m.jampans.com Open in urlscan Pro
67.212.173.76 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://workplace.metrobank.com/
Effective URL:
https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2e43sc920f2&utm_campa...
Submission: On September 25 via api (September 25th 2024, 10:07:44 am UTC) from GB — Scanned from GB

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 10 domains to perform 15 HTTP transactions. The main IP is 67.212.173.76, located in United States and belongs to SINGLEHOP-LLC, US. The main domain is m.jampans.com.
TLS certificate: Issued by E6 on August 30th 2024. Valid for: 3 months.

This is the only time m.jampans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	185.53.177.52 185.53.177.52	61969 (TEAMINTER...) (TEAMINTERNET-AS)
1	2600:9000:225... 2600:9000:2250:f600:1d:4618:5c80:21	16509 (AMAZON-02) (AMAZON-02)
1	34.224.252.116 34.224.252.116	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.211.95.28 18.211.95.28	14618 (AMAZON-AES) (AMAZON-AES)
2 2	2600:9000:212... 2600:9000:2127:f000:f:5851:4840:93a1	16509 (AMAZON-02) (AMAZON-02)
2	13.32.121.11 13.32.121.11	16509 (AMAZON-02) (AMAZON-02)
3	157.90.33.122 157.90.33.122	24940 (HETZNER-AS) (HETZNER-AS)
2	157.90.33.72 157.90.33.72	24940 (HETZNER-AS) (HETZNER-AS)
1	67.212.173.76 67.212.173.76	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
15	8

4 185.53.177.52 (Germany)

ASN61969 (TEAMINTERNET-AS, DE)

workplace.metrobank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:f600:1d:4618:5c80:21 (United States)

ASN16509 (AMAZON-02, US)

d38psrni17bvxu.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.224.252.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-252-116.compute-1.amazonaws.com

fabri-qwi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.211.95.28 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-95-28.compute-1.amazonaws.com

cloth-jqq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:f000:f:5851:4840:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

trk.signupclicks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.121.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-11.fra60.r.cloudfront.net

allowclicks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.90.33.122 (Ismaning, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: sub3.1push.io

push-sdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.90.33.72 (Ismaning, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: sub2.1push.io

uidsync.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.212.173.76 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi

m.jampans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	metrobank.com workplace.metrobank.com	4 KB
3	push-sdk.com push-sdk.com — Cisco Umbrella Rank: 44321	16 KB
2	uidsync.net uidsync.net — Cisco Umbrella Rank: 44386	708 B
2	allowclicks.com allowclicks.com	3 KB
2	signupclicks.com 2 redirects trk.signupclicks.com	2 KB
1	jampans.com m.jampans.com	1 KB
1	cloth-jqq.com 1 redirects cloth-jqq.com — Cisco Umbrella Rank: 458240	1004 B
1	fabri-qwi.com fabri-qwi.com	3 KB
1	cloudfront.net d38psrni17bvxu.cloudfront.net	2 KB
0	bufferingvideos.com Failed bufferingvideos.com Failed
15	10

	Domain	Requested by
4	workplace.metrobank.com	d38psrni17bvxu.cloudfront.net workplace.metrobank.com
3	push-sdk.com	allowclicks.com push-sdk.com
2	uidsync.net	push-sdk.com
2	allowclicks.com	fabri-qwi.com
2	trk.signupclicks.com	2 redirects
1	m.jampans.com	allowclicks.com
1	cloth-jqq.com	1 redirects
1	fabri-qwi.com	workplace.metrobank.com
1	d38psrni17bvxu.cloudfront.net	workplace.metrobank.com
0	bufferingvideos.com Failed	m.jampans.com
15	10

This site contains no links.

Subject Issuer	Validity	Valid
zeropark.com Amazon RSA 2048 M02	`2024-06-11` - `2025-07-09`	a year	crt.sh
allowclicks.com Amazon RSA 2048 M03	`2024-07-06` - `2025-08-04`	a year	crt.sh
push-sdk.com R11	`2024-08-11` - `2024-11-09`	3 months	crt.sh
uidsync.net Sectigo RSA Domain Validation Secure Server CA	`2023-12-30` - `2025-01-29`	a year	crt.sh
m.jampans.com E6	`2024-08-30` - `2024-11-28`	3 months	crt.sh

This page contains 1 frames:

Frame: https://bufferingvideos.com/play/?camperid=sept89&campaign=sept89&device=Samsung%20SM-A205U&model=SM-A205U&country=GB&city=London&language=en-GB&cid=crpu1rtmjjbc73afgl0g&topic={topic}
Frame ID: 3E77C8A79D6486534821C305F7B52F0E
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading...

