app.funnel-preview.com Open in urlscan Pro
2606:4700::6810:fc2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gti4.com/17dy379i3
Effective URL:
https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47...
Submission: On January 19 via manual (January 19th 2022, 8:55:15 pm UTC) from US — Scanned from DE

Summary HTTP 50 Redirects Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 15 domains to perform 50 HTTP transactions. The main IP is 2606:4700::6810:fc2, located in United States and belongs to CLOUDFLARENET, US. The main domain is app.funnel-preview.com. The Cisco Umbrella rank of the primary domain is 260689.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 31st 2021. Valid for: a year.

This is the only time app.funnel-preview.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 9	2606:4700::68... 2606:4700::6810:ec2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3037::6815:4e07	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
14	2606:4700::68... 2606:4700::6810:fc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.17.221.30 52.17.221.30	16509 (AMAZON-02) (AMAZON-02)
2	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
2	162.247.243.146 162.247.243.146	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	23.23.235.119 23.23.235.119	14618 (AMAZON-AES) (AMAZON-AES)
2 2	13.32.121.15 13.32.121.15	16509 (AMAZON-02) (AMAZON-02)
4	18.66.97.87 18.66.97.87	16509 (AMAZON-02) (AMAZON-02)
1 3	5.161.53.22 5.161.53.22	213230 (HETZNER-C...) (HETZNER-CLOUD2-AS)
1	2a02:4780:9:3... 2a02:4780:9:317:0:1224:f50b:3	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	67.202.114.212 67.202.114.212	32748 (STEADFAST) (STEADFAST)
50	15

9 2606:4700::6810:ec2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gti4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3037::6815:4e07 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700::6810:fc2 (United States)

ASN13335 (CLOUDFLARENET, US)

app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.funnel-preview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.221.30 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-221-30.eu-west-1.compute.amazonaws.com

track.addevent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.243.146 (United States)

ASN13335 (CLOUDFLARENET, US)

bam-cell.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.23.235.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-23-235-119.compute-1.amazonaws.com

cooked-steadfast-licorice.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.121.15 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-15.fra60.r.cloudfront.net

cdn.glitch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.66.97.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-87.fra56.r.cloudfront.net

cdn.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 5.161.53.22 (Middle River, United States) 1 redirects

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.22.53.161.5.clients.your-server.de

3iut.sbs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:4780:9:317:0:1224:f50b:3 (Cyprus)

ASN47583 (AS-HOSTINGER, CY)

tubeiplay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.114.212 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	clickfunnels.com app.clickfunnels.com — Cisco Umbrella Rank: 32255 assets.clickfunnels.com — Cisco Umbrella Rank: 55990 www.clickfunnels.com — Cisco Umbrella Rank: 45347 images.clickfunnels.com — Cisco Umbrella Rank: 81595	742 KB
9	gti4.com 1 redirects gti4.com	765 KB
7	glitch.me cooked-steadfast-licorice.glitch.me cdn.glitch.me — Cisco Umbrella Rank: 119031	162 KB
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 934	34 KB
3	3iut.sbs 1 redirects 3iut.sbs	29 KB
3	funnel-preview.com app.funnel-preview.com — Cisco Umbrella Rank: 260689	16 KB
2	glitch.com 2 redirects cdn.glitch.com — Cisco Umbrella Rank: 130614	884 B
2	nr-data.net bam-cell.nr-data.net — Cisco Umbrella Rank: 348	1 KB
2	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 367	26 KB
2	addevent.com track.addevent.com — Cisco Umbrella Rank: 29812	141 B
2	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1366	10 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	5 KB
1	amung.us whos.amung.us — Cisco Umbrella Rank: 12727	29 B
1	facebook.com facebook.com — Cisco Umbrella Rank: 32	3 KB
1	tubeiplay.com tubeiplay.com	1 KB
50	15

	Domain	Requested by
9	gti4.com	1 redirects gti4.com static.cloudflareinsights.com
6	app.clickfunnels.com	gti4.com app.funnel-preview.com
4	cdn.glitch.me	cooked-steadfast-licorice.glitch.me
4	use.fontawesome.com	gti4.com app.funnel-preview.com
3	3iut.sbs	1 redirects app.funnel-preview.com
3	app.funnel-preview.com	cooked-steadfast-licorice.glitch.me static.cloudflareinsights.com
3	cooked-steadfast-licorice.glitch.me	cooked-steadfast-licorice.glitch.me
2	www.clickfunnels.com	app.funnel-preview.com
2	cdn.glitch.com	2 redirects
2	bam-cell.nr-data.net	js-agent.newrelic.com
2	assets.clickfunnels.com
2	js-agent.newrelic.com	gti4.com app.funnel-preview.com
2	track.addevent.com	gti4.com app.funnel-preview.com
2	static.cloudflareinsights.com	gti4.com app.funnel-preview.com
2	fonts.googleapis.com	gti4.com app.funnel-preview.com
1	whos.amung.us
1	facebook.com
1	tubeiplay.com
1	images.clickfunnels.com	app.funnel-preview.com
50	19

This site contains no links.

Subject Issuer	Validity	Valid
gti4.com Cloudflare Inc ECC CA-3	`2022-01-19` - `2023-01-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
addevent.com Amazon	`2021-02-25` - `2022-03-26`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-10-06` - `2022-11-07`	a year	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh
glitch.com Amazon	`2021-01-18` - `2022-02-15`	a year	crt.sh
3iut.sbs R3	`2022-01-09` - `2022-04-09`	3 months	crt.sh
tubeiplay.com R3	`2021-12-01` - `2022-03-01`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-10-29` - `2022-01-27`	3 months	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Frame ID: 736878583639D6437C3DF4B53FBAFAB4
Requests: 53 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log into Facebook | Facebook

Page URL History Show full URLs

https://gti4.com/17dy379i3 HTTP 302
https://gti4.com/11642617894757 Page URL
https://cooked-steadfast-licorice.glitch.me/ Page URL
https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at... Page URL

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

50
Requests

90 %
HTTPS

47 %
IPv6

15
Domains

19
Subdomains

15
IPs

4
Countries

1794 kB
Transfer

6196 kB
Size

25
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gti4.com/17dy379i3 HTTP 302
https://gti4.com/11642617894757 Page URL
https://cooked-steadfast-licorice.glitch.me/ Page URL
https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://gti4.com/17dy379i3 HTTP 302
https://gti4.com/11642617894757

Request Chain 27

https://cdn.glitch.com/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg?v=1618177344016 HTTP 301
https://cdn.glitch.me/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg

Request Chain 28

https://cdn.glitch.com/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg?v=1618199565140 HTTP 301
https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg

Request Chain 45

https://3iut.sbs/hselaya/location HTTP 301
https://3iut.sbs/hselaya/location/

50 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

11642617894757 Show response
gti4.com/
Redirect Chain

https://gti4.com/17dy379i3
https://gti4.com/11642617894757

57 KB
16 KB

243ms
243ms

Document
text/html

2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

3e6008777aea18145473bf9edcc2880dd7084892a8935f74aeab4ac19e2ec325

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-type: text/html; charset=utf-8
cf-ray: 6d02f65eadac5c85-FRA
access-control-allow-origin: *
cache-control: max-age=60, public, s-maxage=600, r-maxage=10
last-modified: Wed, 19 Jan 2022 18:54:55 GMT
strict-transport-security: max-age=0
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200 OK
x-content-digest: 1e51669014cb2fa00d5deeb42547e2635c01c96d
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: stale, valid, store
x-request-id: 1aa75787b7ff2a2f358bcf092a9e02c4
x-runtime: 0.329595
server: cloudflare
content-encoding: br

Redirect headers

date: Wed, 19 Jan 2022 20:55:09 GMT
content-type: text/html; charset=utf-8
location: https://gti4.com/11642617894757
cf-ray: 6d02f65c6f7e5c85-FRA
access-control-allow-origin: *
cache-control: no-cache
strict-transport-security: max-age=0
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 302 Found
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss
x-request-id: fc656fa79b9c74217b259749237b26ef
x-runtime: 0.129010
server: cloudflare

GET
H2 200 lander.css
gti4.com/assets/ 425 KB
70 KB 53ms
52ms Stylesheet
text/css 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/assets/lander.css

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 682
last-modified: Mon, 17 Jan 2022 19:26:38 GMT
server: cloudflare
etag: W/"61e5c2ee-6a514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f6604ae35c85-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:10 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.9.0/css/ 55 KB
12 KB 48ms
22ms Stylesheet
text/css 2606:4700:3037::6815:4e07
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:4e07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9787532
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: AA6GDGHF1EP1YMSV
x-amz-id-2: FVGWVyYYqQn2l1Ba046iKfA5aezXFtUKV8Y0PKQpAQrqG9pd1eXkgR6im6CKuxorHNlTsXX7n/4=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"dbf9d822cefe851ba6f66e1ad57e8987"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJlmCB2Gl3ibu2IDKPvhiEZj0bqJ3J%2FGSsV2bgvgiqMfRnBbVEcRsrb7iE5BMmhH4%2BuvGOXD1BYOsKSdie6hgG40%2F0%2FtWGfuT4whJnoqtOMGpR9Lr8bei3o8qh05KdHT%2BdjDVeRy6xbuysG9pxAp7QfN"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 6d02f66078577a5b-DUS

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 26 KB
5 KB 47ms
21ms Stylesheet
text/css 2606:4700:3037::6815:4e07
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:4e07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9782106
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: FT9T7XK30VX8DYDD
x-amz-id-2: lEPyEGmC4g5PNh+HIQv7XJlt6GE1GcH3Sb0MYU4rV9AgdmN0bgZNpBeaXHNkjyqrWJgK0EpzJW4=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"e140a7d32f343530f016095df3cc2ae4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzL%2FbbGkd%2BaAav2nrRAEXk1YRcapi30JfUkxq2E1Is0PTS5i1xu2OVN1C7YTORqWGw12E%2Fs54OtEPmm75gDh%2Fqw0m3r4H2Qsw5obM1hxFS9OEM%2BWIS%2B1PLBJ%2BlfERR%2F2rROl0RM9cHWAgj%2B9DEMTw1nP"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 6d02f660785c7a5b-DUS

GET
H2 200 css
fonts.googleapis.com/ 45 KB
3 KB 291ms
48ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

901fcfe7369510083cd7c309317e0c17ce1ae9d922f8e50dc539894ab3c68916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 19 Jan 2022 20:43:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 19 Jan 2022 20:55:10 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jan 2022 20:55:10 GMT

GET
H2 200 application.js Show response
gti4.com/assets/userevents/ 5 KB
2 KB 40ms
40ms Script
application/x-javascript 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/assets/userevents/application.js

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

004e3565fa58bd4ff0cbf31deb5451508a5ec7d46c4480f9bfa23326f187a158

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 661
last-modified: Mon, 17 Jan 2022 19:26:38 GMT
server: cloudflare
etag: W/"61e5c2ee-1353"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f6614dd85c85-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:10 GMT

GET
H2 200 lander.js Show response
gti4.com/assets/ 2 MB
661 KB 78ms
78ms Script
application/x-javascript 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/assets/lander.js

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b357586d6c3c09600170883415b6c70d9d6b8693af70ce98daf2adb1a2b42c7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 683
last-modified: Mon, 17 Jan 2022 19:29:43 GMT
server: cloudflare
etag: W/"61e5c3a7-237e6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f6604aeb5c85-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:10 GMT

GET
H2 200 ClickfunnelsTag.png
gti4.com/hosted/images/3d/392630953c4119a324492bb1c05778/ 9 KB
9 KB 52ms
51ms Image
image/png 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gti4.com/hosted/images/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59a24fd9ceda194298ccf0b352fa9acd789bf3fb4c69c01bcdcab44c584d0219

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
cf-cache-status: HIT
age: 6131
cf-polished: origSize=9030
content-length: 8895
last-modified: Fri, 03 Jan 2020 17:41:49 GMT
server: cloudflare
etag: "a633777156a5ffeb58c92d3d59fa4e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 6d02f661cf425c85-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 mailcheck.min.js Show response
app.clickfunnels.com/ 3 KB
1 KB 98ms
63ms Script
application/x-javascript 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/mailcheck.min.js

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0189e16cf01f8149342c9f2de872cfa73571f2a145a830f18b16154bf1d2982

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 6214
last-modified: Mon, 17 Jan 2022 19:26:38 GMT
server: cloudflare
etag: W/"61e5c2ee-a8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 6d02f6625b5b7040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H2 200 pushcrew.js Show response
app.clickfunnels.com/assets/ 637 B
1 KB 91ms
56ms Script
application/x-javascript 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/pushcrew.js

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 125
last-modified: Mon, 17 Jan 2022 19:26:37 GMT
server: cloudflare
etag: W/"61e5c2ed-27d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f6625b5e7040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:10 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 100ms
58ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://gti4.com/
Origin: https://gti4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6d02f6626d4b5c26-FRA

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 vendor.js Show response
gti4.com/ 18 KB
5 KB 193ms
192ms Script
application/javascript 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/vendor.js

