net/1/ 49 B
392 B 506ms
451ms Script
text/javascript 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=1509&ck=0&s=5e22615e3b39ef2a&ref=https://reflor.clickfunnels.com/optin1683620496022&ap=346&be=461&fe=707&dc=374&perf=%7B%22timing%22:%7B%22of%22:1683703982910,%22n%22:0,%22r%22:0,%22re%22:306,%22f%22:306,%22dn%22:306,%22dne%22:306,%22c%22:306,%22s%22:306,%22ce%22:306,%22rq%22:306,%22rp%22:461,%22rpe%22:464,%22di%22:796,%22ds%22:798,%22de%22:835,%22dc%22:1062,%22l%22:1062,%22le%22:1168%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=637&fcp=637&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/async-api.8f89c105-1.231.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reflor.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:04 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: close
Content-Length: 49
x-served-by: cache-fra-eddf8230031-FRA

GET
H2

200

Primary Request user.php Show response
postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/
Redirect Chain

https://scambinance.com/go.php?url=https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/
https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php

186 KB
186 KB

190ms
190ms

Document
text/html

91.234.46.215
DHH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Requested by: Host: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/optin1683620496022
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.215 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp15.infonet.hr
Software: Apache / PHP/5.6.40
Resource Hash: 815599dd8df8dfd61c47e97b8ea069e04016e31c12df460bb96bc72bb59bfa9f

Request headers

Referer: https://reflor.clickfunnels.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: text/html; charset=UTF-8
date: Wed, 10 May 2023 07:33:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/5.6.40

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 10 May 2023 07:33:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: de/user.php
pragma: no-cache
server: Apache
x-powered-by: PHP/5.6.40

POST NRJS-fc902efb332119fff33
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-fc902efb332119fff33
bam.nr-data.net/events/1/ 0
0

POST rum
reflor.clickfunnels.com/cdn-cgi/ 0
0

GET
H2 200 fonts.css
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 1 KB
859 B 107ms
32ms Stylesheet
text/css 2600:9000:2251:0:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Requested by

Host: postbnde.pigeon-sky.com
URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:0:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbnde.pigeon-sky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
content-security-policy: frame-ancestors https://*.deutsche-bank.de
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 226
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMS9TVy8yOS9kSDh2TUVCV01Iam52Y2hjc1E4eTJGNU5uVT0=
vary: Accept-Encoding,Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 4e77y-h93MQA_5fZfVOpMB0GwZN1Hk11AmkIq57XQBRmWFjPxm5r1w==
expires: Thu, 09 May 2024 07:33:05 GMT

GET
H2 200 user-style.css
postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/ 3 KB
3 KB 138ms
137ms Stylesheet
text/css 91.234.46.215
DHH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/user-style.css
Requested by: Host: postbnde.pigeon-sky.com
URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.215 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp15.infonet.hr
Software: Apache /
Resource Hash: 04063518f643a580b52dd2bd42ac258a95558176be48f6b7f76936acb7b10407

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
last-modified: Thu, 27 Apr 2023 17:03:20 GMT
server: Apache
accept-ranges: bytes
content-length: 3122
content-type: text/css

GET
H2 200 logo-cut.png
postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/ 2 KB
2 KB 124ms
124ms Image
image/png 91.234.46.215
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/logo-cut.png
Requested by: Host: postbnde.pigeon-sky.com
URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.215 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp15.infonet.hr
Software: Apache /
Resource Hash: ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 1806
content-type: image/png

GET
H2 200 img1.jpg
postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/ 44 KB
44 KB 146ms
145ms Image
image/jpeg 91.234.46.215
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/img1.jpg
Requested by: Host: postbnde.pigeon-sky.com
URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.215 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp15.infonet.hr
Software: Apache /
Resource Hash: 97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 45295
content-type: image/jpeg

GET
H2 200 back.jpg
postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/ 243 KB
243 KB 66ms
66ms Image
image/jpeg 91.234.46.215
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/back.jpg
Requested by: Host: postbnde.pigeon-sky.com
URL: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/user-style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.215 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp15.infonet.hr
Software: Apache /
Resource Hash: 8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbnde.pigeon-sky.com/post2/3rtg5tyr4re/de/res/user-style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 248757
content-type: image/jpeg

GET
H2 200 FrutigerLTW05-55Roman.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 25 KB
26 KB 112ms
65ms Font
font/woff2 2600:9000:2251:0:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-55Roman.woff2

Requested by

Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:0:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin: https://postbnde.pigeon-sky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors https://*.deutsche-bank.de
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 25764
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMS9TVy8yOS9kSDh2TUVCV01Iam52Y2hjc1E4eTJGNU5uVT0=
vary: Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: n39PtGcubMJIc04ytzc8fPJdKo-3rbZ3eVKYvCBQh1Ofh7ZNbFBm9w==
expires: Thu, 09 May 2024 07:33:05 GMT

GET
H2 200 FrutigerLTW05-65Bold.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 25 KB
26 KB 89ms
43ms Font
font/woff2 2600:9000:2251:0:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-65Bold.woff2

Requested by

Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:0:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin: https://postbnde.pigeon-sky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 07:33:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors https://*.deutsche-bank.de
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 26008
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMTg3N0pCNjN6MUNzN1h1RVRYWUcxQ3ptWldZT1YxN1g4MD0=
vary: Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: t0UHp51rgQ1dDOmQPNVwJWit8SxcyOB5EzmIB3Iw7OVlc_mWDeIsaA==
expires: Thu, 09 May 2024 07:33:05 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: track.addevent.com
URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=c3939e8d-6f61-468b-46c0-adb566238690&url=https%3A%2F%2Freflor.clickfunnels.com%2Foptin1683620496022&cache=1683703983702

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=2878&ck=0&s=5e22615e3b39ef2a&ref=https://reflor.clickfunnels.com/optin1683620496022

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=2880&ck=0&s=5e22615e3b39ef2a&ref=https://reflor.clickfunnels.com/optin1683620496022

Domain: reflor.clickfunnels.com
URL: https://reflor.clickfunnels.com/cdn-cgi/rum?

