urlscan.io logo urlscan.io
SecurityTrails logo

s1.proxyfly.org Open in urlscan Pro
139.162.69.65  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474...
Effective URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474...
Submission: On September 21 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 8 domains to perform 24 HTTP transactions. The main IP is 139.162.69.65, located in Tokyo, Japan and belongs to LINODE-AP Linode, LLC, US. The main domain is s1.proxyfly.org.
TLS certificate: Issued by R3 on August 19th 2021. Valid for: 3 months.
This is the only time s1.proxyfly.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 11 139.162.69.65 63949 (LINODE-AP...)
2 142.250.185.72 15169 (GOOGLE)
1 185.94.236.247 42567 (MOJHOST-EU)
1 13.224.193.108 16509 (AMAZON-02)
1 45.57.90.1 2906 (AS-SSI)
1 205.185.216.10 20446 (HIGHWINDS3)
2 185.94.236.245 42567 (MOJHOST-EU)
2 172.217.18.110 15169 (GOOGLE)
3 69.16.175.42 20446 (HIGHWINDS3)
24 10
11    139.162.69.65 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1549-65.members.linode.com
s1.proxyfly.org
2    142.250.185.72 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f8.1e100.net
www.googletagmanager.com
1    185.94.236.247 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
poweredby.jads.co
1    13.224.193.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-108.fra2.r.cloudfront.net
js.juicyads.com
1    45.57.90.1 (United States)

ASN2906 (AS-SSI, US)
PTR: occ.a.nflxso.net
assets.nflxext.com
1    205.185.216.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
a.exdynsrv.com
2    185.94.236.245 (Netherlands)

ASN42567 (MOJHOST-EU, NL)
adserver.juicyads.com
2    172.217.18.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f14.1e100.net
www.google-analytics.com
3    69.16.175.42 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net
ads.juicyads.me
Domain Requested by
11 s1.proxyfly.org 1 redirects s1.proxyfly.org
3 ads.juicyads.me adserver.juicyads.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 adserver.juicyads.com poweredby.jads.co
2 www.googletagmanager.com s1.proxyfly.org
www.googletagmanager.com
1 a.exdynsrv.com s1.proxyfly.org
1 assets.nflxext.com s1.proxyfly.org
1 js.juicyads.com s1.proxyfly.org
1 poweredby.jads.co s1.proxyfly.org
24 9

This site contains links to these domains. Also see Links.

Domain
proxybot.cc
Subject Issuer Validity Valid
proxyfly.org
R3		 2021-08-19 -
2021-11-17		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.jads.co
Sectigo RSA Domain Validation Secure Server CA		 2020-11-27 -
2021-12-28		 a year crt.sh
*.juicyads.com
Sectigo RSA Domain Validation Secure Server CA		 2020-01-20 -
2022-04-23		 2 years crt.sh
*.1.nflxso.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-31 -
2021-09-30		 a month crt.sh
exdynsrv.com
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh
*.juicyads.me
Sectigo RSA Domain Validation Secure Server CA		 2021-05-24 -
2022-05-24		 a year crt.sh

This page contains 2 frames:

Primary Page: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Frame ID: 34A8BEDD6DBCA44A298C3B95505401A7
Requests: 20 HTTP requests in this frame

Frame: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Frame ID: C9AC17EACD9D46CF8D14954463ACC188
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e777777463225... HTTP 301
    https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e777777463225... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

24
Requests

96 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

10
IPs

3
Countries

1296 kB
Transfer

2037 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468 HTTP 301
    https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set 7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
s1.proxyfly.org/o/
Redirect Chain
  • http://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f...
  • https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772...
361 KB
77 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
d32779ce210ee84f2780a3c1edaf7bf77c3fb312d2eebd5c4b0c7476b7f1a99d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport

Request headers

Host
s1.proxyfly.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Status
200 OK
via
1.1 i-01ce1802ba3d09686 (us-west-2)
x-request-id
c637a543-c584-4994-9220-530f3bd66bb2
expires
0
x-content-type-options
nosniff
Set-Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D;
x-b3-traceid
cea4a1764e571f40
x-originating-url
http://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
206
x-netflix_proxy_execution-time
472
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-decorator-operation
lo_svc
x-netflix_nfstatus
1_1
date
Tue, 21 Sep 2021 14:02:03 GMT
x-frame-options
DENY
x-xss-protection
1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Tue, 21 Sep 2021 14:02:01 GMT
Content-Type
text/html
Content-Length
178
Connection
keep-alive
Location
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
656e6f6e2f657572742f6b63622f4d3039333130453230335a324d323733563238335832653330306b30373063335932483235304b3253323230643361302f322f736a2e7061727473746f6f624337256e6f6d6d6f632c736a2e7061727473746f6f6...
s1.proxyfly.org/o/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f6b63622f4d3039333130453230335a324d323733563238335832653330306b30373063335932483235304b3253323230643361302f322f736a2e7061727473746f6f624337256e6f6d6d6f632c736a2e7061727473746f6f622f736a2f736a2f3137326530326132762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
b7261df829a96f7cf801028a17aa5bb279e587cd91820177cb95b499e6acf216
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:05 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
49e6ed0b-dbb1-4362-a4cc-e9a4b3697c68
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Fri, 25 Mar 2022 20:39:24 GMT
656e6f6e2f657572742f6c2f4d3039333130453230335a324d323733563238335832653330306b30373063335932483235304b3253323230643361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c4337257...
s1.proxyfly.org/o/ 		114 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f6c2f4d3039333130453230335a324d323733563238335832653330306b30373063335932483235304b3253323230643361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c43372573746e656e6f706d6f632f736a2f736a2f3137326530326132762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:05 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
792800a7-f48e-4488-86df-e4fc365fbf67
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Fri, 25 Mar 2022 21:07:01 GMT
js
www.googletagmanager.com/gtag/ 		100 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-156489712-1
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.72 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
e6d8c7d19a2a56053dfe532263127a528ec4cb5f0eeafa48a6245ac0d205348d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:07 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40292
x-xss-protection
0
last-modified
Tue, 21 Sep 2021 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Sep 2021 14:02:07 GMT
6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f6...
s1.proxyfly.org/o/ 		0
0
736a2e627574534b4453746f2f736574616c706d65747470697263732f67726f2e77616c65696b6f6f632e6e64632f2f3a7370747468
s1.proxyfly.org/o/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/736a2e627574534b4453746f2f736574616c706d65747470697263732f67726f2e77616c65696b6f6f632e6e64632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
strict-transport-security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
BC5xsXKGgJbQbCzkLNvwBQ==
age
3870673
Transfer-Encoding
chunked
Status
200 OK
Connection
keep-alive
x-ms-lease-status
unlocked
Server
nginx
date
Tue, 21 Sep 2021 14:02:04 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Content-Type
application/javascript
access-control-allow-origin
*
x-ms-request-id
49a954ae-301e-0038-24bd-8b99bf000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
6923d445081a348d-NRT
656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e656761702d726f72726543372565726f634337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f6...
s1.proxyfly.org/o/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e656761702d726f72726543372565726f634337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
9e91f69e993bcc64d54ff7c336900975e5e83b3c57f9744b403c6be5143c84b5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:08 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
edd32e9a-0751-4f94-ad3f-0d98be909e2e
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Sat, 26 Mar 2022 01:32:26 GMT
656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f73736...
s1.proxyfly.org/o/ 		134 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
38e7ddfb569757aa78f50ad6a53b9e585f23d6bccbdfeb532f1d28b81991d32a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:06 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
Server
nginx
Status
200 OK
Vary
Accept-Encoding
Content-Type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=16070400
req_id
8b47947f-ab9b-4d6d-94d4-fc22f3a1af93
Connection
keep-alive
timing-allow-origin
https://www.netflix.com
Transfer-Encoding
chunked
expires
Sat, 26 Mar 2022 01:49:51 GMT
jfc.js
poweredby.jads.co/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://poweredby.jads.co/js/jfc.js
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.236.247 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
c8630ae7042704a3a000e88c6ca1041715eaf37b17af0d4b0629c61dacf25371