Requested by

Host: gti4.com
URL: https://gti4.com/11642617894757

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: br
cf-cache-status: MISS
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 200 OK
strict-transport-security: max-age=0
x-request-id: fd097c26655232d20cdc9857249b3827
x-runtime: 0.014876
x-content-digest: 581e49c9b7bdd06dab54c00931f4256b223e620e
server: cloudflare
x-frame-options: ALLOWALL
etag: W/"7422e50efbaea439fda7ef3b0eb54ee1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=900, public
access-control-allow-credentials: true
cf-ray: 6d02f6631a935c85-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: fresh

GET
H2 403 /
track.addevent.com/atc/ 0
71 B 137ms
28ms Image
text/plain 52.17.221.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=9e03fb4d-05fd-4333-4802-dc16eef19145&url=https%3A%2F%2Fgti4.com%2F11642617894757&cache=1642625710570
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.221.30 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-221-30.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
308 B 253ms
237ms XHR
text/html 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=bEFTTEZyNm9ObGVpWUErbGtBOXdlZz09LS1VNDlza2dWYWtGWVY0R3VuMHFUbmZRPT0%3D--7a17fef6b835a61ec050a28dcf06630410c357b2&page_id=WnZCZTRpMzI5WjExYWZ1QVdYcU91UT09LS1jWXAvMmgxK1BuOVQxZFQvRW5rTHd3PT0%3D--3b92811e6290fcc2f3761053c6ad21326ba34ac1&funnel_step_id=eGUyeTVUZHdJRU1tOHhjcW1VbHE3Zz09LS1lUGIxeFFXREV0SWUydmtZMHBYalVnPT0%3D--0c99e261b1f38603d27dede268341822a9bfc4bd&user_id=b1JuVVpiN0UxenorYlpqK0x3dk95QT09LS1SdEVSaERXWnJlZ2NvcDVQUDZ6VVl3PT0%3D--e9916bc6338a8d199fd13b449e98ecb996363080&account_id=NGdsdUp1dmdyMVQ3Z2xxcjZFK2tIZz09LS1CcUJTZU1scC9TNnhXdDBwa2VPSDlnPT0%3D--4a7451cae5a40dec26aaa0d7b88ac8cdeed65378&page_code=NTI3NzY1MjE%3D&mode_id=1&time_zone=America%2FChicago&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::PageviewsCreatedSummary&nonce=716aafd6-0637-4769-815c-549d190d7e07&url=https%3A%2F%2Fgti4.com%2F11642617894757

Requested by

Host: gti4.com
URL: https://gti4.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
access-control-request-method: *
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
strict-transport-security: max-age=0
x-request-id: d349badbdd1f23c82520772d2347da9f
x-runtime: 0.076186
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
pragma: no-cache
cache-control: no-cache, no-store
access-control-allow-credentials: true
cf-ray: 6d02f6633e467028-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
812 B 209ms
194ms XHR
text/html 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=bEFTTEZyNm9ObGVpWUErbGtBOXdlZz09LS1VNDlza2dWYWtGWVY0R3VuMHFUbmZRPT0%3D--7a17fef6b835a61ec050a28dcf06630410c357b2&page_id=WnZCZTRpMzI5WjExYWZ1QVdYcU91UT09LS1jWXAvMmgxK1BuOVQxZFQvRW5rTHd3PT0%3D--3b92811e6290fcc2f3761053c6ad21326ba34ac1&funnel_step_id=eGUyeTVUZHdJRU1tOHhjcW1VbHE3Zz09LS1lUGIxeFFXREV0SWUydmtZMHBYalVnPT0%3D--0c99e261b1f38603d27dede268341822a9bfc4bd&user_id=b1JuVVpiN0UxenorYlpqK0x3dk95QT09LS1SdEVSaERXWnJlZ2NvcDVQUDZ6VVl3PT0%3D--e9916bc6338a8d199fd13b449e98ecb996363080&account_id=NGdsdUp1dmdyMVQ3Z2xxcjZFK2tIZz09LS1CcUJTZU1scC9TNnhXdDBwa2VPSDlnPT0%3D--4a7451cae5a40dec26aaa0d7b88ac8cdeed65378&page_code=NTI3NzY1MjE%3D&mode_id=1&time_zone=America%2FChicago&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniquePageviewsCreatedSummary&nonce=ca5c98b9-31a2-452f-ac47-488ac955cdc3&url=https%3A%2F%2Fgti4.com%2F11642617894757

Requested by

Host: gti4.com
URL: https://gti4.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
access-control-request-method: *
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
strict-transport-security: max-age=0
x-request-id: 044fec393df54b9facc9c4bad5439275
x-runtime: 0.033190
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
pragma: no-cache
cache-control: no-cache, no-store
access-control-allow-credentials: true
cf-ray: 6d02f6633e4c7028-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2 202 / Show response
app.clickfunnels.com/userevents/ 0
334 B 440ms
426ms XHR
text/html 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/userevents/?funnel_id=bEFTTEZyNm9ObGVpWUErbGtBOXdlZz09LS1VNDlza2dWYWtGWVY0R3VuMHFUbmZRPT0%3D--7a17fef6b835a61ec050a28dcf06630410c357b2&page_id=WnZCZTRpMzI5WjExYWZ1QVdYcU91UT09LS1jWXAvMmgxK1BuOVQxZFQvRW5rTHd3PT0%3D--3b92811e6290fcc2f3761053c6ad21326ba34ac1&funnel_step_id=eGUyeTVUZHdJRU1tOHhjcW1VbHE3Zz09LS1lUGIxeFFXREV0SWUydmtZMHBYalVnPT0%3D--0c99e261b1f38603d27dede268341822a9bfc4bd&user_id=b1JuVVpiN0UxenorYlpqK0x3dk95QT09LS1SdEVSaERXWnJlZ2NvcDVQUDZ6VVl3PT0%3D--e9916bc6338a8d199fd13b449e98ecb996363080&account_id=NGdsdUp1dmdyMVQ3Z2xxcjZFK2tIZz09LS1CcUJTZU1scC9TNnhXdDBwa2VPSDlnPT0%3D--4a7451cae5a40dec26aaa0d7b88ac8cdeed65378&page_code=NTI3NzY1MjE%3D&mode_id=1&time_zone=America%2FChicago&app_domain=app.clickfunnels.com&aff_sub2=&aff_sub3=&aff_sub=&affiliate_id=&cf_affiliate_id=&content=&medium=&name=&source=&term=&client_width=1600&type=Userevents::UniqueVisitorsCreatedSummary&nonce=5ee7e049-c289-4b92-809c-3d662464fc7f&url=https%3A%2F%2Fgti4.com%2F11642617894757

