Submitted URL: https://iclikkiwir.xyz/?action=register&sub_id=PAYENG
Effective URL: https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7347047365238325369&pub=15494&pid=15494-8581460c&c=0&app=unk...
Submission: On March 16 via manual from KZ — Scanned from DE

Summary

This website contacted 6 IPs in 5 countries across 7 domains to perform 6 HTTP transactions. The main IP is 162.55.4.52, located in Bergen, Germany and belongs to HETZNER-AS, DE. The main domain is v115323.pi6p.com.
TLS certificate: Issued by R3 on March 7th 2024. Valid for: 3 months.
This is the only time v115323.pi6p.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a02:4780:6:1... 47583 (AS-HOSTINGER)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 158.69.254.144 16276 (OVH)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2 34.90.81.51 396982 (GOOGLE-CL...)
1 216.104.36.158 32475 (SINGLEHOP...)
1 162.55.4.52 24940 (HETZNER-AS)
6 6
Apex Domain
Subdomains
Transfer
2 histats.com
s10.histats.com — Cisco Umbrella Rank: 16643
s4.histats.com — Cisco Umbrella Rank: 16694
5 KB
1 pi6p.com
v115323.pi6p.com
149 KB
1 eumarkdepot.com
mdm.eumarkdepot.com
4 KB
1 weletmim.com
yes.weletmim.com
367 B
1 storkmobi.com
run.storkmobi.com — Cisco Umbrella Rank: 597314
250 B
1 smrturl.co
smrturl.co — Cisco Umbrella Rank: 402932
851 B
1 iclikkiwir.xyz
iclikkiwir.xyz
1 KB
6 7
Domain Requested by
1 v115323.pi6p.com mdm.eumarkdepot.com
1 mdm.eumarkdepot.com smrturl.co
1 yes.weletmim.com 1 redirects
1 run.storkmobi.com 1 redirects
1 smrturl.co
1 s4.histats.com s10.histats.com
1 s10.histats.com iclikkiwir.xyz
1 iclikkiwir.xyz
6 8

This site contains no links.

Subject Issuer Validity Valid
iclikkiwir.xyz
R3
2024-01-23 -
2024-04-22
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-13 -
2024-05-11
a year crt.sh
histats.com
R3
2024-02-16 -
2024-05-16
3 months crt.sh
smrturl.co
GTS CA 1P5
2024-01-21 -
2024-04-20
3 months crt.sh
mdm.eumarkdepot.com
R3
2024-01-24 -
2024-04-23
3 months crt.sh
v115323.pi6p.com
R3
2024-03-07 -
2024-06-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7347047365238325369&pub=15494&pid=15494-8581460c&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
Frame ID: 099926F555C1A98DEEAAB98DFCDAC817
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

thing this at them my more than by one see he because

Page URL History Show full URLs

  1. https://iclikkiwir.xyz/?action=register&sub_id=PAYENG Page URL
  2. https://smrturl.co/o/297770/53447827?s1=PAYENG Page URL
  3. https://run.storkmobi.com/click?pid=3554&offer_id=81521&sub1=Cdbd8d97137477&sub5=297770&sub6=https%3A%... HTTP 302
    https://yes.weletmim.com/click?pid=1373&offer_id=78348&sub5=3554_297770&sub3=81521&sub4=%5BSOI-Sweeps... HTTP 302
    https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=137... Page URL
  4. https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7347047365238325369&pub=15494&pid=15494-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