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 21 Sep 2021 14:02:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Aug 2018 17:13:26 GMT
Server
nginx
ETag
W/"5b730db6-1a94"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Connection
close
jp.php
js.juicyads.com/ 		93 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.juicyads.com/jp.php?c=3454y213q256y2o2q29443&u=http%3A%2F%2Fwww.juicyads.rocks
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-108.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
8214fdf78778445ddfda453d055feda0574a213838e290d51a72943134e98bc9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
cache
date
Tue, 21 Sep 2021 13:54:12 GMT
via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
server
nginx
age
472
x-edge-origin-shield-skipped
0
content-type
application/javascript; charset=utf-8
cache-control
max-age=900
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
oRrTpuyWW9jODFmPRqcC277l_Pl_-BOR1Jg-vFj3If2ArnWjrB31Eg==
expires
Tue, 21 Sep 2021 14:09:12 GMT
JP-en-20210823-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/5a27cb25-33a9-4bcc-b441-95fefabcbd37/55cf9a60-a5b6-4e01-9538-3ca473e3a76e/ 		359 KB
359 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/vlv3/5a27cb25-33a9-4bcc-b441-95fefabcbd37/55cf9a60-a5b6-4e01-9538-3ca473e3a76e/JP-en-20210823-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.57.90.1 , United States, ASN2906 (AS-SSI, US),
Reverse DNS
occ.a.nflxso.net
Software
nginx /
Resource Hash
af721ea6255c04ca14559e94acd070e4fa7ebafd16819c9902f93e45836079b5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 21 Sep 2021 14:02:07 GMT
Last-Modified
Thu, 26 Aug 2021 00:06:12 GMT
Server
nginx
Content-MD5
szRtyfyCVVyrcPrVZ9NuYQ==
Content-Type
image/jpeg
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
367386
Expires
Tue, 28 Sep 2021 14:02:08 GMT
676e702e37355f65756c625f5f6f676f4c2d662d42462f736567616d692f6e69676f6c2f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
s1.proxyfly.org/o/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.proxyfly.org/o/676e702e37355f65756c625f5f6f676f4c2d662d42462f736567616d692f6e69676f6c2f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:08 GMT
Content-Encoding
gzip
Server
nginx
content-md5
ozykfvEQtuPsUIa4d2QH0w==
Vary
Accept-Encoding
Content-Type
image/png
Status
200 OK
cache-control
max-age=604801
Transfer-Encoding
chunked
Connection
keep-alive
expires
Tue, 28 Sep 2021 14:02:09 GMT
popunder1000.js
a.exdynsrv.com/ 		94 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.exdynsrv.com/popunder1000.js
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
nginx /
Resource Hash
569af0d58a2df0af2da77aaebaaf00b84c15334c5e9af0b77ba4c81a62db5d40

