rdvsecret.com Open in urlscan Pro
188.114.97.3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11
Effective URL:
https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Submission: On October 23 via api (October 23rd 2024, 4:22:30 pm UTC) from US — Scanned from FR

Summary HTTP 32 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 5 countries across 15 domains to perform 32 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is rdvsecret.com.
TLS certificate: Issued by WE1 on September 18th 2024. Valid for: 3 months.

This is the only time rdvsecret.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 9	51.83.56.5 51.83.56.5	16276 (OVH) (OVH)
2 2	75.2.108.135 75.2.108.135	16509 (AMAZON-02) (AMAZON-02)
2 2	18.192.108.151 18.192.108.151	16509 (AMAZON-02) (AMAZON-02)
2 2	54.72.178.230 54.72.178.230	16509 (AMAZON-02) (AMAZON-02)
1 1	52.19.138.177 52.19.138.177	16509 (AMAZON-02) (AMAZON-02)
1 1	34.160.108.161 34.160.108.161	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	142.132.150.101 142.132.150.101	24940 (HETZNER-AS) (HETZNER-AS)
3 10	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.25.14 104.17.25.14	() ()
1	2a00:1450:400... 2a00:1450:4001:813::200a	() ()
4	18.193.203.120 18.193.203.120	() ()
3	2a04:4e42:200... 2a04:4e42:200::649	() ()
2	2a00:1450:400... 2a00:1450:4001:80b::200a	() ()
4	172.217.16.131 172.217.16.131	() ()
32	9

9 51.83.56.5 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: ip5.ip-51-83-56.eu

lasedero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.lasedero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.135 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: addd706a4c953b584.awsglobalaccelerator.com

fridgewaters.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.192.108.151 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-108-151.eu-central-1.compute.amazonaws.com

silence.whisperinggalaxy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.72.178.230 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-178-230.eu-west-1.compute.amazonaws.com

pointsafes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
safeclink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.138.177 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-138-177.eu-west-1.compute.amazonaws.com

ogngqz.meyoudate.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.160.108.161 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 161.108.160.34.bc.googleusercontent.com

www.h-trck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.132.150.101 (Falkenstein, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.101.150.132.142.clients.your-server.de

crazyperf.afflnx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 188.114.97.3 (Amsterdam, Netherlands) 3 redirects

ASN13335 (CLOUDFLARENET, US)

harem-smrt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rdvsecret.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN- ()

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (None, )

ASN- ()

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.193.203.120 (None, )

ASN- ()

ads.adextrem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:200::649 (None, )

ASN- ()

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (None, )

ASN- ()

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.16.131 (None, )

ASN- ()

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	lasedero.com 2 redirects lasedero.com www.lasedero.com	50 KB
8	rdvsecret.com 2 redirects rdvsecret.com	979 KB
4	gstatic.com fonts.gstatic.com	68 KB
4	adextrem.com ads.adextrem.com	3 KB
3	jquery.com code.jquery.com	105 KB
3	googleapis.com ajax.googleapis.com fonts.googleapis.com	32 KB
3	afflnx.com crazyperf.afflnx.com	28 KB
2	harem-smrt.com 1 redirects harem-smrt.com	2 KB
2	whisperinggalaxy.com 2 redirects silence.whisperinggalaxy.com	1 KB
2	fridgewaters.com 2 redirects fridgewaters.com	2 KB
1	cloudflare.com cdnjs.cloudflare.com	6 KB
1	h-trck.com 1 redirects www.h-trck.com	672 B
1	meyoudate.net 1 redirects ogngqz.meyoudate.net	722 B
1	safeclink.com 1 redirects safeclink.com — Cisco Umbrella Rank: 848730	842 B
1	pointsafes.com 1 redirects pointsafes.com	343 B
32	15

	Domain	Requested by
8	rdvsecret.com	2 redirects harem-smrt.com rdvsecret.com
8	www.lasedero.com	1 redirects www.lasedero.com
4	fonts.gstatic.com	fonts.googleapis.com
4	ads.adextrem.com	rdvsecret.com ads.adextrem.com
3	code.jquery.com	rdvsecret.com
3	crazyperf.afflnx.com	www.lasedero.com crazyperf.afflnx.com
2	fonts.googleapis.com	rdvsecret.com
2	harem-smrt.com	1 redirects crazyperf.afflnx.com
2	silence.whisperinggalaxy.com	2 redirects
2	fridgewaters.com	2 redirects
1	ajax.googleapis.com	rdvsecret.com
1	cdnjs.cloudflare.com	harem-smrt.com
1	www.h-trck.com	1 redirects
1	ogngqz.meyoudate.net	1 redirects
1	safeclink.com	1 redirects
1	pointsafes.com	1 redirects
1	lasedero.com	1 redirects
32	17

This site contains no links.

Subject Issuer	Validity	Valid
lasedero.com R11	`2024-09-02` - `2024-12-01`	3 months	crt.sh
afflnx.com R10	`2024-08-22` - `2024-11-20`	3 months	crt.sh
harem-smrt.com WE1	`2024-09-18` - `2024-12-17`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
rdvsecret.com WE1	`2024-09-18` - `2024-12-17`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.adextrem.com Amazon RSA 2048 M03	`2024-01-03` - `2025-01-30`	a year	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Frame ID: 9DCE94F0AB34B7FC1A92D19DC4822D57
Requests: 31 HTTP requests in this frame

Frame: https://ads.adextrem.com/push/ifp.php?slot=4
Frame ID: E1D8E6537AB48BBD235F864CC209E3E6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rl... HTTP 301
https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rl... Page URL
https://www.lasedero.com/index2.php?a=lnkout&sess=81pfejv24ris1l6r22vu6hsumh&idop=v02j50gupnri&idoptp... HTTP 302
https://fridgewaters.com/?a=1529&c=73047&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s1=bd0ca97b363b708a0ee011f... HTTP 302
https://fridgewaters.com/?s1=bd0ca97b363b708a0ee011fa3b0edc9d&c=73047&a=1529&s2=d2mgjikdktr5hd9ogasp2... HTTP 302
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=... HTTP 307
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1/2?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s... HTTP 302
https://pointsafes.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9og... HTTP 302
https://safeclink.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9og... HTTP 302
https://ogngqz.meyoudate.net/?utm_source=da57dc555e50572d&s1=187482&s2=1994588&s3=1529&s5=bd0ca97b363b708... HTTP 302
https://www.h-trck.com/4C2WD7/3QQG7/?sub2=187482&sub3=1529&sub5=gzfbz671922ba000a2b21 HTTP 302
https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&s... Page URL
https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08... Page URL
https://harem-smrt.com/offers/index.php?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d... HTTP 302
https://rdvsecret.com/offer/?id=1&lp=0&affid=74_187482&source=&clickid=101078723&mail= HTTP 302
https://rdvsecret.com/plancul/1/lp1.php?pt=auto&id=1&lp=0&affid=74_187482&source=&clickid=10107872... HTTP 302
https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&cli... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