Page URL History Show full URLs

http://workplace.metrobank.com/ HTTP 307
https://workplace.metrobank.com/ HTTP 307
http://workplace.metrobank.com/ Page URL
http://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f... HTTP 307
https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f... Page URL
https://cloth-jqq.com/zclkredirect?visitid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&type=js&browserWid... HTTP 302
https://trk.signupclicks.com/zp-redirect?target=https%3A%2F%2Fallowclicks.com%2FeSKIwbedO70saJ%2F%3Ftd%3D... HTTP 302
https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sou... Page URL
https://trk.signupclicks.com/click HTTP 302
https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

15
Requests

53 %
HTTPS

22 %
IPv6

10
Domains

10
Subdomains

8
IPs

2
Countries

30 kB
Transfer

70 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://workplace.metrobank.com/ HTTP 307
https://workplace.metrobank.com/ HTTP 307
http://workplace.metrobank.com/ Page URL
http://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415 HTTP 307
https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415 Page URL
https://cloth-jqq.com/zclkredirect?visitid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&gpu=Intel%20Inc.%3B%20Intel%20Iris%20OpenGL%20Engine&timezone=UTC%2B01%3A00&timezoneName=Europe%2FLondon HTTP 302
https://trk.signupclicks.com/zp-redirect?target=https%3A%2F%2Fallowclicks.com%2FeSKIwbedO70saJ%2F%3Ftd%3Dtrk.signupclicks.com%26clickid%3Dwr171mi492b192e4jetb2jaq%26sourceid%3D00806162-39c8-49d9-a4e7-e1855fa4eec2%26cep%3DnPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU%26lptoken%3D17cd27352671065458f9&caid=00806162-39c8-49d9-a4e7-e1855fa4eec2&zpid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&cid=&rt=R&ts=1727258858868&hash=CT-t1D3fsg9NPztyTnRtSh0-OCFyv3MMqBwY8Wx1-9E HTTP 302
https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9 Page URL
https://trk.signupclicks.com/click HTTP 302
https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2e43sc920f2&utm_campaign=00806162-39c8-49d9-a4e7-e1855fa4eec2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://workplace.metrobank.com/ HTTP 307
https://workplace.metrobank.com/ HTTP 307
http://workplace.metrobank.com/

Request Chain 5

http://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415 HTTP 307
https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415

Request Chain 6

https://cloth-jqq.com/zclkredirect?visitid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&gpu=Intel%20Inc.%3B%20Intel%20Iris%20OpenGL%20Engine&timezone=UTC%2B01%3A00&timezoneName=Europe%2FLondon HTTP 302
https://trk.signupclicks.com/zp-redirect?target=https%3A%2F%2Fallowclicks.com%2FeSKIwbedO70saJ%2F%3Ftd%3Dtrk.signupclicks.com%26clickid%3Dwr171mi492b192e4jetb2jaq%26sourceid%3D00806162-39c8-49d9-a4e7-e1855fa4eec2%26cep%3DnPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU%26lptoken%3D17cd27352671065458f9&caid=00806162-39c8-49d9-a4e7-e1855fa4eec2&zpid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&cid=&rt=R&ts=1727258858868&hash=CT-t1D3fsg9NPztyTnRtSh0-OCFyv3MMqBwY8Wx1-9E HTTP 302
https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9

Request Chain 13

https://sizzletrak.com/click?key=f2cc57c9d9fe5e090b3e&subid=M7418520324032954395&pid=655-3e815c8z&partner_id=655 HTTP 307
https://bufferingvideos.com/play/?camperid=sept89&campaign=sept89&device=Samsung%20SM-A205U&model=SM-A205U&country=GB&city=London&language=en-GB&cid=crpu1rtmjjbc73afgl0g&topic={topic}