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 21 Sep 2021 14:02:07 GMT
Content-Encoding
gzip
Server
nginx
etag
W/"f744f0d2317398d07acc666b278"
X-HW
1632232927.dop102.fr8.t,1632232927.cds202.fr8.shn,1632232927.cds202.fr8.c
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
40039
Cookie set WebsiteDetect
s1.proxyfly.org/personalization/cl2/freeform/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 i-0ab5aff13c012feaf (us-west-2)
x-content-type-options
nosniff
Transfer-Encoding
chunked
x-netflix_proxy_execution-time
340
Status
200 OK
Connection
keep-alive
x-xss-protection
1; mode=block
allow
GET, POST, OPTIONS
Server
nginx
date
Tue, 21 Sep 2021 14:02:05 GMT
x-netflix_nfstatus
1_1
x-frame-options
DENY
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
http://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?modalView=login&source=wwwhead&fetchType=js
access-control-allow-origin
https://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
max-age=0
access-control-allow-credentials
true
Set-Cookie
memclid=731aa005-78c0-4677-98ae-ea38a7240d6a; nfvdid=BQFmAAEBEPghwGjNeev2wr4uvg3X86hA16HrggG2p9HwbPlIaYQUO%2FVpK03YkkWHm0yFGcFCXwl1xZ9TgtXDZSZSYdw%2BQdZa1oqevEIkpjMFWDZOw9b8vA%3D%3D;
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
Mon, 20 Sep 2021 14:02:05 GMT
Cookie set WebsiteScreen
s1.proxyfly.org/personalization/cl2/freeform/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 i-02172264f44c8b2c6 (us-west-2)
x-content-type-options
nosniff
Transfer-Encoding
chunked
x-netflix_proxy_execution-time
263
Status
200 OK
Connection
keep-alive
x-xss-protection
1; mode=block
allow
GET, POST, OPTIONS
Server
nginx
date
Tue, 21 Sep 2021 14:02:05 GMT
x-netflix_nfstatus
1_1
x-frame-options
DENY
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
http://www.netflix.com/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&screenh=1200&screenw=1600&winh=1200&ratio=1
access-control-allow-origin
https://www.netflix.com/jp-en/Login?nextpage=https%3A%2F%2Fwww.netflix.com%2Fbrowse%2Fmy-list
cache-control
max-age=0
access-control-allow-credentials
true
Set-Cookie
memclid=97f813fa-997c-4de6-aa65-48ad64857c3f; nfvdid=BQFmAAEBEOg1Kf1ajvwCmB30%2BeAHMI1AVFsnB3L5sLWargVf%2FDhp4%2BlhahEwJODbEvH4nTCpEzfeT%2B4E5oRO09PzcL%2FVpWrQ9XmwktloNjpNO6ZQK%2FXHvg%3D%3D;
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
Mon, 20 Sep 2021 14:02:05 GMT
js
www.googletagmanager.com/gtag/ 		100 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-156489712-3&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-156489712-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.72 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
6064e511cfe2d9871e543ff0473110ebf2b2bc5c4f330f3334a17f7dafcf79ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40310
x-xss-protection
0
last-modified
Tue, 21 Sep 2021 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Sep 2021 14:02:08 GMT
66666f772e33392d31762d6e6f63692d666e2f73746e6f662f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
s1.proxyfly.org/o/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s1.proxyfly.org/o/66666f772e33392d31762d6e6f63692d666e2f73746e6f662f6975657469732f6566662f6d6f632e747865786c666e2e7374657373612f2f3a7370747468
Requested by
Host: s1.proxyfly.org
URL: https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
139.162.69.65 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li1549-65.members.linode.com
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://s1.proxyfly.org
Accept-Encoding
gzip, deflate, br
Host
s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Cookie
flwssn=f4eb322c-07a6-45df-a2d1-10d2ee1f8c08; memclid=c91ea1ea-f284-4a48-86ed-07c1733df84c; NetflixId=v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.; SameSite=Lax; SecureNetflixId=v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060; nfvdid=BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
Connection
keep-alive
Referer
https://s1.proxyfly.org/o/656e6f6e2f657572742f656e6f6e2f44427839666d74433445757973612f312f7373656c2e6e69676f4c4337256e69676f6c43372573656761704337257373656c2c7373656c2e657361426e69676f6c4337256e69676f6c4337257373656c2f7373632f7373632f3137326530326132762d7373632d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Origin
https://s1.proxyfly.org
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:08 GMT
Server
nginx
content-md5
fPYVbMSBJEtaJUNi17c/AA==
Status
200 OK
Transfer-Encoding
chunked
Content-Type
font/woff
access-control-allow-origin
*
cache-control
max-age=604801
Connection
keep-alive
accept-ranges
bytes
expires
Tue, 28 Sep 2021 14:02:09 GMT
fadeinbox.js
adserver.juicyads.com/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adserver.juicyads.com/js/fadeinbox.js
Requested by
Host: poweredby.jads.co
URL: https://poweredby.jads.co/js/jfc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.236.245 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
43799418c7a36f766db96b168104db592e151fc6e7ec6d9d613a0c99ddf9f9d6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 21 Sep 2021 14:02:08 GMT
Content-Encoding
gzip
Last-Modified
Sat, 06 Dec 2014 15:18:42 GMT
Server
nginx
ETag
W/"54831e52-fa8"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Connection
close
Cookie set adshow.php
adserver.juicyads.com/ Frame C9AC 		5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Requested by
Host: poweredby.jads.co
URL: https://poweredby.jads.co/js/jfc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.94.236.245 , Netherlands, ASN42567 (MOJHOST-EU, NL),
Reverse DNS
Software
nginx / PHP/5.6.40
Resource Hash
18cd45093674eb4ce314fd4cca75867b5b4119e95f521a0a8467a9018ad41a35