32
Requests

100 %
HTTPS

21 %
IPv6

15
Domains

17
Subdomains

9
IPs

5
Countries

1270 kB
Transfer

1723 kB
Size

25
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11 HTTP 301
https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11 Page URL
https://www.lasedero.com/index2.php?a=lnkout&sess=81pfejv24ris1l6r22vu6hsumh&idop=v02j50gupnri&idoptpl=v559xc57zzg2 HTTP 302
https://fridgewaters.com/?a=1529&c=73047&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s1=bd0ca97b363b708a0ee011fa3b0edc9d HTTP 302
https://fridgewaters.com/?s1=bd0ca97b363b708a0ee011fa3b0edc9d&c=73047&a=1529&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&ch-redir=1 HTTP 302
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529 HTTP 307
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1/2?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529 HTTP 302
https://pointsafes.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5= HTTP 302
https://safeclink.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&ckmguid=ff33afd1-4cb5-4057-a212-639665f7c796 HTTP 302
https://ogngqz.meyoudate.net/?utm_source=da57dc555e50572d&s1=187482&s2=1994588&s3=1529&s5=bd0ca97b363b708a0ee011fa3b0edc9d&click_id=172082783&ban=other&j5=1&j6=1&j9=1 HTTP 302
https://www.h-trck.com/4C2WD7/3QQG7/?sub2=187482&sub3=1529&sub5=gzfbz671922ba000a2b21 HTTP 302
https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482 Page URL
https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail= Page URL
https://harem-smrt.com/offers/index.php?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=&r=1&ua=Mozilla/5.0%20(X11;%20Linux%20x86_64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/130.0.0.0%20Safari/537.36&ua_pm=Linux&fw=1600&fh=1200&wdw_d={%22name%22:%22%22,%22status%22:%22%22,%22closed%22:false,%22length%22:0,%22origin%22:%22https://harem-smrt.com%22,%22innerWidth%22:1600,%22innerHeight%22:1200,%22scrollX%22:0,%22pageXOffset%22:0,%22scrollY%22:0,%22pageYOffset%22:0,%22screenX%22:60,%22screenY%22:60,%22outerWidth%22:1600,%22outerHeight%22:1285,%22devicePixelRatio%22:1,%22screenLeft%22:60,%22screenTop%22:60,%22isSecureContext%22:true,%22crossOriginIsolated%22:false,%22originAgentCluster%22:true,%22credentialless%22:false,%22fhe%22:%22Europe/Paris%22,%22prop%22:%22prop%22,%22TEMPORARY%22:0,%22PERSISTENT%22:1}&ngt_d={%22vendorSub%22:%22%22,%22productSub%22:%2220030107%22,%22vendor%22:%22Google%20Inc.%22,%22maxTouchPoints%22:0,%22scheduling%22:{},%22userActivation%22:{},%22doNotTrack%22:null,%22geolocation%22:{},%22connection%22:{},%22plugins%22:{%220%22:{%220%22:{},%221%22:{}},%221%22:{%220%22:{},%221%22:{}},%222%22:{%220%22:{},%221%22:{}},%223%22:{%220%22:{},%221%22:{}},%224%22:{%220%22:{},%221%22:{}}},%22mimeTypes%22:{%220%22:{},%221%22:{}},%22pdfViewerEnabled%22:true,%22webkitTemporaryStorage%22:{},%22webkitPersistentStorage%22:{},%22windowControlsOverlay%22:{},%22hardwareConcurrency%22:8,%22cookieEnabled%22:true,%22appCodeName%22:%22Mozilla%22,%22appName%22:%22Netscape%22,%22appVersion%22:%225.0%20(X11;%20Linux%20x86_64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/130.0.0.0%20Safari/537.36%22,%22platform%22:%22Linux%20x86_64%22,%22product%22:%22Gecko%22,%22userAgent%22:%22Mozilla/5.0%20(X11;%20Linux%20x86_64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/130.0.0.0%20Safari/537.36%22,%22language%22:%22fr-FR%22,%22languages%22:[%22en-US%22,%22en%22],%22onLine%22:true,%22webdriver%22:false,%22deprecatedRunAdAuctionEnforcesKAnonymity%22:false,%22protectedAudience%22:{},%22storageBuckets%22:{},%22clipboard%22:{},%22credentials%22:{},%22keyboard%22:{},%22managed%22:{},%22mediaDevices%22:{},%22storage%22:{},%22serviceWorker%22:{},%22virtualKeyboard%22:{},%22wakeLock%22:{},%22deviceMemory%22:8,%22userAgentData%22:{%22brands%22:[],%22mobile%22:false,%22platform%22:%22%22},%22login%22:{},%22ink%22:{},%22mediaCapabilities%22:{},%22hid%22:{},%22locks%22:{},%22gpu%22:{},%22mediaSession%22:{},%22permissions%22:{},%22presentation%22:{},%22usb%22:{},%22xr%22:{},%22serial%22:{}}&hs_d={%22length%22:3,%22scrollRestoration%22:%22auto%22,%22state%22:null}&sc_d={%22availWidth%22:1600,%22availHeight%22:1200,%22width%22:1600,%22height%22:1200,%22colorDepth%22:24,%22pixelDepth%22:24,%22availLeft%22:0,%22availTop%22:0,%22orientation%22:{},%22onchange%22:null,%22isExtended%22:false}&fhe_d=Europe/Paris&plg_d=[%22PDF%20Viewer%22,%22Chrome%20PDF%20Viewer%22,%22Chromium%20PDF%20Viewer%22,%22Microsoft%20Edge%20PDF%20Viewer%22,%22WebKit%20built-in%20PDF%22] HTTP 302
https://rdvsecret.com/offer/?id=1&lp=0&affid=74_187482&source=&clickid=101078723&mail= HTTP 302
https://rdvsecret.com/plancul/1/lp1.php?pt=auto&id=1&lp=0&affid=74_187482&source=&clickid=101078723&mail= HTTP 302
https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11 HTTP 301
https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11

Request Chain 7

https://www.lasedero.com/index2.php?a=lnkout&sess=81pfejv24ris1l6r22vu6hsumh&idop=v02j50gupnri&idoptpl=v559xc57zzg2 HTTP 302
https://fridgewaters.com/?a=1529&c=73047&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s1=bd0ca97b363b708a0ee011fa3b0edc9d HTTP 302
https://fridgewaters.com/?s1=bd0ca97b363b708a0ee011fa3b0edc9d&c=73047&a=1529&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&ch-redir=1 HTTP 302
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529 HTTP 307
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1/2?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529 HTTP 302
https://pointsafes.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5= HTTP 302
https://safeclink.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&ckmguid=ff33afd1-4cb5-4057-a212-639665f7c796 HTTP 302
https://ogngqz.meyoudate.net/?utm_source=da57dc555e50572d&s1=187482&s2=1994588&s3=1529&s5=bd0ca97b363b708a0ee011fa3b0edc9d&click_id=172082783&ban=other&j5=1&j6=1&j9=1 HTTP 302
https://www.h-trck.com/4C2WD7/3QQG7/?sub2=187482&sub3=1529&sub5=gzfbz671922ba000a2b21 HTTP 302
https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482

32 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.lasedero.com/sm/
Redirect Chain

https://lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11
https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11

2 KB
2 KB

212ms
132ms

Document
text/html

51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

51.83.56.5 , France, ASN16276 (OVH, FR),

Reverse DNS

ip5.ip-51-83-56.eu

Software

nginx /

Resource Hash

dcf248eb0de77e5c0e2d175fe82bcca35a2540e4c836be137db7de5261c8476b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 23 Oct 2024 16:22:16 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=10
Pragma: no-cache
Referrer-Policy: no-referrer
Server: nginx
Strict-Transport-Security: max-age=15724800
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, nocache, noimageindex noindex, nofollow, noarchive, nosnippet, nocache, noimageindex

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Wed, 23 Oct 2024 16:22:15 GMT
Keep-Alive: timeout=10
Location: https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11
Server: nginx