Requested by

Host: gti4.com
URL: https://gti4.com/assets/userevents/application.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:11 GMT
access-control-request-method: *
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 202 Accepted
strict-transport-security: max-age=0
x-request-id: 9e41d07623fbd2c8273b761d29cb65d0
x-runtime: 0.031900
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html
pragma: no-cache
cache-control: no-cache, no-store
access-control-allow-credentials: true
cf-ray: 6d02f6633e497028-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2 200 nr-1212.min.js Show response
js-agent.newrelic.com/ 34 KB
13 KB 30ms
6ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1212.min.js
Requested by: Host: gti4.com
URL: https://gti4.com/11642617894757
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: S6r4yaeB6jo_ZylmZ_5cM21n7ZH1t6gc
content-encoding: gzip
etag: "9dfe540eb31e6fc0e0dddd91e3511f68"
x-amz-request-id: G3H7ZGH3NRBG71F6
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 12828
x-amz-id-2: vQZCeBOGvSkKZ1wSrpfdy9fIYY8PDJEsYc9Gyv/IF3Azg7eTY8h6Vkh4Af4Tyzu9POjIqG1KicM=
x-served-by: cache-hhn4077-HHN
last-modified: Thu, 04 Nov 2021 21:16:16 GMT
server: AmazonS3
x-timer: S1642625711.791928,VS0,VE0
date: Wed, 19 Jan 2022 20:55:10 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 31853

GET
H2 200 closemodal.png
assets.clickfunnels.com/images/ 672 B
931 B 91ms
77ms Image
image/webp 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.clickfunnels.com/images/closemodal.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 178890
cf-polished: origFmt=png, origSize=788
content-disposition: inline; filename="closemodal.webp"
content-length: 672
last-modified: Thu, 13 Jan 2022 15:23:47 GMT
server: cloudflare
etag: "61e04403-314"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/webp
access-control-allow-origin: *
expires: Sat, 19 Feb 2022 20:55:10 GMT
cache-control: public, max-age=2678400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 6d02f664589f7040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
cf-bgj: imgq:100,h2pri

GET
H2 200 background.png Show response
gti4.com/images/ 119 B
561 B 176ms
176ms XHR
text/javascript 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/images/background.png?_unique=0.8923969089238641&_uniqueVisitorID=null&_type=WINDOW&_location=ttps%3A//gti4.com/11642617894757&_title=PreFrame%20Squeeze%20Page&_key=krpclp25&_page_key=7gn5w14txcm03dwf&_fid=11775870&_fspos=25&_fvrs=1&_funnel_stat=0&_location=https://gti4.com/11642617894757&_referrer=

Requested by

Host: gti4.com
URL: https://gti4.com/vendor.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

cb3876e4940dd51d6df6050004a384b1b99f9dc0a0109a2af81984eadbccaaa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/11642617894757
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
access-control-request-method: *
cf-cache-status: DYNAMIC
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 200 OK
strict-transport-security: max-age=0
content-encoding: br
x-request-id: 624c062c9e4c0f74405aa814d97dca8a
x-runtime: 0.015980
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 6d02f6645ddf5c85-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

POST
H2 200 rum Show response
gti4.com/cdn-cgi/ 0
198 B 17ms
17ms XHR
text/plain 2606:4700::6810:ec2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gti4.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://gti4.com/11642617894757
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: application/json

Response headers

date: Wed, 19 Jan 2022 20:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://gti4.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6d02f6650fa65c85-FRA
vary: Origin

GET
H/1.1 200
OK NRJS-fc902efb332119fff33 Show response
bam-cell.nr-data.net/1/ 49 B
715 B 226ms
201ms Script
text/javascript 162.247.243.146
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/NRJS-fc902efb332119fff33?a=367981416&v=1212.e95d35c&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=1650&ck=1&ref=https://gti4.com/11642617894757&ap=336&be=691&fe=1331&dc=1142&perf=%7B%22timing%22:%7B%22of%22:1642625709434,%22n%22:0,%22r%22:0,%22re%22:424,%22f%22:424,%22dn%22:424,%22dne%22:424,%22c%22:424,%22ce%22:424,%22rq%22:424,%22rp%22:667,%22rpe%22:668,%22dl%22:670,%22di%22:1135,%22ds%22:1142,%22de%22:1180,%22dc%22:1330,%22l%22:1330,%22le%22:1438%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=999&fcp=1136&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1212.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 20:55:11 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 6d02f6667f3f6903-FRA

GET
H2 200 / Show response
cooked-steadfast-licorice.glitch.me/ 4 KB
4 KB 377ms
154ms Document
text/html 23.23.235.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cooked-steadfast-licorice.glitch.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.23.235.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-235-119.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: c999f52d38a4babba03037c0cef8b8480d86630e2a1f7e22d1e20180439aa83b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://gti4.com/

Response headers

date: Wed, 19 Jan 2022 20:55:12 GMT
content-type: text/html; charset=utf-8
content-length: 3631
x-amz-id-2: +/7JR+UvMC2lWAH0jrSVvy1ftmpBR+nFybvF/7YLDfptoIi5NTlAM/lrom3PNb1SwkSDPZXtT0Q=
x-amz-request-id: BFP5Z2KD5J2VD8W3
last-modified: Wed, 19 Jan 2022 18:29:09 GMT
etag: "039c0a1f2394463723070c3882b72f4b"
cache-control: no-cache
x-amz-version-id: mLnWJr_7En8pmxoyFVFT2EeiFHRW.jsp
accept-ranges: bytes
server: AmazonS3

POST NRJS-fc902efb332119fff33
bam-cell.nr-data.net/events/1/ 0
0

POST rum
gti4.com/cdn-cgi/ 0
0

GET
H2 200 style.css
cooked-steadfast-licorice.glitch.me/ 4 KB
4 KB 116ms
115ms Stylesheet
text/css 23.23.235.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cooked-steadfast-licorice.glitch.me/style.css
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.23.235.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-235-119.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cooked-steadfast-licorice.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:12 GMT
last-modified: Wed, 19 Jan 2022 18:29:09 GMT
server: AmazonS3
x-amz-request-id: BFP2KZK326ST8RZB
etag: "e721cb74e2fd144c777f54c7f6d40fe4"
content-type: text/css; charset=utf-8
cache-control: no-cache
content-length: 4158
accept-ranges: bytes
x-amz-version-id: 5MpoILsnBETOQw_p.nlP1_d.5irmovF4
x-amz-id-2: T1xv7O85Xg8noMAxixkq3aDX8bwjkq9ABG4fmZRzuD9bxKJDlmnhyz8EU89T7Vps/sUldR/W+Ms=

