message.central-messages.com Open in urlscan Pro
2606:4700:30::6812:3ea7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://l4.demolaysgroupjascyahoo.com/
Effective URL:
https://message.central-messages.com/js/v/c2/index.html
Submission: On December 16 via automatic, source certstream-suspicious (December 16th 2019, 8:36:17 pm UTC)

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 5 countries across 13 domains to perform 26 HTTP transactions. The main IP is 2606:4700:30::6812:3ea7, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is message.central-messages.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 22nd 2019. Valid for: a year.

This is the only time message.central-messages.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	159.69.42.212 159.69.42.212	24940 (HETZNER-AS) (HETZNER-AS)
2	144.76.0.242 144.76.0.242	24940 (HETZNER-AS) (HETZNER-AS)
3	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	94.130.186.231 94.130.186.231	24940 (HETZNER-AS) (HETZNER-AS)
1 2	209.15.13.136 209.15.13.136	() ()
2	3.226.8.132 3.226.8.132	() ()
2	52.28.12.46 52.28.12.46	() ()
1 4	99.198.108.194 99.198.108.194	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
1 1	212.32.250.31 212.32.250.31	() ()
1 2	2a05:d018:483... 2a05:d018:483:6130:7095:9e50:e827:1089	() ()
1	2a05:d018:483... 2a05:d018:483:6130:3c15:3fed:823c:bf5d	() ()
1	35.157.9.102 35.157.9.102	() ()
6	2606:4700:30:... 2606:4700:30::6812:3ea7	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
26	12

2 159.69.42.212 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.212.42.69.159.clients.your-server.de

l4.demolaysgroupjascyahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 144.76.0.242 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.242.0.76.144.clients.your-server.de

track.tkbo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 94.130.186.231 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.231.186.130.94.clients.your-server.de

track.traffic.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.15.13.136 (Toronto, Canada) 1 redirects

ASN- ()

dprtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.226.8.132 (Ashburn, United States)

ASN- ()
PTR: ec2-3-226-8-132.compute-1.amazonaws.com

usa.nethaneel-has.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.12.46 (Frankfurt am Main, Germany)

ASN- ()
PTR: ec2-52-28-12-46.eu-central-1.compute.amazonaws.com

cletrogen-daution.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.198.108.194 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

free.uumeiju.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.32.250.31 (Netherlands) 1 redirects

ASN- ()

rdtrck2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:483:6130:7095:9e50:e827:1089 (Dublin, Ireland) 1 redirects

ASN- ()

cd-down.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:483:6130:3c15:3fed:823c:bf5d (Dublin, Ireland)

ASN- ()

gdmconvtrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.9.102 (Frankfurt am Main, Germany)

ASN- ()
PTR: ec2-35-157-9-102.eu-central-1.compute.amazonaws.com

3176034.catchtheclick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:30::6812:3ea7 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

message.central-messages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	central-messages.com message.central-messages.com	561 KB
4	uumeiju.com 1 redirects free.uumeiju.com	18 KB
3	google-analytics.com www.google-analytics.com	18 KB
2	cd-down.com 1 redirects cd-down.com	4 KB
2	cletrogen-daution.com cletrogen-daution.com	2 KB
2	nethaneel-has.com usa.nethaneel-has.com	3 KB
2	dprtb.com 1 redirects dprtb.com	3 KB
2	traffic.club track.traffic.club	1 KB
2	tkbo.com track.tkbo.com	2 KB
2	demolaysgroupjascyahoo.com l4.demolaysgroupjascyahoo.com	2 KB
1	catchtheclick.com 3176034.catchtheclick.com	4 KB
1	gdmconvtrck.com gdmconvtrck.com	1 KB
1	rdtrck2.com 1 redirects rdtrck2.com	716 B
26	13

	Domain	Requested by
6	message.central-messages.com	3176034.catchtheclick.com message.central-messages.com
4	free.uumeiju.com	1 redirects free.uumeiju.com
3	www.google-analytics.com	l4.demolaysgroupjascyahoo.com
2	cd-down.com	1 redirects free.uumeiju.com
2	cletrogen-daution.com	usa.nethaneel-has.com
2	usa.nethaneel-has.com	dprtb.com usa.nethaneel-has.com
2	dprtb.com	1 redirects track.traffic.club
2	track.traffic.club	track.tkbo.com track.traffic.club
2	track.tkbo.com	l4.demolaysgroupjascyahoo.com track.tkbo.com
2	l4.demolaysgroupjascyahoo.com	l4.demolaysgroupjascyahoo.com
1	3176034.catchtheclick.com	gdmconvtrck.com
1	gdmconvtrck.com	cd-down.com
1	rdtrck2.com	1 redirects
26	13

This site contains no links.

Subject Issuer	Validity	Valid
l4.demolaysgroupjascyahoo.com Let's Encrypt Authority X3	`2019-12-16` - `2020-03-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
track.tkbo.com Sectigo RSA Domain Validation Secure Server CA	`2019-02-27` - `2020-02-27`	a year	crt.sh
traffic.club GlobeSSL DV Certification Authority 2	`2019-01-07` - `2021-01-06`	2 years	crt.sh
free.uumeiju.com Let's Encrypt Authority X3	`2019-10-11` - `2020-01-09`	3 months	crt.sh
*.catchtheclick.com Let's Encrypt Authority X3	`2019-09-20` - `2019-12-19`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-05-22` - `2020-05-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://message.central-messages.com/js/v/c2/index.html
Frame ID: 43357CC1BB832572D758502ECEB1643C
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://l4.demolaysgroupjascyahoo.com/ Page URL
http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com Page URL
https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref= Page URL
https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VT... Page URL
https://track.traffic.club/helper/forward.php Page URL
http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSe... Page URL
http://dprtb.com/Redirect/ HTTP 302
http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea... Page URL
http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth... Page URL
http://cletrogen-daution.com/zp-redirect?target=https%3A%2F%2Ffree.uumeiju.com%2F%3Futm_medium%3Dee8992a5... Page URL
http://cletrogen-daution.com/redirect?target=BASE64aHR0cHM6Ly9mcmVlLnV1bWVpanUuY29tLz91dG1fbWVkaXVtPWVlOD... Page URL
https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid... Page URL
https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
https://free.uumeiju.com/proc.php?4aef8e533dade99975da126254def21ecf82998a HTTP 302
https://rdtrck2.com/5dd8fb1bdad446000198e75c?pid=983-6b6a3aez&partner_id=983&ref_id=677113861072... HTTP 302
http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c Page URL
http://cd-down.com/?a=56040&c=207045&oc=96884&sr=t&s2=5df7eab167814c00012afe5c&vt=1576528561913... HTTP 302
https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCE... Page URL
https://message.central-messages.com/js/v/c2/index.html Page URL