GET
H/1.1 200
OK jquery.min.js Show response
www.lasedero.com/assets/global/ 88 KB
31 KB 82ms
77ms Script
application/javascript 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lasedero.com/assets/global/jquery.min.js?1664903021
Requested by: Host: www.lasedero.com
URL: https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.83.56.5 , France, ASN16276 (OVH, FR),
Reverse DNS: ip5.ip-51-83-56.eu
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800, public, must-revalidate, proxy-revalidate
Content-Encoding: gzip
ETag: W/"633c676d-15e40"
Pragma: public
Connection: keep-alive
Expires: Wed, 30 Oct 2024 16:22:16 GMT
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:16 GMT
Content-Type: application/javascript
Last-Modified: Tue, 04 Oct 2022 17:03:41 GMT
Server: nginx
Vary: Accept-Encoding

GET
H/1.1 200
OK scripts.min.js Show response
www.lasedero.com/assets/global/ 20 KB
7 KB 82ms
43ms Script
application/javascript 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lasedero.com/assets/global/scripts.min.js?1686237668
Requested by: Host: www.lasedero.com
URL: https://www.lasedero.com/sm/?pf_email=s************@s**.fr&src=emlslmd&sbsrc2=reg-Edenf2022&sbsrc1=rlcmss11
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.83.56.5 , France, ASN16276 (OVH, FR),
Reverse DNS: ip5.ip-51-83-56.eu
Software: nginx /
Resource Hash: 325db9ba8decd08c42b7648eef7e2e80be60235c33361f955adf144debd30a3d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800, public, must-revalidate, proxy-revalidate
Content-Encoding: gzip
ETag: W/"6481f1e4-5098"
Pragma: public
Connection: keep-alive
Expires: Wed, 30 Oct 2024 16:22:16 GMT
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:16 GMT
Content-Type: application/javascript
Last-Modified: Thu, 08 Jun 2023 15:21:08 GMT
Server: nginx
Vary: Accept-Encoding

GET
H/1.1 200
OK f.min.js Show response
www.lasedero.com/assets/global/ 15 KB
7 KB 51ms
28ms Script
application/javascript 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lasedero.com/assets/global/f.min.js?_=1729700536569
Requested by: Host: www.lasedero.com
URL: https://www.lasedero.com/assets/global/jquery.min.js?1664903021
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.83.56.5 , France, ASN16276 (OVH, FR),
Reverse DNS: ip5.ip-51-83-56.eu
Software: nginx /
Resource Hash: a7d02f0f13c90e4f9c5d4ce785b2d0a6210b39c249f982c570a829638ed52728

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800, public, must-revalidate, proxy-revalidate
Content-Encoding: gzip
ETag: W/"62462a9d-3d81"
Pragma: public
Connection: keep-alive
Expires: Wed, 30 Oct 2024 16:22:16 GMT
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:16 GMT
Content-Type: application/javascript
Last-Modified: Thu, 31 Mar 2022 22:26:37 GMT
Server: nginx
Vary: Accept-Encoding

GET
H/1.1 200
OK index2.php
www.lasedero.com/ 43 B
1 KB 70ms
47ms Image
image/gif 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.lasedero.com/index2.php?a=hitopv&sess=81pfejv24ris1l6r22vu6hsumh&idop=v02j50gupnri&idoptpl=v559xc57zzg2&_ts=1729700536594

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

51.83.56.5 , France, ASN16276 (OVH, FR),

Reverse DNS

ip5.ip-51-83-56.eu

Software

nginx /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=15724800
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, nocache, noimageindex, noindex, nofollow, noarchive, nosnippet, nocache, noimageindex
Cache-Control: no-store, no-cache, must-revalidate
Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness
Pragma: no-cache
Connection: keep-alive
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:16 GMT
Content-Type: image/gif
Server: nginx
X-Frame-Options: SAMEORIGIN

GET
H/1.1 404
Not Found favicon.ico
www.lasedero.com/ 548 B
404 B 103ms
40ms Other
text/html 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lasedero.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.83.56.5 , France, ASN16276 (OVH, FR),
Reverse DNS: ip5.ip-51-83-56.eu
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Connection: keep-alive
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:16 GMT
Content-Type: text/html
Vary: Accept-Encoding
Server: nginx

POST
H/1.1 200
OK index2.php
www.lasedero.com/ 15 B
1 KB 80ms
78ms XHR
application/json 51.83.56.5
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.lasedero.com/index2.php?a=ajax&idop=v02j50gupnri&idoptpl=v559xc57zzg2

Requested by

Host: www.lasedero.com
URL: https://www.lasedero.com/assets/global/jquery.min.js?1664903021

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

51.83.56.5 , France, ASN16276 (OVH, FR),

Reverse DNS

ip5.ip-51-83-56.eu

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, nocache, noimageindex, noindex, nofollow, noarchive, nosnippet, nocache, noimageindex
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=10
Date: Wed, 23 Oct 2024 16:22:17 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=15724800
Cache-Control: no-store, no-cache, must-revalidate
Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness
Pragma: no-cache
Connection: keep-alive
Referrer-Policy: no-referrer
Server: nginx

GET
H/1.1

200
OK

4abb8c2c4bd7d Show response
crazyperf.afflnx.com/c/
Redirect Chain

https://www.lasedero.com/index2.php?a=lnkout&sess=81pfejv24ris1l6r22vu6hsumh&idop=v02j50gupnri&idoptpl=v559xc57zzg2
https://fridgewaters.com/?a=1529&c=73047&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s1=bd0ca97b363b708a0ee011fa3b0edc9d
https://fridgewaters.com/?s1=bd0ca97b363b708a0ee011fa3b0edc9d&c=73047&a=1529&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&ch-redir=1
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529
https://silence.whisperinggalaxy.com/a8409f07-d408-408c-8b41-d01e5c7af5f1/2?s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&aid=1529
https://pointsafes.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=
https://safeclink.com/?a=1529&c=69668&p=r&s1=bd0ca97b363b708a0ee011fa3b0edc9d&s2=d2mgjikdktr5hd9ogasp2pwpik66ig&s3=&s4=&s5=&ckmguid=ff33afd1-4cb5-4057-a212-639665f7c796
https://ogngqz.meyoudate.net/?utm_source=da57dc555e50572d&s1=187482&s2=1994588&s3=1529&s5=bd0ca97b363b708a0ee011fa3b0edc9d&click_id=172082783&ban=other&j5=1&j6=1&j9=1
https://www.h-trck.com/4C2WD7/3QQG7/?sub2=187482&sub3=1529&sub5=gzfbz671922ba000a2b21
https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482

59 KB
25 KB

380ms
78ms

Document
text/html

142.132.150.101
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482
Requested by: Host: www.lasedero.com
URL: https://www.lasedero.com/assets/global/scripts.min.js?1686237668
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 142.132.150.101 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.101.150.132.142.clients.your-server.de
Software: openresty /
Resource Hash: 2403a10e8547a828117b45c3408eb20172e4c7d4da8b408dcab5615a5450a863

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 23 Oct 2024 16:22:19 GMT
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding Accept-Encoding

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 163
content-type: text/html; charset=utf-8
date: Wed, 23 Oct 2024 16:22:19 GMT
location: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: 646b9dda-2fc2-4b5b-9a7f-7065252753aa

GET
H/1.1 204
No Content favicon.ico
crazyperf.afflnx.com/ 0
107 B 29ms
29ms Other
text/plain 142.132.150.101
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://crazyperf.afflnx.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 142.132.150.101 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.101.150.132.142.clients.your-server.de
Software: openresty /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482