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
workplace.metrobank.com/
Redirect Chain

http://workplace.metrobank.com/
https://workplace.metrobank.com/
http://workplace.metrobank.com/

2 KB
2 KB

462ms
462ms

Document
text/html

185.53.177.52
TEAMINTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://workplace.metrobank.com/
Protocol: HTTP/1.1
Server: 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: 11493e10766928368d46bb31915f94e999b819fcfbda0de5b9d62a0a0ce3baf6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

Accept-CH: viewport-width dpr device-memory rtt downlink ect ua ua-full-version ua-platform ua-platform-version ua-arch ua-model ua-mobile
Accept-CH-Lifetime: 30
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 25 Sep 2024 10:07:36 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_P3NcUbHCUCoGRC9hFHyj6Ux1fWapwG1WqHdN0y5VqorNsn38pv5DUkQadNhuJEdbCpSrhEWgWSS46S50V6hQrA==
X-Buckets
X-Domain: metrobank.com
X-Language: english
X-Pcrew-Blocked-Reason
X-Pcrew-Ip-Organization: British Telecommunications PLC
X-Redirect: zeropark_zeroclick
X-Subdomain: workplace
X-Template: tpl_MobileCleanBlack_twoclick

Redirect headers

Location: http://workplace.metrobank.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK js3.js Show response
d38psrni17bvxu.cloudfront.net/scripts/ 1 KB
2 KB 125ms
117ms Script
application/javascript 2600:9000:2250:f600:1d:4618:5c80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3.js
Requested by: Host: workplace.metrobank.com
URL: http://workplace.metrobank.com/
Protocol: HTTP/1.1
Server: 2600:9000:2250:f600:1d:4618:5c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 036c94653e84e6078c087abeb3ac8804491d27b27938839ae3df42b31e2238d9

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: http://workplace.metrobank.com/

Response headers

ETag: "65fc1e7b-448"
Age: 30951
Connection: keep-alive
Via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 1096
X-Amz-Cf-Id: WwZy5nMcnFFG7VB-R4RlBqAMjVVzB1hdFN4RqQB72U0H6Zp2ey2OWQ==
Date: Wed, 25 Sep 2024 01:31:45 GMT
Content-Type: application/javascript
Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT
Server: nginx
X-Amz-Cf-Pop: FRA60-P2

GET
H/1.1 200
OK track.php Show response
workplace.metrobank.com/ 0
608 B 50ms
50ms XHR
text/html 185.53.177.52
TEAMINTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://workplace.metrobank.com/track.php?domain=metrobank.com&toggle=browserjs&uid=MTcyNzI1ODg1Ni4xODUzOmJkNzY1YzQ3NTBlOTcyMDUzNTlkYzA1ZTE4ZjAwNzcwYzllNWMxOTY4NTUyYzdhYjZlYTE0NTI5OGM3ZmNiZDg6NjZmM2UwZTgyZDNlNw%3D%3D
Requested by: Host: d38psrni17bvxu.cloudfront.net
URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3.js
Protocol: HTTP/1.1
Server: 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: http://workplace.metrobank.com/

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Connection: keep-alive
Accept-CH-Lifetime: 30
X-Custom-Track: browserjs
Access-Control-Allow-Origin: *
Date: Wed, 25 Sep 2024 10:07:36 GMT
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: nginx

GET
H/1.1 201
Created ls.php
workplace.metrobank.com/ 16 B
906 B 55ms
55ms XHR
text/javascript 185.53.177.52
TEAMINTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://workplace.metrobank.com/ls.php?t=66f3e0e8&token=5108a6f74782f49c62d4f13167aab20f6bc62096
Requested by: Host: workplace.metrobank.com
URL: http://workplace.metrobank.com/
Protocol: HTTP/1.1
Server: 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: http://workplace.metrobank.com/

Response headers

Transfer-Encoding: chunked
Access-Control-Max-Age: 86400
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Connection: keep-alive
Access-Control-Allow-Methods: POST, OPTIONS
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_GZEzc26XEkaj7Dd7r4uORS4r34v8gpPLm+M2cXdDi2aUzMHUdoniaL0fid1n6cJD6crhUFNgJdrOjWj2+XKv7g==
Accept-CH-Lifetime: 30
X-Log-Success: 66f3e0e8a5d675eb1009e904
Access-Control-Allow-Origin
Date: Wed, 25 Sep 2024 10:07:36 GMT
Content-Type: text/javascript;charset=UTF-8
Charset: utf-8
Server: nginx

