www.agilerefund.click Open in urlscan Pro
172.67.156.38  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Page URL
2. https://www.agilerefund.click/offer.php?id=94&sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Page URL
3. http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Show response www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/	1 KB 1 KB	1398ms 1353ms	Document text/html	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 678a05f62e5eebf6e6cedeee4f8f207ac8c0ab7f5f42046f1cf1eff629fe6408 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-US,en;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 8691a8e5df5be587-DFW Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Sat, 23 Mar 2024 21:54:25 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4zV%2BL1YRqLLnc%2FI1wnrn1qOTrLffYYQ6Kv6C%2FcCG%2Fv3pVafamfUtz0qOVc2T6CpHW4nb7m6a5SsS0D8kC3uqK4JuxeqUhzJP0CqFk5q2tv9yX3n68sGFkdOSbQJLR0ruyzRYJxgymRo%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	jquery-1.11.0.min.js www.agilerefund.click/	94 KB 33 KB	59ms 58ms	Script application/javascript	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.agilerefund.click/jquery-1.11.0.min.js Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Date Sat, 23 Mar 2024 21:54:25 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 5516 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sun, 07 Jan 2024 11:46:37 GMT Server cloudflare ETag W/"659a8f1d-1787d" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhj6ts2fR9BhlttK7xLEEK%2Fw9BkSP1eY6Imn2hvG%2BL5YSFB8r1Msg9H1ssraBZIZAUs5dXFePDacHlcvhE9zlAMZme3%2FJzoOrRYZWvXwPkNPgjDzOFnNCRSrr6jcdl2wq0ratgBkLDQ%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript Cache-Control max-age=14400 CF-RAY 8691a8ef9943e587-DFW
GET H2	200	js www.googletagmanager.com/gtag/	196 KB 71 KB	669ms 112ms	Script application/javascript	142.250.65.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-22484186-3 Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.65.232 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s73-in-f8.1e100.net Software Google Tag Manager / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Sat, 23 Mar 2024 21:54:26 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 72763 x-xss-protection 0 last-modified Sat, 23 Mar 2024 21:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 23 Mar 2024 21:54:26 GMT
GET H2	200	offer.php www.agilerefund.click/	367 B 699 B	761ms 350ms	Document text/html	104.21.64.222 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.agilerefund.click/offer.php?id=94&sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/roquxnkxgh/giejcttef2904kqmgtgs/qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.64.222 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://www.agilerefund.click/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8691a8f58c13e7fb-DFW content-encoding br content-type text/html; charset=UTF-8 date Sat, 23 Mar 2024 21:54:27 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=roMBVeboPsQELAtPS%2F6Xh2lz0AsTSedw7MEpiJcZxtWFKzddwc%2B9TM9X6MwBdlkICBj76LoGnPAftPx7BP09c%2BKYrs%2BCcV9y3FJ0MkOfROXKxJBo6Cqc7YIhS6hqq7r5nE7lAI2QPcQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H/1.1	403 Forbidden	Primary Request index.php Show response www.agilerefund.click/clicks/bpage/aizenpower/	15 KB 8 KB	50ms 50ms	Document text/html	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 88f1c308203a9e7d5c9cb3cce7c0e7d2811cb0680ecb7654ad7bdef3037d0d82 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-CH Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA CF-RAY 8691a8f93ad9e587-DFW Cache-Control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Encoding gzip Content-Type text/html; charset=UTF-8 Cross-Origin-Embedder-Policy require-corp Cross-Origin-Opener-Policy same-origin Cross-Origin-Resource-Policy same-origin Date Sat, 23 Mar 2024 21:54:27 GMT Expires Thu, 01 Jan 1970 00:00:01 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Origin-Agent-Cluster ?1 Permissions-Policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy same-origin Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pda8g6ISoD7TfoJWr49PEf%2BObymrr5N4whl1Xff%2Fb1B68ptcgaIBVIUe%2Bui2BxnLBUqkLFGdkDUHn4nzOs8oXxruyEdGZ7WhMfMWWbuxRr4sDccOgmV4bdWgujZfiLfPVKzJI3W5C7I%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding X-Frame-Options SAMEORIGIN alt-svc h3=":443"; ma=86400 cf-chl-out knBhg81NJXtZPkxpjn6XQhryLnrZVeAJ6TNgITmOaCyhbXckSkx0ChhFAlCxpuIuWjWF1gItODuVrYkyxxTHBMRP0P1I/YJ6lmNqMlDsrNd8jCcgdT4aTSLnO38x54eJh3uqMoPzPqvoqHa7FM+C+Q==$/KD5l22rq8OpOknnl0TC0g== cf-mitigated challenge
