multiflings.com Open in urlscan Pro
199.36.158.100 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://b.medgoodfood.com/c?tid=1a66a88d-86e5-4a62-82f9-163410dfcfb3&t=1
Effective URL:
https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit...
Submission: On January 13 via manual (January 13th 2022, 6:23:01 am UTC) from US — Scanned from DE

Summary HTTP 20 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 11 domains to perform 20 HTTP transactions. The main IP is 199.36.158.100, located in United States and belongs to FASTLY, US. The main domain is multiflings.com. The Cisco Umbrella rank of the primary domain is 333242.
TLS certificate: Issued by GTS CA 1D4 on November 29th 2021. Valid for: 3 months.

This is the only time multiflings.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3032::6815:402f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.184.38.55 18.184.38.55	16509 (AMAZON-02) (AMAZON-02)
1 1	18.195.123.247 18.195.123.247	16509 (AMAZON-02) (AMAZON-02)
9	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	94.130.141.49 94.130.141.49	24940 (HETZNER-AS) (HETZNER-AS)
3	95.211.229.248 95.211.229.248	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2606:4700:303... 2606:4700:3033::6815:3d6c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1f18:454... 2600:1f18:454c:f520:fa98:d29:360b:aced	14618 (AMAZON-AES) (AMAZON-AES)
1	67.22.42.114 67.22.42.114	48684 (VIKINGHOST) (VIKINGHOST)
20	8

1 2606:4700:3032::6815:402f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

b.medgoodfood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.184.38.55 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com

spg.supragamma.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ttl.thetaweblink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.123.247 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-123-247.eu-central-1.compute.amazonaws.com

gmg.gammaguest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

multiflings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 94.130.141.49 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.49.141.130.94.clients.your-server.de

tsyndicate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.211.229.248 (Leidschendam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ds03.evo.0x3e.net

main.exoclick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:3d6c (United States)

ASN13335 (CLOUDFLARENET, US)

nextgencounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:454c:f520:fa98:d29:360b:aced (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

ads.traffichunt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.22.42.114 (Netherlands)

ASN48684 (VIKINGHOST, NL)

tfosrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	multiflings.com multiflings.com — Cisco Umbrella Rank: 333242	100 KB
3	exoclick.com main.exoclick.com — Cisco Umbrella Rank: 34190	1 KB
2	tsyndicate.com tsyndicate.com — Cisco Umbrella Rank: 10895	931 B
1	tfosrv.com tfosrv.com — Cisco Umbrella Rank: 91259	14 KB
1	traffichunt.com ads.traffichunt.com — Cisco Umbrella Rank: 91706	614 B
1	nextgencounter.com nextgencounter.com — Cisco Umbrella Rank: 91376	645 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	35 KB
1	gammaguest.com 1 redirects gmg.gammaguest.com — Cisco Umbrella Rank: 649461	2 KB
1	thetaweblink.com ttl.thetaweblink.com	710 B
1	supragamma.com spg.supragamma.com — Cisco Umbrella Rank: 273647	1 KB
1	medgoodfood.com 1 redirects b.medgoodfood.com — Cisco Umbrella Rank: 598113	855 B
20	11

	Domain	Requested by
9	multiflings.com	multiflings.com
3	main.exoclick.com
2	tsyndicate.com
1	tfosrv.com
1	ads.traffichunt.com
1	nextgencounter.com
1	www.googletagmanager.com	multiflings.com
1	gmg.gammaguest.com	1 redirects
1	ttl.thetaweblink.com
1	spg.supragamma.com
1	b.medgoodfood.com	1 redirects
20	11

This site contains links to these domains. Also see Links.