GET
H2 200 script.js
cooked-steadfast-licorice.glitch.me/ 394 B
734 B 133ms
132ms Script
application/javascript 23.23.235.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cooked-steadfast-licorice.glitch.me/script.js
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.23.235.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-235-119.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cooked-steadfast-licorice.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:12 GMT
last-modified: Wed, 19 Jan 2022 18:29:09 GMT
server: AmazonS3
x-amz-request-id: BFP7RJFVYZAXTEZB
etag: "6af12ab0db9a871a513eda9726c884ac"
content-type: application/javascript; charset=utf-8
cache-control: no-cache
content-length: 394
accept-ranges: bytes
x-amz-version-id: .MaVYGeIyO06f21cePRVXKpWmBP4Aeiw
x-amz-id-2: MuI5Oj47j+uMFo/AAS2oKhEpTz1QAtIOkJWfbPtsbnqudbmDBHyN32xAG/UqpiXdD8r0IiWSoqY=

GET
H/1.1

200
OK

a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg
cdn.glitch.me/
Redirect Chain

https://cdn.glitch.com/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg?v=1618177344016
https://cdn.glitch.me/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg

21 KB
9 KB

61ms
7ms

Image
image/svg+xml

18.66.97.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.glitch.me/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/
Protocol: HTTP/1.1
Server: 18.66.97.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-87.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7cbad3cdba3766268cc0002f04b939ce8f7cd59755e86d3c51f647acae151186

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cooked-steadfast-licorice.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 04 Oct 2021 09:05:42 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 9287371
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Sun, 11 Apr 2021 21:42:24 GMT
Server: AmazonS3
ETag: W/"23a9fe1bc81b40c43b1bd39db9d43813"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, HEAD, POST
Content-Type: image/svg+xml
Via: 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront)
Cache-Control: max-age=31536000
X-Amz-Cf-Pop: FRA56-P2
X-Amz-Cf-Id: EtBUVDtO-jNN2nwpcjQ_s-42Vicf2wKXon3X14ASWb-ATtRrfT3Bog==

Redirect headers

Date: Wed, 19 Jan 2022 03:49:11 GMT
Via: 1.1 fd38301adb0ceb6cf6c42567f371a2f4.cloudfront.net (CloudFront)
Server: AmazonS3
Age: 61562
Vary: Origin
X-Cache: Hit from cloudfront
Location: https://cdn.glitch.me/a9975ea6-8949-4bab-addb-8a95021dc2da%2Fillustration.svg
Connection: keep-alive
X-Amz-Cf-Pop: FRA60-P1
Content-Length: 0
X-Amz-Cf-Id: Iw7ryD28PZgZkKFRUMHAviAVHoRKTJHrNFO3Gq99mCesS94P3WzJCQ==

GET
H/1.1

200
OK

605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg
cdn.glitch.me/
Redirect Chain

https://cdn.glitch.com/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg?v=1618199565140
https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg

25 KB
10 KB

63ms
10ms

Image
image/svg+xml

18.66.97.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/
Protocol: HTTP/1.1
Server: 18.66.97.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-87.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7d029c824720875cf5af4d2afab4be3438f665ef1f9e0f9df263cd1252ee0475

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cooked-steadfast-licorice.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 04 Oct 2021 15:19:02 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 9264971
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Mon, 12 Apr 2021 03:52:46 GMT
Server: AmazonS3
ETag: W/"7f508a0793ac63ed3888e9254db6ddc6"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, HEAD, POST
Content-Type: image/svg+xml
Via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
Cache-Control: max-age=31536000
X-Amz-Cf-Pop: FRA56-P2
X-Amz-Cf-Id: jZFF_j5IbzfbdI2AkTN86x512WLuz8sKSTd38HBY-zy_mnKh4HMzew==

Redirect headers

Date: Tue, 18 Jan 2022 21:05:40 GMT
Via: 1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront)
Server: AmazonS3
Age: 85773
Vary: Origin
X-Cache: Hit from cloudfront
Location: https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FLogo_Color.svg
Connection: keep-alive
X-Amz-Cf-Pop: FRA60-P1
Content-Length: 0
X-Amz-Cf-Id: kTNnXOLa3K7yVDyhu-Nl_p_K_qi6qOeEmenkdpWan1XHOJ7YY6VZ9g==

GET
H/1.1 200
OK 605e2a51-d45f-4d87-a285-9410ad350515%2FHKGrotesk-Bold.otf
cdn.glitch.me/ 67 KB
67 KB 25ms
10ms Font
binary/octet-stream 18.66.97.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FHKGrotesk-Bold.otf?v=1603136323437
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-87.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://cooked-steadfast-licorice.glitch.me/
Origin: https://cooked-steadfast-licorice.glitch.me
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 18 Oct 2021 14:41:45 GMT
Via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
Age: 8057608
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 68144
Last-Modified: Mon, 19 Oct 2020 19:38:43 GMT
Server: AmazonS3
ETag: "3d35049a875fbc4d3f3165da78f82ff4"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, HEAD, POST
Content-Type: binary/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
X-Amz-Cf-Pop: FRA56-P2
X-Amz-Cf-Id: FoAseovQOGm_MFSTCdl0WwuSS8MO66rA4hDpxAgg9e86O1ZYtu1N9w==

GET
H/1.1 200
OK 605e2a51-d45f-4d87-a285-9410ad350515%2FHKGrotesk-Regular.otf
cdn.glitch.me/ 66 KB
67 KB 24ms
8ms Font
binary/octet-stream 18.66.97.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.glitch.me/605e2a51-d45f-4d87-a285-9410ad350515%2FHKGrotesk-Regular.otf?v=1603136326027
Requested by: Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-87.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://cooked-steadfast-licorice.glitch.me/
Origin: https://cooked-steadfast-licorice.glitch.me
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Sun, 24 Oct 2021 20:23:56 GMT
Via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
Age: 7518677
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 67768
Last-Modified: Mon, 19 Oct 2020 19:38:46 GMT
Server: AmazonS3
ETag: "cab8839a909b408392b7b3147c2afd23"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, HEAD, POST
Content-Type: binary/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
X-Amz-Cf-Pop: FRA56-P2
X-Amz-Cf-Id: E2P7z4wPD_MEbZcs3Cy-BuV_04cF7Qy_vW4U_Y_ek86hVU8m-K8A5A==

GET
H2 200 Primary Request home-page1642616699021 Show response
app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/ 45 KB
14 KB 709ms
664ms Document
text/html 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true

Requested by

Host: cooked-steadfast-licorice.glitch.me
URL: https://cooked-steadfast-licorice.glitch.me/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

c52f16fcc2f6502a534219e2198a68b2ebba55c621851b5e5d1de6b522a833db

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cooked-steadfast-licorice.glitch.me/

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-type: text/html; charset=utf-8
cf-ray: 6d02f66ede816903-FRA
access-control-allow-origin: *
cache-control: no-cache, no-store
strict-transport-security: max-age=0
vary: Accept-Encoding
cf-cache-status: BYPASS
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200 OK
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss
x-request-id: e9e66634eeead31a401a179712901108
x-runtime: 0.138089
server: cloudflare
content-encoding: br

GET
H2 200 lander.css
www.clickfunnels.com/assets/ 425 KB
70 KB 85ms
56ms Stylesheet
text/css 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.clickfunnels.com/assets/lander.css

Requested by

Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 685
last-modified: Mon, 17 Jan 2022 19:26:38 GMT
server: cloudflare
etag: W/"61e5c2ee-6a514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f67339897040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:13 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.9.0/css/ 55 KB
12 KB 21ms
19ms Stylesheet
text/css 2606:4700:3037::6815:4e07
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:4e07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9787535
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: AA6GDGHF1EP1YMSV
x-amz-id-2: FVGWVyYYqQn2l1Ba046iKfA5aezXFtUKV8Y0PKQpAQrqG9pd1eXkgR6im6CKuxorHNlTsXX7n/4=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"dbf9d822cefe851ba6f66e1ad57e8987"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vZNcil3Jya9dKsF5w5VxuZYyKTSO9zT51W7%2FHlyBlBn1gXloJP4m1NGQlYx04HsDbpJa5q4T7EC%2BeXA%2BPLUGIQHqT5PgovQejs9WvvgCamRusX8kyMcDiCXu4XjQpkjpB1i2C39RJoG57pw7MRhZ7i6B"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 6d02f6731a177a5b-DUS

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 26 KB
4 KB 27ms
26ms Stylesheet
text/css 2606:4700:3037::6815:4e07
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:4e07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9782109
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: FT9T7XK30VX8DYDD
x-amz-id-2: lEPyEGmC4g5PNh+HIQv7XJlt6GE1GcH3Sb0MYU4rV9AgdmN0bgZNpBeaXHNkjyqrWJgK0EpzJW4=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"e140a7d32f343530f016095df3cc2ae4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eanvII8WkEHrn%2FEPE%2FvBmpOC6o29SSj6UIAgtkVebG8sb%2FvACjKvuit7uDo5zsttaQYt0xOOAxGpz59izYVnVju%2FGRVKbL4P3hGfx9Cf%2Bk02GTI1qtYxHxaBz5930doi%2FxtEjb3nZQ73DjDCPZLfZtVT"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 6d02f6731a197a5b-DUS

GET
H2 200 css
fonts.googleapis.com/ 45 KB
3 KB 48ms
47ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

901fcfe7369510083cd7c309317e0c17ce1ae9d922f8e50dc539894ab3c68916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 19 Jan 2022 19:05:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 19 Jan 2022 20:55:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jan 2022 20:55:13 GMT

GET
H2 200 / Show response
3iut.sbs/hselaya/ 119 KB
28 KB 781ms
179ms Script
application/javascript 5.161.53.22
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://3iut.sbs/hselaya/?api=1&lan=facebooknew&ht=2
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.161.53.22 Middle River, United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.22.53.161.5.clients.your-server.de
Software: nginx / PHP/7.4.27, PleskLin
Resource Hash: 4028b2bc92f4c6c6238d6350600104718ea86e088cc3a83191d8efd4e5526b71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
server: nginx
x-powered-by: PHP/7.4.27, PleskLin
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 lander.js Show response
www.clickfunnels.com/assets/ 2 MB
660 KB 110ms
83ms Script
application/x-javascript 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.clickfunnels.com/assets/lander.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b357586d6c3c09600170883415b6c70d9d6b8693af70ce98daf2adb1a2b42c7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 686
last-modified: Mon, 17 Jan 2022 19:29:43 GMT
server: cloudflare
etag: W/"61e5c3a7-237e6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f673398b7040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:13 GMT

GET
H2 200 ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ 5 KB
5 KB 56ms
39ms Image
image/webp 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
cf-cache-status: HIT
age: 5640
cf-polished: origFmt=png, origSize=9030
cf-ray: 6d02f673fb577040-FRA
last-modified: Fri, 03 Jan 2020 17:41:49 GMT
content-disposition: inline; filename="ClickfunnelsTag.webp"
content-length: 5276
x-amz-id-2: JjgaBIOyf9RSJcnLn7R7++pA+lih8p6qOoVM31hiC5aGiLZHq/YTa3iT6VuZ57b3r6fciSo37T8=
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "a633777156a5ffeb58c92d3d59fa4e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-amz-request-id: 12RHX81HBM41D9GH
cache-control: public, max-age=2073600
accept-ranges: bytes
content-type: image/webp
expires: Sat, 12 Feb 2022 20:55:13 GMT

GET
H2 200 pushcrew.js Show response
app.clickfunnels.com/assets/ 637 B
422 B 46ms
45ms Script
application/x-javascript 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/pushcrew.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 128
last-modified: Mon, 17 Jan 2022 19:26:37 GMT
server: cloudflare
etag: W/"61e5c2ed-27d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 6d02f673db0e7040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Wed, 19 Jan 2022 21:15:13 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 44ms
43ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://app.funnel-preview.com/
Origin: https://app.funnel-preview.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6d02f673db875c26-FRA

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 403 /
track.addevent.com/atc/ 0
70 B 29ms
28ms Image
text/plain 52.17.221.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=a0735fe1-1491-4994-8d1c-f59e14c5c485&url=https%3A%2F%2Fapp.funnel-preview.com%2Ffor_domain%2Falfredoperalta.clickfunnels.com%2Fhome-page1642616699021%3Fupdated_at%3D81f00d55408bc48bb47fc99b9f88dc76v2%26track%3D0%26preview%3Dtrue&cache=1642625713713
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.221.30 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-221-30.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:13 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

