postbankde23.swimrun.com.hr Open in urlscan Pro
91.234.46.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wortin.clickfunnels.com/optinpwjar87m
Effective URL:
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Submission: On May 10 via api (May 10th 2023, 7:44:03 pm UTC) from US — Scanned from DE

Summary HTTP 36 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 10 domains to perform 36 HTTP transactions. The main IP is 91.234.46.205, located in Croatia and belongs to DHH-AS, HR. The main domain is postbankde23.swimrun.com.hr.
TLS certificate: Issued by R3 on May 8th 2023. Valid for: 3 months.

This is the only time postbankde23.swimrun.com.hr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 11	2606:4700::68... 2606:4700::6810:cc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:e2:... 2606:4700:e2::ac40:840f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2606:4700:440... 2606:4700:4400::ac40:944b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:10c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1 1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	91.234.46.205 91.234.46.205	12417 (DHH-AS) (DHH-AS)
3	2600:9000:225... 2600:9000:2251:9000:13:46b5:7d80:93a1	16509 (AMAZON-02) (AMAZON-02)
36	9

11 2606:4700::6810:cc2 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

wortin.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
classic.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e2::ac40:840f (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:944b (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:10c2 (United States)

ASN13335 (CLOUDFLARENET, US)

app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

scambinance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 91.234.46.205 (Croatia) 2 redirects

ASN12417 (DHH-AS, HR)
PTR: cp9.infonet.hr

postbankde23.swimrun.com.hr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2251:9000:13:46b5:7d80:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.deutsche-bank.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	clickfunnels.com 4 redirects wortin.clickfunnels.com app.clickfunnels.com — Cisco Umbrella Rank: 44201 images.clickfunnels.com — Cisco Umbrella Rank: 83278 www.clickfunnels.com — Cisco Umbrella Rank: 78543 classic.clickfunnels.com — Cisco Umbrella Rank: 163016	767 KB
7	swimrun.com.hr 2 redirects postbankde23.swimrun.com.hr	479 KB
6	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 449	17 KB
3	deutsche-bank.de www.deutsche-bank.de — Cisco Umbrella Rank: 275727	53 KB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1039	17 KB
1	scambinance.com 1 redirects scambinance.com	482 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1018	7 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50	3 KB
0	nr-data.net Failed bam.nr-data.net Failed
0	addevent.com Failed track.addevent.com Failed
36	10

	Domain	Requested by
9	app.clickfunnels.com	1 redirects wortin.clickfunnels.com app.clickfunnels.com
7	postbankde23.swimrun.com.hr	2 redirects wortin.clickfunnels.com postbankde23.swimrun.com.hr
6	js-agent.newrelic.com	wortin.clickfunnels.com
3	www.deutsche-bank.de	postbankde23.swimrun.com.hr www.deutsche-bank.de
3	wortin.clickfunnels.com	1 redirects static.cloudflareinsights.com
2	classic.clickfunnels.com	wortin.clickfunnels.com
2	www.clickfunnels.com	2 redirects
2	use.fontawesome.com	wortin.clickfunnels.com
1	scambinance.com	1 redirects
1	static.cloudflareinsights.com	wortin.clickfunnels.com
1	images.clickfunnels.com	wortin.clickfunnels.com
1	fonts.googleapis.com	wortin.clickfunnels.com
0	bam.nr-data.net Failed	js-agent.newrelic.com
0	track.addevent.com Failed	wortin.clickfunnels.com
36	14

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-07-23` - `2023-07-23`	a year	crt.sh
use.fontawesome.com GTS CA 1P5	`2023-05-06` - `2023-08-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-04-13` - `2024-05-14`	a year	crt.sh
www.postbankde23.swimrun.com.hr R3	`2023-05-08` - `2023-08-06`	3 months	crt.sh
www.deutsche-bank.de DigiCert EV RSA CA G2	`2022-11-15` - `2023-11-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Frame ID: A601CEA40FA4B98BC9657C8CC1546A5B
Requests: 37 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

https://wortin.clickfunnels.com/optinpwjar87m HTTP 302
https://wortin.clickfunnels.com/optin1683633515438 Page URL
https://scambinance.com/go.php?url=https://postbankde23.swimrun.com.hr/post2/f45y34g5t HTTP 302
https://postbankde23.swimrun.com.hr/post2/f45y34g5t HTTP 301
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/ HTTP 302
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