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.clickfunnels.com/	1970-01-20 11:41:45	Name: __cf_bm Value: CzWPpoVlIfz3G0aj.tde96CkF.MGlNjVlWqcmKhpI.M-1683703983-0-Ad0PlcAijRy0d90s1gHKxFiTFldX5hpA3jOdZcCrT9DSKJGOD+JdarSdp2Pq18+VyYh95uy6HIwfxkc9/D5ZmOcLGVjI2gx4By9lAISAySbT
reflor.clickfunnels.com/	1970-01-20 20:27:19	Name: addevent_track_cookie Value: c3939e8d-6f61-468b-46c0-adb566238690
.www.clickfunnels.com/	1970-01-20 11:41:45	Name: __cf_bm Value: k7u.6yDIQXesfZKJLjWOGUwtPUVtmftImkWfRdBVF8A-1683703983-0-ATNtXr/GnJHBuwBo3YZBEAw8OaQk7wmkhboQLjy4KNWTkKtvgD/ARbDK2KHvupQEekPDE2bCXfZ7tFS0Mj6L1uU=
reflor.clickfunnels.com/	1969-12-31 23:59:59	Name: is_eu Value: true
reflor.clickfunnels.com/	1970-01-20 20:27:19	Name: 25t8yqllku44xtu8 Value: true
reflor.clickfunnels.com/	1970-01-20 20:27:19	Name: 12967470_viewed_1 Value: 1
postbnde.pigeon-sky.com/	1969-12-31 23:59:59	Name: PH_HPXY_CHECK Value: s1
postbnde.pigeon-sky.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: gk6033fqr2tgcltte0303gpkj0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=c3939e8d-6f61-468b-46c0-adb566238690&url=https%3A%2F%2Freflor.clickfunnels.com%2Foptin1683620496022&cache=1683703983702 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.clickfunnels.com
bam.nr-data.net
classic.clickfunnels.com
fonts.googleapis.com
images.clickfunnels.com
js-agent.newrelic.com
postbnde.pigeon-sky.com
reflor.clickfunnels.com
scambinance.com
static.cloudflareinsights.com
track.addevent.com
use.fontawesome.com
www.clickfunnels.com
www.deutsche-bank.de
bam.nr-data.net
reflor.clickfunnels.com
track.addevent.com
151.101.2.137
162.247.243.29
2600:9000:2251:0:13:46b5:7d80:93a1
2606:4700:4400::ac40:944b
2606:4700::6810:10c2
2606:4700::6810:3865
2606:4700::6810:dc2
2606:4700:e2::ac40:850f
2a00:1450:4001:829::200a
2a06:98c1:3121::3
91.234.46.215
03c8ef299748fad241484cddf509b6e90b394949882a72f9174dc97da671f151
04063518f643a580b52dd2bd42ac258a95558176be48f6b7f76936acb7b10407
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f
13a548e040a1ec08f77911fed1d559b95e5daae0ee227e632140e003c7268e7b
16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8
23eb4278d4cfdfd99216ea683676c2131cd30f1f21f9d5fee91ff2331c2ebc33
302b5fb1a20a09324147a30a7b4c1b1b49c780eca362b6fa7320c8720aa2995d
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
40dfc86a731622d863ae9d7f5858685ff512bd79b2353b4620125c72c84373f0
5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
53350e307f02d76f2b5b69ad7ec7f53e6d32e84d2718f03ddd4b8fcd752f454b
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474
67f99ac35e1f837e5571b596248acd66df2dddedb17e20ba4527c825ec957ced
72bc9bf017d25d46e375132af60ac5c98b6742fb5d767c8f2eea2bdd34e9195b
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
815599dd8df8dfd61c47e97b8ea069e04016e31c12df460bb96bc72bb59bfa9f
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a
9c52fb85b7798d62e60aee232ae9b2a224c88d52cd6405bac28a3a2a18d11642
a696b734193371073510c87df68430499c2f424ad3f7be42f586dc6aff78567b
adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e54f6dd45ddca0b2de26ce3ba1622eb755f28fd5c4a36b4cc95ee1df44430c05
ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

postbnde.pigeon-sky.com Open in urlscan Pro 91.234.46.215 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

33 Requests

82 %HTTPS

73 %IPv6

10 Domains

14 Subdomains

10 IPs

3 Countries

1340 kBTransfer

3506 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

postbnde.pigeon-sky.com Open in urlscan Pro
91.234.46.215 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

82 %
HTTPS

73 %
IPv6

10
Domains

14
Subdomains

10
IPs

3
Countries

1340 kB
Transfer

3506 kB
Size

8
Cookies

33 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!