GET
H2 200 nr-1212.min.js Show response
js-agent.newrelic.com/ 34 KB
13 KB 7ms
6ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1212.min.js
Requested by: Host: app.funnel-preview.com
URL: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: S6r4yaeB6jo_ZylmZ_5cM21n7ZH1t6gc
content-encoding: gzip
etag: "9dfe540eb31e6fc0e0dddd91e3511f68"
x-amz-request-id: G3H7ZGH3NRBG71F6
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 12828
x-amz-id-2: vQZCeBOGvSkKZ1wSrpfdy9fIYY8PDJEsYc9Gyv/IF3Azg7eTY8h6Vkh4Af4Tyzu9POjIqG1KicM=
x-served-by: cache-hhn4077-HHN
last-modified: Thu, 04 Nov 2021 21:16:16 GMT
server: AmazonS3
x-timer: S1642625714.059673,VS0,VE0
date: Wed, 19 Jan 2022 20:55:14 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 31872

GET
H2 200 closemodal.png
assets.clickfunnels.com/images/ 672 B
1 KB 96ms
96ms Image
image/webp 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.clickfunnels.com/images/closemodal.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 178894
cf-polished: origFmt=png, origSize=788
content-disposition: inline; filename="closemodal.webp"
content-length: 672
last-modified: Thu, 13 Jan 2022 15:23:47 GMT
server: cloudflare
etag: "61e04403-314"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/webp
access-control-allow-origin: *
expires: Sat, 19 Feb 2022 20:55:14 GMT
cache-control: public, max-age=2678400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 6d02f678d9697040-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
cf-bgj: imgq:100,h2pri

POST
H2 200 rum Show response
app.funnel-preview.com/cdn-cgi/ 0
204 B 24ms
24ms XHR
text/plain 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.funnel-preview.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: application/json

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://app.funnel-preview.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6d02f678ea866903-FRA
vary: Origin

GET
H2

200

/ Show response
3iut.sbs/hselaya/location/
Redirect Chain

https://3iut.sbs/hselaya/location
https://3iut.sbs/hselaya/location/

1 KB
522 B

98ms
98ms

Script
application/javascript

5.161.53.22
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://3iut.sbs/hselaya/location/
Protocol: H2
Server: 5.161.53.22 Middle River, United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.22.53.161.5.clients.your-server.de
Software: nginx / PHP/7.4.27, PleskLin
Resource Hash: 6484a4cc5ef37afcbed96f3c7fad850a6b89389969766ee1416556a2fc9745ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
content-encoding: br
server: nginx
x-powered-by: PHP/7.4.27, PleskLin
content-type: application/javascript

Redirect headers

location: https://3iut.sbs/hselaya/location/
date: Wed, 19 Jan 2022 20:55:14 GMT
server: nginx
x-powered-by: PleskLin
content-length: 242
content-type: text/html; charset=iso-8859-1

GET
H2 200 dF5SId3UHWd.svg
tubeiplay.com/hmoises/landings/facebooknew/images/ 2 KB
1 KB 371ms
29ms Image
image/svg+xml 2a02:4780:9:317:0:1224:f50b:3
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tubeiplay.com/hmoises/landings/facebooknew/images/dF5SId3UHWd.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:9:317:0:1224:f50b:3 , Cyprus, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
content-encoding: br
last-modified: Wed, 01 Dec 2021 16:09:54 GMT
server: LiteSpeed
etag: "951-61a79e52-8ae3f149c292887d;br"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1029
expires: Wed, 26 Jan 2022 20:55:14 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
3 KB 51ms
29ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: apaRL3yY89hT2DnILfLOmRDm0LJKlAEA6qgif4R2g++GRodVXR4BQ58/A88A7YBH01pnROjhVwTCoAm6jeiVSA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 19 Jan 2022 20:55:14 GMT
strict-transport-security: max-age=15552000; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-fb-rlafr: 0
priority: u=3,i
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET
H2 200 /
whos.amung.us/pingjs/ 29 B
29 B 327ms
106ms Image
text/javascript 67.202.114.212
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whos.amung.us/pingjs/?k=2022dinero&t=selaya%F0%9F%A6%81%F0%9F%A6%81%F0%9F%92%99&x=%20https://whatsapp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.202.114.212 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: amung.us
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
content-encoding: gzip
content-type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK NRJS-fc902efb332119fff33 Show response
bam-cell.nr-data.net/1/ 49 B
720 B 137ms
137ms Script
text/javascript 162.247.243.146
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/NRJS-fc902efb332119fff33?a=367981416&v=1212.e95d35c&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=1667&ck=1&ref=https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021&ap=141&be=723&fe=1648&dc=1268&perf=%7B%22timing%22:%7B%22of%22:1642625712407,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:25,%22c%22:25,%22s%22:31,%22ce%22:46,%22rq%22:46,%22rp%22:710,%22rpe%22:789,%22dl%22:712,%22di%22:1267,%22ds%22:1268,%22de%22:1309,%22dc%22:1648,%22l%22:1648,%22le%22:1652%7D,%22navigation%22:%7B%7D%7D&fp=1253&fcp=1253&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1212.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 20:55:14 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 6d02f678fac16903-FRA

GET
H2 404 gvkKGhHRkH7.png
app.funnel-preview.com/images/ 2 KB
2 KB 60ms
60ms Image
text/html 2606:4700::6810:fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.funnel-preview.com/images/gvkKGhHRkH7.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

fd71d759774192110a14c85875985c66b9c011b6ce1676d5b180968371240d1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com/home-page1642616699021?updated_at=81f00d55408bc48bb47fc99b9f88dc76v2&track=0&preview=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 20:55:14 GMT
access-control-request-method: *
vary: Accept-Encoding
cf-cache-status: HIT
age: 1260613
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 404 Not Found
content-encoding: br
x-request-id: 761fc93c0d5eb40ab44cea6ab21a9d67
x-runtime: 0.029278
access-control-allow-origin: *
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
pragma: no-cache
cache-control: public, max-age=2678400
access-control-allow-credentials: true
cf-ray: 6d02f6790ae06903-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss
expires: Sat, 19 Feb 2022 20:55:14 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bam-cell.nr-data.net
URL: https://bam-cell.nr-data.net/events/1/NRJS-fc902efb332119fff33?a=367981416&v=1212.e95d35c&to=dFZWTENWVQ9QExdNRlJLSFlWXEpMRQBfXUYYSU1aXVBKC1AF&rst=2819&ck=1&ref=https://gti4.com/11642617894757

Domain: gti4.com
URL: https://gti4.com/cdn-cgi/rum?