Domain
gmg.gammaguest.com
lonelypartners.com

Subject Issuer	Validity	Valid
spg.supragamma.com R3	`2021-12-03` - `2022-03-03`	3 months	crt.sh
ttl.thetaweblink.com R3	`2021-11-26` - `2022-02-24`	3 months	crt.sh
www.thecodercouple.in GTS CA 1D4	`2021-11-29` - `2022-02-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
tsyndicate.com R3	`2022-01-12` - `2022-04-12`	3 months	crt.sh
exoclick.com R3	`2022-01-07` - `2022-04-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-02` - `2022-03-01`	a year	crt.sh
*.traffichunt.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-20` - `2022-07-29`	a year	crt.sh
*.tfosrv.com Sectigo RSA Domain Validation Secure Server CA	`2021-11-03` - `2022-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
Frame ID: 5C08D7CF0CAE01D75A0D14E67ECDD8A7
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

swiftfling.com

Page URL History Show full URLs

https://b.medgoodfood.com/c?tid=1a66a88d-86e5-4a62-82f9-163410dfcfb3&t=1 HTTP 302
https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=1... Page URL
https://ttl.thetaweblink.com/redirect?target=BASE64aHR0cHM6Ly9nbWcuZ2FtbWFndWVzdC5jb20vMDMwODlmODUtMDk1Yy... Page URL
https://gmg.gammaguest.com/03089f85-095c-473b-8714-0f3fb52bd48d?Ad=665&BanID=36&CampaignID=121277&s1=13... HTTP 302
https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtG... Page URL

Detected technologies

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

40 %
IPv6

11
Domains

11
Subdomains

8
IPs

3
Countries

154 kB
Transfer

303 kB
Size

8
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://gmg.gammaguest.com/click
Title: WEITER >>>

Search URL Search Domain Scan URL

URL: https://lonelypartners.com/cookies/
Title: Weiterlesen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://b.medgoodfood.com/c?tid=1a66a88d-86e5-4a62-82f9-163410dfcfb3&t=1 HTTP 302
https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=138&banner=1271819&keywords=naughty,bitches,sexy,outfits,playing,toys,asses,lesbian,naughty,bitches,sexy,outfits,playing,toys,asses,pzupueqvetr&Epom={Epom}&country=US&a=2255&flow_id={flow_id}&cid={CLICK_ID} Page URL
https://ttl.thetaweblink.com/redirect?target=BASE64aHR0cHM6Ly9nbWcuZ2FtbWFndWVzdC5jb20vMDMwODlmODUtMDk1Yy00NzNiLTg3MTQtMGYzZmI1MmJkNDhkP0FkPTY2NSZCYW5JRD0zNiZDYW1wYWlnbklEPTEyMTI3NyZzMT0xMzgmU3BvdE5hbWU9MTI3MTgxOSZCTFBJRD1uYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ2xlc2JpYW4lMkNuYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ3B6dXB1ZXF2ZXRyJmVQT009JTdCRXBvbSU3RCZiYW5uZXJfaWQ9VVMmYWZmX2lkPTIyNTUmZmxvd19pZD0lN0JmbG93X2lkJTdE&ts=1642054976829&hash=MuHyNl2TnjOIQChDrYC4akFovN32TjXkBTniI56lDn4&rm=D Page URL
https://gmg.gammaguest.com/03089f85-095c-473b-8714-0f3fb52bd48d?Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D HTTP 302
https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://b.medgoodfood.com/c?tid=1a66a88d-86e5-4a62-82f9-163410dfcfb3&t=1 HTTP 302
https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=138&banner=1271819&keywords=naughty,bitches,sexy,outfits,playing,toys,asses,lesbian,naughty,bitches,sexy,outfits,playing,toys,asses,pzupueqvetr&Epom={Epom}&country=US&a=2255&flow_id={flow_id}&cid={CLICK_ID}

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

e4fd9376-e923-4664-bd3c-4e0b161ab846 Show response
spg.supragamma.com/
Redirect Chain

https://b.medgoodfood.com/c?tid=1a66a88d-86e5-4a62-82f9-163410dfcfb3&t=1
https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=138&banner=1271819&keywords=naughty,bitches,sexy,outfits,playing,toys,asses,lesbian,naughty,bit...

