piclink.me Open in urlscan Pro
2606:4700:3036::6815:3669 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://piclink.me/df44
Submission: On December 29 via api (December 29th 2024, 4:31:35 pm UTC) from US — Scanned from US

Summary HTTP 20 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 1 countries across 8 domains to perform 20 HTTP transactions. The main IP is 2606:4700:3036::6815:3669, located in United States and belongs to CLOUDFLARENET, US. The main domain is piclink.me.
TLS certificate: Issued by WE1 on December 11th 2024. Valid for: 3 months.

This is the only time piclink.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cash App (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3036::6815:3669	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
2	2607:f8b0:400... 2607:f8b0:4006:80d::2008	15169 (GOOGLE) (GOOGLE)
1 6	172.67.138.48 172.67.138.48	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:809::200a	15169 (GOOGLE) (GOOGLE)
2	52.217.13.134 52.217.13.134	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:81e::200e	15169 (GOOGLE) (GOOGLE)
2	142.251.41.4 142.251.41.4	15169 (GOOGLE) (GOOGLE)
1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2002	15169 (GOOGLE) (GOOGLE)
20	10

4 2606:4700:3036::6815:3669 (United States)

ASN13335 (CLOUDFLARENET, US)

piclink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80d::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.67.138.48 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

piclink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.217.13.134 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.41.4 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	piclink.me 1 redirects piclink.me	300 KB
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 td.doubleclick.net — Cisco Umbrella Rank: 182	2 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3	64 B
2	amazonaws.com s3.amazonaws.com	69 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	116 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	846 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 847	31 KB
20	8

	Domain	Requested by
10	piclink.me	1 redirects piclink.me
2	www.google.com	www.googletagmanager.com piclink.me
2	s3.amazonaws.com	piclink.me
2	www.googletagmanager.com	piclink.me www.googletagmanager.com
1	td.doubleclick.net	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	www.google-analytics.com	www.googletagmanager.com
1	fonts.googleapis.com	piclink.me
1	code.jquery.com	piclink.me
20	9

This site contains links to these domains. Also see Links.

Domain
www.instagram.com

Subject Issuer	Validity	Valid
piclink.me WE1	`2024-12-11` - `2025-03-11`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-11-18` - `2025-11-07`	a year	crt.sh
*.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://piclink.me/df44
Frame ID: D1E82C4628CC41BABEAB61B93177FB78
Requests: 16 HTTP requests in this frame

Frame: https://piclink.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: 545E6A244D8061B66D13333AAE791E8C
Requests: 2 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/11077813512?random=1735489890329&cv=11&fst=1735489890329&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v878191926za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fpiclink.me%2Fdf44&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=726326666.1735489890&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 0C37C30A7316F5CBF56AB4BD911A8946
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fpiclink.me
Frame ID: 0B540964DDF5CF52A3D0E7DC107E0F40
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

95 %
HTTPS

60 %
IPv6

8
Domains

9
Subdomains

10
IPs

1
Countries

518 kB
Transfer

809 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://piclink.me/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://piclink.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request df44 Show response
piclink.me/ 7 KB
3 KB 343ms
258ms Document
text/html 2606:4700:3036::6815:3669
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://piclink.me/df44
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3669 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.1.27
Resource Hash: c7a5883b2d4ef63a303c0ca8fb8152d2c1bfb645b6c5daec83b44784b43944b3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 8f9b2e41bb438de2-MIA
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Sun, 29 Dec 2024 16:31:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kVDb%2FZr1SJEOuhDt2RtD6UEN%2BWlv0Ag08x8ufP7YEQVD9UukG2xwXVbX4%2BO8ospVesN2WhuSv4Pw0Rtn0%2FlO0Z%2F9SF32sDvC9CCVXK9QS8qELmD4ntEHQRC7RIDWF3AqHhBzYsincWex"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=29983&min_rtt=29889&rtt_var=4840&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4014&recv_bytes=2282&delivery_rate=129717&cwnd=253&unsent_bytes=0&cid=bc8071ee15ee717e&ts=265&x=0"
x-powered-by: PHP/8.1.27

GET
H2 200 jquery-3.6.2.min.js Show response
code.jquery.com/ 88 KB
31 KB 108ms
30ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.2.min.js
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: da4ad864a87ffcf71c851b5df87f95cb242867f7b711cae4c6133cc9cc0048f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://piclink.me
Referer: https://piclink.me/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15f56"
age: 4012690
x-cache: HIT, HIT
date: Sun, 29 Dec 2024 16:31:29 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-cache-hits: 6, 10606
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-served-by: cache-lga21931-LGA, cache-mia-kmia1760059-MIA
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1735489890.902849,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31043
server: nginx

GET
H2 200 profile.css
piclink.me/css/ 7 KB
3 KB 85ms
83ms Stylesheet
text/css 2606:4700:3036::6815:3669
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://piclink.me/css/profile.css?v=1735489889
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3669 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b29ef570bc5a3d944dec95c7121cad55e23e05fe58e4566529189d57853348b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
etag: W/"63d12a06-1d45"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vcT%2FLeTDuay33%2F8jvkPsps3iA9f08qF05HFFyBoN2vAWgpIOkurRUS4FOocduK9zNXLGg9xtS1sA1TKO4oheERFxG7oy7ftleXlgnBfcxaX6GobMSvMID5VFhzd8Re9%2BDA8ZyrRkqZyU"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f9b2e436d318de2-MIA
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=30275&min_rtt=29794&rtt_var=1069&sent=29&recv=21&lost=0&retrans=0&sent_bytes=19643&recv_bytes=2617&delivery_rate=462388&cwnd=255&unsent_bytes=0&cid=bc8071ee15ee717e&ts=360&x=0"
date: Sun, 29 Dec 2024 16:31:29 GMT
content-type: text/css
last-modified: Wed, 25 Jan 2023 13:09:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 338 KB
116 KB 216ms
78ms Script
application/javascript 2607:f8b0:4006:80d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8

Requested by

Host: piclink.me
URL: https://piclink.me/df44

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8642b4ee1b48c72b11ad3e7af96dbddac7a55a3e0cb5f816d2df8a69b412cad8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 29 Dec 2024 16:31:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 118137
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 piclink_logo.png
piclink.me/images/ 10 KB
11 KB 49ms
48ms Image
image/png 2606:4700:3036::6815:3669
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://piclink.me/images/piclink_logo.png
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3669 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77dde7869882c51c65411be4a01467fd84bc567ca2ad28c5bb0a9eeda473d17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

cf-cache-status: HIT
etag: "63a6063f-2966"
age: 3263464
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MvGLikU9ybwj720WbrU9Ej4xQiKkU4CYdeP%2F%2Boc6qAywiMa2AB3KwAICrgDepAgrvCISgrlNcAskkXeG7zK2knHunYp8AlbjCf6nd3PRT%2Bx4Jv5V4D02QIOimD1wvw8gVNA1BXPwDkRE"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=29982&min_rtt=29794&rtt_var=2788&sent=14&recv=16&lost=0&retrans=0&sent_bytes=7239&recv_bytes=2617&delivery_rate=215162&cwnd=255&unsent_bytes=0&cid=bc8071ee15ee717e&ts=324&x=0"
date: Sun, 29 Dec 2024 16:31:29 GMT
content-type: image/png
last-modified: Fri, 23 Dec 2022 19:49:19 GMT
vary: Accept-Encoding
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f9b2e436d328de2-MIA
accept-ranges: bytes
content-length: 10598
server: cloudflare