36
Requests

81 %
HTTPS

80 %
IPv6

10
Domains

14
Subdomains

9
IPs

3
Countries

1341 kB
Transfer

3506 kB
Size

20
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wortin.clickfunnels.com/optinpwjar87m HTTP 302
https://wortin.clickfunnels.com/optin1683633515438 Page URL
https://scambinance.com/go.php?url=https://postbankde23.swimrun.com.hr/post2/f45y34g5t HTTP 302
https://postbankde23.swimrun.com.hr/post2/f45y34g5t HTTP 301
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/ HTTP 302
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://wortin.clickfunnels.com/optinpwjar87m HTTP 302
https://wortin.clickfunnels.com/optin1683633515438

Request Chain 11

https://app.clickfunnels.com/cf.js HTTP 301
https://www.clickfunnels.com/cf.js HTTP 301
https://classic.clickfunnels.com/cf.js

Request Chain 18

https://www.clickfunnels.com/images/closemodal.png HTTP 301
https://classic.clickfunnels.com/images/closemodal.png

36 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

optin1683633515438 Show response
wortin.clickfunnels.com/
Redirect Chain

https://wortin.clickfunnels.com/optinpwjar87m
https://wortin.clickfunnels.com/optin1683633515438

63 KB
19 KB

156ms
155ms

Document
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

3345d55364d4fcb6a3e56c1776fdc5bc16087b36febac5f019e572d67714e123

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
cache-control: max-age=60, public, s-maxage=600, r-maxage=10
cf-cache-status: HIT
cf-ray: 7c54ac7fbd7f3647-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 10 May 2023 19:43:54 GMT
last-modified: Tue, 09 May 2023 11:59:20 GMT
server: cloudflare
status: 200 OK
strict-transport-security: max-age=0
vary: Accept-Encoding
x-content-digest: 5adce80300ccbc7ae4e2f7b7ce72a8ac3205c6d6
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss, store
x-request-id: cd0aee40d364e38327f32b917183110c
x-runtime: 0.310038

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
cache-control: no-cache
cf-cache-status: EXPIRED
cf-ray: 7c54ac7e4b9c3647-FRA
content-type: text/html; charset=utf-8
date: Wed, 10 May 2023 19:43:54 GMT
location: https://wortin.clickfunnels.com/optin1683633515438
server: cloudflare
status: 302 Found
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss
x-request-id: eb91f3d06fd90812d19289d89cb98685
x-runtime: 0.051622

GET
H2 200 lander.css
app.clickfunnels.com/assets/ 425 KB
70 KB 50ms
49ms Stylesheet
text/css 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.css

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 511
last-modified: Wed, 03 May 2023 22:23:50 GMT
server: cloudflare
etag: W/"6452def6-6a514"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac80bf7c3647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 20:03:55 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.9.0/css/ 55 KB
12 KB 36ms
16ms Stylesheet
text/css 2606:4700:e2::ac40:840f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by: Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:840f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: BW4J78579ASQK4S4
age: 491646
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: GbpJIjZadkuQuE+uV0/MqW9+54hkvNpKB0LdOoyK50rQwu3sx6Y0hjaPWfoubpchpjkvVTMgnMI=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"dbf9d822cefe851ba6f66e1ad57e8987"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LcQuCYn8RN86DCskd0fAaCDR1yl8MRmM2MCghGmHFl7A9XMv%2FQmoV5LUznAnVixicIQPJLP87IAP%2Fgueqc7zqN4ou7ls0wDzSjMOBcT17vHtd6cy1xUm9QUFxtjcewOTzXf4jVtEIFtXkw34QM8GY9nS"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 7c54ac80d9a3380d-FRA

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 26 KB
5 KB 35ms
15ms Stylesheet
text/css 2606:4700:e2::ac40:840f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by: Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:840f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: JMAWFQ67PBTYSD8W
age: 491642
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: ypGg9RKtK8gJx9bRk8h+/CapZXdue5UnjCBGnunZqSVR46xC5xNOLZneLKcmXKWDOpQ+jt5Wm/8=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"e140a7d32f343530f016095df3cc2ae4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=btIIe7H%2FnUSQKQrkgC5f29G7bkDwYdfnvYy2YQDeUNWb3UYrwIu9mZwnFZSsr7sAwkUMLEPguVOtsrc%2FtpOW3y20s3%2BEOe4UFkZS4os9TfWxxgEJ64dSYU8LG9%2B8oETpf9CfxOpS5I7ucdKbHmYf944d"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 7c54ac80d9a7380d-FRA

GET
H2 200 css
fonts.googleapis.com/ 47 KB
3 KB 40ms
18ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

40dfc86a731622d863ae9d7f5858685ff512bd79b2353b4620125c72c84373f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 10 May 2023 19:43:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 10 May 2023 19:12:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 10 May 2023 19:43:55 GMT