786 B
1 KB

87ms
12ms

Document
text/html

18.184.38.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=138&banner=1271819&keywords=naughty,bitches,sexy,outfits,playing,toys,asses,lesbian,naughty,bitches,sexy,outfits,playing,toys,asses,pzupueqvetr&Epom={Epom}&country=US&a=2255&flow_id={flow_id}&cid={CLICK_ID}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.184.38.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4e98583227226a8255ca8f25ef56cb97b568e20df0cc91ad2b486ef46047b027

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Thu, 13 Jan 2022 06:22:56 GMT
content-type: text/html;charset=UTF-8
content-length: 786
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache

Redirect headers

date: Thu, 13 Jan 2022 06:22:56 GMT
content-length: 0
location: https://spg.supragamma.com/e4fd9376-e923-4664-bd3c-4e0b161ab846?adzone=665&site=36&campaign=121277&s1=138&banner=1271819&keywords=naughty,bitches,sexy,outfits,playing,toys,asses,lesbian,naughty,bitches,sexy,outfits,playing,toys,asses,pzupueqvetr&Epom={Epom}&country=US&a=2255&flow_id={flow_id}&cid={CLICK_ID}
cache-control: no-cache, no-store, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cRF4yRr6fUu8uuSPLy%2F2M2%2B8QZBbuCovyeIXvYOZuNrTDkysNUjXkdPvw4YpGdvaL3WI3SIPLYgeHyse53ifB%2BwuxRn0uNMO1nsMEdiyQxi6PZOMaljvA7m9HNW94tJitqi929X3RsMMSZNXRFFscw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6ccc8873ec6175cb-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 redirect Show response
ttl.thetaweblink.com/ 548 B
710 B 41ms
9ms Document
text/html 18.184.38.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ttl.thetaweblink.com/redirect?target=BASE64aHR0cHM6Ly9nbWcuZ2FtbWFndWVzdC5jb20vMDMwODlmODUtMDk1Yy00NzNiLTg3MTQtMGYzZmI1MmJkNDhkP0FkPTY2NSZCYW5JRD0zNiZDYW1wYWlnbklEPTEyMTI3NyZzMT0xMzgmU3BvdE5hbWU9MTI3MTgxOSZCTFBJRD1uYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ2xlc2JpYW4lMkNuYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ3B6dXB1ZXF2ZXRyJmVQT009JTdCRXBvbSU3RCZiYW5uZXJfaWQ9VVMmYWZmX2lkPTIyNTUmZmxvd19pZD0lN0JmbG93X2lkJTdE&ts=1642054976829&hash=MuHyNl2TnjOIQChDrYC4akFovN32TjXkBTniI56lDn4&rm=D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.184.38.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 437c8c7921f92e8487f4e3a7c5cee1f67edf2c6682413c52eb40aeaae673cc40

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://spg.supragamma.com/

Response headers

server: nginx
date: Thu, 13 Jan 2022 06:22:56 GMT
content-type: text/html;charset=UTF-8
content-length: 548
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache

GET
H2

200

Primary Request / Show response
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/
Redirect Chain

https://gmg.gammaguest.com/03089f85-095c-473b-8714-0f3fb52bd48d?Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian...
https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rb...

16 KB
3 KB

220ms
196ms

Document
text/html

199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7713b4f7be6065e8f85a840c35a75fbaf060a95765fafff8bf15b650645af7f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ttl.thetaweblink.com/redirect?target=BASE64aHR0cHM6Ly9nbWcuZ2FtbWFndWVzdC5jb20vMDMwODlmODUtMDk1Yy00NzNiLTg3MTQtMGYzZmI1MmJkNDhkP0FkPTY2NSZCYW5JRD0zNiZDYW1wYWlnbklEPTEyMTI3NyZzMT0xMzgmU3BvdE5hbWU9MTI3MTgxOSZCTFBJRD1uYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ2xlc2JpYW4lMkNuYXVnaHR5JTJDYml0Y2hlcyUyQ3NleHklMkNvdXRmaXRzJTJDcGxheWluZyUyQ3RveXMlMkNhc3NlcyUyQ3B6dXB1ZXF2ZXRyJmVQT009JTdCRXBvbSU3RCZiYW5uZXJfaWQ9VVMmYWZmX2lkPTIyNTUmZmxvd19pZD0lN0JmbG93X2lkJTdE&ts=1642054976829&hash=MuHyNl2TnjOIQChDrYC4akFovN32TjXkBTniI56lDn4&rm=D