Request headers

Host
adserver.juicyads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://s1.proxyfly.org/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/

Response headers

Server
nginx
Date
Tue, 21 Sep 2021 14:02:10 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
X-Powered-By
PHP/5.6.40
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie
surferid=a762f8f5ed5b36a435781b588c276300; expires=Wed, 21-Sep-2022 14:02:08 GMT; Max-Age=31536000; path=/; domain=.juicyads.com imps42493=1; expires=Wed, 22-Sep-2021 14:02:10 GMT; Max-Age=86400; path=/; domain=.juicyads.com juicy_data_1=YToxOntpOjEyMDU2NTg7aToxNjMyNDkyMTI4O30%3D; expires=Fri, 24-Sep-2021 14:02:08 GMT; Max-Age=259198; domain=juicyads.com juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Fri, 24-Sep-2021 14:02:08 GMT; Max-Age=259198; domain=juicyads.com
Content-Encoding
gzip
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-156489712-3&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.110 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s1.proxyfly.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
4511
date
Tue, 21 Sep 2021 12:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Tue, 21 Sep 2021 14:46:57 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=613077083&t=pageview&_s=1&dl=https%3A%2F%2Fs1.proxyfly.org%2Fo%2F7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468&ul=en-us&de=UTF-8&dt=Netflix&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=791145647&gjid=1115184275&cid=1608129158.1632232929&tid=UA-156489712-3&_gid=1457027990.1632232929&_r=1&gtm=2ou9k0&z=400957146
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.110 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://s1.proxyfly.org/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 21 Sep 2021 14:02:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://s1.proxyfly.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
juicyads_black.gif
ads.juicyads.me/ads/ Frame C9AC 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.juicyads.me/ads/juicyads_black.gif
Requested by
Host: adserver.juicyads.com
URL: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
b1e12c59a9b1d3e8447d6a7aeb584101c71751561b98f3f0162f58f1e617c7fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://adserver.juicyads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:10 GMT
last-modified
Wed, 02 Mar 2016 17:54:59 GMT
etag
"1456941299"
x-hw
1632232930.dop102.fr8.t,1632232930.cds134.fr8.hn,1632232930.cds161.fr8.c
content-type
image/gif
cache-control
max-age=23456338
accept-ranges
bytes
content-length
2193
42493-1625212412-0314076001625212412.gif
ads.juicyads.me/network/user158974/ Frame C9AC 		505 KB
506 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.juicyads.me/network/user158974/42493-1625212412-0314076001625212412.gif
Requested by
Host: adserver.juicyads.com
URL: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
9ac29bbea6b5d0d234e771ccdf5ea17e3fac76b897eaa10ed4a2ce0177c8d4f3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://adserver.juicyads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:10 GMT
last-modified
Fri, 02 Jul 2021 07:53:32 GMT
etag
"1625212412"
x-hw
1632232930.dop102.fr8.t,1632232930.cds134.fr8.hn,1632232930.cds253.fr8.c
content-type
image/gif
cache-control
max-age=27886182
accept-ranges
bytes
content-length
517514
1x1.gif
ads.juicyads.me/ Frame C9AC 		43 B
176 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.juicyads.me/1x1.gif
Requested by
Host: adserver.juicyads.com
URL: https://adserver.juicyads.com/adshow.php?adzone=865477&mobile=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://adserver.juicyads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 21 Sep 2021 14:02:10 GMT
last-modified
Thu, 03 Mar 2016 18:47:18 GMT
etag
"1457030838"
x-hw
1632232930.dop102.fr8.t,1632232930.cds134.fr8.hn,1632232930.cds257.fr8.c
content-type
image/gif
cache-control
max-age=23456335
accept-ranges
bytes
content-length
43