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

26
Requests

69 %
HTTPS

31 %
IPv6

13
Domains

13
Subdomains

12
IPs

5
Countries

616 kB
Transfer

661 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://l4.demolaysgroupjascyahoo.com/ Page URL
http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com Page URL
https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref= Page URL
https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a Page URL
https://track.traffic.club/helper/forward.php Page URL
http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSelptMUUyV3JuQ2dTY1lTbzZmVWE3X2xyeXNhbVZpclk4YWtPN0F6dGtrc3gyRUFsMkJlSjNUV0ZjeHEzTnZpZ0hNWENZUVhWbm9oSmxtSTRvT1FmSW5MbzFJb3EtSkl0SlNiZzRFTlN0SDRHM2R1SnB4aGEyNVpsMU1jMQ2&id=fe9979e2-3736-44a5-9177-d510a5b94a79 Page URL
http://dprtb.com/Redirect/ HTTP 302
http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1 Page URL
http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false Page URL
http://cletrogen-daution.com/zp-redirect?target=https%3A%2F%2Ffree.uumeiju.com%2F%3Futm_medium%3Dee8992a55dd1620cfbdf2b3e3da3590183f28f91%26utm_campaign%3DPushVM%26cid%3Dwhpquqibv67mmkhrhhruonh0&caid=8eaf6b21-2ee5-4971-a800-013e5249d0f1&zpid=aad847e3-2043-11ea-a741-0a7b4bed4255&cid=whpquqibv67mmkhrhhruonh0&rt=D Page URL
http://cletrogen-daution.com/redirect?target=BASE64aHR0cHM6Ly9mcmVlLnV1bWVpanUuY29tLz91dG1fbWVkaXVtPWVlODk5MmE1NWRkMTYyMGNmYmRmMmIzZTNkYTM1OTAxODNmMjhmOTEmdXRtX2NhbXBhaWduPVB1c2hWTSZjaWQ9d2hwcXVxaWJ2NjdtbWtocmhocnVvbmgw&ts=1576528560834&hash=o1der9AbXOVau1Kh5CyfDJqk2GZ-GBAtfNEb6QTHXjM&rm=D Page URL
https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0 Page URL
https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e Page URL
https://free.uumeiju.com/proc.php?4aef8e533dade99975da126254def21ecf82998a HTTP 302
https://rdtrck2.com/5dd8fb1bdad446000198e75c?pid=983-6b6a3aez&partner_id=983&ref_id=6771138610721718870&af=UK HTTP 302
http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c Page URL
http://cd-down.com/?a=56040&c=207045&oc=96884&sr=t&s2=5df7eab167814c00012afe5c&vt=1576528561913&h=65fe8e35f47a01bcf5b0aa9252dc950485bbee75&req=http%3A%2F%2Fcd-down.com%2F%3Fa%3D56040%26c%3D207045%26s2%3D5df7eab167814c00012afe5c&us=51353a5e325c42499049c6fda91a5810 HTTP 302
https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040 Page URL
https://message.central-messages.com/js/v/c2/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

http://dprtb.com/Redirect/ HTTP 302
http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1

Request Chain 16

https://free.uumeiju.com/proc.php?4aef8e533dade99975da126254def21ecf82998a HTTP 302
https://rdtrck2.com/5dd8fb1bdad446000198e75c?pid=983-6b6a3aez&partner_id=983&ref_id=6771138610721718870&af=UK HTTP 302
http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c

Request Chain 19

http://cd-down.com/?a=56040&c=207045&oc=96884&sr=t&s2=5df7eab167814c00012afe5c&vt=1576528561913&h=65fe8e35f47a01bcf5b0aa9252dc950485bbee75&req=http%3A%2F%2Fcd-down.com%2F%3Fa%3D56040%26c%3D207045%26s2%3D5df7eab167814c00012afe5c&us=51353a5e325c42499049c6fda91a5810 HTTP 302
https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
l4.demolaysgroupjascyahoo.com/ 1 KB
1 KB 1015ms
67ms Document
text/html 159.69.42.212
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://l4.demolaysgroupjascyahoo.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

159.69.42.212 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.212.42.69.159.clients.your-server.de

Software

openresty /

Resource Hash

6a107229f33d75bb8d03fe7ddb1332b4954007559203fe595984fd0d85406417

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: l4.demolaysgroupjascyahoo.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: openresty
date: Mon, 16 Dec 2019 20:31:08 GMT
content-type: text/html; charset=utf8
set-cookie: ndsp=eyJkb21haW5OYW1lIjoiZGVtb2xheXNncm91cGphc2N5YWhvby5jb20iLCJtZW1iZXIiOiIxIiwidGVtcGxhdGUiOiJzcGxpdHRlciIsInVzZXJBZ2VudCI6Ik1vemlsbGFcLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdFwvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lXC83NC4wLjM3MjkuMTY5IFNhZmFyaVwvNTM3LjM2Iiwic2Vzc2lvbiI6IjFlNjAyYWYyNWVmY2VmNjc2ZmZmYTExMjU1OGQxYzU3IiwidGltZV9pbml0IjoxNTc2NTI4MjY4fQ%3D%3D; expires=Mon, 16-Dec-2019 22:59:59 GMT; Max-Age=8931; path=/
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-encoding: gzip