Response headers

cache-control: max-age=3600
content-encoding: br
content-type: text/html; charset=utf-8
etag: "9b04ab825b41e98e440177cb2eed5c9220513aee3724a51fe118c088d3d34d59-br"
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
strict-transport-security: max-age=31556926
accept-ranges: bytes
date: Thu, 13 Jan 2022 06:22:57 GMT
x-served-by: cache-hhn4041-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1642054977.006690,VS0,VE175
vary: x-fh-requested-host, accept-encoding
content-length: 2286

Redirect headers

server: nginx
date: Thu, 13 Jan 2022 06:22:56 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
pragma: no-cache

GET
H2 200 form.css
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/ 6 KB
1 KB 8ms
7ms Stylesheet
text/css 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/form.css

Requested by

Host: multiflings.com
URL: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4f3e1c56c6812962073c0b90e5504698940d234cb4cd5e2931a64a23f5f2c024

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.200830,VS0,VE1
etag: "326d282ca435f68814b1d5e2b6feea16bbbfe7a4abb9eb5cb3c0c58f3ffda64f-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 1105
x-cache-hits: 1

GET
H2 200 style.css
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/ 7 KB
1 KB 8ms
8ms Stylesheet
text/css 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/style.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5dea4bfa0e4c04b2c5cef3d7f2e12e7309ec921b1584ac0bac9120003dfafcf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.201112,VS0,VE1
etag: "395e079d5efdadb3b3c16c7e9cfdf85d2b446530703645900cd8b8f504aa68e1-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 1376
x-cache-hits: 1

GET
H2 200 cookie.css
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/ 4 KB
868 B 8ms
8ms Stylesheet
text/css 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/css/cookie.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b40186ca0c1ef0fa52f3939e22fe75662a459eeea23fa0ce3f71d5556a6e7b86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.201315,VS0,VE1
etag: "697406b3301f49e1f8737bfae2f2b1d9f2d0d44cf3cbfa70377aa6f85390003b-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 756
x-cache-hits: 1

GET
H2 200 location-pin.svg
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/ 1 KB
774 B 12ms
11ms Image
image/svg+xml 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/location-pin.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ba518a3dbf0ad572a44c511dedd766f52d0a95b9e85ef299be9976638b21e83f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.204734,VS0,VE1
etag: "f67306d798219f1ebe9f4e4fd6e129ef03aa516dd70c2f8503acdd4d27203687-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 663
x-cache-hits: 1

GET
H2 200 location-scaner.svg
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/ 743 B
475 B 12ms
11ms Image
image/svg+xml 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/location-scaner.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

41249f5d8e39186e06897524f0f373fbf44fbfc94f040bde772de7388a552e9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.204819,VS0,VE1
etag: "4ea39b659f0ee99934890c2580227665e1a03416eb80454410a2c0690cfa63be-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 352
x-cache-hits: 1

GET
H2 200 jquery.min.js Show response
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/js/ 87 KB
27 KB 9ms
8ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/js/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.204457,VS0,VE1
etag: "adf7ee27abe439a2ad8b0002c7b346ae1cff9f409dada23746c717da1e6f96d9-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 27955
x-cache-hits: 1

GET
H2 200 step.js Show response
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/js/ 3 KB
892 B 13ms
12ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/js/step.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

11ed73b8f19930ef1d1f05da475baa3b0489d3b07d0deb5b73b4a2814911b7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.204627,VS0,VE1
etag: "76a98ad9b6ca2782d28686843618bf3fe1f04572ca7a3b59c435794d1426c372-br"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 780
x-cache-hits: 1

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 98 KB
35 KB 135ms
49ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TMR4NP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

51f4436e1a297bb437e06efad53aa0e1c783a9deda944b94842fa5ae651d5321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 13 Jan 2022 06:22:57 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34935
x-xss-protection: 0
last-modified: Thu, 13 Jan 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Jan 2022 06:22:57 GMT