Response headers

Date: Wed, 23 Oct 2024 16:22:20 GMT
Server: openresty
Connection: keep-alive

GET
H/1.1 200
OK click.php
crazyperf.afflnx.com/ 120 B
3 KB 50ms
42ms XHR
text/html 142.132.150.101
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://crazyperf.afflnx.com/click.php?forceFallback=&fp=JTVCJTdCJTIya2V5JTIyJTNBJTIydXNlckFnZW50JTIyJTJDJTIydmFsdWUlMjIlM0ElMjJNb3ppbGxhJTJGNS4wJTIwKFgxMSUzQiUyMExpbnV4JTIweDg2XzY0KSUyMEFwcGxlV2ViS2l0JTJGNTM3LjM2JTIwKEtIVE1MJTJDJTIwbGlrZSUyMEdlY2tvKSUyMENocm9tZSUyRjEzMC4wLjAuMCUyMFNhZmFyaSUyRjUzNy4zNiUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMndlYmRyaXZlciUyMiUyQyUyMnZhbHVlJTIyJTNBZmFsc2UlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJsYW5ndWFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBJTIyZnItRlIlMjIlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJjb2xvckRlcHRoJTIyJTJDJTIydmFsdWUlMjIlM0EyNCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmRldmljZU1lbW9yeSUyMiUyQyUyMnZhbHVlJTIyJTNBOCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmhhcmR3YXJlQ29uY3VycmVuY3klMjIlMkMlMjJ2YWx1ZSUyMiUzQTglN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJzY3JlZW5SZXNvbHV0aW9uJTIyJTJDJTIydmFsdWUlMjIlM0ElNUIxNjAwJTJDMTIwMCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmF2YWlsYWJsZVNjcmVlblJlc29sdXRpb24lMjIlMkMlMjJ2YWx1ZSUyMiUzQSU1QjE2MDAlMkMxMjAwJTVEJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIydGltZXpvbmVPZmZzZXQlMjIlMkMlMjJ2YWx1ZSUyMiUzQS0xMjAlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJ0aW1lem9uZSUyMiUyQyUyMnZhbHVlJTIyJTNBJTIyRXVyb3BlJTJGUGFyaXMlMjIlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJzZXNzaW9uU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmxvY2FsU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmluZGV4ZWREYiUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmFkZEJlaGF2aW9yJTIyJTJDJTIydmFsdWUlMjIlM0FmYWxzZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMm9wZW5EYXRhYmFzZSUyMiUyQyUyMnZhbHVlJTIyJTNBZmFsc2UlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJjcHVDbGFzcyUyMiUyQyUyMnZhbHVlJTIyJTNBJTIybm90JTIwYXZhaWxhYmxlJTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGxhdGZvcm0lMjIlMkMlMjJ2YWx1ZSUyMiUzQSUyMkxpbnV4JTIweDg2XzY0JTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGx1Z2lucyUyMiUyQyUyMnZhbHVlJTIyJTNBJTVCJTVCJTIyUERGJTIwVmlld2VyJTIyJTJDJTIyUG9ydGFibGUlMjBEb2N1bWVudCUyMEZvcm1hdCUyMiUyQyU1QiU1QiUyMmFwcGxpY2F0aW9uJTJGcGRmJTIyJTJDJTIycGRmJTIyJTVEJTJDJTVCJTIydGV4dCUyRnBkZiUyMiUyQyUyMnBkZiUyMiU1RCU1RCU1RCUyQyU1QiUyMkNocm9tZSUyMFBERiUyMFZpZXdlciUyMiUyQyUyMlBvcnRhYmxlJTIwRG9jdW1lbnQlMjBGb3JtYXQlMjIlMkMlNUIlNUIlMjJhcHBsaWNhdGlvbiUyRnBkZiUyMiUyQyUyMnBkZiUyMiU1RCUyQyU1QiUyMnRleHQlMkZwZGYlMjIlMkMlMjJwZGYlMjIlNUQlNUQlNUQlMkMlNUIlMjJDaHJvbWl1bSUyMFBERiUyMFZpZXdlciUyMiUyQyUyMlBvcnRhYmxlJTIwRG9jdW1lbnQlMjBGb3JtYXQlMjIlMkMlNUIlNUIlMjJhcHBsaWNhdGlvbiUyRnBkZiUyMiUyQyUyMnBkZiUyMiU1RCUyQyU1QiUyMnRleHQlMkZwZGYlMjIlMkMlMjJwZGYlMjIlNUQlNUQlNUQlMkMlNUIlMjJNaWNyb3NvZnQlMjBFZGdlJTIwUERGJTIwVmlld2VyJTIyJTJDJTIyUG9ydGFibGUlMjBEb2N1bWVudCUyMEZvcm1hdCUyMiUyQyU1QiU1QiUyMmFwcGxpY2F0aW9uJTJGcGRmJTIyJTJDJTIycGRmJTIyJTVEJTJDJTVCJTIydGV4dCUyRnBkZiUyMiUyQyUyMnBkZiUyMiU1RCU1RCU1RCUyQyU1QiUyMldlYktpdCUyMGJ1aWx0LWluJTIwUERGJTIyJTJDJTIyUG9ydGFibGUlMjBEb2N1bWVudCUyMEZvcm1hdCUyMiUyQyU1QiU1QiUyMmFwcGxpY2F0aW9uJTJGcGRmJTIyJTJDJTIycGRmJTIyJTVEJTJDJTVCJTIydGV4dCUyRnBkZiUyMiUyQyUyMnBkZiUyMiU1RCU1RCU1RCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMndlYmdsVmVuZG9yQW5kUmVuZGVyZXIlMjIlMkMlMjJ2YWx1ZSUyMiUzQSUyMkludGVsJTIwSW5jLn5JbnRlbCUyMElyaXMlMjBPcGVuR0wlMjBFbmdpbmUlMjIlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJoYXNMaWVkTGFuZ3VhZ2VzJTIyJTJDJTIydmFsdWUlMjIlM0F0cnVlJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyaGFzTGllZFJlc29sdXRpb24lMjIlMkMlMjJ2YWx1ZSUyMiUzQWZhbHNlJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyaGFzTGllZE9zJTIyJTJDJTIydmFsdWUlMjIlM0FmYWxzZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmhhc0xpZWRCcm93c2VyJTIyJTJDJTIydmFsdWUlMjIlM0FmYWxzZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMnRvdWNoU3VwcG9ydCUyMiUyQyUyMnZhbHVlJTIyJTNBJTVCMCUyQ2ZhbHNlJTJDZmFsc2UlNUQlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJmb250cyUyMiUyQyUyMnZhbHVlJTIyJTNBJTVCJTIyQW5kYWxlJTIwTW9ubyUyMiUyQyUyMkFyaWFsJTIyJTJDJTIyQXJpYWwlMjBCbGFjayUyMiUyQyUyMkNvbWljJTIwU2FucyUyME1TJTIyJTJDJTIyQ291cmllciUyMiUyQyUyMkNvdXJpZXIlMjBOZXclMjIlMkMlMjJHZW9yZ2lhJTIyJTJDJTIySGVsdmV0aWNhJTIyJTJDJTIySW1wYWN0JTIyJTJDJTIyVGltZXMlMjIlMkMlMjJUaW1lcyUyME5ldyUyMFJvbWFuJTIyJTJDJTIyVHJlYnVjaGV0JTIwTVMlMjIlMkMlMjJWZXJkYW5hJTIyJTVEJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyYXVkaW8lMjIlMkMlMjJ2YWx1ZSUyMiUzQSUyMjEyNC4wNDM0NzUyNzUxNjA3NCUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMl9faGFzaCUyMiUyQyUyMnZhbHVlJTIyJTNBJTIyNTBhNjIxMjkzMDNlNDFjMzA2ZGEyNWEyNDE0MzJlYzAlMjIlN0QlNUQ%3D
Requested by: Host: crazyperf.afflnx.com
URL: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 142.132.150.101 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.101.150.132.142.clients.your-server.de
Software: openresty /
Resource Hash