GET
H2 200 application.js Show response
app.clickfunnels.com/assets/userevents/ 5 KB
2 KB 66ms
66ms Script
application/x-javascript 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/userevents/application.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a696b734193371073510c87df68430499c2f424ad3f7be42f586dc6aff78567b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 657
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-147c"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac8118103647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 20:03:55 GMT

GET
H2 200 lander.js Show response
app.clickfunnels.com/assets/ 2 MB
660 KB 49ms
48ms Script
application/x-javascript 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23eb4278d4cfdfd99216ea683676c2131cd30f1f21f9d5fee91ff2331c2ebc33

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 610
last-modified: Wed, 03 May 2023 22:24:48 GMT
server: cloudflare
etag: W/"6452df30-23811d"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac80bf7f3647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 20:03:55 GMT

GET
H2 200 ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ 5 KB
6 KB 50ms
32ms Image
image/webp 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by: Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
cf-cache-status: HIT
x-amz-request-id: YRF3AJ9RA0QYGPS3
age: 4134
cf-polished: origFmt=png, origSize=9030
content-disposition: inline; filename="ClickfunnelsTag.webp"
content-length: 5276
x-amz-id-2: 9ZfhMPUEkDWIkLvtbO9zLxYFOZ4ane1lBn3fiNB3Yah/kKe7bUGGBU1EbZnk5W7S3w7ajVAVorc=
cf-bgj: imgq:85,h2pri
last-modified: Fri, 03 Jan 2020 17:41:49 GMT
server: cloudflare
etag: "a633777156a5ffeb58c92d3d59fa4e34"
vary: Accept
content-type: image/webp
cache-control: public, max-age=2073600
accept-ranges: bytes
cf-ray: 7c54ac81485a3647-FRA
expires: Sat, 03 Jun 2023 19:43:55 GMT

GET
H2 200 pushcrew.js Show response
app.clickfunnels.com/assets/ 637 B
460 B 38ms
37ms Script
application/x-javascript 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/pushcrew.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 390
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-27d"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac81282c3647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 10 May 2023 20:03:55 GMT

GET
H2 200 v52afc6f149f6479b8c77fa569edb01181681764108816 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 105ms
85ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816
Requested by: Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13a548e040a1ec08f77911fed1d559b95e5daae0ee227e632140e003c7268e7b

Request headers

Referer: https://wortin.clickfunnels.com/
Origin: https://wortin.clickfunnels.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
content-encoding: gzip
last-modified: Mon, 17 Apr 2023 20:41:48 GMT
server: cloudflare
etag: W/2023.4.2
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7c54ac817d769a2d-FRA

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

cf.js Show response
classic.clickfunnels.com/
Redirect Chain

https://app.clickfunnels.com/cf.js
https://www.clickfunnels.com/cf.js
https://classic.clickfunnels.com/cf.js

18 KB
6 KB

96ms
53ms

Script
application/x-javascript

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://classic.clickfunnels.com/cf.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
content-encoding: br
cf-cache-status: HIT
age: 2551
last-modified: Wed, 03 May 2023 22:23:49 GMT
server: cloudflare
etag: W/"6452def5-476a"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
access-control-max-age: 1728000
access-control-allow-credentials: true
cf-ray: 7c54ac843cc43647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization

Redirect headers

date: Wed, 10 May 2023 19:43:55 GMT
server: cloudflare
vary: Accept-Encoding
location: https://classic.clickfunnels.com/cf.js
cache-control: max-age=3600
cf-ray: 7c54ac83bd4d3677-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 10 May 2023 20:43:55 GMT

GET /
track.addevent.com/atc/ 0
0

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
309 B 227ms
209ms XHR
text/html 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=c0VDaTErd0IwcUh5dU5NNm9TL2pYZz09LS1Cd0xkcUE4Y2toOXMwWndBQ1B5TUZBPT0%3D--99fe3321a24bebc3b9e935e16d0c8e850ea4d16b&page_id=WDFwVG1KUnFVRURHZG04UHNjYUlIZz09LS1DRUdQbkVXYW9ac0gwaVNtRC9DQkRnPT0%3D--7338c45838bff5b8f57d17727d30634316bffa1d&funnel_step_id=TVl2cFB5SjNYZVZLMU4wbmFpT00zQT09LS1iRDBJS0M1ODdRQmV1ZXBLSGJPdWF3PT0%3D--3f67a06df7e3d35386f9440e3fecdc92199ea41c&user_id=blRuTktxS2dlV0dtMmduZDJIOUZpdz09LS1qeVA4eHArU29WVVo1T2ZSam8yS05BPT0%3D--f613a11edee42e122a0779bdd46300fd93b7a59d&account_id=VllMOUNKVm9iQ0lZeWpqUUZRbHNIZz09LS00MlBoWkl4T3E2VWtKVllBTFpVVTVBPT0%3D--655a91b823503b9f2a9dcc9a4ba05afcab01e935&page_code=NTkyMDkyNjc%3D&mode_id=1&time_zone=UTC&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::PageviewsCreatedSummary&nonce=5473c4ef-8239-425c-8507-4e4363e1ec21&url=https%3A%2F%2Fwortin.clickfunnels.com%2Foptin1683633515438