GET
H2 200 banner_ads.js Show response
l4.demolaysgroupjascyahoo.com/ 111 B
326 B 57ms
57ms Script
application/javascript 159.69.42.212
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://l4.demolaysgroupjascyahoo.com/banner_ads.js
Requested by: Host: l4.demolaysgroupjascyahoo.com
URL: https://l4.demolaysgroupjascyahoo.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.69.42.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.212.42.69.159.clients.your-server.de
Software: openresty /
Resource Hash: 4aa355b64f75bc8293836eb2ca7ff4a0d7230f361c2e9b1b2d7394ac7c540f90

Request headers

Referer: https://l4.demolaysgroupjascyahoo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 16 Dec 2019 20:31:08 GMT
last-modified: Thu, 26 Sep 2019 08:13:05 GMT
server: openresty
etag: "5d8c7311-6f"
content-type: application/javascript
status: 200
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 111
expires: Wed, 15 Jan 2020 20:31:08 GMT

GET
H/1.1 200
OK /
track.tkbo.com/ 737 B
749 B 101ms
74ms Document
text/html 144.76.0.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com

Requested by

Host: l4.demolaysgroupjascyahoo.com
URL: https://l4.demolaysgroupjascyahoo.com/

Protocol

HTTP/1.1

Server

144.76.0.242 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.242.0.76.144.clients.your-server.de

Software

nginx / PHP/5.3.10-1ubuntu3.25

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: track.tkbo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Mon, 16 Dec 2019 20:35:58 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.10-1ubuntu3.25
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip

GET
H2 200 analytics.js
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: l4.demolaysgroupjascyahoo.com
URL: https://l4.demolaysgroupjascyahoo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://l4.demolaysgroupjascyahoo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 141
date: Mon, 16 Dec 2019 20:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 16 Dec 2019 22:33:37 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
109 B 14ms
14ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1919483846&t=event&ni=1&_s=1&dl=https%3A%2F%2Fl4.demolaysgroupjascyahoo.com%2F&ul=en-us&de=UTF-8&dt=demolaysgroupjascyahoo.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Blocking%20Ads&ea=No&_u=YEBAAEAB~&jid=740780132&gjid=1657161080&cid=2097334913.1576528558&tid=UA-43967021-7&_gid=1824681931.1576528558&_r=1&cd1=splitter&cd2=1&cd3=yes&z=290064627

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://l4.demolaysgroupjascyahoo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Dec 2019 20:35:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
106 B 6ms
6ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j79&aip=1&a=1919483846&t=pageview&_s=2&dl=https%3A%2F%2Fl4.demolaysgroupjascyahoo.com%2F&ul=en-us&de=UTF-8&dt=demolaysgroupjascyahoo.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=&gjid=&cid=2097334913.1576528558&tid=UA-43967021-7&_gid=1824681931.1576528558&cd1=splitter&cd2=1&cd3=yes&z=485530258

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://l4.demolaysgroupjascyahoo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Nov 2019 18:15:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2168415
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set go.php
track.tkbo.com/ 950 B
1 KB 701ms
527ms Document
text/html 144.76.0.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref=

Requested by

Host: track.tkbo.com
URL: http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.76.0.242 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.242.0.76.144.clients.your-server.de

Software

nginx / PHP/5.3.10-1ubuntu3.25

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: track.tkbo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://track.tkbo.com/?mid=135&f=135&domain=demolaysgroupjascyahoo.com

Response headers

Server: nginx
Date: Mon, 16 Dec 2019 20:35:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.10-1ubuntu3.25
Set-Cookie: XID=fc1qrn9cgr0b2oihjr6ganerb3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip

GET
H2 200 forward.php
track.traffic.club/helper/ 129 B
646 B 160ms
49ms Document
text/html 94.130.186.231
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a

Requested by

Host: track.tkbo.com
URL: https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

94.130.186.231 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.231.186.130.94.clients.your-server.de

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: track.traffic.club
:scheme: https
:path: /helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref=
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://track.tkbo.com/go.php?mid=135&f=135&domain=demolaysgroupjascyahoo.com&ref=

Response headers

status: 200
server: nginx
date: Mon, 16 Dec 2019 20:35:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: kkl6hi=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk%3D; expires=Mon, 16-Dec-2019 20:36:09 GMT; Max-Age=10
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-encoding: gzip

GET
H2 200 forward.php
track.traffic.club/helper/ 409 B
607 B 48ms
48ms Document
text/html 94.130.186.231
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://track.traffic.club/helper/forward.php

Requested by

Host: track.traffic.club
URL: https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

94.130.186.231 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.231.186.130.94.clients.your-server.de

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: track.traffic.club
:scheme: https
:path: /helper/forward.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a
accept-encoding: gzip, deflate, br
cookie: kkl6hi=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://track.traffic.club/helper/forward.php?target=aHR0cDovL2RwcnRiLmNvbS9jbGljaz9kYXRhPWNqbDFXVVF6VTBsWGQweGxSbkpJZVVaVVNWazVla3BrYW13NVRXMWFNM3BwTmtGMFprdFdiRjl0YlZWb01XZFNlbHB0TVVVeVYzSnVRMmRUWTFsVGJ6Wm1WV0UzWDJ4eWVYTmhiVlpwY2xrNFlXdFBOMEY2ZEd0cmMzZ3lSVUZzTWtKbFNqTlVWMFpqZUhFelRuWnBaMGhOV0VOWlVWaFdibTlvU214dFNUUnZUMUZtU1c1TWJ6RkpiM0V0U2tsMFNsTmlaelJGVGxOMFNEUkhNMlIxU25CNGFHRXlOVnBzTVUxak1RMiZpZD1mZTk5NzllMi0zNzM2LTQ0YTUtOTE3Ny1kNTEwYTViOTRhNzk=&hash=4067fd40f7500aa74b593532f7bcd58a