Request headers

Referer: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Wed, 23 Oct 2024 16:22:20 GMT
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding, Accept-Encoding
Server: openresty
Connection: keep-alive

GET
H3 200 / Show response
harem-smrt.com/offers/ 1 KB
1 KB 117ms
71ms Document
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=
Requested by: Host: crazyperf.afflnx.com
URL: https://crazyperf.afflnx.com/c/4abb8c2c4bd7d?lp=100?sub1=&ext_click_id=3856d39aaeba42a188555e18924bc585&sub6=74&subsource=187482
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c3e582029a64ce681b3ad56bd9ef9457c6c96e3388248674ff2da7a5d9e90cc

Request headers

Referer: https://crazyperf.afflnx.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-Prefers-Color-Scheme, Sec-CH-Viewport-Width, Sec-CH-DPR, Sec-CH-Width
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d7310ba6b85d70e-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 23 Oct 2024 16:22:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BxpL4jClwsl5OJvXnUiJYXMLMDtdGrbOMNPoe9IyF49UxGHdrM2ScEo9WyNohKgV8ZAFnckb5nI9KwAY2rMIiVxgIlzsDahEtQkV9yArvyBrC%2FPKkgAXKUWpg1TCG8nheg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=19439&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4179&recv_bytes=4517&delivery_rate=28948&cwnd=12000&unsent_bytes=0&cid=0fbad98844a8f64c&ts=87&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H3 200 platform.min.js Show response
cdnjs.cloudflare.com/ajax/libs/platform/1.3.6/ 14 KB
6 KB 134ms
48ms Script
application/javascript 104.17.25.14

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/platform/1.3.6/platform.min.js

Requested by

Host: harem-smrt.com
URL: https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

8c039b6e245af3041933a2e283eb929be6c05618616e34ef2b8e3ca2bb368007

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://harem-smrt.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5f006e5f-38b2"
age: 149424
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p92mwmH4v2gIqgEKDUeaPhy3reXkcdgBNJairADyoXQ%2B8kKNBnL6scmYOYBWCZmZAK6tykAKYIxTC2jJxgYRmi5eMlgiEKHhzWfTZY2ZnUf3TqJQ4zMfVfrFQcPCiZHG0Z3fSO0i"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 13 Oct 2025 16:22:20 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 23 Oct 2024 16:22:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 04 Jul 2020 11:56:15 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8d7310bb88bd2a3f-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5648
server: cloudflare

GET
H3

200

Primary Request lp16.php Show response
rdvsecret.com/plancul/1/
Redirect Chain

https://harem-smrt.com/offers/index.php?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=&r=1&ua=Mozilla/5.0%20(X11;%20Linux%20x86_64)%20AppleWebKit/537.36%20(KHTML,%20lik...
https://rdvsecret.com/offer/?id=1&lp=0&affid=74_187482&source=&clickid=101078723&mail=
https://rdvsecret.com/plancul/1/lp1.php?pt=auto&id=1&lp=0&affid=74_187482&source=&clickid=101078723&mail=
https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=

11 KB
5 KB

156ms
155ms

Document
text/html

188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Requested by: Host: harem-smrt.com
URL: https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ce0749025264b4c433d7d2f2ed8834141c96cc61033e1a7dcc0eda614fce6bb

Request headers

Referer: https://harem-smrt.com/offers/?id=39&affid=74&source=187482&clickid=4da024461d1fd5c08ef30d4610f9c08a&mail=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
sec-ch-dpr: 1
sec-ch-prefers-color-scheme: light
sec-ch-viewport-width: 1600

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d7310becd9f791c-CDG
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Wed, 23 Oct 2024 16:22:21 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2BjNyz7FBlChGwOS8MUZLJTrcYmGGABny5ZlVp70ydb0Z5C2YnUs%2Bf%2Bw%2Fd37Et9PscdkZXC3A%2FCgLELSdmZcx13KD%2B9MCgKdbswXCF2mcDQz6e1Hc1Yn5WLVUpH3uXqC"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=23346&sent=15&recv=13&lost=0&retrans=0&sent_bytes=5727&recv_bytes=5539&delivery_rate=11729&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=301&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d7310be5d43791c-CDG
content-type: text/html; charset=UTF-8
date: Wed, 23 Oct 2024 16:22:21 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1FkT0%2BDpcUMSiXD%2B3wz7wLnHK3VLQrdcpXXhANmA7vwkBrREL0gomP04b4iiXhRptehPHIhhMGFIoVzB%2FJNGKbqwLramG8FBEOFI3gGvYuSa19WmupvP5grgEGh%2FJOT%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=23386&sent=13&recv=12&lost=0&retrans=0&sent_bytes=4891&recv_bytes=5042&delivery_rate=23698&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=135&x=1" cfExtPri cfHdrFlush;dur=0

GET
H3 200 0c968cf29006995ce949668f25a05dc1.css
rdvsecret.com/plancul/1/lp16/ 3 KB
2 KB 141ms
88ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fe1345472d48f229da26edbc6f0b0d01fbf0f12a2cd392ff1d4a70a9ccdbd3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=

Response headers

content-encoding: gzip
cf-cache-status: MISS
etag: "dfc-5b79b05717a0b-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BOvgBmI%2F8mymaLYshidbkm2vP3btzXBggtG%2BhDKg%2Bk3QEnZ%2FRtGhE6pEUhw68DCu7mbBO23fxx14yXUXrU%2B2yJbHSd%2FKUCJw5wKbci2sOcv8EjrhNMGP61nfvszkGntx"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=25822&sent=21&recv=19&lost=0&retrans=0&sent_bytes=10744&recv_bytes=6580&delivery_rate=30747&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=636&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: text/css
last-modified: Tue, 29 Dec 2020 14:15:22 GMT
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d7310c16804791c-CDG
accept-ranges: bytes
content-length: 1333
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.0/ 84 KB
30 KB 259ms
29ms Script
text/javascript 2a00:1450:4001:813::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js

Requested by

Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
age: 86630
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:18:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:18:31 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30211
x-xss-protection: 0
server: sffe

GET
H3 200 ba63ff6bd1ff8e5677bdfef10454b549.js Show response
rdvsecret.com/plancul/1/lp16/ 141 B
779 B 139ms
79ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rdvsecret.com/plancul/1/lp16/ba63ff6bd1ff8e5677bdfef10454b549.js?=671922bd59a62
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a52fb920644729138a6356460c3f8b5322736089171c6775e2ca2f4c878bd835

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=

Response headers

content-encoding: gzip
cf-cache-status: MISS
etag: "8d-5b6193395eaf9-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iFSn4h%2FhF7dMaLvK4JZB9cZ7zamZrhpfqemVB3eNA696pzTP%2FBWwQpkmDVIzXieC4QjYEz%2F99%2BkvGps43faU87zVfJuNy9dFYA1IXqky3IbDJTEmJaohj2mCcasINuKa"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=25822&sent=23&recv=19&lost=0&retrans=0&sent_bytes=12785&recv_bytes=6580&delivery_rate=30747&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=638&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: application/javascript
last-modified: Thu, 10 Dec 2020 09:57:19 GMT
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d7310c16807791c-CDG
accept-ranges: bytes
content-length: 124
server: cloudflare

