urlscan.io logo urlscan.io
SecurityTrails logo

khvan.de Open in urlscan Pro
130.255.79.215  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&...
Effective URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Submission: On February 24 via manual from HR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 10 domains to perform 41 HTTP transactions. The main IP is 130.255.79.215, located in Germany and belongs to BKVG-AS, DE. The main domain is khvan.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 8th 2020. Valid for: 3 months.
This is the only time khvan.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 198.143.165.220 32475 (SINGLEHOP...)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 5 130.255.79.215 29141 (BKVG-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
15 143.204.201.16 16509 (AMAZON-02)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
15 85.13.135.110 34788 (NMM-AS D)
41 8
3    198.143.165.220 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi
warm.vulkan.casa
2    2606:4700:3032::681f:5fd9 (United States)

ASN13335 (CLOUDFLARENET, US)
clickmob.c0c.xyz
2    2606:4700:3035::681b:ae1d (United States)

ASN13335 (CLOUDFLARENET, US)
ck.gl2022.info
5    130.255.79.215 (Germany)

ASN29141 (BKVG-AS, DE)
PTR: server-redlemon01.virtualhosts.de
www.exklusive-preise.de
khvan.de
www.rlcontrol.de
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
15    143.204.201.16 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-16.fra53.r.cloudfront.net
rlmgws-data.s3-accelerate.amazonaws.com
2    2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com
15    85.13.135.110 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd13604.kasserver.com
rltools.de
www.rltools.de
Domain Requested by
15 rlmgws-data.s3-accelerate.amazonaws.com khvan.de
rlmgws-data.s3-accelerate.amazonaws.com
11 www.rltools.de rlmgws-data.s3-accelerate.amazonaws.com
4 rltools.de khvan.de
3 khvan.de ck.gl2022.info
rlmgws-data.s3-accelerate.amazonaws.com
khvan.de
3 warm.vulkan.casa 1 redirects warm.vulkan.casa
2 maxcdn.bootstrapcdn.com khvan.de
2 ck.gl2022.info 1 redirects clickmob.c0c.xyz
2 clickmob.c0c.xyz 1 redirects warm.vulkan.casa
1 www.rlcontrol.de khvan.de
1 cdn.onesignal.com khvan.de
1 www.exklusive-preise.de 1 redirects
41 11

This site contains links to these domains. Also see Links.

Domain
odoki.de
my-promobox.de
www.rlcontrol.de
Subject Issuer Validity Valid
warm.vulkan.casa
Let's Encrypt Authority X3		 2020-02-01 -
2020-05-01		 3 months crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-02-04 -
2020-10-09		 8 months crt.sh
www.khvan.de
Let's Encrypt Authority X3		 2020-01-08 -
2020-04-07		 3 months crt.sh
ssl898578.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-10-11 -
2020-04-18		 6 months crt.sh
*.s3-accelerate.amazonaws.com
Amazon		 2019-09-16 -
2020-08-17		 a year crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
rltools.de
Let's Encrypt Authority X3		 2020-02-07 -
2020-05-07		 3 months crt.sh
www.rlcontrol.de
Let's Encrypt Authority X3		 2020-01-08 -
2020-04-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Frame ID: D0F20A914340353B6E533401309EBF3D
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3... Page URL
  2. https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
  3. https://warm.vulkan.casa/proc.php?327fa14be84c303d54299f22f8b33418957379e5 HTTP 302
    https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327 Page URL
  4. https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327&mc=1%7C0%7C%7C0%... HTTP 302
    https://ck.gl2022.info/66817?subaffiliate_id=1631_4327&session_id=bdd8cb5c-56f2-11ea-98a9-06097625304a HTTP 302
    https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_75... Page URL
  5. https://www.exklusive-preise.de/de,flexfancy,responsive_753.html?idPartner=231&idCampaignAd=0&subId=gl158254... HTTP 302
    https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de& Page URL

Detected technologies

Overall confidence: 75%
Detected patterns
  • script /\/Chart(?:\.bundle)?(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /piwik\.js|piwik\.php/i
Overall confidence: 100%
Detected patterns
  • script /moment(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

41
Requests

100 %
HTTPS

50 %
IPv6

10
Domains

11
Subdomains

8
IPs

3
Countries

994 kB
Transfer

1155 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script Page URL
  2. https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e Page URL
  3. https://warm.vulkan.casa/proc.php?327fa14be84c303d54299f22f8b33418957379e5 HTTP 302
    https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327 Page URL
  4. https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327&mc=1%7C0%7C%7C0%7C1600%7C1200 HTTP 302
    https://ck.gl2022.info/66817?subaffiliate_id=1631_4327&session_id=bdd8cb5c-56f2-11ea-98a9-06097625304a HTTP 302
    https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1 Page URL
  5. https://www.exklusive-preise.de/de,flexfancy,responsive_753.html?idPartner=231&idCampaignAd=0&subId=gl15825411166e1dc5e53a93c0f619990138325&subIdentifier=4063&rlmset=samsung_s20_de HTTP 302
    https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://warm.vulkan.casa/proc.php?327fa14be84c303d54299f22f8b33418957379e5 HTTP 302
  • https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
Request Chain 3
  • https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327&mc=1%7C0%7C%7C0%7C1600%7C1200 HTTP 302
  • https://ck.gl2022.info/66817?subaffiliate_id=1631_4327&session_id=bdd8cb5c-56f2-11ea-98a9-06097625304a HTTP 302
  • https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1