Response headers

status: 200
server: nginx
date: Mon, 16 Dec 2019 20:35:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: kkl6hi=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0 tc_rvs=1; expires=Mon, 16-Dec-2019 20:36:02 GMT; Max-Age=3
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-encoding: gzip

GET
H/1.1 200
OK Cookie set click
dprtb.com/ 5 KB
3 KB 248ms
202ms Document
text/html 209.15.13.136

General

Check archive.org

Show headers Download Go to

Full URL: http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSelptMUUyV3JuQ2dTY1lTbzZmVWE3X2xyeXNhbVZpclk4YWtPN0F6dGtrc3gyRUFsMkJlSjNUV0ZjeHEzTnZpZ0hNWENZUVhWbm9oSmxtSTRvT1FmSW5MbzFJb3EtSkl0SlNiZzRFTlN0SDRHM2R1SnB4aGEyNVpsMU1jMQ2&id=fe9979e2-3736-44a5-9177-d510a5b94a79
Requested by: Host: track.traffic.club
URL: https://track.traffic.club/helper/forward.php
Protocol: HTTP/1.1
Server: 209.15.13.136 Toronto, Canada, ASN (),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash

Request headers

Host: dprtb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
Set-Cookie: GPAnPwHQhaJpWqT=GPAnPwHQhaJpWqT; path=/
X-Server: web02
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Date: Mon, 16 Dec 2019 20:35:59 GMT
Content-Length: 2144

GET
H/1.1

200
OK

aad847e3-2043-11ea-a741-0a7b4bed4255 Show response
usa.nethaneel-has.com/zcvisitor/
Redirect Chain

http://dprtb.com/Redirect/
http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1

1012 B
2 KB

264ms
214ms

Document
text/html

3.226.8.132

General

Check archive.org

Show headers Download Go to

Full URL

http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1

Requested by

Host: dprtb.com
URL: http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSelptMUUyV3JuQ2dTY1lTbzZmVWE3X2xyeXNhbVZpclk4YWtPN0F6dGtrc3gyRUFsMkJlSjNUV0ZjeHEzTnZpZ0hNWENZUVhWbm9oSmxtSTRvT1FmSW5MbzFJb3EtSkl0SlNiZzRFTlN0SDRHM2R1SnB4aGEyNVpsMU1jMQ2&id=fe9979e2-3736-44a5-9177-d510a5b94a79

Protocol

HTTP/1.1

Server

3.226.8.132 Ashburn, United States, ASN (),

Reverse DNS

ec2-3-226-8-132.compute-1.amazonaws.com

Software

ZeroPark-Traffic /

Resource Hash

f6e9a3f6749c0d10a3ac81496a0aad337d617913e8a5cd6cf709af37c50cab6e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host: usa.nethaneel-has.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSelptMUUyV3JuQ2dTY1lTbzZmVWE3X2xyeXNhbVZpclk4YWtPN0F6dGtrc3gyRUFsMkJlSjNUV0ZjeHEzTnZpZ0hNWENZUVhWbm9oSmxtSTRvT1FmSW5MbzFJb3EtSkl0SlNiZzRFTlN0SDRHM2R1SnB4aGEyNVpsMU1jMQ2&id=fe9979e2-3736-44a5-9177-d510a5b94a79
Accept-Encoding: gzip, deflate
Origin: http://dprtb.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://dprtb.com/click?data=cjl1WUQzU0lXd0xlRnJIeUZUSVk5ekpkamw5TW1aM3ppNkF0ZktWbF9tbVVoMWdSelptMUUyV3JuQ2dTY1lTbzZmVWE3X2xyeXNhbVZpclk4YWtPN0F6dGtrc3gyRUFsMkJlSjNUV0ZjeHEzTnZpZ0hNWENZUVhWbm9oSmxtSTRvT1FmSW5MbzFJb3EtSkl0SlNiZzRFTlN0SDRHM2R1SnB4aGEyNVpsMU1jMQ2&id=fe9979e2-3736-44a5-9177-d510a5b94a79

Response headers

Date: Mon, 16 Dec 2019 20:36:00 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: ZeroPark-Traffic

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Server: web02
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Date: Mon, 16 Dec 2019 20:35:59 GMT
Content-Length: 240

GET
H/1.1 200
OK zcredirect Show response
usa.nethaneel-has.com/ 806 B
1 KB 309ms
309ms Document
text/html 3.226.8.132

General

Check archive.org

Show headers Download Go to

Full URL

http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false

Requested by

Host: usa.nethaneel-has.com
URL: http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1

Protocol

HTTP/1.1

Server

3.226.8.132 Ashburn, United States, ASN (),

Reverse DNS

ec2-3-226-8-132.compute-1.amazonaws.com

Software

ZeroPark-Traffic /

Resource Hash

6b4c3aeecd3c4c55628f34de22ccb3d3e9f01f1d1a99963a0fc5a234c9a7d00d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Host: usa.nethaneel-has.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://usa.nethaneel-has.com/zcvisitor/aad847e3-2043-11ea-a741-0a7b4bed4255?campaignid=d9f0d090-1cf3-11ea-99c4-12f2f4d45bc1

Response headers

Date: Mon, 16 Dec 2019 20:36:00 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: ZeroPark-Traffic

GET
H/1.1 200
OK Cookie set zp-redirect Show response
cletrogen-daution.com/ 505 B
1 KB 97ms
54ms Document
text/html 52.28.12.46

General

Check archive.org

Show headers Download Go to

Full URL: http://cletrogen-daution.com/zp-redirect?target=https%3A%2F%2Ffree.uumeiju.com%2F%3Futm_medium%3Dee8992a55dd1620cfbdf2b3e3da3590183f28f91%26utm_campaign%3DPushVM%26cid%3Dwhpquqibv67mmkhrhhruonh0&caid=8eaf6b21-2ee5-4971-a800-013e5249d0f1&zpid=aad847e3-2043-11ea-a741-0a7b4bed4255&cid=whpquqibv67mmkhrhhruonh0&rt=D
Requested by: Host: usa.nethaneel-has.com
URL: http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Protocol: HTTP/1.1
Server: 52.28.12.46 Frankfurt am Main, Germany, ASN (),
Reverse DNS: ec2-52-28-12-46.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 29028e0b827f8a0baea56bbe93356e75d09a17f2e8e30381086a1c2f6cf0ddb9