GET
H2 200 10.jpg
multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/ 64 KB
64 KB 9ms
8ms Image
image/jpeg 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/images/10.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cc764dbdd80f747c538f60d9041d37ea0e0774e383e7f1a9211e7780f0eb5d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/adu_de_20_08_27_t81_v1_2_ex2_re1_dis1_jv/?cep=-PMTMV2EZLWRDMM-9d0z0kHV8EGxtGvujRK0vhDy8YMhQKRZit9KyWPqcNNBZETZf0aF4hbg49QwWgW7m22uIB9oDRQFErwccIH6ENwequzmSV0TpqALwopI4LJL8rboKX2OdMGkZhUnm2FJcO5W0sNiiNjTg2sbrOVss3QQr-CQVsAg7OS-Zdph0CvFgaW5ohKtvbRCf8bGDiLSdo-__FP-AIk4QPTBeKKHKtJ0ohr7F8Js4l75lOEH-sLSDy2izskl7PyasPVNi6H2NMnWYCir7nCIoAcffbt-OIiuK67so4bks5cjfTIzh1tii_yJFgK2ri4sOBt2kSNa-FifiMVWvrr0Vn1SqAkrIhFRB9-zZVgiUf_f0C-TX6C9FbDDdIDlAPin7O3RKe0gUz9_2tsdE7_sapR_dIHy_6ps3nEXlICd0c9Phx5pz9S6nvI_dn2muUDuJUACHOO2gQUlglD9JEBds_NHwoi4IQYkC7t7sQfPqssa2cAAGrfTePBMLUDub8PxR29SUSn1-NdopQqfiEcgvaoklwuwQgkw1vQpSEQA_8JMrwvOtg7fL7UxJywZ1AwqarjngQj2MdBr14meCY2RXjH-QIlV2Jfq8CUheTcxXwqZSkq80CaW3OLc-zimqg7vAcnrxJ9gIHCk3lR07mpoZLzfKgqMCOLwtAU&lptoken=16e242f305b467287608&Ad=665&BanID=36&CampaignID=121277&s1=138&SpotName=1271819&BLPID=naughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Clesbian%2Cnaughty%2Cbitches%2Csexy%2Coutfits%2Cplaying%2Ctoys%2Casses%2Cpzupueqvetr&ePOM=%7BEpom%7D&banner_id=US&aff_id=2255&flow_id=%7Bflow_id%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: gzip
last-modified: Mon, 10 Jan 2022 13:02:49 GMT
x-timer: S1642054977.213604,VS0,VE1
etag: "f9bf4be4bd8c4eb420fc78f3ba9a63872c10716181e7adcce4d9ec3044b70c95"
x-served-by: cache-hhn4041-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/jpeg
cache-control: max-age=3600
date: Thu, 13 Jan 2022 06:22:57 GMT
accept-ranges: bytes
content-length: 65553
x-cache-hits: 1

GET
H2 200 06eb0705-463f-4b96-836b-64bf3cfa8631
tsyndicate.com/api/v1/retargeting/set/ 35 B
466 B 43ms
13ms Image
image/gif 94.130.141.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tsyndicate.com/api/v1/retargeting/set/06eb0705-463f-4b96-836b-64bf3cfa8631?gtmcb=1355201437
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.141.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.141.130.94.clients.your-server.de
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Jan 2022 06:22:57 GMT
server: nginx
x-api-version: 1
vary: *
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-type: text/plain; charset=utf-8
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
content-length: 35
x-request-id: df1aac9b3f9d77e1
expires: 0