GET
H2 404 new_instagram_logo.svg
piclink.me/images/ 807 B
807 B 80ms
80ms Image
text/html 2606:4700:3036::6815:3669
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://piclink.me/images/new_instagram_logo.svg
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3669 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.1.27
Resource Hash: af57b7d78344037a0b4bc8d10780c0ec89f28c13b1e939fc5341cfed5e1d92ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v45xNwm6of8dMP%2FDTVEN5Au3w3Xs4THHPukWB23teRTpXkaGZE5aOtwOGsOMyzx5qbkn2qBBjh4fHpPrqDQOe%2FGRgzL%2BqDAT7Kj3tAkn2S00Y7LY9KTwAwd87Ww7%2Bs9GLQd%2F7mv4RL%2FT"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f9b2e436d338de2-MIA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=30275&min_rtt=29794&rtt_var=1069&sent=26&recv=21&lost=0&retrans=0&sent_bytes=18609&recv_bytes=2617&delivery_rate=462388&cwnd=255&unsent_bytes=0&cid=bc8071ee15ee717e&ts=356&x=0"
date: Sun, 29 Dec 2024 16:31:29 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.27
vary: Accept-Encoding
server: cloudflare

GET
H3 200 website_icon.svg
piclink.me/images/icons_old/ 1 KB
1 KB 49ms
48ms Image
image/svg+xml 172.67.138.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://piclink.me/images/icons_old/website_icon.svg
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.138.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: befcccb86cf6fc4fac5e45eeb2c99dba765b43f55a377f5e3fb23a17113603d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"63d2c8b1-4a3"
age: 5174
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUjfjZBnZXOcjQ0gLGJqN8pqvWlY8iqljg0dNlW0TzmR%2BdFYVW%2BTKe1HEuTuHtfwd1OYV0%2BOZojRgt9L0vswrwhwYDeASwbZ%2FwPTe39oU%2FiEDRFw9V0FQQWKYppX"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30473&min_rtt=30456&rtt_var=11454&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4229&recv_bytes=4326&delivery_rate=99486&cwnd=12000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=69&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 29 Dec 2024 16:31:29 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Jan 2023 18:38:41 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f9b2e43b980741c-MIA
server: cloudflare

GET
H2 200 css
fonts.googleapis.com/ 802 B
846 B 265ms
98ms Stylesheet
text/css 2607:f8b0:4006:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins:200

Requested by

Host: piclink.me
URL: https://piclink.me/css/profile.css?v=1735489889

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c6ea07a9d7347b4c621a4142128c517835122d092dace3697256eccd0ce4ef92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 29 Dec 2024 16:31:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sun, 29 Dec 2024 16:31:30 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 66caf86cc8214-66caf86cc8216.jpg
piclink.me/uploads/profile/ 273 KB
274 KB 44ms
43ms Image
image/jpeg 172.67.138.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://piclink.me/uploads/profile/66caf86cc8214-66caf86cc8216.jpg
Requested by: Host: piclink.me
URL: https://piclink.me/df44
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.138.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8dad2ccbc23d98b28012674fe74c657146891ebfed521eb8b9da6c39e7b7afd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

cf-cache-status: HIT
etag: "66caf86c-44432"
age: 304483
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wuoMinkdkFHIjKwQuaIPdHOTnggMq31m4yBual%2F1eUMSst%2BWU3NeUI8qRSbZ2NvTERWg5aHhInwS%2BOjkziNOc5KqfHBqfPNFk7zfNO2GE%2F92p8HM3NM4hU9ZVKyw"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30331&min_rtt=30016&rtt_var=3784&sent=16&recv=13&lost=0&retrans=0&sent_bytes=5695&recv_bytes=5125&delivery_rate=25709&cwnd=12000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=426&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: image/jpeg
last-modified: Sun, 25 Aug 2024 09:25:00 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f9b2e45fcab741c-MIA
accept-ranges: bytes
content-length: 279602
server: cloudflare

GET
H/1.1 200
OK CashMarket-MediumRounded.woff2
s3.amazonaws.com/franklin-assets/static/fonts/cash-market/v2/ 35 KB
36 KB 220ms
86ms Font
binary/octet-stream 52.217.13.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/franklin-assets/static/fonts/cash-market/v2/CashMarket-MediumRounded.woff2
Requested by: Host: piclink.me
URL: https://piclink.me/css/profile.css?v=1735489889
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.217.13.134 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://piclink.me
Referer: https://piclink.me/