GET
H/1.1 200
OK track.php Show response
workplace.metrobank.com/ 0
623 B 158ms
150ms XHR
text/html 185.53.177.52
TEAMINTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://workplace.metrobank.com/track.php?click=d7d5931cb96cb18c6819ee1f8830d4887a0e7dad&domain=metrobank.com&uid=MTcyNzI1ODg1Ni4xODUzOmJkNzY1YzQ3NTBlOTcyMDUzNTlkYzA1ZTE4ZjAwNzcwYzllNWMxOTY4NTUyYzdhYjZlYTE0NTI5OGM3ZmNiZDg6NjZmM2UwZTgyZDNlNw%3D%3D&ts=fE1vYmlsZUNsZWFuQmxhY2t8fDQ3OWMwfHx8fHx8fDY2ZjNlMGU4MmQzOWV8fHwxNzI3MjU4ODU2LjU4NjR8NTY2M2Q0NzYzZWUzZTBlZTc1OWQ1ZjkwZWQ5MDRkNDI3MmZlZGYzMXx8fHx8MXx8MHwwfHx8fDF8fHx8fDB8MHx8fHx8fHx8fHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDUxMDhhNmY3NDc4MmY0OWM2MmQ0ZjEzMTY3YWFiMjBmNmJjNjIwOTZ8MHx8MHwwfHx8&kw=&search=&pcat=&bucket=&clientID=&adtest=off
Requested by: Host: d38psrni17bvxu.cloudfront.net
URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3.js
Protocol: HTTP/1.1
Server: 185.53.177.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: http://workplace.metrobank.com/

Response headers

Transfer-Encoding: chunked
X-View-Match: true
Content-Encoding: gzip
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Connection: keep-alive
Accept-CH-Lifetime: 30
X-Custom-Track: none
Access-Control-Allow-Origin: *
Date: Wed, 25 Sep 2024 10:07:37 GMT
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: nginx

GET
H2

200

85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d Show response
fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/
Redirect Chain

http://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415
https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415

3 KB
3 KB

368ms
104ms

Document
text/html

34.224.252.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415

Requested by

Host: workplace.metrobank.com
URL: http://workplace.metrobank.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.252.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-224-252-116.compute-1.amazonaws.com

Software

Resource Hash

929d8c5e5165eed2afb026df258fee3bffbd1e3b50f8bb08d798f32f2d9f29b2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Referer: http://workplace.metrobank.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

access-control-allow-headers: X-Requested-With,Content-Type
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 3088
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
content-type: text/html;charset=UTF-8
date: Wed, 25 Sep 2024 10:07:37 GMT

Redirect headers

Location: https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415
Non-Authoritative-Reason: HttpsUpgrades

GET
H2

200

/ Show response
allowclicks.com/eSKIwbedO70saJ/
Redirect Chain

https://cloth-jqq.com/zclkredirect?visitid=fd2e96b0-7b25-11ef-84f3-0affc599a3af&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&gpu=Intel%20Inc.%3B%20Intel...
https://trk.signupclicks.com/zp-redirect?target=https%3A%2F%2Fallowclicks.com%2FeSKIwbedO70saJ%2F%3Ftd%3Dtrk.signupclicks.com%26clickid%3Dwr171mi492b192e4jetb2jaq%26sourceid%3D00806162-39c8-49d9-a4...
https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIu...

9 KB
2 KB

623ms
59ms

Document
text/html

13.32.121.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9
Requested by: Host: fabri-qwi.com
URL: https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 750a916feb9dc4594b4c3334879b854590a5c6603d5ab6caba89cc52fa609b95

Request headers

Referer: https://fabri-qwi.com/zclkvisitor/fd2e96b0-7b25-11ef-84f3-0affc599a3af/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=f4f6d140-3914-11ef-bced-0affd04c9415
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

age: 22277
content-encoding: br
content-type: text/html
date: Wed, 25 Sep 2024 08:57:21 GMT
etag: W/"bc5f0821283edcde4a44299b6be17a13"
last-modified: Fri, 14 Jun 2024 11:38:18 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 ed4565467c6c9847b6a3fcb6cec799e4.cloudfront.net (CloudFront)
x-amz-cf-id: WHvkktM-iVMqhEFlMK9dTXOMH9Qul5qt6ruxHab8cFCO1pDFEDFZaw==
x-amz-cf-pop: FRA60-P1
x-cache: Hit from cloudfront