GET
H/1.1 200
OK tag.php
main.exoclick.com/ 0
419 B 61ms
17ms Image
text/html 95.211.229.248
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.exoclick.com/tag.php?goal=68831a8833a4917ff6b2c530dc3a4c1f&gtmcb=2054752968
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 95.211.229.248 Leidschendam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: ds03.evo.0x3e.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 13 Jan 2022 06:22:57 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK tag.php
main.exoclick.com/ 0
419 B 59ms
15ms Image
text/html 95.211.229.248
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.exoclick.com/tag.php?goal=33d8e6a4225d77ae914dff110feef000&gtmcb=2101639599
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 95.211.229.248 Leidschendam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: ds03.evo.0x3e.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 13 Jan 2022 06:22:57 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 index.min.js
nextgencounter.com/ 645 B
645 B 523ms
468ms Image
application/javascript 2606:4700:3033::6815:3d6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextgencounter.com/index.min.js?pk=d22e6e1bbef67e016bac3e7555dfcf6d&gtmcb=489757492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3d6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 13 Jan 2022 06:22:57 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 19 Mar 2021 11:14:58 GMT
server: cloudflare
etag: W/"605487b2-285"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0AY%2FMzeAwf7PgNEw4HfdUoio0cqdIY9l8AE088z%2BtUeb07OqlcSgCiZ10uux9FvCHre0As3XGWoXgXUNWmcwfvyJj51l3eeOc4JURpmlsx7pk%2FFAF9BBspjnnh6sgEjvSle338IDfIk9cgv6DFP2c78%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ccc88791a2a88bc-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK tag.php
main.exoclick.com/ 0
419 B 59ms
16ms Image
text/html 95.211.229.248
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.exoclick.com/tag.php?goal=5ca8b60d120434a1134c010ca6272da6&gtmcb=1974685227
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 95.211.229.248 Leidschendam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: ds03.evo.0x3e.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 13 Jan 2022 06:22:57 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 /
ads.traffichunt.com/adv_ret/ 0
614 B 301ms
98ms Image
text/plain 2600:1f18:454c:f520:fa98:d29:360b:aced
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.traffichunt.com/adv_ret/?adv_pixel_id=861&nid=3&gtmcb=2102447915
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:454c:f520:fa98:d29:360b:aced Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 13 Jan 2022 06:22:57 GMT
server: nginx
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 e61f38d1-37ba-4a3d-9474-c0d9e0d9ea70
tsyndicate.com/api/v1/retargeting/set/ 35 B
465 B 41ms
12ms Image
image/gif 94.130.141.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tsyndicate.com/api/v1/retargeting/set/e61f38d1-37ba-4a3d-9474-c0d9e0d9ea70?gtmcb=1745868225
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.141.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.141.130.94.clients.your-server.de
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Jan 2022 06:22:57 GMT
server: nginx
x-api-version: 1
vary: *
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-type: text/plain; charset=utf-8
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
content-length: 35
x-request-id: 7e8e2dc215c0300b
expires: 0

GET
H/1.1 200
OK retargeting.js
tfosrv.com/ 14 KB
14 KB 49ms
15ms Image
text/javascript 67.22.42.114
VIKINGHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tfosrv.com/retargeting.js?id=981&gtmcb=2079859677
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 67.22.42.114 , Netherlands, ASN48684 (VIKINGHOST, NL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://multiflings.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Jan 2022 06:22:57 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding: chunked
Content-Type: text/javascript
Expires: 0