Response headers

ETag: "78f6a7289d0e20d4533b050d0a0ed852"
x-amz-version-id: wUHM1COVNt.Dix0wIkAoFn1sxef0coOq
Access-Control-Allow-Methods: GET
x-amz-request-id: BVPDHCNAD79PJJVM
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 36144
Date: Sun, 29 Dec 2024 16:31:31 GMT
Last-Modified: Fri, 12 Apr 2019 16:58:11 GMT
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Server: AmazonS3
Content-Type: binary/octet-stream
x-amz-id-2: s6tAvactvdjETvQOFbXyJrzz0fjhks7PWB+o7nVEcQMqZ7eXzfPCq2//Y2vu+TdruC1yLK0XI8U=

GET
H/1.1 200
OK CashMarket-RegularRounded.woff2
s3.amazonaws.com/franklin-assets/static/fonts/cash-market/v2/ 33 KB
33 KB 227ms
94ms Font
binary/octet-stream 52.217.13.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/franklin-assets/static/fonts/cash-market/v2/CashMarket-RegularRounded.woff2
Requested by: Host: piclink.me
URL: https://piclink.me/css/profile.css?v=1735489889
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.217.13.134 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://piclink.me
Referer: https://piclink.me/

Response headers

ETag: "6d90b43b30166957cb37e18620a82f05"
x-amz-version-id: 1kIMV9IIRZaoDfloV8ku_k_rC2sCtvcj
Access-Control-Allow-Methods: GET
x-amz-request-id: BVP67TAM8CAYWQ8P
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 33692
Date: Sun, 29 Dec 2024 16:31:31 GMT
Last-Modified: Fri, 12 Apr 2019 16:58:11 GMT
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Server: AmazonS3
Content-Type: binary/octet-stream
x-amz-id-2: +5HkkwqEM3IHdKxWq/GGuSd217KVx+fzituPiIUve0M6x7mMDHk6ReNJdVMhRoJtaGSe3T1pXuQ=

GET
H3

200

main.js Show response
piclink.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame 545E
Redirect Chain

https://piclink.me/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://piclink.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

9 KB
5 KB

54ms
53ms

Script
application/javascript

172.67.138.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://piclink.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

Requested by

Host: piclink.me
URL: https://piclink.me/df44

Protocol

Server

172.67.138.48 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

414bd5e511c1f160c62c7535460e77fce05c642fbb1966904cca1e256cd1cd18

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVhLl4yaJN9kMPF14ZryXQ%2FcjLoDq%2FufxCMtWujH9n3uj2grTtR6gq7H2w%2BHH0N1y3OT7lYnKuhOmpYAcxYYa%2BSl%2Bk8J8kSdB1YPqUEbQlxFsjMD2vG99zNLi0Tm"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8f9b2e468d6b741c-MIA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32272&min_rtt=30016&rtt_var=1984&sent=88&recv=29&lost=0&retrans=0&sent_bytes=89695&recv_bytes=6055&delivery_rate=774570&cwnd=48000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=504&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=58i7emqaMI0pbJvhasXvaQ9epPCY712kgZjtj89XqmA37sO8h0hVhYYee7sDixiNk64TlqYx%2F8Jpn1L33EDuUDMR5Ve3dHjKA1IEULeveb3LcsslSWaqoiSgQwcl"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f9b2e460cce741c-MIA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfL4;desc="?proto=QUIC&rtt=30331&min_rtt=30016&rtt_var=3784&sent=26&recv=13&lost=0&retrans=0&sent_bytes=17695&recv_bytes=5125&delivery_rate=25709&cwnd=12000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=431&x=1", cfExtPri, cfHdrFlush;dur=25
date: Sun, 29 Dec 2024 16:31:30 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 275ms
93ms Fetch
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-NC9NTB1ZP8&gtm=45je4cc1v878191926za200&_p=1735489890207&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=612221503.1735489890&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1735489890&sct=1&seg=0&dl=https%3A%2F%2Fpiclink.me%2Fdf44&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=874
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://piclink.me
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 collect
www.google.com/ccm/ 0
0 309ms
114ms Ping
text/plain 142.251.41.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fpiclink.me%2Fdf44&scrsrc=www.googletagmanager.com&frm=0&rnd=1248394699.1735489890&auid=726326666.1735489890&navt=n&npa=0&gtm=45je4cc1v878191926za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735489890333&tfd=880&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.41.4 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s40-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11077813512/ 4 KB
2 KB 312ms
120ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11077813512/?random=1735489890329&cv=11&fst=1735489890329&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v878191926za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fpiclink.me%2Fdf44&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=726326666.1735489890&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