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s1.proxyfly.org
URL
https://s1.proxyfly.org/o/6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f632e78696c6674656e2e7777772f2f3a7370747468

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

87 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| gtag object| dataLayer undefined| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups function| OptanonWrapper object| google_tag_manager object| netflix string| juicy_adzone string| isMobile string| adsrv string| containerStyle string| iframeDim string| frameWidth string| frameHeight string| fibSrc function| strip_alpha_chars function| domready object| juicy_tags function| f488 function| Q888 function| n800 function| s488 function| y7vv function| R7qq function| v799 function| T799 string| a7213ffe56 function| t0xx object| JuicyPop string| __public_path__ object| Codex object| C object| global object| process string| ad_idzone boolean| ad_popup_fallback boolean| ad_popup_force boolean| ad_chrome_enabled boolean| ad_new_tab number| ad_frequency_period number| ad_frequency_count number| ad_trigger_method function| F7ss function| x233 function| M5GG function| C7ss string| e94dfadd0 object| exoJsPop101 string| ad_sub string| ad_sub2 string| ad_sub3 string| ad_cat string| ad_trigger_class string| ad_tags string| ad_el boolean| ad_t_venor boolean| ad_cookieconsent object| google_tag_data string| GoogleAnalyticsObject function| ga string| displaymode string| enablefade object| autohidebox string| showonscroll number| IEfadelength number| Mozfadedegree number| random_num function| displayfadeinbox function| mozfadefx function| staticfadebox function| hidefadebox function| controlledhidebox function| initfunction function| get_cookie number| offset object| gaplugins object| gaGlobal object| gaData object| iebody object| objref number| docheight number| objheight number| showonscrollvar

12 Cookies

Domain/Path Name / Value
s1.proxyfly.org/personalization/cl2/freeform Name: memclid
Value: 731aa005-78c0-4677-98ae-ea38a7240d6a
s1.proxyfly.org/personalization/cl2/freeform Name: nfvdid
Value: BQFmAAEBEPghwGjNeev2wr4uvg3X86hA16HrggG2p9HwbPlIaYQUO%2FVpK03YkkWHm0yFGcFCXwl1xZ9TgtXDZSZSYdw%2BQdZa1oqevEIkpjMFWDZOw9b8vA%3D%3D
s1.proxyfly.org/o Name: flwssn
Value: f4eb322c-07a6-45df-a2d1-10d2ee1f8c08
s1.proxyfly.org/o Name: memclid
Value: c91ea1ea-f284-4a48-86ed-07c1733df84c
s1.proxyfly.org/o Name: NetflixId
Value: v%3D2%26ct%3DBQAOAAEBEOl1-0TETDnu_QkWElI_BNqBAC8wq_8jG3JFWnRI-aMsVCBVeSl4MPOa53eVpcH9TfQXK0PpUBkHQh_IWwV9Cc-npYa1evIMNdW7e_00t682U0GqxgTypnQlbXt-_aXafQo-uyzYBncM0WK_lvyl6R3Chhs3mPEJNsE9ahrGG0MVx7Bz7qNid9I_W-aqvCZQfqCbwJiLXnnv5MgFlZiGXOfL9ZoPiYyknIBvSdZRgsjPG18Ok-clRNLqrCzKU4CmXkRzBZKp1CjzyUeR3GoWrdG6qZPxgEC3QlyoJdS81Gpmj75ifI1mAeYW0YyvaZ96-5DLfPrW3aVLjGuHBi_3MeK2_VNc4s_5XQCjl9EsktdOZXY.%26bt%3Ddev%26mac%3DAQEAEAABABThzJd78kCn9ELYKpQrvCNGcJef80ub0i0.
s1.proxyfly.org/o Name: SameSite
Value: Lax
s1.proxyfly.org/o Name: SecureNetflixId
Value: v%3D2%26mac%3DAQEAEQABABRZoq2eTaT_4tgLy6bh3PCYjal-4SSq0x0.%26dt%3D1632232923060
s1.proxyfly.org/o Name: nfvdid
Value: BQFmAAEBEAXw_Au-bpCV3uedwNaNqKRAbh6zaAmCdrIU4i1IN1pg-ZkbyaKNn0Z2cJUi1-uxScPID8ncIyDjOk79XYDj1vvV4i_g24VUQWCGesEVLCuocQ%3D%3D
s1.proxyfly.org/o Name: juicy_fadedin
Value: yes
.proxyfly.org/ Name: _ga
Value: GA1.2.1608129158.1632232929
.proxyfly.org/ Name: _gid
Value: GA1.2.1457027990.1632232929
.proxyfly.org/ Name: _gat_gtag_UA_156489712_3
Value: 1

2 Console Messages

Source Level URL
Text
security error URL: https://s1.proxyfly.org/o/7473696c2d796d4632256573776f72624632256d6f632e78696c6674656e2e77777746322546322541332573707474683d656761707478656e3f6e69676f4c2f6e652d706a2f6d6f632e78696c6674656e2e7777772f2f3a7370747468
Message:
Refused to apply style from 'https://s1.proxyfly.org/o/6e69676f6c3d776569566c61646f6d3b706d61267373633d6570795468637465663b706d6126646165687777773d656372756f733f746365746544657469736265572f6d726f66656572662f326c632f6e6f6974617a696c616e6f737265702f6d6f632e78696c6674656e2e7777772f2f3a7370747468' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://s1.proxyfly.org/o/656e6f6e2f657572742f6c2f4d3039333130453230335a324d323733563238335832653330306b30373063335932483235304b3253323230643361302f322f736a2e746e65696c4372656c6c6f72746e6f436e69676f6c4337256e69676f6c43372573746e656e6f706d6f632f736a2f736a2f3137326530326132762d736a2d69746b6168732d352e32322e312f69756265772f656c646e754268747572742f302e302e334535252f6d6f632e747865786c666e2e7865646f632f2f3a7370747468
Message:
Failed to load resource: net::ERR_INCOMPLETE_CHUNKED_ENCODING

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.exdynsrv.com
ads.juicyads.me
adserver.juicyads.com
assets.nflxext.com
js.juicyads.com
poweredby.jads.co
s1.proxyfly.org
www.google-analytics.com
www.googletagmanager.com
s1.proxyfly.org
13.224.193.108
139.162.69.65
142.250.185.72
172.217.18.110
185.94.236.245
185.94.236.247
205.185.216.10
45.57.90.1
69.16.175.42
0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616
18cd45093674eb4ce314fd4cca75867b5b4119e95f521a0a8467a9018ad41a35
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
38e7ddfb569757aa78f50ad6a53b9e585f23d6bccbdfeb532f1d28b81991d32a
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
43799418c7a36f766db96b168104db592e151fc6e7ec6d9d613a0c99ddf9f9d6
569af0d58a2df0af2da77aaebaaf00b84c15334c5e9af0b77ba4c81a62db5d40
6064e511cfe2d9871e543ff0473110ebf2b2bc5c4f330f3334a17f7dafcf79ba
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8214fdf78778445ddfda453d055feda0574a213838e290d51a72943134e98bc9
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ac29bbea6b5d0d234e771ccdf5ea17e3fac76b897eaa10ed4a2ce0177c8d4f3
9e91f69e993bcc64d54ff7c336900975e5e83b3c57f9744b403c6be5143c84b5
af721ea6255c04ca14559e94acd070e4fa7ebafd16819c9902f93e45836079b5
b1e12c59a9b1d3e8447d6a7aeb584101c71751561b98f3f0162f58f1e617c7fb
b7261df829a96f7cf801028a17aa5bb279e587cd91820177cb95b499e6acf216
c8630ae7042704a3a000e88c6ca1041715eaf37b17af0d4b0629c61dacf25371
d32779ce210ee84f2780a3c1edaf7bf77c3fb312d2eebd5c4b0c7476b7f1a99d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d8c7d19a2a56053dfe532263127a528ec4cb5f0eeafa48a6245ac0d205348d
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62