GET H/1.1	200 OK	v1 Show response www.agilerefund.click/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/	501 KB 143 KB	2775ms 2732ms	Script application/javascript	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.agilerefund.click/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8691a8f93ad9e587 Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a37ce4e790638a84641e88cc693bfd1697173da39158d30942d879cbccdc8bcf Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp&__cf_chl_rt_tk=LukXymfDjO2MEE.G.m5nS5Br4_.uSrJ67wmh6BAE6Lg-1711230867-0.0.1.1-1706 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Date Sat, 23 Mar 2024 21:54:30 GMT Content-Encoding gzip NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iQuMRY3lTRKZMKRIkADa%2B0%2FoFP%2Fk%2BF%2FGG7yGU3AZik6yO%2FIP%2F5Gx9gwYic2cL%2BR8vM%2F2rz7RrE4%2B9O5DdZ6WdxnV0V6gleRrt0Aj5JAejSy8xmDYaoQPPoeOCiS5QjdS6%2Bcs%2FSCgYcA%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript; charset=UTF-8 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive CF-RAY 8691a8f9eac76b2b-DFW alt-svc h3=":443"; ma=86400
GET H2	200	api.js Show response challenges.cloudflare.com/turnstile/v0/g/dc6b543c1346/	39 KB 13 KB	168ms 66ms	Script application/javascript	104.17.2.184 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/turnstile/v0/g/dc6b543c1346/api.js?onload=QkWxI7&render=explicit Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8691a8f93ad9e587 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2e584d67a5b1a868363ed5e83a72ea6bc2cad8a052f64583d0fe95e7fa36e97 Request headers Referer Origin http://www.agilerefund.click accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Sat, 23 Mar 2024 21:54:30 GMT content-encoding br server cloudflare vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=31536000 cross-origin-resource-policy cross-origin cf-ray 8691a90cccb1460b-DFW alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	favicon.ico www.agilerefund.click/	1 KB 806 B	51ms 51ms	Image image/x-icon	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www.agilerefund.click/favicon.ico Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Date Sat, 23 Mar 2024 21:54:30 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 184 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sun, 07 Jan 2024 11:46:38 GMT Server cloudflare ETag W/"659a8f1e-57e" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sv%2B3vAyc04zSt98jDmkaWoZUvymjpGOsc7YYb0dngI%2BX5zOxE8NFTmaRb5BhaOvg4d4kW5dYDz8CDLblEJr9p3dPyyHRS7U6qEy30QCY5wC7WMW1HjklHuiKmgtktAABZJDoKoyu5bw%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/x-icon Cache-Control max-age=14400 CF-RAY 8691a90c390b6b2b-DFW
GET BLOB	200 OK	703e6d93-3116-440f-a7e0-3f8289df663b http://www.agilerefund.click/	13 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:http://www.agilerefund.click/703e6d93-3116-440f-a7e0-3f8289df663b Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04 Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Length 13 Content-Type text/javascript