Redirect headers

cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 0
date: Wed, 25 Sep 2024 10:07:39 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9
pragma: no-cache
server: nginx
via: 1.1 9b9ab8e6e595847652a9158c684a8926.cloudfront.net (CloudFront)
x-amz-cf-id: RMMmMRi0J2sSZ2X6J_-BAbVk_ofGPfnjgKuqHQVunevNdPotq_JRRg==
x-amz-cf-pop: PRG50-C1
x-cache: Miss from cloudfront

GET
H2 200 sdk.js Show response
push-sdk.com/f/ 52 KB
15 KB 406ms
49ms Script
application/javascript 157.90.33.122
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://push-sdk.com/f/sdk.js?z=1222145
Requested by: Host: allowclicks.com
URL: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 157.90.33.122 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sub3.1push.io
Software: Angie /
Resource Hash: 7a54a48535e98ca46d1275d906a69cb3a95a5026a5034ef300ec56318155d38e

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: https://allowclicks.com/

Response headers

cache-control: no-cache, max-age=0, must-revalidate, proxy-revalidate
content-length: 15349
content-encoding: gzip
date: Wed, 25 Sep 2024 10:07:40 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: Angie

POST
H2 200 event
push-sdk.com/ 0
527 B 146ms
144ms Ping
text/plain 157.90.33.122
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://push-sdk.com/event?z=1222145
Requested by: Host: push-sdk.com
URL: https://push-sdk.com/f/sdk.js?z=1222145
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 157.90.33.122 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sub3.1push.io
Software: Angie /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type: text/plain;charset=UTF-8
Referer: https://allowclicks.com/

Response headers

access-control-expose-headers: Authorization
cache-control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 11 Jan 1994 00:00:00 GMT
access-control-allow-origin: https://allowclicks.com
content-length: 0
date: Wed, 25 Sep 2024 10:07:40 GMT
server: Angie
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token

GET
H2 404 favicon.ico
allowclicks.com/ 346 B
593 B 157ms
157ms Other
text/html 13.32.121.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://allowclicks.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5869e789d63920a8a1eb403f0357624e30d0bf84ccc156de43f0e7879ec1e6c1

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9

Response headers

via: 1.1 ed4565467c6c9847b6a3fcb6cec799e4.cloudfront.net (CloudFront)
x-cache: Error from cloudfront
content-length: 346
x-amz-cf-id: nb1yX6O6iSPANDr61KMl2314cz5UTbJnZcfrsaz9eYXVDlUConhejQ==
date: Wed, 25 Sep 2024 10:07:40 GMT
content-type: text/html; charset=utf-8
x-amz-cf-pop: FRA60-P1
server: AmazonS3

OPTIONS
H2 204 sync
uidsync.net/ 0
0 273ms
124ms Preflight 157.90.33.72
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://uidsync.net/sync?user_id=34G4CJczKwu95muU2gUs0A
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 157.90.33.72 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sub2.1push.io
Software: Angie /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://allowclicks.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://allowclicks.com
access-control-expose-headers: Authorization
cache-control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
date: Wed, 25 Sep 2024 10:07:40 GMT
expires: Tue, 11 Jan 1994 00:00:00 GMT
pragma: no-cache
server: Angie

GET
H2 200 sync Show response
uidsync.net/ 62 B
708 B 214ms
66ms Fetch
application/json 157.90.33.72
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://uidsync.net/sync?user_id=34G4CJczKwu95muU2gUs0A
Requested by: Host: push-sdk.com
URL: https://push-sdk.com/f/sdk.js?z=1222145
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 157.90.33.72 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sub2.1push.io
Software: Angie /
Resource Hash: f47c83c18af0a7acfea51aaf62526525f5335797934b797c0e8da117350270c2

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type: application/json
Referer: https://allowclicks.com/