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.spg.supragamma.com/	1970-01-20 00:09:01	Name: e4fd9376-e923-4664-bd3c-4e0b161ab846-v4 Value: 4WslqT_JpCIk83GG8rVbP9jRWY_h_xGhgnbjCMM9lhI
.spg.supragamma.com/	1970-01-20 08:53:10	Name: cc-v4 Value: YHe7byqPWCUaqpHBoZWvXKDgAXR7ThRswbQwp%2FXDwPXN7QT9SSSCXbSf93vSA09ZQWkbHzPvvwlYTzz5IQc%2B6RM04MlM2iidvqTzoYIP02o4qznR02oa%2FtAcT%2BSCMJl9qRaiOgFjEaOTdkr7P4HhPw%3D%3D
.gmg.gammaguest.com/	1970-01-20 00:09:01	Name: 03089f85-095c-473b-8714-0f3fb52bd48d-v4 Value: Bv3S2dyXcz_6d4GybQRYSGdbYil3KQPFNaabtKIOTSM
.gmg.gammaguest.com/	1970-01-20 00:09:01	Name: cep-v4 Value: RnHdOFCQaCJyaln4Izgf9VOv8Cfospwc2pSBoDyVMCbdHzakl5O4nFwA_TX2al44XaHYiXeMWJno2Lg_SIrPYQIrpjD7FmmfTqfvL2KCYoBWmNn9ZJEabOPquarQwF-EMwnfJsUXLDclJl0iDc_r5GQxjMsqRlPzvFUYVYoKrzg1wDKpmCrvytv5Kof_8gGXTxyhXGPPHqScrBxot45HpK3SfvldYh4cB8jSxJCIlr6-4xkh_sxloiHuSyRSAU3w5N_o2ne390dQJ1reOAvb7_Wrw_Eeb7cltn8N7Dzw8HzMaRSAHgYgklTU4SNzI5K-XxpLkHpNbM32Iw-_wviNF9SBOHpfu_gGdwF0RF_3PVGIUOncWknBWKk4EecOlnx-9vqoqjBQDeTCCcPOApb_Lq6JyAdEnqYf_mjOS3EoDg5wpWc9o5kFAaAv0GORm08SrOXxt0n9ZBFm1se-Jp_TQg7ilAJ07SF8o0zUvEBXmjnbFwyzdr5Gv6sG7gH1cTlXzffS49JUL5NrDuH9gVW579KazM5dtpxxRuBdUIXL8Pndu1FSiOk0xbG55TVPgS8j1oeAIVeIJRyaQSFpO0K0Q4P0n3TCP-19cAt18EO6kjeDGTfs9aDFnQztbUgxYKcJGS6tQXp0W6rOvMlbxbMIh1VeUKRPOlwkuh3R9MGV6VQ
.exoclick.com/	1970-01-20 08:53:10	Name: goals Value: a%3A1%3A%7Bi%3A71475%3Ba%3A1%3A%7Bs%3A4%3A%22date%22%3Bs%3A10%3A%222022-01-13%22%3B%7D%7D
ads.traffichunt.com/	1970-01-20 02:17:10	Name: new_adx_profile_guid Value: ae101007-8827-4d55-9af1-c1e16273c0c2
ads.traffichunt.com/	1970-01-20 02:17:10	Name: new_3.adx_rt_0 Value: 861
ads.traffichunt.com/	1970-01-20 00:08:38	Name: new_3.adx_daily_rt_0 Value: 861

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.traffichunt.com
b.medgoodfood.com
gmg.gammaguest.com
main.exoclick.com
multiflings.com
nextgencounter.com
spg.supragamma.com
tfosrv.com
tsyndicate.com
ttl.thetaweblink.com
www.googletagmanager.com
18.184.38.55
18.195.123.247
199.36.158.100
2600:1f18:454c:f520:fa98:d29:360b:aced
2606:4700:3032::6815:402f
2606:4700:3033::6815:3d6c
2a00:1450:4001:831::2008
67.22.42.114
94.130.141.49
95.211.229.248
11ed73b8f19930ef1d1f05da475baa3b0489d3b07d0deb5b73b4a2814911b7f2
41249f5d8e39186e06897524f0f373fbf44fbfc94f040bde772de7388a552e9d
437c8c7921f92e8487f4e3a7c5cee1f67edf2c6682413c52eb40aeaae673cc40
4e98583227226a8255ca8f25ef56cb97b568e20df0cc91ad2b486ef46047b027
4f3e1c56c6812962073c0b90e5504698940d234cb4cd5e2931a64a23f5f2c024
51f4436e1a297bb437e06efad53aa0e1c783a9deda944b94842fa5ae651d5321
5dea4bfa0e4c04b2c5cef3d7f2e12e7309ec921b1584ac0bac9120003dfafcf0
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
7713b4f7be6065e8f85a840c35a75fbaf060a95765fafff8bf15b650645af7f5
b40186ca0c1ef0fa52f3939e22fe75662a459eeea23fa0ce3f71d5556a6e7b86
ba518a3dbf0ad572a44c511dedd766f52d0a95b9e85ef299be9976638b21e83f
cc764dbdd80f747c538f60d9041d37ea0e0774e383e7f1a9211e7780f0eb5d38
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

multiflings.com Open in urlscan Pro 199.36.158.100 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

40 %IPv6

11 Domains

11 Subdomains

8 IPs

3 Countries

154 kBTransfer

303 kBSize

8 Cookies

2 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

8 Cookies

Indicators

multiflings.com Open in urlscan Pro
199.36.158.100 Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

40 %
IPv6

11
Domains

11
Subdomains

8
IPs

3
Countries

154 kB
Transfer

303 kB
Size

8
Cookies

20 HTTP transactions
0 data transactions