iceybloxclicker.tk Open in urlscan Pro
195.20.47.166 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://iceybloxclicker.tk/
Submission: On October 02 via manual (October 2nd 2022, 3:22:55 am UTC) from US — Scanned from NL

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 5 countries across 10 domains to perform 12 HTTP transactions. The main IP is 195.20.47.166, located in Netherlands and belongs to VFMNL-AS Amsterdam Location BGP Setup, NL. The main domain is iceybloxclicker.tk.

This is the only time iceybloxclicker.tk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	195.20.47.166 195.20.47.166	31624 (VFMNL-AS ...) (VFMNL-AS Amsterdam Location BGP Setup)
2	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1 1	2606:4700:303... 2606:4700:3037::ac43:ab5a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3030::6815:27c9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.149.204.188 34.149.204.188	15169 (GOOGLE) (GOOGLE)
1	2606:50c0:800... 2606:50c0:8001::153	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400d:80a::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	52.206.150.106 52.206.150.106	14618 (AMAZON-AES) (AMAZON-AES)
2	162.159.137.232 162.159.137.232	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	9

1 195.20.47.166 (Netherlands)

ASN31624 (VFMNL-AS Amsterdam Location BGP Setup, NL)

iceybloxclicker.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:ab5a (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

shorturl.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:27c9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.shorturl.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.204.188 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com

furryhub.sadjghf.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8001::153 (United States)

ASN54113 (FASTLY, US)

3kh0.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80a::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.206.150.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-150-106.compute-1.amazonaws.com

ipgeolocation.abstractapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.159.137.232 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

discord.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	discord.com discord.com — Cisco Umbrella Rank: 2201	1 KB
2	repl.co furryhub.sadjghf.repl.co	2 KB
2	shorturl.at 2 redirects shorturl.at — Cisco Umbrella Rank: 163584 www.shorturl.at — Cisco Umbrella Rank: 187496	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 28	17 KB
1	abstractapi.com ipgeolocation.abstractapi.com — Cisco Umbrella Rank: 75738	1 KB
1	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 2251	8 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	75 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 208	27 KB
1	github.io 3kh0.github.io — Cisco Umbrella Rank: 231398	1 KB
1	iceybloxclicker.tk iceybloxclicker.tk	998 B
12	10

	Domain	Requested by
2	discord.com	furryhub.sadjghf.repl.co
2	furryhub.sadjghf.repl.co	iceybloxclicker.tk 3kh0.github.io
2	www.google-analytics.com	iceybloxclicker.tk
1	ipgeolocation.abstractapi.com	cdnjs.cloudflare.com
1	fundingchoicesmessages.google.com	3kh0.github.io
1	www.googletagmanager.com	3kh0.github.io
1	cdnjs.cloudflare.com	furryhub.sadjghf.repl.co
1	3kh0.github.io	furryhub.sadjghf.repl.co
1	www.shorturl.at	1 redirects
1	shorturl.at	1 redirects
1	iceybloxclicker.tk
12	11

This site contains no links.

Subject Issuer	Validity	Valid
sadjghf.repl.co R3	`2022-08-21` - `2022-11-19`	3 months	crt.sh
*.github.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-07` - `2023-04-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
ipgeolocation.abstractapi.com Amazon	`2022-05-23` - `2023-06-21`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://iceybloxclicker.tk/
Frame ID: BDE1EBE1AED52C06EC19A38B737991DF
Requests: 3 HTTP requests in this frame

Frame: https://furryhub.sadjghf.repl.co/
Frame ID: 5EE1C1C42EB2CA1EBE3326F423C3EBA2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

iceybloxclicker.tk

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

75 %
HTTPS

64 %
IPv6

10
Domains

11
Subdomains

9
IPs

5
Countries

135 kB
Transfer

369 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 1

http://shorturl.at/dftX1 HTTP 301
https://www.shorturl.at/dftX1 HTTP 302
https://furryhub.sadjghf.repl.co/

Request Chain 2

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=iceybloxclicker.tk&utmhid=296487913&utmr=-&utmp=%2F&utmht=1664680970721&utmac=UA-23441223-3&utmcc=__utma%3D1.382050424.1664680971.1664680971.1664680971.1%3B%2B__utmz%3D1.1664680971.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1099187095&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=iceybloxclicker.tk&utmhid=296487913&utmr=-&utmp=%2F&utmht=1664680970721&utmac=UA-23441223-3&utmcc=__utma%3D1.382050424.1664680971.1664680971.1664680971.1%3B%2B__utmz%3D1.1664680971.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1099187095&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200 Primary Request / Show response
iceybloxclicker.tk/ 1 KB
998 B 105ms
66ms Document
text/html 195.20.47.166
VFMNL-AS Amsterda...

General

Check archive.org

Show headers Download Go to

Full URL: http://iceybloxclicker.tk/
Protocol: HTTP/1.1
Server: 195.20.47.166 , Netherlands, ASN31624 (VFMNL-AS Amsterdam Location BGP Setup, NL),
Reverse DNS
Software: nginx /
Resource Hash: f3c443530a77a661e00e5b4f37901e27638bf777707e457b9e3e86a3a86354a9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 613
Content-Type: text/html;charset=UTF-8
Date: Sun, 02 Oct 2022 03:22:50 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding
X-Server: ip-172-31-40-58

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

103ms
32ms

Script
text/javascript

2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: iceybloxclicker.tk
URL: http://iceybloxclicker.tk/

Protocol

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://iceybloxclicker.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 02 Oct 2022 01:42:51 GMT
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
server: Golfe2
age: 5999
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Sun, 02 Oct 2022 03:42:51 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

/ Show response
furryhub.sadjghf.repl.co/ Frame 5EE1
Redirect Chain

http://shorturl.at/dftX1
https://www.shorturl.at/dftX1
https://furryhub.sadjghf.repl.co/

2 KB
2 KB

712ms
243ms

Document
text/html

34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://furryhub.sadjghf.repl.co/

Requested by

Host: iceybloxclicker.tk
URL: http://iceybloxclicker.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

188.204.149.34.bc.googleusercontent.com

Software

Resource Hash

bc311335343a11d4409c19c6b79f4f05f600114df1b77ef0edb4341ea97b7234

Security Headers

Name	Value
Strict-Transport-Security	max-age=4147432; includeSubDomains

Request headers

Referer: http://iceybloxclicker.tk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

access-control-allow-origin: *
content-length: 2036
content-type: text/html; charset=utf-8
date: Sun, 02 Oct 2022 03:22:52 GMT
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
replit-cluster: global
strict-transport-security: max-age=4147432; includeSubDomains

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 753a50e4bc469253-FRA
content-type: text/html; charset=UTF-8
date: Sun, 02 Oct 2022 03:22:51 GMT
location: https://furryhub.sadjghf.repl.co/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2wfNnH6F0yDw%2FDArRYn%2FUr5HGI0T570VsW9OH2IlqLD7p3yFjESk04cCLgxs%2FgalirgeGKpPP5veITJM%2FDP%2F%2BQaEvqrJmmEXmm5kWZxfBCw04CAQ3AugirTfJsSvYt8ySMgRl%2FK3MaXEYLMmFDo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nginx-upstream-cache-status: MISS
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block

GET
H2

200

__utm.gif
www.google-analytics.com/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=ic...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=i...

35 B
197 B

39ms
38ms

Image
image/gif

2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=iceybloxclicker.tk&utmhid=296487913&utmr=-&utmp=%2F&utmht=1664680970721&utmac=UA-23441223-3&utmcc=__utma%3D1.382050424.1664680971.1664680971.1664680971.1%3B%2B__utmz%3D1.1664680971.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1099187095&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: iceybloxclicker.tk
URL: http://iceybloxclicker.tk/

Protocol

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://iceybloxclicker.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 03:22:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1830110842&utmhn=iceybloxclicker.tk&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=iceybloxclicker.tk&utmhid=296487913&utmr=-&utmp=%2F&utmht=1664680970721&utmac=UA-23441223-3&utmcc=__utma%3D1.382050424.1664680971.1664680971.1664680971.1%3B%2B__utmz%3D1.1664680971.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1099187095&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 main.js Show response
3kh0.github.io/js/ Frame 5EE1 2 KB
1 KB 308ms
108ms Script
application/javascript 2606:50c0:8001::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://3kh0.github.io/js/main.js

Requested by

Host: furryhub.sadjghf.repl.co
URL: https://furryhub.sadjghf.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

3d35ecde4694627e5f1a198b63a2371fa8aac5392db17852089083dbc920d879

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://furryhub.sadjghf.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-fastly-request-id: 6a23641cedf736af70c43af73ad2e0306b92903f
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Sun, 02 Oct 2022 03:22:52 GMT
age: 0
x-cache: HIT
x-cache-hits: 1
x-proxy-cache: MISS
content-length: 854
x-served-by: cache-ewr18175-EWR
last-modified: Sun, 02 Oct 2022 02:45:58 GMT
server: GitHub.com
x-github-request-id: 080B:1862:530F63:745C1E:6338FF09
x-timer: S1664680972.355518,VS0,VE14
etag: W/"6338fb66-7d2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Sun, 02 Oct 2022 03:11:29 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ Frame 5EE1 85 KB
27 KB 81ms
30ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: furryhub.sadjghf.repl.co
URL: https://furryhub.sadjghf.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://furryhub.sadjghf.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 03:22:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1487313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27277
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15283"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2FR8u8owLd7wzG7BH3QjzRSI9I76WLmf4hQErf8KbNjfi%2BxuhytnumdZ5e%2BmOG3ZLO1jqPTpgCOkg6mljgrnJZO%2FvZeLmCPcQ19k3tU4RSyDKDhmOH38J%2FyC2xweQ0isRCcghMHcKT472qSICMgTgdal"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 753a50ec1b78b73c-AMS
expires: Fri, 22 Sep 2023 03:22:52 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 5EE1 216 KB
75 KB 189ms
81ms Script
application/javascript 2a00:1450:400d:80a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-98DP5VKS42

Requested by

Host: 3kh0.github.io
URL: https://3kh0.github.io/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3abcc9fd64569ee20bf03f776c87d7a40622e71e822c8cda1bb1214088a803f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://furryhub.sadjghf.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 03:22:52 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76658
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 02 Oct 2022 03:22:52 GMT

GET
H2 404 tab_cloak.js
furryhub.sadjghf.repl.co/js/ Frame 5EE1 0
0 153ms
153ms Script
text/html 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://furryhub.sadjghf.repl.co/js/tab_cloak.js

Requested by

Host: 3kh0.github.io
URL: https://3kh0.github.io/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

188.204.149.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=4147431; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://furryhub.sadjghf.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=4147431; includeSubDomains
date: Sun, 02 Oct 2022 03:22:52 GMT
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: text/html; charset=utf-8

GET
H2 200 pub-5756835229788588 Show response
fundingchoicesmessages.google.com/i/ Frame 5EE1 18 KB
8 KB 183ms
58ms Script
application/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/pub-5756835229788588?ers=1

Requested by

Host: 3kh0.github.io
URL: https://3kh0.github.io/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

799c681c5e98c8a5347ea88226879fa73c0fd35c7371bdb3928cfab5bbba2308

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7blISInCia7mcq541Jm7dA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://furryhub.sadjghf.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 03:22:52 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-7blISInCia7mcq541Jm7dA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ipgeolocation.abstractapi.com/v1/ Frame 5EE1 959 B
1 KB 323ms
111ms XHR
application/json 52.206.150.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ipgeolocation.abstractapi.com/v1/?api_key=a1ebbf04c6164dd98b527e26c57fc28c

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.150.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-150-106.compute-1.amazonaws.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8984cc9a12952db3f4ef32e083bfbad0aee71f4eec733a9fb14a85f03293a79b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://furryhub.sadjghf.repl.co/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 03:22:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: same-origin
server: nginx/1.14.0 (Ubuntu)
vary: Cookie, Origin
allow: GET, HEAD, OPTIONS
content-type: application/json
x-frame-options: DENY
access-control-allow-origin: *
content-length: 959

POST
H3 204 mvSmuO3InLdo9Xphed3E4BoJcTcxhCc0SUoleibphCgXHDZNNE5jThQ1pvwysBiIZZ3Y Show response
discord.com/api/webhooks/1025218973224149062/ Frame 5EE1 0
1 KB 341ms
315ms XHR
text/html 162.159.137.232
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://discord.com/api/webhooks/1025218973224149062/mvSmuO3InLdo9Xphed3E4BoJcTcxhCc0SUoleibphCgXHDZNNE5jThQ1pvwysBiIZZ3Y

Requested by

Host: furryhub.sadjghf.repl.co
URL: https://furryhub.sadjghf.repl.co/

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.137.232 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://furryhub.sadjghf.repl.co/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-type: application/json

Response headers

date: Sun, 02 Oct 2022 03:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
cf-cache-status: DYNAMIC
x-ratelimit-bucket: 3cd1f278bd0ecaf11e0d2391374c011d
x-ratelimit-reset-after: 2
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-envoy-upstream-service-time: 180
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-ratelimit-remaining: 4
access-control-allow-methods: POST, GET, PUT, PATCH, DELETE
content-type: text/html; charset=utf-8
access-control-allow-origin: https://furryhub.sadjghf.repl.co
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EFJXYkXwoBa14tH4yLIlZxhXvQ1CpQK2GCNtTy%2Bgt2jQlQoLWZIln9IEfi6deBbeJcwsHbN4YZdAJ6qMx6bC%2BQwjVLX8HdVffOAYwQ4P5%2BArgElda7GZ6S4x7tQ0"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Retry-After, X-RateLimit-Global, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-RateLimit-Reset-After, X-RateLimit-Bucket, X-RateLimit-Scope, Date
access-control-allow-credentials: true
x-ratelimit-reset: 1664680976
x-ratelimit-limit: 5
cf-ray: 753a50f14b9eb950-AMS
access-control-allow-headers: Content-Type, Authorization, X-Audit-Log-Reason, X-Track, X-Super-Properties, X-Context-Properties, X-Failed-Requests, X-Fingerprint, X-RPC-Proxy, X-Discord-Locale, X-Debug-Options, x-client-trace-id, If-None-Match, Range, X-RateLimit-Precision

OPTIONS
H2 200 mvSmuO3InLdo9Xphed3E4BoJcTcxhCc0SUoleibphCgXHDZNNE5jThQ1pvwysBiIZZ3Y
discord.com/api/webhooks/1025218973224149062/ Frame 0
0 205ms
146ms Preflight
text/html 162.159.137.232
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://discord.com/api/webhooks/1025218973224149062/mvSmuO3InLdo9Xphed3E4BoJcTcxhCc0SUoleibphCgXHDZNNE5jThQ1pvwysBiIZZ3Y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.137.232 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://furryhub.sadjghf.repl.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Authorization, X-Audit-Log-Reason, X-Track, X-Super-Properties, X-Context-Properties, X-Failed-Requests, X-Fingerprint, X-RPC-Proxy, X-Discord-Locale, X-Debug-Options, x-client-trace-id, If-None-Match, Range, X-RateLimit-Precision
access-control-allow-methods: POST, GET, PUT, PATCH, DELETE
access-control-allow-origin: https://furryhub.sadjghf.repl.co
allow: OPTIONS, GET, DELETE, POST, HEAD, PATCH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 753a50f02ecab939-AMS
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 02 Oct 2022 03:22:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Md2u2u2iKwacm%2BAiJk3%2FWLAkqn9SPCw4eIoEjuMYIX7JDYU6uqjTysTD2gq%2F4jmHCIAjqrnR9opZsPbRU5HSlITbw24%2FP4%2F7eKJhs0uEGB3Xl%2Bk4PFkLTmQxjlA%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
x-content-type-options: nosniff
x-envoy-upstream-service-time: 9

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
iceybloxclicker.tk/	1969-12-31 23:59:59	Name: JSESSIONID Value: D22C01351B95EB6D9A884005C706DABF
iceybloxclicker.tk/	1970-01-20 16:00:40	Name: __utma Value: 1.382050424.1664680971.1664680971.1664680971.1
iceybloxclicker.tk/	1969-12-31 23:59:59	Name: __utmc Value: 1
iceybloxclicker.tk/	1970-01-20 10:47:28	Name: __utmz Value: 1.1664680971.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
iceybloxclicker.tk/	1970-01-20 06:24:41	Name: __utmt Value: 1
iceybloxclicker.tk/	1970-01-20 06:24:42	Name: __utmb Value: 1.1.10.1664680971

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://furryhub.sadjghf.repl.co/js/tab_cloak.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3kh0.github.io
cdnjs.cloudflare.com
discord.com
fundingchoicesmessages.google.com
furryhub.sadjghf.repl.co
iceybloxclicker.tk
ipgeolocation.abstractapi.com
shorturl.at
www.google-analytics.com
www.googletagmanager.com
www.shorturl.at
162.159.137.232
195.20.47.166
2606:4700:3030::6815:27c9
2606:4700:3037::ac43:ab5a
2606:4700::6811:180e
2606:50c0:8001::153
2a00:1450:4001:80f::200e
2a00:1450:4001:830::200e
2a00:1450:400d:80a::2008
34.149.204.188
52.206.150.106
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
3abcc9fd64569ee20bf03f776c87d7a40622e71e822c8cda1bb1214088a803f9
3d35ecde4694627e5f1a198b63a2371fa8aac5392db17852089083dbc920d879
799c681c5e98c8a5347ea88226879fa73c0fd35c7371bdb3928cfab5bbba2308
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8984cc9a12952db3f4ef32e083bfbad0aee71f4eec733a9fb14a85f03293a79b
bc311335343a11d4409c19c6b79f4f05f600114df1b77ef0edb4341ea97b7234
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3c443530a77a661e00e5b4f37901e27638bf777707e457b9e3e86a3a86354a9

iceybloxclicker.tk Open in urlscan Pro 195.20.47.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

64 %IPv6

10 Domains

11 Subdomains

9 IPs

5 Countries

135 kBTransfer

369 kBSize

6 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

6 Cookies

1 Console Messages

Indicators

iceybloxclicker.tk Open in urlscan Pro
195.20.47.166 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

64 %
IPv6

10
Domains

11
Subdomains

9
IPs

5
Countries

135 kB
Transfer

369 kB
Size

6
Cookies

12 HTTP transactions
0 data transactions