GET
H/1.1 200
OK detect.js Show response
ads.adextrem.com/ 78 B
826 B 397ms
32ms Script
application/javascript 18.193.203.120

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adextrem.com/detect.js
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.203.120 -, , ASN (),
Reverse DNS
Software: Apache/2.4.10 (Debian) /
Resource Hash: 1fab08ee7301c1c5676fa683c923e47681d2b1ec4fd396045937e8fb6befa7c8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

Cache-control: no-cache="set-cookie"
Content-Encoding: gzip
ETag: "4e-559751641a5c0-gzip"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91
Date: Wed, 23 Oct 2024 16:22:21 GMT
Content-Type: application/javascript
Last-Modified: Mon, 18 Sep 2017 11:31:43 GMT
Server: Apache/2.4.10 (Debian)
Vary: Accept-Encoding

GET
H2 200 jquery-ui.css
code.jquery.com/ui/1.12.1/themes/base/ 35 KB
8 KB 256ms
29ms Stylesheet
text/css 2a04:4e42:200::649

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 44f8a56d427917b5fa0dd7933ba545679be5e6b3b93099e64a4e29c2159f57c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-8c85"
age: 4857252
x-cache: HIT, HIT
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: text/css
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 18, 188920
x-served-by: cache-lga21981-LGA, cache-lcy-eglc8600021-LCY
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1729700542.823945,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8323
server: nginx

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 228ms
30ms Script
application/javascript 2a04:4e42:200::649

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15d9d"
age: 5892647
x-cache: HIT, HIT
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 13, 867901
x-served-by: cache-lga21931-LGA, cache-lcy-eglc8600021-LCY
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1729700542.824201,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30875
server: nginx

GET
H2 200 jquery-ui.min.js Show response
code.jquery.com/ui/1.12.1/ 248 KB
66 KB 227ms
29ms Script
application/javascript 2a04:4e42:200::649

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.12.1/jquery-ui.min.js
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-3dee4"
age: 4943504
x-cache: HIT, HIT
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-cache-hits: 1, 189689
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-served-by: cache-lga13623-LGA, cache-lcy-eglc8600021-LCY
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1729700542.824488,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 67751
server: nginx

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 260ms
49ms Stylesheet
text/css 2a00:1450:4001:80b::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500,700,900&display=swap

Requested by

Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

6249a639e8cfba4180cecb2899158fc25f679b4b8f23ff7d8d043cc5a7508663

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 23 Oct 2024 16:22:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 16:22:21 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 23 Oct 2024 15:25:47 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 3 KB
762 B 2421ms
2221ms Stylesheet
text/css 2a00:1450:4001:80b::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab&display=swap

Requested by

Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

04afc18c1c8527efcb94cd9e4f22fd45958cb68b49c994630188c0fc9c56d2d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 23 Oct 2024 16:22:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 16:22:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 23 Oct 2024 15:50:58 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK detect.php Show response
ads.adextrem.com/ 34 B
206 B 28ms
28ms Script
text/html 18.193.203.120

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adextrem.com/detect.php
Requested by: Host: ads.adextrem.com
URL: https://ads.adextrem.com/detect.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.203.120 -, , ASN (),
Reverse DNS
Software: Apache/2.4.10 (Debian) /
Resource Hash: 6ab2b9bf505bf16efda449af810081478279b4b4151996c66cfccdbc8cd33175

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://rdvsecret.com/

Response headers

Content-Length: 34
Date: Wed, 23 Oct 2024 16:22:24 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache/2.4.10 (Debian)
Connection: keep-alive

GET
H3 200 1.gif
rdvsecret.com/plancul/1/lp16/ 967 KB
968 KB 68ms
67ms Image
image/gif 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rdvsecret.com/plancul/1/lp16/1.gif
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f4d95d70a7c81a640b273cc833c39a15f44c3b6c87c48c7d372926fef736862

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28

Response headers

cf-cache-status: REVALIDATED
etag: "f1c09-5b58d829e9380"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2DslSTUOUILE75M698RKWwpbX6co4mnSsltGC7E6WTq%2Bu3rLXTGyRMdsf0CejD4EcWm5NHNE3YmGe%2BFwcCSYxekVcsgeShATxG9P4Aeq1uajtN2NuIDXXBbPRtMUqjXA"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32511&sent=26&recv=25&lost=0&retrans=1&sent_bytes=14419&recv_bytes=7655&delivery_rate=12782&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=3236&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 23 Oct 2024 16:22:24 GMT
content-type: image/gif
last-modified: Thu, 03 Dec 2020 11:17:50 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d7310d1af39791c-CDG
accept-ranges: bytes
content-length: 990217
server: cloudflare

GET
H3 200 title.svg
rdvsecret.com/plancul/1/lp16/ 1 KB
1 KB 94ms
94ms Image
image/svg+xml 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rdvsecret.com/plancul/1/lp16/title.svg
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaf7e935a0487af944c842426a64ccf6ff7f961c1ea83aef6c976d0515be10d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/plancul/1/lp16/0c968cf29006995ce949668f25a05dc1.css?=671922bd59a28

Response headers

server: cloudflare
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: REVALIDATED
etag: W/"4ed-5b58d84e26900"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=noZhmQLZJsZdwW8Agdr3oh7VDb5qBTZmPge8p%2BySccs8pfLIHd7mo%2Blxy%2Bekn0IZOqUR%2FrcvyQFKHjfstuHb%2Fqrlq7PwZ%2F1YhJ0Ty4sl4ypjzqd6n6j3HLVQiw5%2B0lML"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d7310d1af3a791c-CDG
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32511&sent=36&recv=25&lost=0&retrans=1&sent_bytes=26419&recv_bytes=7655&delivery_rate=12782&cwnd=12000&unsent_bytes=0&cid=e7d30be985aa4831&ts=3243&x=1", cfExtPri, cfHdrFlush;dur=12
date: Wed, 23 Oct 2024 16:22:24 GMT
content-type: image/svg+xml
last-modified: Thu, 03 Dec 2020 11:18:28 GMT
vary: Accept-Encoding
priority: u=3,i

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 98ms
39ms Font
font/woff2 172.217.16.131

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.131 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://rdvsecret.com
Referer: https://fonts.googleapis.com/

Response headers

age: 151803
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 21 Oct 2025 22:12:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 21 Oct 2024 22:12:21 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H3 200 BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rj.woff2
fonts.gstatic.com/s/robotoslab/v34/ 14 KB
14 KB 123ms
64ms Font
font/woff2 172.217.16.131

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v34/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rj.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Slab&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.131 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

438099da1cf057f5b48133f7a74b2d506751fb1b2e888d22ca397fa1983a8f9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://rdvsecret.com
Referer: https://fonts.googleapis.com/

Response headers

age: 84148
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:59:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:59:56 GMT
last-modified: Tue, 24 Oct 2023 01:50:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13992
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 108ms
49ms Font
font/woff2 172.217.16.131

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.131 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://rdvsecret.com
Referer: https://fonts.googleapis.com/

Response headers

age: 120204
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 06:59:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 06:59:00 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 99ms
40ms Font
font/woff2 172.217.16.131

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.131 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://rdvsecret.com
Referer: https://fonts.googleapis.com/

Response headers

age: 85960
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:29:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:29:44 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK loader.php Show response
ads.adextrem.com/push/ 4 KB
2 KB 29ms
28ms Script
text/html 18.193.203.120