Response headers

access-control-expose-headers: Authorization
cache-control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 11 Jan 1994 00:00:00 GMT
access-control-allow-origin: https://allowclicks.com
content-length: 62
date: Wed, 25 Sep 2024 10:07:40 GMT
content-type: application/json; charset=utf-8
server: Angie
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token

POST
H2 200 event
push-sdk.com/ 0
528 B 196ms
62ms Ping
text/plain 157.90.33.122
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://push-sdk.com/event?z=1222145
Requested by: Host: push-sdk.com
URL: https://push-sdk.com/f/sdk.js?z=1222145
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 157.90.33.122 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sub3.1push.io
Software: Angie /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type: text/plain;charset=UTF-8
Referer: https://allowclicks.com/

Response headers

access-control-expose-headers: Authorization
cache-control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 11 Jan 1994 00:00:00 GMT
access-control-allow-origin: https://allowclicks.com
content-length: 0
date: Wed, 25 Sep 2024 10:07:41 GMT
server: Angie
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token

GET
H2

200

Primary Request / Show response
m.jampans.com/
Redirect Chain

https://trk.signupclicks.com/click
https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2e43sc920f2&utm_campaign=00806162-39c8-49d9-a4e7-e1855fa4eec2

2 KB
1 KB

828ms
477ms

Document
text/html

67.212.173.76
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2e43sc920f2&utm_campaign=00806162-39c8-49d9-a4e7-e1855fa4eec2

Requested by

Host: allowclicks.com
URL: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

67.212.173.76 , United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx /

Resource Hash

788238b95385c1e17b4899bce937ab08e52a28ab2862febdca4514c85a971122

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://allowclicks.com/eSKIwbedO70saJ/?td=trk.signupclicks.com&clickid=wr171mi492b192e4jetb2jaq&sourceid=00806162-39c8-49d9-a4e7-e1855fa4eec2&cep=nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU&lptoken=17cd27352671065458f9#
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
alt-svc: h3=":443"; ma=604800; persist=1
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 25 Sep 2024 10:07:42 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 0
date: Wed, 25 Sep 2024 10:07:41 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://m.jampans.com/?utm_medium=bdc3ee0a6c8bbf8d5d237f2140c351143971df2a&np=2&cid=d8ou6vc67vnuo2e43sc920f2&utm_campaign=00806162-39c8-49d9-a4e7-e1855fa4eec2
pragma: no-cache
server: nginx
via: 1.1 9b9ab8e6e595847652a9158c684a8926.cloudfront.net (CloudFront)
x-amz-cf-id: yi9HU5T3TcZdvaW9qHYSScAVxM7uAm80qf8oUKllV1dRzL_3RlPokg==
x-amz-cf-pop: PRG50-C1
x-cache: Miss from cloudfront

GET

/
bufferingvideos.com/play/
Redirect Chain

https://sizzletrak.com/click?key=f2cc57c9d9fe5e090b3e&subid=M7418520324032954395&pid=655-3e815c8z&partner_id=655
https://bufferingvideos.com/play/?camperid=sept89&campaign=sept89&device=Samsung%20SM-A205U&model=SM-A205U&country=GB&city=London&language=en-GB&cid=crpu1rtmjjbc73afgl0g&topic={topic}

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bufferingvideos.com
URL: https://bufferingvideos.com/play/?camperid=sept89&campaign=sept89&device=Samsung%20SM-A205U&model=SM-A205U&country=GB&city=London&language=en-GB&cid=crpu1rtmjjbc73afgl0g&topic={topic}