Request headers

Host: cletrogen-daution.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://usa.nethaneel-has.com/zcredirect?visitid=aad847e3-2043-11ea-a741-0a7b4bed4255&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false

Response headers

Server: nginx
Date: Mon, 16 Dec 2019 20:36:00 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 505
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Set-Cookie: 8eaf6b21-2ee5-4971-a800-013e5249d0f1-v4=8eaf6b21-2ee5-4971-a800-013e5249d0f1;Max-Age=86400;Expires=Tue, 17-Dec-2019 20:36:00 GMT;domain=cletrogen-daution.com;path=/;HttpOnly cc-v4=z%2FvLbb2HVwydbjtk7f1U22f3nHQGIZHGel1dEdBOvu4U1HpHga21GTo2UyLCfYfo6D8QhQVCr86IcoGgTG3Hgsvw9IhMqIt%2FB4HVIQEmARoenX6smRqLh%2BuhNrqmV54ZASE9TxEdj4W7JG1bJja4xw%3D%3D;Max-Age=31536000;Expires=Tue, 15-Dec-2020 20:36:00 GMT;domain=cletrogen-daution.com;path=/;HttpOnly

GET
H/1.1 200
OK redirect Show response
cletrogen-daution.com/ 338 B
632 B 42ms
41ms Document
text/html 52.28.12.46

General

Check archive.org

Show headers Download Go to

Full URL: http://cletrogen-daution.com/redirect?target=BASE64aHR0cHM6Ly9mcmVlLnV1bWVpanUuY29tLz91dG1fbWVkaXVtPWVlODk5MmE1NWRkMTYyMGNmYmRmMmIzZTNkYTM1OTAxODNmMjhmOTEmdXRtX2NhbXBhaWduPVB1c2hWTSZjaWQ9d2hwcXVxaWJ2NjdtbWtocmhocnVvbmgw&ts=1576528560834&hash=o1der9AbXOVau1Kh5CyfDJqk2GZ-GBAtfNEb6QTHXjM&rm=D
Protocol: HTTP/1.1
Server: 52.28.12.46 Frankfurt am Main, Germany, ASN (),
Reverse DNS: ec2-52-28-12-46.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 93ed5fca5c7e9cef9d69e0a5f2e67c758d3ba29304d68a7de56a1df89900bcfa

Request headers

Host: cletrogen-daution.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://cletrogen-daution.com/zp-redirect?target=https%3A%2F%2Ffree.uumeiju.com%2F%3Futm_medium%3Dee8992a55dd1620cfbdf2b3e3da3590183f28f91%26utm_campaign%3DPushVM%26cid%3Dwhpquqibv67mmkhrhhruonh0&caid=8eaf6b21-2ee5-4971-a800-013e5249d0f1&zpid=aad847e3-2043-11ea-a741-0a7b4bed4255&cid=whpquqibv67mmkhrhhruonh0&rt=D
Accept-Encoding: gzip, deflate
Cookie: 8eaf6b21-2ee5-4971-a800-013e5249d0f1-v4=8eaf6b21-2ee5-4971-a800-013e5249d0f1; cc-v4=z%2FvLbb2HVwydbjtk7f1U22f3nHQGIZHGel1dEdBOvu4U1HpHga21GTo2UyLCfYfo6D8QhQVCr86IcoGgTG3Hgsvw9IhMqIt%2FB4HVIQEmARoenX6smRqLh%2BuhNrqmV54ZASE9TxEdj4W7JG1bJja4xw%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://cletrogen-daution.com/zp-redirect?target=https%3A%2F%2Ffree.uumeiju.com%2F%3Futm_medium%3Dee8992a55dd1620cfbdf2b3e3da3590183f28f91%26utm_campaign%3DPushVM%26cid%3Dwhpquqibv67mmkhrhhruonh0&caid=8eaf6b21-2ee5-4971-a800-013e5249d0f1&zpid=aad847e3-2043-11ea-a741-0a7b4bed4255&cid=whpquqibv67mmkhrhhruonh0&rt=D

Response headers

Server: nginx
Date: Mon, 16 Dec 2019 20:36:00 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

GET
H2 200 / Show response
free.uumeiju.com/ 3 KB
2 KB 568ms
117ms Document
text/html 99.198.108.194
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.198.108.194 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

2a97c7ef5360b534e964bf98a1694d340efe4bddd62bc9aa87106315cdee058a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: free.uumeiju.com
:scheme: https
:path: /?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://cletrogen-daution.com/redirect?target=BASE64aHR0cHM6Ly9mcmVlLnV1bWVpanUuY29tLz91dG1fbWVkaXVtPWVlODk5MmE1NWRkMTYyMGNmYmRmMmIzZTNkYTM1OTAxODNmMjhmOTEmdXRtX2NhbXBhaWduPVB1c2hWTSZjaWQ9d2hwcXVxaWJ2NjdtbWtocmhocnVvbmgw&ts=1576528560834&hash=o1der9AbXOVau1Kh5CyfDJqk2GZ-GBAtfNEb6QTHXjM&rm=D
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://cletrogen-daution.com/redirect?target=BASE64aHR0cHM6Ly9mcmVlLnV1bWVpanUuY29tLz91dG1fbWVkaXVtPWVlODk5MmE1NWRkMTYyMGNmYmRmMmIzZTNkYTM1OTAxODNmMjhmOTEmdXRtX2NhbXBhaWduPVB1c2hWTSZjaWQ9d2hwcXVxaWJ2NjdtbWtocmhocnVvbmgw&ts=1576528560834&hash=o1der9AbXOVau1Kh5CyfDJqk2GZ-GBAtfNEb6QTHXjM&rm=D

Response headers

status: 200
server: nginx
date: Mon, 16 Dec 2019 20:36:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=76641712449d4d9944eec239da968e7e; expires=Tue, 15-Dec-2020 20:36:01 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H2 200 / Show response
free.uumeiju.com/ 14 KB
4 KB 130ms
130ms Document
text/html 99.198.108.194
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e

Requested by

Host: free.uumeiju.com
URL: https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.198.108.194 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

9c15394f957b6c1e656d27a1896cd55a1aef0e190b1f1f136c4e2e613e0ce71e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: free.uumeiju.com
:scheme: https
:path: /?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0
accept-encoding: gzip, deflate, br
cookie: u=76641712449d4d9944eec239da968e7e
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://free.uumeiju.com/?utm_medium=ee8992a55dd1620cfbdf2b3e3da3590183f28f91&utm_campaign=PushVM&cid=whpquqibv67mmkhrhhruonh0

Response headers

status: 200
server: nginx
date: Mon, 16 Dec 2019 20:36:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET
H/1.1

200
OK

/ Show response
cd-down.com/
Redirect Chain

https://free.uumeiju.com/proc.php?4aef8e533dade99975da126254def21ecf82998a
https://rdtrck2.com/5dd8fb1bdad446000198e75c?pid=983-6b6a3aez&partner_id=983&ref_id=6771138610721718870&af=UK
http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c

2 KB
1 KB

72ms
28ms

Document
text/html

2a05:d018:483:6130:7095:9e50:e827:1089

General

Check archive.org

Show headers Download Go to

Full URL: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c
Requested by: Host: free.uumeiju.com
URL: https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
Protocol: HTTP/1.1
Server: 2a05:d018:483:6130:7095:9e50:e827:1089 Dublin, Ireland, ASN (),
Reverse DNS
Software: nginx /
Resource Hash: b5ebea28624fb2b5fd8faa5e71a6613e9fb16e0275924d0e0183e089981f5c54

Request headers

Host: cd-down.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 16 Dec 2019 20:36:01 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Expires: Sat, 1 May 2020 12:00:00 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 16 Dec 2019 20:36:01 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 95
Connection: keep-alive
Location: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c
Set-Cookie: redhash=NWRmN2VhYjE2NzgxNGMwMDAxMmFmZTVjfDB8NWRkOGZiMWJkYWQ0NDYwMDAxOThlNzVjfHw3OTRhMWZhOS04YTBjLTRiNTktOGRhZi04ZWQ2NmY5Y2QwNTB8MTU3NjUyODU2MQ==; Path=/; Domain=rdtrck2.com; Expires=Tue, 15 Dec 2020 20:36:01 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Expose-Headers: Content-Length,Content-Range

GET
H2 200 skip-button.jpg
free.uumeiju.com/20190821/ 12 KB
12 KB 114ms
114ms Image
image/jpeg 99.198.108.194
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://free.uumeiju.com/20190821/skip-button.jpg

Requested by

Host: free.uumeiju.com
URL: https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.198.108.194 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://free.uumeiju.com/?utm_term=6771138610721718870&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:01 GMT
last-modified: Wed, 21 Aug 2019 12:57:11 GMT
server: nginx
etag: "5d5d3fa7-2e32"
strict-transport-security: max-age=31536000; includeSubdomains;
content-type: image/jpeg
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 11826
expires: Tue, 17 Dec 2019 20:36:01 GMT

GET
H/1.1 200
OK trck Show response
gdmconvtrck.com/ 1 KB
1 KB 66ms
27ms Script
text/javascript 2a05:d018:483:6130:3c15:3fed:823c:bf5d

General

Check archive.org

Show headers Download Go to

Full URL: http://gdmconvtrck.com/trck
Requested by: Host: cd-down.com
URL: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c
Protocol: HTTP/1.1
Server: 2a05:d018:483:6130:3c15:3fed:823c:bf5d Dublin, Ireland, ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 91f9275b1ced45b621bc9769c0ce0f9fedbc03e1ddbc00264b03cd002080f482

Request headers

Referer: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Dec 2019 20:36:02 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/javascript;charset=utf-8
Access-Control-Allow-Origin: *, *
Cache-Control: no-cache, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
Expires: Sat, 1 May 2020 12:00:00 GMT

GET
H/1.1

200
OK

Cookie set / Show response
3176034.catchtheclick.com/
Redirect Chain

http://cd-down.com/?a=56040&c=207045&oc=96884&sr=t&s2=5df7eab167814c00012afe5c&vt=1576528561913&h=65fe8e35f47a01bcf5b0aa9252dc950485bbee75&req=http%3A%2F%2Fcd-down.com%2F%3Fa%3D56040%26c%3D207045%2...
https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040

4 KB
4 KB

139ms
53ms

Document
text/html

35.157.9.102

General

Check archive.org

Show headers Download Go to

Full URL: https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040
Requested by: Host: gdmconvtrck.com
URL: http://gdmconvtrck.com/trck
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.157.9.102 Frankfurt am Main, Germany, ASN (),
Reverse DNS: ec2-35-157-9-102.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 / PHP/7.0.33
Resource Hash: 0a2a6b2a24c2c503287f3509574a2355f03be2892e9f9b0d2fb60ed48aa8e4a3

Request headers

Host: 3176034.catchtheclick.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://cd-down.com/?a=56040&c=207045&s2=5df7eab167814c00012afe5c

Response headers

Server: nginx/1.16.1
Date: Mon, 16 Dec 2019 20:36:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.0.33
Set-Cookie: jarr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/

Redirect headers

Date: Mon, 16 Dec 2019 20:36:02 GMT
Content-Type: text/html;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Set-Cookie: gdm_click_freq_v1_1_001=DH6ymMopkm02Yg/pEH9TKXAJpqSUL7UWL9QXc+GVn5g+YD2ieZOWLHwFvUrFnc+n; Expires=Sun, 15-Mar-2020 20:36:02 GMT gdm_suid_v1_1_001=LvxO8DAy8Ictl26Jg+hEz7YtMPNoPYWXhcLdYe39ukQKjktF0/zyzRAp1FloHrqe; Expires=Sun, 15-Mar-2020 20:36:02 GMT gdm_click_adv_freq_v1_1_001=k5zWhR2J/ZQ3D//T/Wiu+edGWrm8vTPGaD4kkvQMt/ChWU6x6ugzJUmQX56jpMil; Expires=Sun, 15-Mar-2020 20:36:02 GMT gdm_sid_v1_3_001=hKp4/7xOyVxNBf1BYxn5iAGj+5PD+NS84xVwnhqEU9BMPoEO0ih3XrhP5BBnCMr+MWI3PFhF7C6p7BHxq2Y42do9QXaEwO17u2OfUXmmMxhpj5PR2SYvE8+vSfQSSQPO4fGQIfdnp6zEctb9T9J3+EvyZkEMQx19aJPeeE6LvD1ZQHZJrUA3VX2BD9k0DQve3v4lop7KeSbdBrLuKy0IVDFDDTVSsFrbXFv0VfaNB2GBqXTQCQC6QZmIhlEoIbNfM7L29+tdVLANr58pKvP6HmIl0zp/bUxYTIRYGI9aMegxz1KUHmMpJCdzWJYa2I/ltbSO7vEQHvcdi19yh0tWbqg64MSeRWiz6R1PjnhHzzLME3W9POioghEs0pFj6lYFBV8UYwOsYJ4A5RQSAzPriRhtBxd7ze8tn7L44qT3USBmDuEraOlGGXcgkdmtZoSpcsBsBlpkxsKkwpcld2rDMALJrbUlMgIVr/U45+u11pEN3/G9XdE7oAbnYZiJGxm0U0RdWZmntnRTchJnVaPXsXXVx2h3TyBhHYxlIO5GPuJv895CKPpTYUYowoedcH9Yyw1HzDgl1ewQdLrVSuTtJl11lc7XrgpPz0gaNhDq851a2fouSMyMaLmJcL90Q0Fl0YLjmslGLzL2a/jjJ4Ad9rPbSp+J161zlEoYN040Qi40AYnQKLwmdgRdNNbokL4sxb/0Tl+u3Ss2xaPuMioKJp9fmdgdLK9EUs35YVU/KMLWJ1CYzS6+qxHVfpgaw7WOwC9x8wLS4zbKxBW4P6HTr00WXEnNw63i+jGr7e0WYIbLq5Lt8hBuDqnkcVpoCMp/T/K7qsyEWNnkKNCp9eerFnT13yAF/thRDIW4YtFeakQpqpDc6XhbelANvR9FEM3KlCjJcCsJFWc/MtQGYGVPCEfWDp89b6YtYxj0+zrV055OYjJ+Bex+7xWbzcArknKZpp5mROjVhbaf5r6KEZvwpmf3SOl+2Ot5Dy3KD/Ed7+8pugYwvm14izySxruM43X6; Expires=Sun, 15-Mar-2020 20:36:02 GMT gdm_uid_v1_1_001=LvxO8DAy8Ictl26Jg+hEz7YtMPNoPYWXhcLdYe39ukQKjktF0/zyzRAp1FloHrqe; Expires=Sun, 15-Mar-2020 20:36:02 GMT
Location: https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040
Content-Language: en-US
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob

GET
H2 200 Primary Request index.html Show response
message.central-messages.com/js/v/c2/ 10 KB
3 KB 22ms
21ms Document
text/html 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://message.central-messages.com/js/v/c2/index.html
Requested by: Host: 3176034.catchtheclick.com
URL: https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83a6261df354a68c85f233861eec20af63982d36c10f3bb95af8773f6a6d18bf

Request headers

:method: GET
:authority: message.central-messages.com
:scheme: https
:path: /js/v/c2/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://3176034.catchtheclick.com/?mob=ocdXibJmpWhjRDsc5JocLNbqBTulVXNXrA1IwJpsUwiFQGe1Gr4lMfWKAZqD8GWrFpYMVCEXbwx_vxk99rCC8w&tid=47ad0f1e5ebc4d1a9c1ab08d4904bb96121e3&tid1=56040

Response headers

status: 200
date: Mon, 16 Dec 2019 20:36:02 GMT
content-type: text/html
set-cookie: __cfduid=d1da4379df569ad3f98f8b6ccf70649f41576528562; expires=Wed, 15-Jan-20 20:36:02 GMT; path=/; domain=.central-messages.com; HttpOnly
last-modified: Wed, 25 Sep 2019 08:32:26 GMT
vary: Accept-Encoding
cache-control: max-age=5356800
cf-cache-status: HIT
age: 942524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5463727a3e955a06-VIE
content-encoding: br

GET
H2 200 inc.js Show response
message.central-messages.com/js/v/c2/ 6 KB
2 KB 28ms
27ms Script
application/javascript 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://message.central-messages.com/js/v/c2/inc.js
Requested by: Host: message.central-messages.com
URL: https://message.central-messages.com/js/v/c2/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 363c024fbf26ae1c4048d4c20451b7045b49672c52d7b8a9477600e887c54ef3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2019 15:19:32 GMT
server: cloudflare
age: 4547
etag: W/"5dc58784-2559"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=5356800
cf-polished: origSize=9561
cf-ray: 5463727a6eb85a06-VIE
cf-bgj: minify

GET
H2 200 play-01.png
message.central-messages.com/js/v/c2/imgs/ 5 KB
5 KB 22ms
22ms Image
image/png 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.central-messages.com/js/v/c2/imgs/play-01.png
Requested by: Host: message.central-messages.com
URL: https://message.central-messages.com/js/v/c2/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: da5718ccece267af24556ccce3ca5909f9faf49401fc50d78edf4852129410b5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:02 GMT
cf-cache-status: HIT
last-modified: Wed, 28 Aug 2019 07:26:20 GMT
server: cloudflare
age: 4547
etag: "5d662c9c-130a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=5356800
accept-ranges: bytes
cf-ray: 5463727a6eb95a06-VIE
content-length: 4874

GET
H2 200 3.png
message.central-messages.com/js/v/c2/imgs/ 183 KB
183 KB 20ms
19ms Image
image/png 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.central-messages.com/js/v/c2/imgs/3.png
Requested by: Host: message.central-messages.com
URL: https://message.central-messages.com/js/v/c2/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa1934b3ab854ed8db61ca00728c02fd6c5cf737aaa67902ee7240c22f7db6f0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:02 GMT
cf-cache-status: HIT
last-modified: Mon, 16 Sep 2019 11:07:52 GMT
server: cloudflare
age: 4547
etag: "5d7f6d08-2dae6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=5356800
accept-ranges: bytes
cf-ray: 5463727a6eba5a06-VIE
content-length: 187110

GET
H2 200 logochamp.png
message.central-messages.com/js/v/c2/imgs/ 162 KB
162 KB 30ms
30ms Image
image/png 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.central-messages.com/js/v/c2/imgs/logochamp.png
Requested by: Host: message.central-messages.com
URL: https://message.central-messages.com/js/v/c2/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e7159d46f126f30ecf640510a6544d7b058a0ac8c0a3b9d258d9695991e1d47

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:02 GMT
cf-cache-status: HIT
last-modified: Mon, 16 Sep 2019 10:21:02 GMT
server: cloudflare
age: 4547
etag: "5d7f620e-2883b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=5356800
accept-ranges: bytes
cf-ray: 5463727a8eea5a06-VIE
content-length: 165947

GET
H2 200 champ.jpg
message.central-messages.com/js/v/c2/imgs/ 206 KB
206 KB 29ms
29ms Image
image/jpeg 2606:4700:30::6812:3ea7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://message.central-messages.com/js/v/c2/imgs/champ.jpg
Requested by: Host: message.central-messages.com
URL: https://message.central-messages.com/js/v/c2/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:3ea7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11f82900a7eeef89949461d1813127c3913a89354e6f86540d3936f7fb10362d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 20:36:02 GMT
cf-cache-status: HIT
last-modified: Mon, 16 Sep 2019 12:33:12 GMT
server: cloudflare
age: 4303
etag: "5d7f8108-337c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=5356800
accept-ranges: bytes
cf-ray: 5463727a9ef95a06-VIE
content-length: 210886

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.central-messages.com/	1970-01-20 05:54:02	Name: jjj Value: 0
.central-messages.com/	1970-01-19 14:41:08	Name: u Value: 20x536x15435df7eab236f6c
.central-messages.com/	1970-01-19 06:38:40	Name: __cfduid Value: d1da4379df569ad3f98f8b6ccf70649f41576528562

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3176034.catchtheclick.com
cd-down.com
cletrogen-daution.com
dprtb.com
free.uumeiju.com
gdmconvtrck.com
l4.demolaysgroupjascyahoo.com
message.central-messages.com
rdtrck2.com
track.tkbo.com
track.traffic.club
usa.nethaneel-has.com
www.google-analytics.com
144.76.0.242
159.69.42.212
209.15.13.136
212.32.250.31
2606:4700:30::6812:3ea7
2a00:1450:4001:808::200e
2a05:d018:483:6130:3c15:3fed:823c:bf5d
2a05:d018:483:6130:7095:9e50:e827:1089
3.226.8.132
35.157.9.102
52.28.12.46
94.130.186.231
99.198.108.194
0a2a6b2a24c2c503287f3509574a2355f03be2892e9f9b0d2fb60ed48aa8e4a3
11f82900a7eeef89949461d1813127c3913a89354e6f86540d3936f7fb10362d
29028e0b827f8a0baea56bbe93356e75d09a17f2e8e30381086a1c2f6cf0ddb9
2a97c7ef5360b534e964bf98a1694d340efe4bddd62bc9aa87106315cdee058a
363c024fbf26ae1c4048d4c20451b7045b49672c52d7b8a9477600e887c54ef3
4aa355b64f75bc8293836eb2ca7ff4a0d7230f361c2e9b1b2d7394ac7c540f90
6a107229f33d75bb8d03fe7ddb1332b4954007559203fe595984fd0d85406417
6b4c3aeecd3c4c55628f34de22ccb3d3e9f01f1d1a99963a0fc5a234c9a7d00d
83a6261df354a68c85f233861eec20af63982d36c10f3bb95af8773f6a6d18bf
91f9275b1ced45b621bc9769c0ce0f9fedbc03e1ddbc00264b03cd002080f482
93ed5fca5c7e9cef9d69e0a5f2e67c758d3ba29304d68a7de56a1df89900bcfa
9c15394f957b6c1e656d27a1896cd55a1aef0e190b1f1f136c4e2e613e0ce71e
9e7159d46f126f30ecf640510a6544d7b058a0ac8c0a3b9d258d9695991e1d47
aa1934b3ab854ed8db61ca00728c02fd6c5cf737aaa67902ee7240c22f7db6f0
b5ebea28624fb2b5fd8faa5e71a6613e9fb16e0275924d0e0183e089981f5c54
da5718ccece267af24556ccce3ca5909f9faf49401fc50d78edf4852129410b5
f6e9a3f6749c0d10a3ac81496a0aad337d617913e8a5cd6cf709af37c50cab6e

message.central-messages.com Open in urlscan Pro 2606:4700:30::6812:3ea7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

26 Requests

69 %HTTPS

31 %IPv6

13 Domains

13 Subdomains

12 IPs

5 Countries

616 kBTransfer

661 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

3 Cookies

message.central-messages.com Open in urlscan Pro
2606:4700:30::6812:3ea7 Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

69 %
HTTPS

31 %
IPv6

13
Domains

13
Subdomains

12
IPs

5
Countries

616 kB
Transfer

661 kB
Size

3
Cookies

26 HTTP transactions
0 data transactions