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adextrem.com/push/loader.php
Requested by: Host: rdvsecret.com
URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.203.120 -, , ASN (),
Reverse DNS
Software: Apache/2.4.10 (Debian) /
Resource Hash: 8b9ea8752caa6b5eb8b322494a98677a062c9e3175c254280b72a0133a567943

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Encoding: gzip
Pragma: no-cache
Connection: keep-alive
Content-Length: 1561
Date: Wed, 23 Oct 2024 16:22:24 GMT
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Apache/2.4.10 (Debian)

GET
H/1.1 200
OK ifp.php
ads.adextrem.com/push/ Frame E1D8 0
0 155ms
54ms Document
text/html 18.193.203.120

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adextrem.com/push/ifp.php?slot=4
Requested by: Host: ads.adextrem.com
URL: https://ads.adextrem.com/push/loader.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.203.120 -, , ASN (),
Reverse DNS
Software: Apache/2.4.10 (Debian) /
Resource Hash

Request headers

Referer: https://rdvsecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0 post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1076
Content-Type: text/html; charset=UTF-8
Date: Wed, 23 Oct 2024 16:22:24 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.4.10 (Debian)
Vary: Accept-Encoding

GET
H3 200 jump-favicon.ico
rdvsecret.com/plancul/1/lp16/ 1 KB
836 B 66ms
66ms Other
image/vnd.microsoft.icon 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rdvsecret.com/plancul/1/lp16/jump-favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dedda483c1ee58da9fb3d6f9f9ba972db18d893554a53673a32221bb3d93a701

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"47e-5b58d75079280"
age: 4833
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HeiNXyIBlhj1kvvxCg4QsTfZ1R5ujaa%2FifG4%2BlzuFwoCE%2BmDHsK65YL5YRzBB5t55BKpLPX94cD%2FLgXyLgVeCdbIZ5P7D5xr%2B%2FsfPxemKxgx5N7SrUO7h7EV4SitX5%2BL"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=23418&sent=903&recv=366&lost=3&retrans=4&sent_bytes=1033399&recv_bytes=23880&delivery_rate=6279443&cwnd=147390&unsent_bytes=0&cid=e7d30be985aa4831&ts=3619&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 23 Oct 2024 16:22:24 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 03 Dec 2020 11:14:02 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d7310d43925791c-CDG
server: cloudflare

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.lasedero.com/	1970-01-21 00:29:46	Name: phpsess Value: 81pfejv24ris1l6r22vu6hsumh
.lasedero.com/	1970-01-21 00:29:46	Name: 6834b79529aefe311132eca9228c5598_v02j50gupnri Value: y
.lasedero.com/	1970-01-21 00:29:46	Name: c574f1eca03704c30b3ee6a50175cccf_v02j50gupnri Value: y
.lasedero.com/	1970-01-21 08:52:20	Name: screen_size Value: 1600x1200
.lasedero.com/	1970-01-21 08:52:20	Name: fp_k Value: be0a705dd7796891ae008f107cb513b5719e80c9e74708db80f0e9349915fb96
.fridgewaters.com/	1970-01-21 01:11:32	Name: pt30 Value: e447eca0808e4066aa56d28d2584f5c7
.fridgewaters.com/	1970-01-21 10:04:20	Name: ptc Value: e447eca0808e4066aa56d28d2584f5c7
.fridgewaters.com/	1969-12-31 23:59:59	Name: ptbs Value: e447eca0808e4066aa56d28d2584f5c7
.fridgewaters.com/	1969-12-31 23:59:59	Name: sid Value: dahTZi2ShWQuMnHZulvcMQZ/4ZqW6AW3Gikl0I27Mojj8xeQLzs8Iw==
.fridgewaters.com/	1970-01-21 10:04:20	Name: trk Value: pXg7YqfcOBE35Qse5xC2YQZ/4ZqW6AW3Gikl0I27Mojj8xeQLzs8Iw==
.fridgewaters.com/	1970-01-21 01:11:32	Name: c4762 Value: dahTZi2ShWQGu3nq2qOhSSG35JBYe8kGjIx1nfwINVLfl8PR2ErwfQ==
.silence.whisperinggalaxy.com/	1970-01-21 00:29:46	Name: a8409f07-d408-408c-8b41-d01e5c7af5f1-v4 Value: 4ZTJIxwDTYLwct0juBhdkQPKBGTI3XL0jwLii0oroH8
.silence.whisperinggalaxy.com/	1970-01-21 09:13:56	Name: cc-v4 Value: 8iG%2B0QjKX%2BEISL8kTw6ZZHJpMLqgW8UIoNXiXblsd6MEQSZs5UZHQz2oYpW%2BbBSVMiyjoAjojr2KpSKwW8f%2FZBrGgeuUthP9l9%2BbOpzuEq1qKwdlR5rhCDFS07T59hLagIAdJ2fgORkQapSI41IhBQ%3D%3D
.safeclink.com/	1969-12-31 23:59:59	Name: sid Value: dahTZi2ShWTYMfxvceKMCQZ/4ZqW6AW3G+S/XwwqdjTZr3/BPskSGw==
.safeclink.com/	1970-01-21 10:04:20	Name: trk Value: pXg7YqfcOBETTYKnZr/ZRQZ/4ZqW6AW3G+S/XwwqdjTZr3/BPskSGw==
.safeclink.com/	1970-01-21 01:11:32	Name: c4538 Value: dahTZi2ShWQiliB37/+FCI6QpnEPvRB9FI8d+5aauT/fl8PR2ErwfQ==
ogngqz.meyoudate.net/	1970-01-21 01:54:44	Name: unique_id Value: 671922bb000da8fe
ogngqz.meyoudate.net/	1970-01-21 02:37:56	Name: unique_id2 Value: 671922bb000ece99
ogngqz.meyoudate.net/	1970-01-21 02:37:56	Name: 671922bb000ece99_c Value: 1
ogngqz.meyoudate.net/	1970-01-21 01:11:32	Name: ref_token Value: 187482
ogngqz.meyoudate.net/	1970-01-21 10:04:20	Name: tid Value: gzfbz671922ba000a2b21
www.h-trck.com/	1970-01-21 00:29:46	Name: uniqueClick_3QQG7 Value: a6f364ae-f66e-415d-bc1e-5b83671ec7d0:1729700539
www.h-trck.com/	1970-01-21 02:37:56	Name: transaction_id Value: 3856d39aaeba42a188555e18924bc585
crazyperf.afflnx.com/	1969-12-31 23:59:59	Name: CF Value: 7yhZqJlrdtQvmGNExoknng__
.afflnx.com/	1970-01-21 00:29:46	Name: s Value: G634Z%2B%2BxwFe1R9U3hrylwQDqxAuTQJsRtV8Sh1CVK%2B%2F%2Bc84K33cOf9MBucMpF4WrLgYQR1glQL%2FuW5ulc52KaiB%2BTvaRHptV%2BTS4T6y71uRO5u4l768%2B%2BFZnc%2Bhia2YvzOAjufw9RLwI5Ae6AsvEcWzN3znR7uubKbxY6vI2%2FYQBXUZOntBVHrRjPiB067j%2Fj27ms%2BqB%2F5aeLXTfR5qNB8DTxoeixSB%2B1DQw59OAtlXvoM9MMyHkp6OuNgBPG6p676%2FlhsmOQdDrt0J5l5QgkX7%2Ffj1JRr7Wc%2FSPEIwWtgvq%2Fdmo%2BhNPypv9Dl3nfkfpN0ia1TT0PtnlSpuyN89SsFIBnm4g4%2FGqUFOp47f%2FdubLI68%2Fw1xjqrnyJHfUWeLsv7cilMYdAQgoPfV3gF2SfidzB60v4LP3A6jkGorqVhj075fIifTKykFunW6hP12J3TG5eWhITsh7cCLNeOM0IDa9%2BPeRaeie3Pw6KW8tkYo%2FQv4VXQSvUf4kNQwuTczn8Wudp8Scfv%2BLYAm5Q172ksa%2F5j1PvbXjA5DEXnsEfQHDTcxqNjTRWAQ%2Fv272bnGhwlsetMjb5s067auKhIm3rDbt45tcDFqeTwhOR4bZ4zLLKTa%2FLoThUDmVfyub%2BPWbCeKmwSDOWPrWXliY8L0A6aaSCcVD3baaiLajXTcb%2FYpEwOfhfsQaikNtZCEqZaaUs%2FnLl7aax4eoS9ZFb75H3J%2BXOv8sv1Ke1CHL6hygqNutrYWX2wkUyJ7PDPaE3fjH0Uzd%2Bqb%2BnjacIY5Q%2F1T6PJnMsTbBF9p%2BMhDo7xUazLXzNOwfQcFaAtkzz27npRv8dGeqg%2Bg9HqCOHp5I5nK7zkwsrlm8MhWhPYscOLbMFLAI54Hcd1i7q%2FY736%2FP%2FZmEatgyZ7c%2F7ZEX7OPLUI5PlFpVE2eiTa%2FM7Pddt%2FgSuKv0S5rXbjzomYsfXAIWxNr4aCwunfncfS4%2FLFr1IYmqB6Mn6eY890av5uOm%2BKvc0YRUK3H4CQjfwqTpxBOJoBP%2B34QaGkU9aW0gIlaz%2B0aCrOMVUcCs8%2BQKfBT8yBMRYo0rkBwmSCKWNnsWD6IvjVIw%2FrlAlE09Cq4sOUiX%2Bh6G706QoKnJDvgRTfKlc%2BqNHSXcIOt3JhY71nD7USFCfj6xPtIoxAhRISnfEY%2FOaxkr3%2FxXm385IuTMxaKBlZTIjNHauh0Z0Zr3gMw7XnDovC2FHvgWFy1amKFvNQwmyOrEzmCqTXz%2FF%2BEh1HFX1DFbljJ04XsUEnB2M%2FrVihyLCTu22vbsBbjNmfOWMYXfqoCNIRy4Bmh%2FJAVcYoXlD%2BoeULwNFYFW4%2BND7NjsxwCUE4dPlHkKp1UzqXX%2F1oRdsBffc0iwG0%2Bdm9Q9sj0otbsv5DFcmC4RkWrcj1SnngFyep7uzdFFSR83pnWiZ%2BWfecUqmxy2n7%2FcAF94%2F9X5HYYBlYwrvxw2cEsr%2B%2Bps%2BGcuAkx1EO1T9S2u7eZZRa5M3wnoeFKOdUQD1W4Blt1yGddfJNPGL6LgoVbghFP5LcXJUF1ZuArefYWKQTFLj0%2FY3v%2BIJEDC8HiD%2BswllVjwLD2DrX5uykyIrKqOaqQ5z0PpFOQ6EnhL2eLQRbrBgWUFNWxrycs%2F1V2Lvtdbt9RrjkiT7sftjb4oxdN3ZAerMvxfV4aAfNrSo6wNXw73sHaOA0usjTkU%2FbBBm4CyKUY7vDlSB5Oa8QFwkb0utJZJZuE9JEpv7CnjMoU3cqvcceF6YMxJcG%2FzwTG%2FQeBrmcCly%2BjClWraYeUUGBrMK9O4kZjQxVQIuMrXaPhOq88BSXzGz9z51rP8W8Msg4TcBAgQj1uDADT5ePM%3D