6b5fe692b7ae4d0c19731c68a01e3da7ef67264cd5e994f4bddc7b73009b2858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2214
date: Sun, 29 Dec 2024 16:31:30 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 11077813512
td.doubleclick.net/td/rul/ Frame 0C37 0
0 273ms
101ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/11077813512?random=1735489890329&cv=11&fst=1735489890329&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v878191926za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fpiclink.me%2Fdf44&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=726326666.1735489890&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://piclink.me/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 29 Dec 2024 16:31:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4cc0/ Frame 0B54 0
0 243ms
79ms Document
text/html 2607:f8b0:4006:80d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fpiclink.me

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NC9NTB1ZP8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 186180
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Dec 2024 12:48:30 GMT
expires: Sat, 27 Dec 2025 12:48:30 GMT
last-modified: Thu, 12 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 8f9b2e41bb438de2 Show response
piclink.me/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 545E 0
1 KB 49ms
43ms XHR
text/plain 172.67.138.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://piclink.me/cdn-cgi/challenge-platform/h/b/jsd/r/8f9b2e41bb438de2
Requested by: Host: piclink.me
URL: https://piclink.me/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.138.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yq5mJ2wq6Z8SvHiRRSYf%2BZ83WKkoTY%2B8f74GyLs3rNTN34NckWtUZPbtEgJ%2BD9%2FBrEJcp2GA55aKJlaoAyNb0tfI8KQmwlNvXnVhVx8YluT%2FLKb2A1oA7lMjLEhB"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f9b2e480f6f741c-MIA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32394&min_rtt=29941&rtt_var=716&sent=271&recv=90&lost=0&retrans=0&sent_bytes=298237&recv_bytes=25310&delivery_rate=4206049&cwnd=156000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=758&x=1", cfExtPri, cfHdrFlush;dur=0
content-length: 0
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H3 200 /
www.google.com/pagead/1p-user-list/11077813512/ 42 B
64 B 117ms
116ms Image
image/gif 142.251.41.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11077813512/?random=1735489890329&cv=11&fst=1735488000000&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v878191926za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1600&u_h=1200&url=https%3A%2F%2Fpiclink.me%2Fdf44&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=726326666.1735489890&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dBztBBjqWaGxmr3IbOUf2b3lu7SHIyA&random=1180552969&rmt_tld=0&ipr=y

Requested by

Host: piclink.me
URL: https://piclink.me/df44

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.4 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 29 Dec 2024 16:31:30 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 favicon.ico
piclink.me/ 1 KB
1 KB 46ms
46ms Other
image/x-icon 172.67.138.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://piclink.me/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.138.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a90567ec75a49509d980e7a966aa204dec690066ed8f3b7eb9c6b9dc3442fe5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://piclink.me/df44