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.trk.signupclicks.com/	1970-01-20 23:49:05	Name: cep-v4 Value: nPym-FdSNm1kOwJ7PMgGFn2RZ0pWQjczUmjL4BDyzlVcHI1BIumS2APyeXF40H022vKsdcInhFR96p0I26HB9c5P34ur5-JHYNce1lforpiL86KvdbsgY3Ky8FRcQ1trqDIqvm2W9EA5RUIJPzZ2cvPl0TvUSkYR2Z81TJewnDwT1Gp9UwdnkwxIMSc6tNHcqzCbk-bU_igdsB5JAnkCrXuCXbW345kWm-SmbSeecxZYmUCziHzxPv_VAwbFEfQBzHBD4x8lJJ1smINN67jDR6rqR69kbpe74pZMMXdMaIJ604fIGl6CTbegUIJer7rhMjdnZfdU528wLScPLSxewLL1aNH40gwpMokQZqhCX57xu9JJyLZ3U_8JqF1HFzyBUkuPCY8Nthhq1EmhC0eAJ8yszIoHcwufWDVxqT-BnqYdnENgEvd4BkMG90PvFKoCTymiGjE1fJSaBPUxtJ0QedFTAL-HE7gFhsHg8MdTsauPSnv2Qdf-KddIkNH-URUDtCkvk6BUrCT7CKAsPxFGINxocRjdrA9QvdJzXG92ZDU
uidsync.net/	1970-01-21 08:33:14	Name: rauid Value: 34G4CJczKwu95muU2gUs0A
.trk.signupclicks.com/	1970-01-21 08:33:14	Name: cc-v4 Value: Szaq1VuCOzRdIX4gT7PEKR9GTjVDl%2FuEWMjqlW3ira5SdbLy6RUobWFWEph4lyY0FajZ5NGBVPg%2BayK1Yvq1IGgvh5oFVqpB9Lr7SCOFhbK1XMHdRMQ7SN%2Bv%2FxovRI30K1P616S0YxroJTC9k9fmxg%3D%3D
.trk.signupclicks.com/	1970-01-20 23:49:05	Name: 00806162-39c8-49d9-a4e7-e1855fa4eec2-clk-v4 Value: 00806162-39c8-49d9-a4e7-e1855fa4eec2
.trk.signupclicks.com/	1970-01-20 23:49:05	Name: 00806162-39c8-49d9-a4e7-e1855fa4eec2-v4 Value: bVPKRSZsTm2DvKHfmmhGz-Zkjzl-E7uF7F4qrdkTPOY
sizzletrak.com/	1970-01-21 08:33:14	Name: uclick Value: nL/fkFZeMdk11OXxbGCYtBLDVHIcVSNIsn5BzQxcKvqrqQ2qXJIE8i+m57rabP9c0/QKbA==
sizzletrak.com/	1970-01-21 08:33:14	Name: bcid Value: crpu1rtmjjbc73afgl0g
sizzletrak.com/	1970-01-21 08:33:14	Name: cid Value: crpu1rtmjjbc73afgl0g

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://allowclicks.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

allowclicks.com
bufferingvideos.com
cloth-jqq.com
d38psrni17bvxu.cloudfront.net
fabri-qwi.com
m.jampans.com
push-sdk.com
trk.signupclicks.com
uidsync.net
workplace.metrobank.com
bufferingvideos.com
13.32.121.11
157.90.33.122
157.90.33.72
18.211.95.28
185.53.177.52
2600:9000:2127:f000:f:5851:4840:93a1
2600:9000:2250:f600:1d:4618:5c80:21
34.224.252.116
67.212.173.76
036c94653e84e6078c087abeb3ac8804491d27b27938839ae3df42b31e2238d9
11493e10766928368d46bb31915f94e999b819fcfbda0de5b9d62a0a0ce3baf6
5869e789d63920a8a1eb403f0357624e30d0bf84ccc156de43f0e7879ec1e6c1
750a916feb9dc4594b4c3334879b854590a5c6603d5ab6caba89cc52fa609b95
788238b95385c1e17b4899bce937ab08e52a28ab2862febdca4514c85a971122
7a54a48535e98ca46d1275d906a69cb3a95a5026a5034ef300ec56318155d38e
929d8c5e5165eed2afb026df258fee3bffbd1e3b50f8bb08d798f32f2d9f29b2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f47c83c18af0a7acfea51aaf62526525f5335797934b797c0e8da117350270c2

m.jampans.com Open in urlscan Pro 67.212.173.76 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

53 %HTTPS

22 %IPv6

10 Domains

10 Subdomains

8 IPs

2 Countries

30 kBTransfer

70 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

8 Cookies

1 Console Messages

Indicators

m.jampans.com Open in urlscan Pro
67.212.173.76 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

53 %
HTTPS

22 %
IPv6

10
Domains

10
Subdomains

8
IPs

2
Countries

30 kB
Transfer

70 kB
Size

8
Cookies

15 HTTP transactions
0 data transactions