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

219 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com	1970-01-20 09:02:41	Name: updated_at Value: 81f00d55408bc48bb47fc99b9f88dc76v2
app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com	1970-01-20 09:02:41	Name: track Value: 0
app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com	1970-01-20 09:02:41	Name: preview Value: true
app.funnel-preview.com/for_domain/alfredoperalta.clickfunnels.com	1970-01-20 09:02:41	Name: addevent_track_cookie Value: a0735fe1-1491-4994-8d1c-f59e14c5c485
.gti4.com/	1970-01-20 00:17:07	Name: __cf_bm Value: hd9jQAsYBv5flUi4NY2GI4ikoglH87.6od.5Jr06r5g-1642625709-0-AXjhubPdpu75wwfu5OcKs7ZIaMmk5SHdNeP9ovrkdwFzp+4u+xuXcDDD8b4pieZ4w/bXBxM5n9ZuToZfp9OHaWh1tE5Pdem/oyn55XA4AtNJ
.clickfunnels.com/	1970-01-20 00:17:07	Name: __cf_bm Value: y7mDnFqOAr3awazvXAa15ft9XyD5_LZOU5dju4GVKeU-1642625710-0-Adt36FoZcC9mBSOZkgSMsTZcmBIBwgMuKoHAAZL9a7Kpvy013Row3+3f98k7xugCGsdL0n78T7BUxBAqwkwANc4qJl4B/guSngtmpus1Qx9U
gti4.com/	1970-01-20 09:02:41	Name: addevent_track_cookie Value: 9e03fb4d-05fd-4333-4802-dc16eef19145
gti4.com/	1970-01-20 09:02:41	Name: cf:aff_sub2 Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:aff_sub3 Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:aff_sub Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:affiliate_id Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:cf_affiliate_id Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:content Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:medium Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:name Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:source Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:term Value:
gti4.com/	1970-01-20 09:02:41	Name: cf:NTI3NzY1MjE Value: :visited=true
gti4.com/	1970-01-20 09:02:41	Name: cf:visitor_id Value: d9343bf6-cf1c-4df8-a776-0251ebe5d74b
gti4.com/	1969-12-31 23:59:59	Name: is_eu Value: true
gti4.com/	1970-01-20 09:02:41	Name: 7gn5w14txcm03dwf Value: true
gti4.com/	1970-01-20 09:02:41	Name: 11775870_viewed_25 Value: 1
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: a940fe483c54dfcd
.funnel-preview.com/	1969-12-31 23:59:59	Name: _etison_sessions_dcs_v2 Value: 5845523250ac5b8ff951d25669948221
.app.funnel-preview.com/	1970-01-20 00:17:07	Name: __cf_bm Value: 75b1TeWB4dsEEGe_kDmEcE3.tIJxOJzSyLVqhNk8_Pc-1642625713-0-ARS1wQ5PbB9MUXYZu2/tFvxAyykvdQxJEhTenUHBbecaFOOsgze9l+0QnJa9+F/k6mSQlhJ8+aiq1SKKw0Z41uMd8itG/xp0D6CfGwVT20GF

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=9e03fb4d-05fd-4333-4802-dc16eef19145&url=https%3A%2F%2Fgti4.com%2F11642617894757&cache=1642625710570 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://track.addevent.com/atc/?trktyp=jsinit&trkcal=&guid=a0735fe1-1491-4994-8d1c-f59e14c5c485&url=https%3A%2F%2Fapp.funnel-preview.com%2Ffor_domain%2Falfredoperalta.clickfunnels.com%2Fhome-page1642616699021%3Fupdated_at%3D81f00d55408bc48bb47fc99b9f88dc76v2%26track%3D0%26preview%3Dtrue&cache=1642625713713 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://app.funnel-preview.com/images/gvkKGhHRkH7.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3iut.sbs
app.clickfunnels.com
app.funnel-preview.com
assets.clickfunnels.com
bam-cell.nr-data.net
cdn.glitch.com
cdn.glitch.me
cooked-steadfast-licorice.glitch.me
facebook.com
fonts.googleapis.com
gti4.com
images.clickfunnels.com
js-agent.newrelic.com
static.cloudflareinsights.com
track.addevent.com
tubeiplay.com
use.fontawesome.com
whos.amung.us
www.clickfunnels.com
bam-cell.nr-data.net
gti4.com
13.32.121.15
151.101.130.137
162.247.243.146
18.66.97.87
23.23.235.119
2606:4700:3037::6815:4e07
2606:4700::6810:5f41
2606:4700::6810:ec2
2606:4700::6810:fc2
2a00:1450:4001:82a::200a
2a02:4780:9:317:0:1224:f50b:3
2a03:2880:f11c:8083:face:b00c:0:25de
5.161.53.22
52.17.221.30
67.202.114.212
004e3565fa58bd4ff0cbf31deb5451508a5ec7d46c4480f9bfa23326f187a158
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3e6008777aea18145473bf9edcc2880dd7084892a8935f74aeab4ac19e2ec325
4028b2bc92f4c6c6238d6350600104718ea86e088cc3a83191d8efd4e5526b71
5216f197f782f4bb872e02a677986af90a488015910f8d3864b796ad68dbd389
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
59a24fd9ceda194298ccf0b352fa9acd789bf3fb4c69c01bcdcab44c584d0219
5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474
6484a4cc5ef37afcbed96f3c7fad850a6b89389969766ee1416556a2fc9745ad
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
7cbad3cdba3766268cc0002f04b939ce8f7cd59755e86d3c51f647acae151186
7d029c824720875cf5af4d2afab4be3438f665ef1f9e0f9df263cd1252ee0475
901fcfe7369510083cd7c309317e0c17ce1ae9d922f8e50dc539894ab3c68916
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
b357586d6c3c09600170883415b6c70d9d6b8693af70ce98daf2adb1a2b42c7d
c52f16fcc2f6502a534219e2198a68b2ebba55c621851b5e5d1de6b522a833db
c999f52d38a4babba03037c0cef8b8480d86630e2a1f7e22d1e20180439aa83b
caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d
cb3876e4940dd51d6df6050004a384b1b99f9dc0a0109a2af81984eadbccaaa8
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
e0189e16cf01f8149342c9f2de872cfa73571f2a145a830f18b16154bf1d2982
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fd71d759774192110a14c85875985c66b9c011b6ce1676d5b180968371240d1c

app.funnel-preview.com Open in urlscan Pro 2606:4700::6810:fc2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

50 Requests

90 %HTTPS

47 %IPv6

15 Domains

19 Subdomains

15 IPs

4 Countries

1794 kBTransfer

6196 kBSize

25 Cookies

0 Outgoing links

Page URL History

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

app.funnel-preview.com Open in urlscan Pro
2606:4700::6810:fc2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

90 %
HTTPS

47 %
IPv6

15
Domains

19
Subdomains

15
IPs

4
Countries

1794 kB
Transfer

6196 kB
Size

25
Cookies

50 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!