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"63c17035-47e"
age: 806435
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kz18Mq8YP14a8sBkN%2BW9o%2Be1Iv9WW2ZLVhqBszDvne12v2U8lAqjGA7o7Ettw5NhlEV7qARFEJkr4yJSieMYujRghLeedd%2FBgCWPmRchUghC6yL4P1dQPv1xTJc7"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=33052&min_rtt=29941&rtt_var=1855&sent=273&recv=92&lost=0&retrans=0&sent_bytes=299436&recv_bytes=26151&delivery_rate=21235&cwnd=156000&unsent_bytes=0&cid=aaa7a567693ed2a6&ts=987&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 29 Dec 2024 16:31:30 GMT
content-type: image/x-icon
last-modified: Fri, 13 Jan 2023 14:52:37 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f9b2e49794c741c-MIA
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cash App (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.piclink.me/	1970-01-21 11:40:49	Name: _ga Value: GA1.1.612221503.1735489890
.piclink.me/	1970-01-21 04:14:25	Name: _gcl_au Value: 1.1.726326666.1735489890
.piclink.me/	1970-01-21 11:40:49	Name: _ga_NC9NTB1ZP8 Value: GS1.1.1735489890.1.0.1735489890.0.0.0
.piclink.me/	1970-01-21 10:50:25	Name: cf_clearance Value: JZvNcQv9ypbiG.eq7IWg_TxD9UD0dnVWPkk1tk47Hj4-1735489890-1.2.1.1-Wrcr9v8ofrsEw0iSreHl0l.X6uEto31rHMykLkfhFHgivpGqLZFBucc8fyQ.1Jgc0EeayOoK.fMHT8oM9aucPfTu4e3rPEJ6olN02WnZTQe8Tez9_HzfeeJoeb9kugf9V6a6J6ceCar8qaHGNFILtqId2pzh8HE40htvcuhVSjWkyb6nz1QOPIPmnb28Mbh3aS_33ZYkQdT2ECObNWW452.OQV6IkhzB5z7ulGAllWv.7BvJOSoal2ipZNNwZ4NHQo1eZisRv0M3lYQrGeVJhKLgDYpMB90c3dD7z5s2qiCUpvW9MxDym5aoExeV3SobGJohjx7DuCKcEP23of1Y82ZZVvEJf2RxaZhPmVXDZAKRpvDDolzx4WR2C_Z.7OF6
.doubleclick.net/	1970-01-21 02:04:50	Name: test_cookie Value: CheckForPermission

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://piclink.me/images/new_instagram_logo.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
googleads.g.doubleclick.net
piclink.me
s3.amazonaws.com
td.doubleclick.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
142.251.40.130
142.251.41.4
172.67.138.48
2606:4700:3036::6815:3669
2607:f8b0:4006:809::200a
2607:f8b0:4006:80d::2008
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81e::200e
2a04:4e42::649
52.217.13.134
0a90567ec75a49509d980e7a966aa204dec690066ed8f3b7eb9c6b9dc3442fe5
32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3
414bd5e511c1f160c62c7535460e77fce05c642fbb1966904cca1e256cd1cd18
6b5fe692b7ae4d0c19731c68a01e3da7ef67264cd5e994f4bddc7b73009b2858
77dde7869882c51c65411be4a01467fd84bc567ca2ad28c5bb0a9eeda473d17e
8642b4ee1b48c72b11ad3e7af96dbddac7a55a3e0cb5f816d2df8a69b412cad8
af57b7d78344037a0b4bc8d10780c0ec89f28c13b1e939fc5341cfed5e1d92ba
b29ef570bc5a3d944dec95c7121cad55e23e05fe58e4566529189d57853348b7
befcccb86cf6fc4fac5e45eeb2c99dba765b43f55a377f5e3fb23a17113603d0
c6ea07a9d7347b4c621a4142128c517835122d092dace3697256eccd0ce4ef92
c7a5883b2d4ef63a303c0ca8fb8152d2c1bfb645b6c5daec83b44784b43944b3
da4ad864a87ffcf71c851b5df87f95cb242867f7b711cae4c6133cc9cc0048f0
de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f8dad2ccbc23d98b28012674fe74c657146891ebfed521eb8b9da6c39e7b7afd

piclink.me Open in urlscan Pro 2606:4700:3036::6815:3669 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

95 %HTTPS

60 %IPv6

8 Domains

9 Subdomains

10 IPs

1 Countries

518 kBTransfer

809 kBSize

5 Cookies

1 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

piclink.me Open in urlscan Pro
2606:4700:3036::6815:3669 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

95 %
HTTPS

60 %
IPv6

8
Domains

9
Subdomains

10
IPs

1
Countries

518 kB
Transfer

809 kB
Size

5
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!