Requested by

Host: app.clickfunnels.com
URL: https://app.clickfunnels.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
access-control-request-method: *
cf-cache-status: BYPASS
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
x-request-id: 0153c0050088b5245c66315b58a50ed8
pragma: no-cache
x-runtime: 0.033052
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac833ed5372d-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-frame-options: ALLOWALL
x-rack-cache: miss

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
309 B 213ms
195ms XHR
text/html 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=c0VDaTErd0IwcUh5dU5NNm9TL2pYZz09LS1Cd0xkcUE4Y2toOXMwWndBQ1B5TUZBPT0%3D--99fe3321a24bebc3b9e935e16d0c8e850ea4d16b&page_id=WDFwVG1KUnFVRURHZG04UHNjYUlIZz09LS1DRUdQbkVXYW9ac0gwaVNtRC9DQkRnPT0%3D--7338c45838bff5b8f57d17727d30634316bffa1d&funnel_step_id=TVl2cFB5SjNYZVZLMU4wbmFpT00zQT09LS1iRDBJS0M1ODdRQmV1ZXBLSGJPdWF3PT0%3D--3f67a06df7e3d35386f9440e3fecdc92199ea41c&user_id=blRuTktxS2dlV0dtMmduZDJIOUZpdz09LS1qeVA4eHArU29WVVo1T2ZSam8yS05BPT0%3D--f613a11edee42e122a0779bdd46300fd93b7a59d&account_id=VllMOUNKVm9iQ0lZeWpqUUZRbHNIZz09LS00MlBoWkl4T3E2VWtKVllBTFpVVTVBPT0%3D--655a91b823503b9f2a9dcc9a4ba05afcab01e935&page_code=NTkyMDkyNjc%3D&mode_id=1&time_zone=UTC&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniquePageviewsCreatedSummary&nonce=f90bf972-0d7a-4b17-a4a4-91d0d9fdf97b&url=https%3A%2F%2Fwortin.clickfunnels.com%2Foptin1683633515438

Requested by

Host: app.clickfunnels.com
URL: https://app.clickfunnels.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
access-control-request-method: *
cf-cache-status: BYPASS
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
x-request-id: 98a56845e7c89d519781a57705f39123
pragma: no-cache
x-runtime: 0.031873
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac833ed7372d-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-frame-options: ALLOWALL
x-rack-cache: miss

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
752 B 198ms
180ms XHR
text/html 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=c0VDaTErd0IwcUh5dU5NNm9TL2pYZz09LS1Cd0xkcUE4Y2toOXMwWndBQ1B5TUZBPT0%3D--99fe3321a24bebc3b9e935e16d0c8e850ea4d16b&page_id=WDFwVG1KUnFVRURHZG04UHNjYUlIZz09LS1DRUdQbkVXYW9ac0gwaVNtRC9DQkRnPT0%3D--7338c45838bff5b8f57d17727d30634316bffa1d&funnel_step_id=TVl2cFB5SjNYZVZLMU4wbmFpT00zQT09LS1iRDBJS0M1ODdRQmV1ZXBLSGJPdWF3PT0%3D--3f67a06df7e3d35386f9440e3fecdc92199ea41c&user_id=blRuTktxS2dlV0dtMmduZDJIOUZpdz09LS1qeVA4eHArU29WVVo1T2ZSam8yS05BPT0%3D--f613a11edee42e122a0779bdd46300fd93b7a59d&account_id=VllMOUNKVm9iQ0lZeWpqUUZRbHNIZz09LS00MlBoWkl4T3E2VWtKVllBTFpVVTVBPT0%3D--655a91b823503b9f2a9dcc9a4ba05afcab01e935&page_code=NTkyMDkyNjc%3D&mode_id=1&time_zone=UTC&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniqueVisitorsCreatedSummary&nonce=51053232-6154-41a1-8a4f-edf5c54a114c&url=https%3A%2F%2Fwortin.clickfunnels.com%2Foptin1683633515438

Requested by

Host: app.clickfunnels.com
URL: https://app.clickfunnels.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
access-control-request-method: *
cf-cache-status: BYPASS
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
x-request-id: 4f4dbcad20026deee9eea7e4293c8aa7
pragma: no-cache
x-runtime: 0.031331
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac833ed8372d-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-frame-options: ALLOWALL
x-rack-cache: miss

GET
H2 200 async-api.8f89c105-1.231.0.min.js Show response
js-agent.newrelic.com/ 2 KB
1 KB 649ms
212ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/async-api.8f89c105-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

67f99ac35e1f837e5571b596248acd66df2dddedb17e20ba4527c825ec957ced

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: mU67jycgcinZxIFlMFQSe3f.nxc8alvQ
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZGK97PK2YPQSRS
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 1293
x-amz-id-2: kvrdOPa3jiiQrdn+2scs4F/bSwlrBWK/M9+74qi96c5KTVimFzftn/g9QkraKvgZQDv3+HsWRs0=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.153280,VS0,VE0
etag: "c795d925c282d627e664bd4811db2c5f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 296

GET
H2 200 lazy-loader.67423d16-1.231.0.min.js Show response
js-agent.newrelic.com/ 928 B
903 B 648ms
211ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/lazy-loader.67423d16-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: T3hyF0giIyFMr4zq18cu84rHhrcGImyr
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZJJXQ6TPEY2VVC
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 414
x-amz-id-2: +8V8+qvUGVhAzMLASKbyWUwEftcLXMxYs/C0sstasw5qqi6vYeF6WUwf9TFvF27/8f0i0WPu1V4=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.153220,VS0,VE0
etag: "5c71e603fdc4b5e7eb31a10d4bf90768"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 297

GET
H2

200

closemodal.png
classic.clickfunnels.com/images/
Redirect Chain

https://www.clickfunnels.com/images/closemodal.png
https://classic.clickfunnels.com/images/closemodal.png

672 B
928 B

52ms
51ms

Image
image/webp

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://classic.clickfunnels.com/images/closemodal.png

Protocol

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
cf-cache-status: HIT
age: 526370
cf-polished: origFmt=png, origSize=788
content-disposition: inline; filename="closemodal.webp"
content-length: 672
last-modified: Mon, 01 May 2023 12:10:46 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "644fac46-314"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
access-control-allow-credentials: true
access-control-max-age: 1728000
accept-ranges: bytes
cf-ray: 7c54ac854e443647-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Sat, 10 Jun 2023 19:43:55 GMT

Redirect headers

date: Wed, 10 May 2023 19:43:55 GMT
server: cloudflare
vary: Accept-Encoding
location: https://classic.clickfunnels.com/images/closemodal.png
cache-control: max-age=3600
cf-ray: 7c54ac848e613677-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 10 May 2023 20:43:55 GMT

GET
H2 200 track Show response
app.clickfunnels.com/v1/ 118 B
442 B 197ms
197ms XHR
text/javascript 2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/v1/track?_unique=0.5223941402890269&_uniqueVisitorID=null&_type=WINDOW&_location=ttps%3A//wortin.clickfunnels.com/optin1683633515438&_title=Hilfe%20%26%20Kontakt%20-%20Postbank%20BestSign&_key=xgzq1svf&_page_key=gz1vw62o632ji5mv&_fid=12967680&_fspos=1&_fvrs=1&_funnel_stat=1&_location=https://wortin.clickfunnels.com/optin1683633515438&_referrer=

Requested by

Host: app.clickfunnels.com
URL: https://app.clickfunnels.com/cf.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

4711b9b01f5bce59465ef0d0ff099292f44bf778660451ab08ce8efc9a8d70b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
strict-transport-security: max-age=0
access-control-request-method: *
cf-cache-status: BYPASS
content-encoding: br
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 200 OK
x-request-id: f813518cc584e2955dde1c5927b0e703
x-runtime: 0.014252
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
access-control-max-age: 1728000
cf-ray: 7c54ac8498bb372d-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-frame-options: ALLOWALL
x-rack-cache: miss

POST
H2 204 rum Show response
wortin.clickfunnels.com/cdn-cgi/ 0
125 B 25ms
21ms XHR
text/plain 2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://wortin.clickfunnels.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://wortin.clickfunnels.com/optin1683633515438
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type: application/json

Response headers

date: Wed, 10 May 2023 19:43:55 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://wortin.clickfunnels.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7c54ac854e433647-FRA

GET
H2 200 862.04af29e3-1.231.0.min.js
js-agent.newrelic.com/ 9 KB
4 KB 211ms
209ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/862.04af29e3-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: F3uiK5YwfyYXl9HDrytyVd85M_NbPJob
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZSSQ5CC168WDBY
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 3627
x-amz-id-2: Em8lzYfc7eahA1MwfDiZsQYfvDcrcgycAMHno0Y3NJs6SrWUADdnltUSS8G7v3rQmavHY5HO4oM=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.371366,VS0,VE0
etag: "8ff6f8d3b9281c2834e211ce2228757e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 310

GET
H2 200 page_view_event-aggregate.8cf0450e-1.231.0.min.js
js-agent.newrelic.com/ 11 KB
4 KB 237ms
236ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/page_view_event-aggregate.8cf0450e-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: YL5vYhsqsLDVb5Z0VzI.0IKZ9oVf.jnj
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZS52D4AVQ05BTV
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 4107
x-amz-id-2: 2qbE86X9U0hYfAOX7RGRmqLju09EHiw52n06aK3Fwai2vnqblQXtS4pFL8pRubJ/XI+MjSLQutM=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.371728,VS0,VE0
etag: "927ef57448f4e9500b6ddd704625d0b2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 281

GET
H2 200 page_view_timing-aggregate.a30a53ff-1.231.0.min.js
js-agent.newrelic.com/ 12 KB
5 KB 237ms
236ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/page_view_timing-aggregate.a30a53ff-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: tXajjyfh__GTM5HYavqt0WCAqFhJIRAd
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZPHSW1P29VGGWN
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 4637
x-amz-id-2: jSK73adwkCHNrz0p/S3trvbd8Gp2Oo25CEKALHCQNG7a2ohICJoAyHBLYuwj/+G3dDDSfY+7+Uo=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.371695,VS0,VE0
etag: "81350454b5ae22caf77cada88c68cd10"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 311

GET
H2 200 metrics-aggregate.78efb4d5-1.231.0.min.js
js-agent.newrelic.com/ 4 KB
2 KB 221ms
220ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/metrics-aggregate.78efb4d5-1.231.0.min.js

Requested by

Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wortin.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: GnoOJSNFMPBLvvU2loT.6gfpbCRyQb8e
content-encoding: gzip
via: 1.1 varnish
date: Wed, 10 May 2023 19:43:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: YFZNMV7W4RH7W17R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 1587
x-amz-id-2: RqziufvjXOtxVBnJLEZ20rnE58farMfHlMel0vdvJtvcQGVDwGfZJ54f4MXZB2Xv5SB5t7Yp0EA=
x-served-by: cache-gig2250039-GIG
last-modified: Fri, 28 Apr 2023 17:58:54 GMT
server: AmazonS3
x-timer: S1683747836.371679,VS0,VE0
etag: "25879f97e7abf9cd89e027ff5a41ed81"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 310

GET
H2

200

Primary Request user.php Show response
postbankde23.swimrun.com.hr/post2/f45y34g5t/de/
Redirect Chain

https://scambinance.com/go.php?url=https://postbankde23.swimrun.com.hr/post2/f45y34g5t
https://postbankde23.swimrun.com.hr/post2/f45y34g5t
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/
https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php

186 KB
186 KB

142ms
142ms

Document
text/html

91.234.46.205
DHH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Requested by: Host: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/optin1683633515438
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.205 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp9.infonet.hr
Software: Apache /
Resource Hash: 2d733c5375bb583eb3a0ecd58ae06a84c1016ab3a934ace1ad409dd6599a2ef9

Request headers

Referer: https://wortin.clickfunnels.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html; charset=UTF-8
date: Wed, 10 May 2023 19:43:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 10 May 2023 19:43:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: de/user.php
pragma: no-cache
server: Apache

GET NRJS-fc902efb332119fff33
bam.nr-data.net/1/ 0
0

POST NRJS-fc902efb332119fff33
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-fc902efb332119fff33
bam.nr-data.net/events/1/ 0
0

POST rum
wortin.clickfunnels.com/cdn-cgi/ 0
0

GET
H2 200 fonts.css
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 1 KB
860 B 74ms
25ms Stylesheet
text/css 2600:9000:2251:9000:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Requested by

Host: postbankde23.swimrun.com.hr
URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:9000:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbankde23.swimrun.com.hr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:57 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
content-security-policy: frame-ancestors https://*.deutsche-bank.de
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 226
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMTg3N0pCNjN6MUNzN1h1RVRYWUcxQ3ptWldZT1YxN1g4MD0=
vary: Accept-Encoding,Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 6_NS7NwrVaBecMW4R8xaiMJjGvnuQ1aqfcvSl-WbSYpl6RV7OuRbnQ==
expires: Thu, 09 May 2024 19:43:57 GMT

GET
H2 200 user-style.css
postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/ 3 KB
3 KB 122ms
122ms Stylesheet
text/css 91.234.46.205
DHH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/user-style.css
Requested by: Host: postbankde23.swimrun.com.hr
URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.205 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp9.infonet.hr
Software: Apache /
Resource Hash: 04063518f643a580b52dd2bd42ac258a95558176be48f6b7f76936acb7b10407

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:56 GMT
last-modified: Thu, 27 Apr 2023 17:03:20 GMT
server: Apache
accept-ranges: bytes
content-length: 3122
content-type: text/css

GET
H2 200 logo-cut.png
postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/ 2 KB
2 KB 107ms
107ms Image
image/png 91.234.46.205
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/logo-cut.png
Requested by: Host: postbankde23.swimrun.com.hr
URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.205 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp9.infonet.hr
Software: Apache /
Resource Hash: ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:56 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 1806
content-type: image/png

GET
H2 200 img1.jpg
postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/ 44 KB
44 KB 85ms
84ms Image
image/jpeg 91.234.46.205
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/img1.jpg
Requested by: Host: postbankde23.swimrun.com.hr
URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.205 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp9.infonet.hr
Software: Apache /
Resource Hash: 97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/user.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:57 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 45295
content-type: image/jpeg

GET
H2 200 back.jpg
postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/ 243 KB
243 KB 54ms
53ms Image
image/jpeg 91.234.46.205
DHH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/back.jpg
Requested by: Host: postbankde23.swimrun.com.hr
URL: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/user-style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.234.46.205 , Croatia, ASN12417 (DHH-AS, HR),
Reverse DNS: cp9.infonet.hr
Software: Apache /
Resource Hash: 8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://postbankde23.swimrun.com.hr/post2/f45y34g5t/de/res/user-style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:57 GMT
last-modified: Tue, 31 Jan 2023 17:08:04 GMT
server: Apache
accept-ranges: bytes
content-length: 248757
content-type: image/jpeg

GET
H2 200 FrutigerLTW05-55Roman.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 25 KB
26 KB 35ms
20ms Font
font/woff2 2600:9000:2251:9000:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-55Roman.woff2

Requested by

Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:9000:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin: https://postbankde23.swimrun.com.hr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:57 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors https://*.deutsche-bank.de
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 25764
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMThyQy9DWG9ONDlkdkdJQ3FidllHSlpyOHZkVEhuaWEvUT0=
vary: Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: b09oUpl2qdynZymCi0EvmNgQZZd7rTF_e02NqiAgLEWQ0ep8SrYtWg==
expires: Thu, 09 May 2024 19:43:57 GMT

GET
H2 200 FrutigerLTW05-65Bold.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 25 KB
26 KB 33ms
19ms Font
font/woff2 2600:9000:2251:9000:13:46b5:7d80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-65Bold.woff2

Requested by

Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2251:9000:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin: https://postbankde23.swimrun.com.hr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 19:43:57 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors https://*.deutsche-bank.de
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 26008
last-modified: Wed, 24 Feb 2021 08:20:14 GMT
server: Apache
db-nickname: VTJGc2RHVmtYMTlWVlcydHRLYTczcVZLN3Q2VkdTMGJsa2RpTzFLRGVKRT0=
vary: Origin
x-frame-options: SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: n6FfnoakBG2OSq7gEW2Lg_6Nh5o6eK8oVizLOridaAvdskHeohL-5Q==
expires: Thu, 09 May 2024 19:43:57 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: track.addevent.com
URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=9baba5a8-c337-4269-182b-1777d692adfb&url=https%3A%2F%2Fwortin.clickfunnels.com%2Foptin1683633515438&cache=1683747835359

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=1933&ck=0&s=29168f78cadf14a3&ref=https://wortin.clickfunnels.com/optin1683633515438&ap=318&be=419&fe=723&dc=431&perf=%7B%22timing%22:%7B%22of%22:1683747834568,%22n%22:0,%22r%22:1,%22re%22:263,%22f%22:263,%22dn%22:263,%22dne%22:263,%22c%22:263,%22s%22:263,%22ce%22:263,%22rq%22:263,%22rp%22:419,%22rpe%22:422,%22di%22:797,%22ds%22:800,%22de%22:849,%22dc%22:1035,%22l%22:1035,%22le%22:1142%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=515&fcp=515&jsonp=NREUM.setToken

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=2379&ck=0&s=29168f78cadf14a3&ref=https://wortin.clickfunnels.com/optin1683633515438

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-fc902efb332119fff33?a=367981416&v=1.231.0&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=2381&ck=0&s=29168f78cadf14a3&ref=https://wortin.clickfunnels.com/optin1683633515438

Domain: wortin.clickfunnels.com
URL: https://wortin.clickfunnels.com/cdn-cgi/rum?

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.clickfunnels.com/	1970-01-20 11:42:29	Name: __cf_bm Value: XeSFDrvIibHMfw7l08NKladVffjwGF5fsdbAXRTeRUY-1683747834-0-AQm9mC5JpAJL7QQ1b+mY3fCsHVslxwXDZiPMFa3BbqbRpcMDIcyn1JGj7+eAtjonlXuc6pHytFZe11MtHayIj0gl1DuWZ2QDFmHTHj4gMxGj
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: addevent_track_cookie Value: 9baba5a8-c337-4269-182b-1777d692adfb
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:aff_sub2 Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:aff_sub3 Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:aff_sub Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:affiliate_id Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:cf_affiliate_id Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:content Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:medium Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:name Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:source Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:term Value:
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:NTkyMDkyNjc Value: :visited=true
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: cf:visitor_id Value: 1ebed44f-9f17-48a1-8468-8fedeba10296
.www.clickfunnels.com/	1970-01-20 11:42:29	Name: __cf_bm Value: kZYMFS2vppf5b97EJYIWVQ.AnUIMJQzJ7o4uGYc63b4-1683747835-0-AXmEdgJqmz5o/K3z8D2lF8k6n0+MJj+y66PU7inMjTxHz3B1VR99G5SlonAB8r/YWSTv16EsLNgN5+XFnYoahBQ=
wortin.clickfunnels.com/	1969-12-31 23:59:59	Name: is_eu Value: true
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: gz1vw62o632ji5mv Value: true
wortin.clickfunnels.com/	1970-01-20 20:28:03	Name: 12967680_viewed_1 Value: 1
postbankde23.swimrun.com.hr/	1969-12-31 23:59:59	Name: PH_HPXY_CHECK Value: s1
postbankde23.swimrun.com.hr/	1969-12-31 23:59:59	Name: PHPSESSID Value: dc9050f73e07607361edd6bf06e9e556

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=9baba5a8-c337-4269-182b-1777d692adfb&url=https%3A%2F%2Fwortin.clickfunnels.com%2Foptin1683633515438&cache=1683747835359 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.clickfunnels.com
bam.nr-data.net
classic.clickfunnels.com
fonts.googleapis.com
images.clickfunnels.com
js-agent.newrelic.com
postbankde23.swimrun.com.hr
scambinance.com
static.cloudflareinsights.com
track.addevent.com
use.fontawesome.com
wortin.clickfunnels.com
www.clickfunnels.com
www.deutsche-bank.de
bam.nr-data.net
track.addevent.com
wortin.clickfunnels.com
151.101.2.137
2600:9000:2251:9000:13:46b5:7d80:93a1
2606:4700:4400::ac40:944b
2606:4700::6810:10c2
2606:4700::6810:3965
2606:4700::6810:cc2
2606:4700:e2::ac40:840f
2a00:1450:4001:80b::200a
2a06:98c1:3120::3
91.234.46.205
04063518f643a580b52dd2bd42ac258a95558176be48f6b7f76936acb7b10407
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f
13a548e040a1ec08f77911fed1d559b95e5daae0ee227e632140e003c7268e7b
16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8
23eb4278d4cfdfd99216ea683676c2131cd30f1f21f9d5fee91ff2331c2ebc33
2d733c5375bb583eb3a0ecd58ae06a84c1016ab3a934ace1ad409dd6599a2ef9
3345d55364d4fcb6a3e56c1776fdc5bc16087b36febac5f019e572d67714e123
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
40dfc86a731622d863ae9d7f5858685ff512bd79b2353b4620125c72c84373f0
4711b9b01f5bce59465ef0d0ff099292f44bf778660451ab08ce8efc9a8d70b3
5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474
67f99ac35e1f837e5571b596248acd66df2dddedb17e20ba4527c825ec957ced
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a
a696b734193371073510c87df68430499c2f424ad3f7be42f586dc6aff78567b
adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

postbankde23.swimrun.com.hr Open in urlscan Pro 91.234.46.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

36 Requests

81 %HTTPS

80 %IPv6

10 Domains

14 Subdomains

9 IPs

3 Countries

1341 kBTransfer

3506 kBSize

20 Cookies

0 Outgoing links

Page URL History

Redirected requests

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

postbankde23.swimrun.com.hr Open in urlscan Pro
91.234.46.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

36
Requests

81 %
HTTPS

80 %
IPv6

10
Domains

14
Subdomains

9
IPs

3
Countries

1341 kB
Transfer

3506 kB
Size

20
Cookies

36 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!