POST H/1.1	200 OK	086e56f1b785fd3 Show response www.agilerefund.click/cdn-cgi/challenge-platform/h/g/flow/ov1/753115893:1711228264:aewvFw_1oMjeF0XX_vnJYcgsJtZEVRc5i2c_Hg-Hm9Q/8691a8f93ad9e587/	15 KB 12 KB	67ms 67ms	XHR text/plain	172.67.156.38 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.agilerefund.click/cdn-cgi/challenge-platform/h/g/flow/ov1/753115893:1711228264:aewvFw_1oMjeF0XX_vnJYcgsJtZEVRc5i2c_Hg-Hm9Q/8691a8f93ad9e587/086e56f1b785fd3 Requested by Host: www.agilerefund.click URL: http://www.agilerefund.click/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8691a8f93ad9e587 Protocol HTTP/1.1 Server 172.67.156.38 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67b8ddfdbf5db0b840f6432cbe1898c73b1be0fcf912ffb82d5ca92181f852f3 Request headers Referer http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 CF-Challenge 086e56f1b785fd3 Content-type application/x-www-form-urlencoded Response headers Date Sat, 23 Mar 2024 21:54:30 GMT Content-Encoding gzip NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPvCDTSGzjAG%2BCBDhaC1jhGeAI7clNU4JaJsjtOJeGfxH9tsYFXVByymprCOCvTmVg7BAelOEKyKeCuM2PXQaTrZSNVp2SOGRmJnSHuF678uEtzTGgTRKSSM9fwGB4vyl6GsJLkxvVs%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/plain; charset=UTF-8 Connection keep-alive CF-RAY 8691a90ce9de6b2b-DFW alt-svc h3=":443"; ma=86400 cf-chl-gen uojrrtN/SLBqdfOyL7XsOxV743RSlA7A1cAbtNEqspEixhvxBGPqBQIYuly80EaI$R0UGoRRqGsHI+qgswR3oKg==
GET H3	200	normal challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5op60/0x4AAAAAAADnOjc0PNeA8qVm/light/ Frame 7560	0 0	106ms 57ms	Document text/html	104.17.2.184 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5op60/0x4AAAAAAADnOjc0PNeA8qVm/light/normal Requested by Host: challenges.cloudflare.com URL: https://challenges.cloudflare.com/turnstile/v0/g/dc6b543c1346/api.js?onload=QkWxI7&render=explicit Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self' Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 8691a90e2ed24665-DFW content-encoding br content-security-policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self' content-type text/html; charset=UTF-8 critical-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Sat, 23 Mar 2024 21:54:30 GMT document-policy js-profiling origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare
GET BLOB	200 OK	8451c51c-7c18-405e-a0b8-9c76166faa93 http://www.agilerefund.click/	80 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:http://www.agilerefund.click/8451c51c-7c18-405e-a0b8-9c76166faa93 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 1d5d7571ddb9876d6bdb02c3291e62d788f660b71e6eb9d9032234a691db4680 Request headers accept-language en-US,en;q=0.9 Referer http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Length 80 Content-Type text/javascript

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _cf_chl_opt function| uBKcTT5 function| nsucfa4 object| TVVqzA9 object| XMIiKe7 function| ZHoSf2 function| QxtIvG1 function| htlsh8 function| QkWxI7 boolean| CUXVS8 function| kXDTXr5 object| NyHssL1 number| ZZmu6 object| angular object| turnstile boolean| sWGgn2 string| PMJx0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.agilerefund.click/	1970-01-20 19:20:34	Name: cf_chl_3 Value: 086e56f1b785fd3

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
other	error	URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Message: The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.
other	warning	URL: http://www.agilerefund.click/clicks/bpage/aizenpower/index.php?sid=1032024&h=qrbaztn5ehpynltxjs_-zuzdfsmrwf8jn844s2wxsm4/efvmo1got617jnj65mv2ge4o6e0jontf88y2qfxxkobnm7bdwqtxcsnugs1uripp Message: The page requested an origin-keyed agent cluster using the Origin-Agent-Cluster header, but could not be origin-keyed since the origin 'http://www.agilerefund.click' had previously been placed in a site-keyed agent cluster. Update your headers to uniformly request origin-keying for all pages on the origin.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
www.agilerefund.click
www.googletagmanager.com
104.17.2.184
104.21.64.222
142.250.65.232
172.67.156.38
1d5d7571ddb9876d6bdb02c3291e62d788f660b71e6eb9d9032234a691db4680
678a05f62e5eebf6e6cedeee4f8f207ac8c0ab7f5f42046f1cf1eff629fe6408
67b8ddfdbf5db0b840f6432cbe1898c73b1be0fcf912ffb82d5ca92181f852f3
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
88f1c308203a9e7d5c9cb3cce7c0e7d2811cb0680ecb7654ad7bdef3037d0d82
a37ce4e790638a84641e88cc693bfd1697173da39158d30942d879cbccdc8bcf
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
d2e584d67a5b1a868363ed5e83a72ea6bc2cad8a052f64583d0fe95e7fa36e97