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.lasedero.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)
rendering	warning	URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=(Line 7) Message: The value "false" for key "user-scalable" is invalid, and has been ignored.
javascript	warning	URL: https://ads.adextrem.com/detect.js Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ads.adextrem.com/detect.php, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://ads.adextrem.com/detect.js Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ads.adextrem.com/detect.php, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other	error	URL: https://rdvsecret.com/plancul/1/lp16.php?pt=auto&lp=16&id=1&affid=74_187482&source=pasdesource&clickid=101078723&mail=# Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.adextrem.com
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
crazyperf.afflnx.com
fonts.googleapis.com
fonts.gstatic.com
fridgewaters.com
harem-smrt.com
lasedero.com
ogngqz.meyoudate.net
pointsafes.com
rdvsecret.com
safeclink.com
silence.whisperinggalaxy.com
www.h-trck.com
www.lasedero.com
104.17.25.14
142.132.150.101
172.217.16.131
18.192.108.151
18.193.203.120
188.114.97.3
2a00:1450:4001:80b::200a
2a00:1450:4001:813::200a
2a04:4e42:200::649
34.160.108.161
51.83.56.5
52.19.138.177
54.72.178.230
75.2.108.135
04afc18c1c8527efcb94cd9e4f22fd45958cb68b49c994630188c0fc9c56d2d0
0f4d95d70a7c81a640b273cc833c39a15f44c3b6c87c48c7d372926fef736862
1fab08ee7301c1c5676fa683c923e47681d2b1ec4fd396045937e8fb6befa7c8
2403a10e8547a828117b45c3408eb20172e4c7d4da8b408dcab5615a5450a863
325db9ba8decd08c42b7648eef7e2e80be60235c33361f955adf144debd30a3d
3c3e582029a64ce681b3ad56bd9ef9457c6c96e3388248674ff2da7a5d9e90cc
438099da1cf057f5b48133f7a74b2d506751fb1b2e888d22ca397fa1983a8f9a
44f8a56d427917b5fa0dd7933ba545679be5e6b3b93099e64a4e29c2159f57c0
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
6249a639e8cfba4180cecb2899158fc25f679b4b8f23ff7d8d043cc5a7508663
6ab2b9bf505bf16efda449af810081478279b4b4151996c66cfccdbc8cd33175
6fe1345472d48f229da26edbc6f0b0d01fbf0f12a2cd392ff1d4a70a9ccdbd3e
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
7ce0749025264b4c433d7d2f2ed8834141c96cc61033e1a7dcc0eda614fce6bb
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
8b9ea8752caa6b5eb8b322494a98677a062c9e3175c254280b72a0133a567943
8c039b6e245af3041933a2e283eb929be6c05618616e34ef2b8e3ca2bb368007
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a52fb920644729138a6356460c3f8b5322736089171c6775e2ca2f4c878bd835
a7d02f0f13c90e4f9c5d4ce785b2d0a6210b39c249f982c570a829638ed52728
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
dcf248eb0de77e5c0e2d175fe82bcca35a2540e4c836be137db7de5261c8476b
dedda483c1ee58da9fb3d6f9f9ba972db18d893554a53673a32221bb3d93a701
eaf7e935a0487af944c842426a64ccf6ff7f961c1ea83aef6c976d0515be10d9
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

rdvsecret.com Open in urlscan Pro 188.114.97.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

32 Requests

100 %HTTPS

21 %IPv6

15 Domains

17 Subdomains

9 IPs

5 Countries

1270 kBTransfer

1723 kBSize

25 Cookies

0 Outgoing links

Page URL History

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

rdvsecret.com Open in urlscan Pro
188.114.97.3 Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

100 %
HTTPS

21 %
IPv6

15
Domains

17
Subdomains

9
IPs

5
Countries

1270 kB
Transfer

1723 kB
Size

25
Cookies

32 HTTP transactions
0 data transactions