41 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.143.165.220 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.3.4
Resource Hash
9d6a1b50c1cb98a750dd6dfbc4379bfdd131e90d8fc00bb712f3b5742dee3008
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
warm.vulkan.casa
:scheme
https
:path
/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
server
nginx
date
Mon, 24 Feb 2020 10:45:14 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/7.3.4
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
set-cookie
u=4c42c9d82ab12c80a01f0c6a10a7f07a; expires=Tue, 23-Feb-2021 10:45:14 GMT; Max-Age=31536000; path=/
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip
/
warm.vulkan.casa/ 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
Requested by
Host: warm.vulkan.casa
URL: https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.143.165.220 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/7.3.4
Resource Hash
445d1944c0b23f259e215947dcc27df6d116a5a0faf4551324cb813a05d550d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

:method
GET
:authority
warm.vulkan.casa
:scheme
https
:path
/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
referer
https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
u=4c42c9d82ab12c80a01f0c6a10a7f07a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://warm.vulkan.casa/75eda42ca2bc3f147e8815ad405fb94c069c1844/?1={campaign_id}_{lp_name}&2={t1}&3={t2}&4={t5}&5={t4}&cid={clickid}&rcid=back&src=script

Response headers

status
200
server
nginx
date
Mon, 24 Feb 2020 10:45:14 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/7.3.4
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=31536000; includeSubdomains;
content-encoding
gzip
4572648
clickmob.c0c.xyz/rest/ck/o/1631/
Redirect Chain
  • https://warm.vulkan.casa/proc.php?327fa14be84c303d54299f22f8b33418957379e5
  • https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
1 KB
902 B 		Document
General
Check archive.org
Download Go to
Full URL
https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
Requested by
Host: warm.vulkan.casa
URL: https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::681f:5fd9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df43db046c15a835f3d0c7681fada63dbf48bbe8a5af2594d9686b1f45ee00c1

Request headers

:method
GET
:authority
clickmob.c0c.xyz
:scheme
https
:path
/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://warm.vulkan.casa/?utm_term=6796962329222185372&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e#

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:15 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=ddfa491975bdeba7d53db0b8d93312b8c1582541114; expires=Wed, 25-Mar-20 10:45:14 GMT; path=/; domain=.c0c.xyz; HttpOnly; SameSite=Lax
vary
Accept-Encoding
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
56a0d9504a42d6f1-FRA
content-encoding
br

Redirect headers

status
302
server
nginx
date
Mon, 24 Feb 2020 10:45:14 GMT
content-type
text/html; charset=UTF-8
location
https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
x-powered-by
PHP/7.3.4
cache-control
no-store, no-cache, must-revalidate, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=31536000; includeSubdomains;
r
ck.gl2022.info/
Redirect Chain
  • https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327&mc=1%7C0%7C%7C0%7C1600%7C1200
  • https://ck.gl2022.info/66817?subaffiliate_id=1631_4327&session_id=bdd8cb5c-56f2-11ea-98a9-06097625304a
  • https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26su...
1 KB
773 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1
Requested by
Host: clickmob.c0c.xyz
URL: https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ae1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / HHVM/3.11.1
Resource Hash
41922036ecbd8f3b1a24cd30e2ca7dda793ce1b4d7acfcf262b8b5b5b1f3121f

Request headers

:method
GET
:authority
ck.gl2022.info
:scheme
https
:path
/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=de62305bc83ddc22cab07381c278dfc5d1582541115; 51D_Bandwidth=1582541115.9781; ubbc=eyJpdiI6ImFtemwxeEx6ZHpaYkJIXC9QbmRsQnd3PT0iLCJ2YWx1ZSI6Im02UlRQN0E0ZmhxQVllT1U0UnA2ZVE9PSIsIm1hYyI6Ijg0YmM3ZTFhOTg5ZTFjZWE4MmE4M2VkYjYwN2MyN2RjYTdhZjhhNzY2ZWQyMmM3MGI3MzE4YmI3MDAwN2YzMjUifQ%3D%3D; bbuc=eyJpdiI6InN4cHVUU1BRQU9zM1l2THpSeTRnemc9PSIsInZhbHVlIjoibWUzbG5rZEd2NXdnNGI5bjRSRkVzdWRyME5LNmVMWVRSSnFuY1drbWtWUT0iLCJtYWMiOiI0NGQwYzkxNjE5NWIzOGYwYmY0MTdlNmU1M2Q3MTZmMWFiZGE5NzdmYmYzZDZiZTA4OWFkMDljNTE1MDQ4MzIyIn0%3D; bbrc=eyJpdiI6ImdWQnc2MEozZW5KUlNaQzl1ZTREZkE9PSIsInZhbHVlIjoibTFzNDZKVDh5VGpyeE9vcUlEZjlFdz09IiwibWFjIjoiZjllZjYxMjQzNDgzOWY3MDBlNGZmNjgwMDdmZThjYWYxMjQ2Mzk5ZThhZDA4ZDBlYzhmNWMwZmUxNjE4NTU4MSJ9; laravel_session=eyJpdiI6Ik02bHdtZW0wZDN4NkNwbmVOa0crOWc9PSIsInZhbHVlIjoiU2FUR3F1cnJXOTIyVVNEN25uK3lkeVRHeVZPbTF6K0c2NExkRFd1dzVQMThncFB1MFpVbU5JRllcL1hmOGVIUTJcLzRkVm13WGpmTWdlT2k0ZnlQWUplUT09IiwibWFjIjoiNzRkNjk5MTc0YjViNWJhOTY5ZThjNzQ0YjQzNGJkZmJiZDdhYzNhOTJjZjQ5YmJjZDVlMTk1MTdlNDMwOWFmZSJ9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://clickmob.c0c.xyz/rest/ck/o/1631/4572648?click_id=6796962329222185372&sc=4327

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:16 GMT
content-type
text/html; charset=UTF-8
set-cookie
laravel_session=eyJpdiI6IkQ5VHdBWWdiWGFXQlJ5bW1pck1GdVE9PSIsInZhbHVlIjoibzk4Y0NOYjViUEZtZkFYckJ4ZWcrbzM1SkRTa3ZleEhoemt6RmM1VGxaUUE3ODV6SzRyNFBQdDNydFlCUkNqRHppZWxlaGRYMkRsMU9GT082NDhDWWc9PSIsIm1hYyI6IjQ1NjIzNTk1YmY1YjBkNDMyMmU2NTU1MWIxMDZhM2UxNjVjMWM4NmJiNDM2MzllYWFjZGVkYmFlZWEzOGRkOTYifQ%3D%3D; path=/; httponly
x-powered-by
HHVM/3.11.1
vary
Accept-Encoding
cache-control
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
56a0d957cde7c2ea-FRA
content-encoding
br

Redirect headers

status
302
date
Mon, 24 Feb 2020 10:45:16 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=de62305bc83ddc22cab07381c278dfc5d1582541115; expires=Wed, 25-Mar-20 10:45:15 GMT; path=/; domain=.gl2022.info; HttpOnly; SameSite=Lax 51D_Bandwidth=1582541115.9781 ubbc=eyJpdiI6ImFtemwxeEx6ZHpaYkJIXC9QbmRsQnd3PT0iLCJ2YWx1ZSI6Im02UlRQN0E0ZmhxQVllT1U0UnA2ZVE9PSIsIm1hYyI6Ijg0YmM3ZTFhOTg5ZTFjZWE4MmE4M2VkYjYwN2MyN2RjYTdhZjhhNzY2ZWQyMmM3MGI3MzE4YmI3MDAwN2YzMjUifQ%3D%3D; expires=Tue, 25-Feb-2020 10:45:16 GMT; Max-Age=86400; path=/; httponly bbuc=eyJpdiI6InN4cHVUU1BRQU9zM1l2THpSeTRnemc9PSIsInZhbHVlIjoibWUzbG5rZEd2NXdnNGI5bjRSRkVzdWRyME5LNmVMWVRSSnFuY1drbWtWUT0iLCJtYWMiOiI0NGQwYzkxNjE5NWIzOGYwYmY0MTdlNmU1M2Q3MTZmMWFiZGE5NzdmYmYzZDZiZTA4OWFkMDljNTE1MDQ4MzIyIn0%3D; expires=Tue, 25-Feb-2020 10:45:16 GMT; Max-Age=86400; path=/; httponly bbrc=eyJpdiI6ImdWQnc2MEozZW5KUlNaQzl1ZTREZkE9PSIsInZhbHVlIjoibTFzNDZKVDh5VGpyeE9vcUlEZjlFdz09IiwibWFjIjoiZjllZjYxMjQzNDgzOWY3MDBlNGZmNjgwMDdmZThjYWYxMjQ2Mzk5ZThhZDA4ZDBlYzhmNWMwZmUxNjE4NTU4MSJ9; expires=Mon, 24-Feb-2020 17:45:16 GMT; Max-Age=25200; path=/; httponly laravel_session=eyJpdiI6Ik02bHdtZW0wZDN4NkNwbmVOa0crOWc9PSIsInZhbHVlIjoiU2FUR3F1cnJXOTIyVVNEN25uK3lkeVRHeVZPbTF6K0c2NExkRFd1dzVQMThncFB1MFpVbU5JRllcL1hmOGVIUTJcLzRkVm13WGpmTWdlT2k0ZnlQWUplUT09IiwibWFjIjoiNzRkNjk5MTc0YjViNWJhOTY5ZThjNzQ0YjQzNGJkZmJiZDdhYzNhOTJjZjQ5YmJjZDVlMTk1MTdlNDMwOWFmZSJ9; path=/; httponly
location
https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1
cache-control
no-cache
vary
Accept-Encoding
x-powered-by
HHVM/3.11.1
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
56a0d9552e19c2ea-FRA
Primary Request campaign_804.html
khvan.de/
Redirect Chain
  • https://www.exklusive-preise.de/de,flexfancy,responsive_753.html?idPartner=231&idCampaignAd=0&subId=gl15825411166e1dc5e53a93c0f619990138325&subIdentifier=4063&rlmset=samsung_s20_de
  • https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
58 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Requested by
Host: ck.gl2022.info
URL: https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
130.255.79.215 , Germany, ASN29141 (BKVG-AS, DE),
Reverse DNS
server-redlemon01.virtualhosts.de
Software
Apache /
Resource Hash
be968f9a0b1f2d96d7a7260ed8d0ebba1f7921a003b4a782211f262dc871e761

Request headers

:method
GET
:authority
khvan.de
:scheme
https
:path
/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://ck.gl2022.info/r?url=https%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de&redirect_back=%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:16 GMT
server
Apache
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=3497jqfd7qq3421v3hjb3g7bjj; path=/ coyoteAffiliTokenId804=367875034; expires=Mon, 24-Feb-2020 14:45:16 GMT; Max-Age=14400; path=/
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
11480
content-type
text/html; charset=UTF-8

Redirect headers

status
302
date
Mon, 24 Feb 2020 10:45:16 GMT
server
Apache
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=so0dnmrivhkqou54m9sr72le2d; path=/ coyoteTrackingCookie_753=367875034; expires=Wed, 25-Mar-2020 10:45:16 GMT; Max-Age=2592000; path=/;samesite=None; Secure coyoteSimpleTrackingCookie=367875034; expires=Wed, 25-Mar-2020 10:45:16 GMT; Max-Age=2592000; path=/;samesite=None; Secure
location
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
24
content-type
text/html; charset=UTF-8
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03287280ffc2f50b1c9b477d00acb16fec7797d50e3a89a2dcb5589e36e413c0

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
3289
etag
W/"f242ff15a186d9d5dc1c33cc46f2d4a1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=43200
cf-ray
56a0d95c2a1f97f0-FRA
expires
Mon, 24 Feb 2020 22:45:16 GMT
style_new.css
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/ 		86 KB
86 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
681d661a747c781563953a908b32028116c282f0f1a17c7e1bcfefe507a010ed

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
Last-Modified
Fri, 07 Feb 2020 16:43:56 GMT
Server
AmazonS3
x-amz-request-id
5C742E4E010D8EF9
ETag
"db98e07907cd2ee710c015e7107a09de"
X-Cache
Miss from cloudfront
Content-Type
text/css
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
87763
x-amz-id-2
QpdHJyWrJBq9SZgfolK78eTIa0ba4/u9ahxqx1kOGsB+TyXwJh+Zs+4t68l8kH/+AZdWemWSnOE=
X-Amz-Cf-Id
wxHTRQQQMqCapwIWFBAYjIDtAKd9HZ4pwq2XYjDvuaeZiUKmsLn6EA==
spinner.css
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/spinner.css
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
54f7c8623cf0f0cf760385a22a4a5d20db7b2e3dfaecaab38ddf25ace848b171

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 befe3b8553d90339ecf78e5d7cefa60b.cloudfront.net (CloudFront)
Last-Modified
Wed, 14 Feb 2018 10:07:16 GMT
Server
AmazonS3
x-amz-request-id
7BDCD5AD50E63FBA
ETag
"308609aca6938598a1390b47ec576e97"
X-Cache
Miss from cloudfront
Content-Type
text/css
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1295
x-amz-id-2
MIZY4LZKPdi1DPoOav5E5lbc3cIiifsYkj2ST/WsCcS3TK4QMT82rO+AUSShIcdwtGLgcomaXOU=
X-Amz-Cf-Id
z0O3J1g-8NYmG0sYtWmwiEvSW-MnIfr5cf1NXRg49THwEfopiCwGag==
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:20 GMT
access-control-allow-origin
*
etag
"1544639720"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
7050
balloon.min.css
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/ 		5 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/balloon.min.css
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4122f214f47bf170342826a86092121db1a8ac7cb3c0f899a1ede8b6b96f27c8

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
Last-Modified
Wed, 14 Feb 2018 10:07:16 GMT
Server
AmazonS3
x-amz-request-id
85F6CF7CA2075310
ETag
"acd37f0b3be30c6cefff2ed8117e5938"
X-Cache
Miss from cloudfront
Content-Type
text/css
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5489
x-amz-id-2
8JO/eielQV78WMaCdbO6kkAVhLMNvAF4sMA8lXmC0xnFcx7nJBCTUXtQFO2begMT+qsOWk1xXHU=
X-Amz-Cf-Id
EmZ-PUCYDEA2se2M1gj5OqBT0OtP32_9PLtr6ptI3_Xd4nv-WaeFMg==
jquery-3.4.1.js
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/ 		274 KB
274 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
Last-Modified
Wed, 28 Aug 2019 14:45:01 GMT
Server
AmazonS3
x-amz-request-id
23F9230B756FD857
ETag
"11c05eb286ed576526bf4543760785b9"
X-Cache
Miss from cloudfront
Content-Type
application/javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
280364
x-amz-id-2
lXjhe0qLu+1+rP0EUEGV5lbhCs8csBaowYdqSE4Y5P2juluLxMtZl/ZOHYrsoCYf7lcePn9+5Qc=
X-Amz-Cf-Id
3yyFSIyy2rQPsSsE8RJ7eBMw9GT3c_9w1xIgQrG1RUUiuRrJTIZW6g==
logic_new.js
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/scripts/ 		215 KB
216 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/scripts/logic_new.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9f24098543b58b30681e55c99319e594ecfb667630f1f7edca3a781e2b2e9e8f

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
Last-Modified
Mon, 24 Feb 2020 09:41:48 GMT
Server
AmazonS3
x-amz-request-id
CFB2D2B16B9EFA24
ETag
"2225345f1f5996fd43c73ff451578218"
X-Cache
Miss from cloudfront
Content-Type
application/javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
220229
x-amz-id-2
dZQ/SPuZAIUCm/h45Zd/zvZXq0X1bu5EfDX3Go9suH/I+8FT4tkfFQxrCJffLWDMpWWYI2AfTUQ=
X-Amz-Cf-Id
xNlnSFbBH-bmddSCKxuKw6G3lbJCfW2o1jv8PafCb3QQ3Odcc5Rc4Q==
md5.min.js
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/md5.min.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9265ea6ee06a36211ef80e33821b309020e5c40c972cf70a07f10577c0cce549

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
Last-Modified
Tue, 08 Oct 2019 09:23:31 GMT
Server
AmazonS3
x-amz-request-id
0FFD7ED7E9EDA602
ETag
"d42ff83c2d527cdab773855cfe523561"
X-Cache
Miss from cloudfront
Content-Type
application/javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3767
x-amz-id-2
7Nu2d+rOe6qCMoxopnzn43r5WzoyfWgDM1WjOz/bT0UkBZIwvFgdZdDS9NSiiEtBSTaAtsVqefs=
X-Amz-Cf-Id
RXzUHS3uh6x3lvTLzf-2p4P-mDbwm8gtexLgyLnw5wKbzY9uBd-ofQ==
rlm_stat.js
rltools.de/rlm_analytics/scripts/ 		14 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rltools.de/rlm_analytics/scripts/rlm_stat.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
f5c804ef98b68fbd56b6ddbd4768123021127cdb689c578996e08d449141ceae

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
last-modified
Fri, 21 Feb 2020 14:20:31 GMT
server
Apache
etag
"369d-59f16b9553225-gzip"
vary
Accept-Encoding
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3101
adressDeOrt.js
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/scripts/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/scripts/adressDeOrt.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
535d10090cc257449cff69796471934c76205a9daf4b4de4b3bb1d8fee1e9ebb

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
Last-Modified
Tue, 08 Oct 2019 12:56:05 GMT
Server
AmazonS3
x-amz-request-id
CC28DBE949943AD6
ETag
"57ec68f670da706ba942e3af1ac19f2c"
X-Cache
Miss from cloudfront
Content-Type
application/javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9071
x-amz-id-2
Ni1g+nf/TvMh/qR7QXoTpq4EPDR6+0IAzJ5ClajLDY+13Z7B867+RNw6SeRff22S7cFHLanRLCU=
X-Amz-Cf-Id
ikHl3sTkhhOhd3JXILpDxIoevGExTo_PJXv_lK9wUGw1wNLDI6Iaog==
moment.min.js
www.rlcontrol.de/ftp/flexblocks/scripts/lib/ 		50 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rlcontrol.de/ftp/flexblocks/scripts/lib/moment.min.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
130.255.79.215 , Germany, ASN29141 (BKVG-AS, DE),
Reverse DNS
server-redlemon01.virtualhosts.de
Software
Apache /
Resource Hash
0aeb4ecf1091b9c52c9fa0ba4dc118b1abafbd88a51278935e574f6baff0bb49

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
last-modified
Tue, 24 Jul 2018 14:05:29 GMT
server
Apache
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
16804
expires
Wed, 25 Mar 2020 10:45:16 GMT
piwik.js
rltools.de/matomo/ 		67 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rltools.de/matomo/piwik.js
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
ad2c5ecd660a0a5dff000926a75fe4b13cafa7849ad1e85c36676f1a120e013a

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
last-modified
Tue, 11 Feb 2020 09:44:29 GMT
server
Apache
etag
"10d53-59e49b3cdf0da-gzip"
vary
Accept-Encoding
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
23351
rlm_stat.php
www.rltools.de/rlm_analytics/ 		17 B
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
34fd5e4f888964acd30ad04729781398c7f68f7dd2ff027b0937fc3e468f4cd1

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
outer_slice_top.png
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/ 		136 B
713 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/outer_slice_top.png
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bf37f0c405389fda13867faa69cf36ffe1b8764f3e0460f2caade056a36d2483

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
Last-Modified
Wed, 14 Feb 2018 10:07:18 GMT
Server
AmazonS3
x-amz-request-id
E0A27E4F10E52ED3
ETag
"b3cd71c3db91f48dfd8b00d472022dc0"
X-Cache
Miss from cloudfront
Content-Type
image/png
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
136
x-amz-id-2
z6OgsRQxca+lg5xWjW1KwBZdGqMIeZyQKVB+1gR3ASgr0N/PVc+F63y9jf607yIBnFD9NOufisQ=
X-Amz-Cf-Id
gkvYg5KpXD-JeHq4pf4ZvAT7_3rIRJrcjy-NGqtFMdnfxolrwhPVWg==
outer_slice_bottom.png
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/ 		143 B
720 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/outer_slice_bottom.png
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c86ac9a90aafd6aa025eeb2d1d6de20c03df782ef151c9d2515b23407768f134

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
Last-Modified
Wed, 14 Feb 2018 10:07:18 GMT
Server
AmazonS3
x-amz-request-id
236F87AA07454681
ETag
"cdfb089c7a2ffb19106f0553ad115375"
X-Cache
Miss from cloudfront
Content-Type
image/png
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
143
x-amz-id-2
mx5NPU+R21h8i5u3WEVs6M/YFGTAaMMQ5JbEBf16sk4Qv1wxfO60w42npB1n/GdW+GPWxxrJiIg=
X-Amz-Cf-Id
GbUCzHnUq6M7RiPQ1PEGFvcW73xorRD5hgRpbWZImpF1qMqEdt9_oA==
Aileron-Regular.woff
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/Aileron-Regular.woff
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6d6ec731c7579bb3420bdd0ec8ac80682ac44b1fbe1ffa8429b736e644f2be69

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
Origin
https://khvan.de
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
x-amz-request-id
B872F2BFE93D4C97
X-Cache
Miss from cloudfront
Connection
keep-alive
Content-Length
21776
x-amz-id-2
80KFnJGGuXi3nUWwOXvM7yVtCq7Z3o4O3JlvhN5aa0Qg9V6iH/MWbb/KfofJp0Fdt6PX/U1uJuQ=
Last-Modified
Wed, 14 Feb 2018 10:07:17 GMT
Server
AmazonS3
ETag
"4309f5e6504ab4404a1c909a5ef8457f"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
ISTJgqG1_STgFOZeaTpLQv1yIGgQ80gdT8tUioPfz9XC8a4U3RwTUA==
Aileron-Bold.woff
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/Aileron-Bold.woff
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ac249b9af121f1a9bf29b7c611b5986a5f1088da276a72a1e96b77fec1020aad

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
Origin
https://khvan.de
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
x-amz-request-id
29CB6758C846615F
X-Cache
Miss from cloudfront
Connection
keep-alive
Content-Length
23108
x-amz-id-2
JGL/nFY8VTiJlstfmZmWzSePxrkXo6yF4Vbu6l9ToYaYdwSIxcdifip7X7zo5pfv3M498/ge5+s=
Last-Modified
Wed, 14 Feb 2018 10:07:17 GMT
Server
AmazonS3
ETag
"317ed94a878c8d8ea413f51e575513f4"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
64mFBk8AkVQXEiUfitJL74B0yTDotcIFJOYu9w66f3qxc3Ru45FmCQ==
Candal.woff
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/Candal.woff
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
80a2aa3ffeb789ffaa34b6a0b738e7baed24396c4656dd1224c8c0ba0f4ddf84

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
Origin
https://khvan.de
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
x-amz-request-id
005CD7B128FBB894
X-Cache
Miss from cloudfront
Connection
keep-alive
Content-Length
25000
x-amz-id-2
alTxzely+mwlAFVhwgXLvE+0uim7hkfmq6iw8MML6FXmAyStSfRqpaSasF/i/AEzrsvAefZoWlM=
Last-Modified
Wed, 14 Feb 2018 10:07:18 GMT
Server
AmazonS3
ETag
"e29c6ae99d1f2dc8d6a607b46c082b74"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
6AQSbTRgekmh2jiyqZbjsWaWEw5usvf2k8MvWg2csS-zWKv6qA0tGg==
resource.php
khvan.de/ftp/flexfancy/services/ 		1 KB
643 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://khvan.de/ftp/flexfancy/services/resource.php?rlmset=samsung_s20_de
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
130.255.79.215 , Germany, ASN29141 (BKVG-AS, DE),
Reverse DNS
server-redlemon01.virtualhosts.de
Software
Apache /
Resource Hash
5c2e9b9ca79882a98d061c7deab0a44ed0846237f2a72ac396dc5aeb9b065c40

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
server
Apache
content-length
590
vary
Accept-Encoding,User-Agent
content-type
application/json; charset=utf-8
piwik.php
rltools.de/matomo/ 		43 B
81 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rltools.de/matomo/piwik.php?action_name=&idsite=1&rec=1&r=223924&h=11&m=45&s=16&url=https%3A%2F%2Fkhvan.de%2Fcampaign_804.html%3FcoyoteAffiliTokenId%3D367875034%26rlmset%3Dsamsung_s20_de%26&urlref=https%3A%2F%2Fck.gl2022.info%2Fr%3Furl%3Dhttps%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de%26redirect_back%3D%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1&_id=55104adb629059cd&_idts=1582541117&_idvc=1&_idn=0&_refts=1582541117&_viewts=1582541117&_ref=https%3A%2F%2Fck.gl2022.info%2Fr%3Furl%3Dhttps%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de%26redirect_back%3D%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1&send_image=1&cookie=1&res=1600x1200&dimension1=231&dimension2=adressdata1&dimension3=samsung_s20_de&dimension4=gl15825411166e1dc5e53a93c0f619990138325&dimension5=4063&dimension13=804&gt_ms=223&pv_id=SDYhCN
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:16 GMT
cache-control
no-store
server
Apache
content-type
image/gif
Aileron-Heavy.woff
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/fonts/Aileron-Heavy.woff
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
67bb015ac96fd86bc355f22829c7c4e7ed5c288176c2ec013c356eef07b1ae87

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
Origin
https://khvan.de
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
x-amz-request-id
B28F6A176298854C
X-Cache
Miss from cloudfront
Connection
keep-alive
Content-Length
23280
x-amz-id-2
CSeu0BSEe/4u9D4Bpcmx38qdOi+xeq9152RCXhJkh+N854+SLYex9AsVcBgaQtpNDJVpbbJb+28=
Last-Modified
Wed, 14 Feb 2018 10:07:17 GMT
Server
AmazonS3
ETag
"977a8badf138ba0183b618103fbea86a"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
9M8JqDUJbEXXeJMv6J8mvuwYLSHp7YT66Cj1OyGZrCqpkGVK6XXNyg==
error.png
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/gui/ 		722 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/gui/error.png
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ca519a3b004d9a512220a2faf88bb8ca16f177dad8d0b5bbdb4bbffa84a7a867

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
Last-Modified
Wed, 14 Feb 2018 10:07:28 GMT
Server
AmazonS3
x-amz-request-id
41D85596558E39CF
ETag
"80061b49575e9865f377e8c4028331ef"
X-Cache
Miss from cloudfront
Content-Type
image/png
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
722
x-amz-id-2
TYAeQzfYkE5p3cPBc6VDvKutKdrKPsGNHrH0FFvLwEdLkxvNF3NPQhIaAbrm4N+zmIIprQrU2So=
X-Amz-Cf-Id
545p72zaPor55IBAzwNC4uWcKpvVovLLVEMyf2EKRtKcdvKbMj5o1w==
checkbox.png
rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/gui/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/images/gui/checkbox.png
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.16 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-16.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d59fddd512526f62fc744ca6b79c807d3d972795686d00b6b87e69e706546e77

Request headers

Referer
https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/css/style_new.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Mon, 24 Feb 2020 10:45:17 GMT
Via
1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
Last-Modified
Mon, 04 Jun 2018 15:08:55 GMT
Server
AmazonS3
x-amz-request-id
4B2D870359BFC82A
ETag
"46b1a02714406cd093dfe9a7af57997d"
X-Cache
Miss from cloudfront
Content-Type
image/png
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1509
x-amz-id-2
tZAGr6s0/EypRY1yVdGSXFhgJq/xZkrjQ4BNo4E0bustJEt98nSZ/4Mg3ghI5a7OrYbpN1NY5oI=
X-Amz-Cf-Id
DESLQDuFMyadDiJsftp_GmzIlx7WU5rfKfOZfU4Tw1cAaal8H3XxLA==
s20allcolours.png
khvan.de/ftp/flexfancy/build/promotion/ 		147 KB
148 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khvan.de/ftp/flexfancy/build/promotion/s20allcolours.png
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
130.255.79.215 , Germany, ASN29141 (BKVG-AS, DE),
Reverse DNS
server-redlemon01.virtualhosts.de
Software
Apache /
Resource Hash
07619cdfe4ad78e7311d4fa008d98ff6332b6e3cfc20ad9d54ef4b93d9cc27cd

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
last-modified
Fri, 14 Feb 2020 13:54:54 GMT
server
Apache
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
150566
expires
Wed, 25 Mar 2020 10:45:16 GMT
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: khvan.de
URL: https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://khvan.de
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:36:18 GMT
access-control-allow-origin
*
etag
"1544639778"
vary
Accept-Encoding
x-cache
HIT
content-type
font/woff2
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
77171
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
38 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
38 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:16 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
piwik.php
rltools.de/matomo/ 		43 B
89 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rltools.de/matomo/piwik.php?e_c=Info&e_a=store_page_name&e_n=adressdata1&idsite=1&rec=1&r=327619&h=11&m=45&s=16&url=https%3A%2F%2Fkhvan.de%2Fcampaign_804.html%3FcoyoteAffiliTokenId%3D367875034%26rlmset%3Dsamsung_s20_de%26&urlref=https%3A%2F%2Fck.gl2022.info%2Fr%3Furl%3Dhttps%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de%26redirect_back%3D%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1&_id=55104adb629059cd&_idts=1582541117&_idvc=1&_idn=0&_refts=1582541117&_viewts=1582541117&_ref=https%3A%2F%2Fck.gl2022.info%2Fr%3Furl%3Dhttps%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de%26redirect_back%3D%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1&send_image=1&cookie=1&res=1600x1200&dimension1=231&dimension2=adressdata1&dimension3=samsung_s20_de&dimension4=gl15825411166e1dc5e53a93c0f619990138325&dimension5=4063&dimension13=804&gt_ms=223&pv_id=SDYhCN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Mon, 24 Feb 2020 10:45:17 GMT
cache-control
no-store
server
Apache
content-type
image/gif
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:18 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:19 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:20 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:21 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:22 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:23 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:24 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With
rlm_stat.php
www.rltools.de/rlm_analytics/ 		12 B
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rltools.de/rlm_analytics/rlm_stat.php
Requested by
Host: rlmgws-data.s3-accelerate.amazonaws.com
URL: https://rlmgws-data.s3-accelerate.amazonaws.com/flexfancy/lib/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.13.135.110 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd13604.kasserver.com
Software
Apache /
Resource Hash
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Accept
*/*
Referer
https://khvan.de/campaign_804.html?coyoteAffiliTokenId=367875034&rlmset=samsung_s20_de&
Origin
https://khvan.de
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 24 Feb 2020 10:45:25 GMT
server
Apache
status
200
access-control-max-age
1000
access-control-allow-methods
GET, PUT, POST, DELETE, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization, X-Requested-With

Verdicts & Comments Add Verdict or Comment

138 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| OneSignal object| _paq function| $ function| jQuery boolean| secondCoregStage number| totalCoregCount number| clickedCoregCount number| coregCount boolean| coregsUncovered boolean| coregSlider object| currentCoregParent number| lastPercentage number| currentPercentage object| percentInterval number| weightedCoregCount number| initProgress string| prepageProcessingMessage function| OnCoregDoiPage function| OnFirstRegPage function| OnSecondRegPage function| OnCoregPage function| OnPromoPage1 function| OnThankYouPage function| SetPromotionImage function| set_progress function| apply_coreg_highlights function| transform_tile_coregs function| DrawProgressIndicator function| DecodeBase64 function| HexDigitToDec function| SimpleHexToDec function| HexColorToRgb function| IsEnglishVersion function| GetLocale object| messageStrings function| Translate function| GetCookie function| SetCookie function| FinishPrepageSection function| InitPrepageQuiz string| originalContinueButtonLabel string| originalPromoImage function| InitPrepageImageSelector function| PadNumber function| FormatClockTime function| RunCountdownClock function| UpdateUserProgress function| InitTextSwitchControls function| show_info_popup function| BrandbueroBuyButtonCallback function| apply_frank_coreg_changes function| InRange function| CheckMaxAge function| FP_ShowMessage function| FP_MessageBoxIsVisible function| apply_fisherprice_coreg_changes function| apply_o2_coreg_changes function| assign_coreg_indices function| show_first_coreg function| get_coreg_container_by_index function| show_next_coreg function| hide_coreg_and_show_next function| InitGui function| ShowMessage function| ShowPromoConsentMessage function| InputValidator object| inputValidators function| VerifyInputFields function| ShowSecondRegPage number| agbNum number| unknownAttemptCount number| maxUnknownAttemptCount boolean| emailErrorShown string| textInputColor boolean| skipSecondRegPage function| ShowKickboxError function| HideKickboxErrorMessage function| IsValidTonlineAddress function| SetupContinueButton function| SetupPromoConsentInfoWindow function| AssignInputProxies function| AttachShowSponsorsHandlers function| SetupSponsorsList function| AssignInputValidator function| AssignInputValidators function| CreateDefaultConfig function| ConfigureContinueButton function| DrawCoregProgressShape number| currentProgressStage number| targetProgressWidth object| coregProgressInterval function| DrawCoregProgressBar number| currentCoregStep function| UpdateCoregProgress function| GetCoregCount function| GetNextCoregId function| FinalizeCoreg object| lastSelectedRadio boolean| blitzCoregClicked function| build_radio_buttons function| InitCoregs function| ConfigureSweepstake function| ConfigureSimplePage function| OnRegistrationPage function| OnRegistrationPage1 function| OnRegistrationPage2 function| InitSweepstake function| ApplyFazTweaks function| RebuildBlitzCoreg function| IsMobileBrowser function| showArrowHint function| ModifySpiegelCoreg function| ApplyAdjustments function| ShowCoregStoerer function| HideCoregStoerer function| SetupStoerer function| SetupNewProgressbar function| AssignInputCounterparts function| HighlightErrors function| add_coreg_images function| apply_agb_coreg_changes function| apply_selection_list_coreg_changes function| GetCoregIdFromElement function| md5 function| RlmStat number| globalStatisticJavaSciptFunctionsLoaded string| globalAjaxUrl function| setAjaxUrl function| moment function| CalcCalendarWeek number| calendarWeek object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log

5 Cookies

Domain/Path Name / Value
khvan.de/ Name: _pk_ses.1.e759
Value: 1
khvan.de/ Name: _pk_id.1.e759
Value: 55104adb629059cd.1582541117.1.1582541117.1582541117.
khvan.de/ Name: _pk_ref.1.e759
Value: %5B%22%22%2C%22%22%2C1582541117%2C%22https%3A%2F%2Fck.gl2022.info%2Fr%3Furl%3Dhttps%3A%2F%2Fwww.exklusive-preise.de%2Fde%2Cflexfancy%2Cresponsive_753.html%3FidPartner%3D231%26idCampaignAd%3D0%26subId%3Dgl15825411166e1dc5e53a93c0f619990138325%26subIdentifier%3D4063%26rlmset%3Dsamsung_s20_de%26redirect_back%3D%2F%2Fck.gl2022.info%2F66817%2F%3Fsubaffiliate_id%3D1631_4327%26session_id%3Dbdd8cb5c-56f2-11ea-98a9-06097625304a%26tt%3D1%22%5D
khvan.de/ Name: coyoteAffiliTokenId804
Value: 367875034
khvan.de/ Name: PHPSESSID
Value: 3497jqfd7qq3421v3hjb3g7bjj

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1)
Message:
OneSignal: Using fallback ES5 Stub for backwards compatibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.onesignal.com
ck.gl2022.info
clickmob.c0c.xyz
khvan.de
maxcdn.bootstrapcdn.com
rlmgws-data.s3-accelerate.amazonaws.com
rltools.de
warm.vulkan.casa
www.exklusive-preise.de
www.rlcontrol.de
www.rltools.de
130.255.79.215
143.204.201.16
198.143.165.220
2001:4de0:ac19::1:b:1a
2606:4700:3032::681f:5fd9
2606:4700:3035::681b:ae1d
2606:4700::6812:e134
85.13.135.110
03287280ffc2f50b1c9b477d00acb16fec7797d50e3a89a2dcb5589e36e413c0
07619cdfe4ad78e7311d4fa008d98ff6332b6e3cfc20ad9d54ef4b93d9cc27cd
0aeb4ecf1091b9c52c9fa0ba4dc118b1abafbd88a51278935e574f6baff0bb49
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
34fd5e4f888964acd30ad04729781398c7f68f7dd2ff027b0937fc3e468f4cd1
4122f214f47bf170342826a86092121db1a8ac7cb3c0f899a1ede8b6b96f27c8
41922036ecbd8f3b1a24cd30e2ca7dda793ce1b4d7acfcf262b8b5b5b1f3121f
445d1944c0b23f259e215947dcc27df6d116a5a0faf4551324cb813a05d550d1
535d10090cc257449cff69796471934c76205a9daf4b4de4b3bb1d8fee1e9ebb
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54f7c8623cf0f0cf760385a22a4a5d20db7b2e3dfaecaab38ddf25ace848b171
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
5c2e9b9ca79882a98d061c7deab0a44ed0846237f2a72ac396dc5aeb9b065c40
67bb015ac96fd86bc355f22829c7c4e7ed5c288176c2ec013c356eef07b1ae87
681d661a747c781563953a908b32028116c282f0f1a17c7e1bcfefe507a010ed
6d6ec731c7579bb3420bdd0ec8ac80682ac44b1fbe1ffa8429b736e644f2be69
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
80a2aa3ffeb789ffaa34b6a0b738e7baed24396c4656dd1224c8c0ba0f4ddf84
9265ea6ee06a36211ef80e33821b309020e5c40c972cf70a07f10577c0cce549
9d6a1b50c1cb98a750dd6dfbc4379bfdd131e90d8fc00bb712f3b5742dee3008
9f24098543b58b30681e55c99319e594ecfb667630f1f7edca3a781e2b2e9e8f
ac249b9af121f1a9bf29b7c611b5986a5f1088da276a72a1e96b77fec1020aad
ad2c5ecd660a0a5dff000926a75fe4b13cafa7849ad1e85c36676f1a120e013a
be968f9a0b1f2d96d7a7260ed8d0ebba1f7921a003b4a782211f262dc871e761
bf37f0c405389fda13867faa69cf36ffe1b8764f3e0460f2caade056a36d2483
c86ac9a90aafd6aa025eeb2d1d6de20c03df782ef151c9d2515b23407768f134
ca519a3b004d9a512220a2faf88bb8ca16f177dad8d0b5bbdb4bbffa84a7a867
d59fddd512526f62fc744ca6b79c807d3d972795686d00b6b87e69e706546e77
df43db046c15a835f3d0c7681fada63dbf48bbe8a5af2594d9686b1f45ee00c1
f5c804ef98b68fbd56b6ddbd4768123021127cdb689c578996e08d449141ceae