8
Subdomains

6
IPs

5
Countries

159 kB
Transfer

172 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://iclikkiwir.xyz/?action=register&sub_id=PAYENG Page URL
  2. https://smrturl.co/o/297770/53447827?s1=PAYENG Page URL
  3. https://run.storkmobi.com/click?pid=3554&offer_id=81521&sub1=Cdbd8d97137477&sub5=297770&sub6=https%3A%2F%2Ficlikkiwir.xyz%2F&sub7=https%3A%2F%2Ficlikkiwir.xyz%2F HTTP 302
    https://yes.weletmim.com/click?pid=1373&offer_id=78348&sub5=3554_297770&sub3=81521&sub4=%5BSOI-Sweeps%5D+DE+-+CEOO+-+Win+%E2%82%AC500+Amazon+Gift+Card HTTP 302
    https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3 Page URL
  4. https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7347047365238325369&pub=15494&pid=15494-8581460c&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://run.storkmobi.com/click?pid=3554&offer_id=81521&sub1=Cdbd8d97137477&sub5=297770&sub6=https%3A%2F%2Ficlikkiwir.xyz%2F&sub7=https%3A%2F%2Ficlikkiwir.xyz%2F HTTP 302
  • https://yes.weletmim.com/click?pid=1373&offer_id=78348&sub5=3554_297770&sub3=81521&sub4=%5BSOI-Sweeps%5D+DE+-+CEOO+-+Win+%E2%82%AC500+Amazon+Gift+Card HTTP 302
  • https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
iclikkiwir.xyz/
2 KB
1 KB
Document
General
Full URL
https://iclikkiwir.xyz/?action=register&sub_id=PAYENG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:4780:6:1257:0:c03:1e26:4 Jakarta, Indonesia, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.33
Resource Hash
738371578bbf2aab1fdf2ede40dcc2d2dc2696e459d9e7ebeaebf0edf834e855
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-length
1061
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Sat, 16 Mar 2024 19:36:06 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
platform
hostinger
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
js15_as.js
s10.histats.com/
11 KB
5 KB
Script
General
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: iclikkiwir.xyz
URL: https://iclikkiwir.xyz/?action=register&sub_id=PAYENG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:4373 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://iclikkiwir.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 16 Mar 2024 19:36:06 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 16 Apr 2020 10:44:16 GMT
server
cloudflare
age
10402
etag
"-375139978"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=28800
accept-ranges
bytes
cf-ray
865730af0c4b9249-FRA
content-length
4547
0.php
s4.histats.com/stats/
47 B
181 B
Script
General
Full URL
https://s4.histats.com/stats/0.php?4832985&@f16&@g1&@h1&@i1&@j1710617766267&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:133083649&@b3:1710617766&@b4:js15_as.js&@b5:60&@a-_0.2.1&@vhttps%3A%2F%2Ficlikkiwir.xyz%2F%3Faction%3Dregister%26sub_id%3DPAYENG&@w
Requested by
Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
158.69.254.144 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns548341.ip-158-69-254.net
Software
/
Resource Hash
a60692031ce09be66be89784e8b0214c0f8b6f52cd8fd6a36129a635ffe41ad2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://iclikkiwir.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date
Sat, 16 Mar 2024 19:36:06 GMT
Connection
close
Content-Length
47
Content-Type
text/html;charset=UTF-8
53447827
smrturl.co/o/297770/
838 B
851 B
Document
General
Full URL
https://smrturl.co/o/297770/53447827?s1=PAYENG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1dca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.11
Resource Hash
5dd0d310e22cf4e748845ace5d87c6507e517b3a8f74db0e2b433c16cb15064f

Request headers

Referer
https://iclikkiwir.xyz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
865730b15c1c65a3-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 16 Mar 2024 19:36:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NTjRVteEJiyP2H5ESQ1ah%2BfWPdwJQSDvi%2FwTKrFnlyuuHrNJc4qL%2FVudJelkAiwxeEvvwu3S6xEwGUPhUH3Ekp28eMcOJVmcgDeiy2jo4fzkPJesQSEzEuX18TVhCu2D4FVUaO5A0Um0"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.11
/
mdm.eumarkdepot.com/
Redirect Chain
  • https://run.storkmobi.com/click?pid=3554&offer_id=81521&sub1=Cdbd8d97137477&sub5=297770&sub6=https%3A%2F%2Ficlikkiwir.xyz%2F&sub7=https%3A%2F%2Ficlikkiwir.xyz%2F
  • https://yes.weletmim.com/click?pid=1373&offer_id=78348&sub5=3554_297770&sub3=81521&sub4=%5BSOI-Sweeps%5D+DE+-+CEOO+-+Win+%E2%82%AC500+Amazon+Gift+Card
  • https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3
9 KB
4 KB
Document
General
Full URL
https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3
Requested by
Host: smrturl.co
URL: https://smrturl.co/o/297770/53447827?s1=PAYENG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.104.36.158 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx /
Resource Hash
880d85e73816a8ec6c2434e42b3d62c14d2017bd1c698230c7d5d0240cc83271
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
alt-svc
h3=":443"; ma=604800; persist=1
cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sat, 16 Mar 2024 19:36:07 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
content-length
0
date
Sat, 16 Mar 2024 19:36:07 GMT
location
https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3
server
nginx
x-adjust-use-original-forwarded-for
1
Primary Request go.php
v115323.pi6p.com/
148 KB
149 KB
Document
General
Full URL
https://v115323.pi6p.com/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7347047365238325369&pub=15494&pid=15494-8581460c&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
Requested by
Host: mdm.eumarkdepot.com
URL: https://mdm.eumarkdepot.com/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_297770&cid=65f5f4a7e2e9d800014a31e3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
162.55.4.52 Bergen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.52.4.55.162.clients.your-server.de
Software
nginx/1.24.0 /
Resource Hash
998a230258ae404a2cba4e28cb0fa563daf84bb0508f9071e13d6afd5f1f0ac4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://mdm.eumarkdepot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 16 Mar 2024 19:36:08 GMT
Server
nginx/1.24.0
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Domain/Path Name / Value
smrturl.co/o/297770 Name: dynamo_v_id
Value: Vdb53f57798981
iclikkiwir.xyz/ Name: PHPSESSID
Value: 208841ec8accab9dc114fc8003bb2ba7
iclikkiwir.xyz/ Name: HstCfa4832985
Value: 1710617766267
iclikkiwir.xyz/ Name: HstCla4832985
Value: 1710617766267
iclikkiwir.xyz/ Name: HstCmu4832985
Value: 1710617766267
iclikkiwir.xyz/ Name: HstPn4832985
Value: 1
iclikkiwir.xyz/ Name: HstPt4832985
Value: 1
iclikkiwir.xyz/ Name: HstCnv4832985
Value: 1
iclikkiwir.xyz/ Name: HstCns4832985
Value: 1
yes.weletmim.com/ Name: afclick
Value: 65f5f4a7e2e9d800014a31e3
yes.weletmim.com/ Name: afoffers
Value: {"78348":1710617767}

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests