urlscan.io logo urlscan.io
SecurityTrails logo

sozeight.com Open in urlscan Pro
13.50.59.231  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://byluxrayor.com/
Effective URL: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&ca...
Submission: On July 03 via manual from SA — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 39 HTTP transactions. The main IP is 13.50.59.231, located in Stockholm, Sweden and belongs to AMAZON-02, US. The main domain is sozeight.com.
TLS certificate: Issued by R3 on May 23rd 2024. Valid for: 3 months.
This is the only time sozeight.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 139.45.197.240 9002 (RETN-AS)
3 139.45.197.252 9002 (RETN-AS)
2 15 139.45.197.236 9002 (RETN-AS)
9 139.45.197.251 9002 (RETN-AS)
2 172.67.209.113 13335 (CLOUDFLAR...)
3 139.45.195.8 9002 (RETN-AS)
5 13.50.59.231 16509 (AMAZON-02)
39 9
2    2606:4700:3037::ac43:d171 (United States)

ASN13335 (CLOUDFLARENET, US)
byluxrayor.com
1    139.45.197.240 (United Kingdom)

ASN9002 (RETN-AS, GB)
propeller-tracking.com
3    139.45.197.252 (United Kingdom)

ASN9002 (RETN-AS, GB)
choogeet.net
15    139.45.197.236 (United Kingdom)

ASN9002 (RETN-AS, GB)
unphionetor.com
betshucklean.com
9    139.45.197.251 (United Kingdom)

ASN9002 (RETN-AS, GB)
jouteetu.net
2    172.67.209.113 (United States)

ASN13335 (CLOUDFLARENET, US)
byluxrayor.com
3    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
5    13.50.59.231 (Stockholm, Sweden)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
sozeight.com
Apex Domain
Subdomains		 Transfer
12 betshucklean.com
betshucklean.com
30 KB
9 jouteetu.net
jouteetu.net — Cisco Umbrella Rank: 24328
5 sozeight.com
sozeight.com
139 KB
4 byluxrayor.com
byluxrayor.com
18 KB
3 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 8833
2 KB
3 unphionetor.com
unphionetor.com — Cisco Umbrella Rank: 354359
2 KB
3 choogeet.net
choogeet.net — Cisco Umbrella Rank: 231474
17 KB
1 propeller-tracking.com
propeller-tracking.com — Cisco Umbrella Rank: 343307
3 KB
0 update48451.xyz Failed
update48451.xyz Failed
39 9
Domain Requested by
12 betshucklean.com 2 redirects byluxrayor.com
betshucklean.com
9 jouteetu.net choogeet.net
5 sozeight.com sozeight.com
4 byluxrayor.com byluxrayor.com
choogeet.net
3 my.rtmark.net choogeet.net
betshucklean.com
3 unphionetor.com propeller-tracking.com
3 choogeet.net byluxrayor.com
choogeet.net
1 propeller-tracking.com byluxrayor.com
0 update48451.xyz Failed sozeight.com
39 9

This site contains no links.

Subject Issuer Validity Valid
byluxrayor.com
Cloudflare Inc ECC CA-3		 2024-01-02 -
2024-12-31		 a year crt.sh
propeller-tracking.com
R3		 2024-06-04 -
2024-09-02		 3 months crt.sh
choogeet.net
E6		 2024-06-15 -
2024-09-13		 3 months crt.sh
unphionetor.com
R11		 2024-06-29 -
2024-09-27		 3 months crt.sh
jouteetu.net
R3		 2024-05-14 -
2024-08-12		 3 months crt.sh
rtmark.net
R3		 2024-05-11 -
2024-08-09		 3 months crt.sh
betshucklean.com
R11		 2024-06-23 -
2024-09-21		 3 months crt.sh
sozeight.com
R3		 2024-05-23 -
2024-08-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Frame ID: 12C6D5643F9FE2E0A23F94279B6F9090
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Installieren Sie den Turbo-Werbeblocker

Page URL History Show full URLs

  1. http://byluxrayor.com/ HTTP 307
    https://byluxrayor.com/ Page URL
  2. https://betshucklean.com/4/3479550&var=%7Bzoneid%7D Page URL
  3. https://betshucklean.com/?z=3479550&syncedCookie=true&rhd=false HTTP 302
    https://betshucklean.com/4/7393037/?var=3479550 Page URL
  4. https://betshucklean.com/?z=7393037&syncedCookie=false&rhd=false HTTP 302
    https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.0098... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

39
Requests

97 %
HTTPS

13 %
IPv6

9
Domains

9
Subdomains

9
IPs

3
Countries

207 kB
Transfer

332 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://byluxrayor.com/ HTTP 307
    https://byluxrayor.com/ Page URL
  2. https://betshucklean.com/4/3479550&var=%7Bzoneid%7D Page URL
  3. https://betshucklean.com/?z=3479550&syncedCookie=true&rhd=false HTTP 302
    https://betshucklean.com/4/7393037/?var=3479550 Page URL
  4. https://betshucklean.com/?z=7393037&syncedCookie=false&rhd=false HTTP 302
    https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://byluxrayor.com/ HTTP 307
  • https://byluxrayor.com/
Request Chain 27
  • https://betshucklean.com/?z=3479550&syncedCookie=true&rhd=false HTTP 302
  • https://betshucklean.com/4/7393037/?var=3479550

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
byluxrayor.com/
Redirect Chain
  • http://byluxrayor.com/
  • https://byluxrayor.com/
38 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://byluxrayor.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:d171 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c707b27dad20a094fc32b05a308adc79701ea8bb288b78ed96faf455f247cac

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
89d65e066b4118d8-FRA
content-encoding
br
content-type
text/html
date
Wed, 03 Jul 2024 10:59:38 GMT
last-modified
Tue, 27 Jun 2023 13:07:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rfnf0kKonoXGZK0W5plZuul2E6Yvl2JwpAtX0TKcoGiIfQr4izbfHdR1hww5qbaWH5b2J4RxYd9nF%2FZxwKCmfk%2BAQGo7JA9uwxtBikS8BaVLnxvkaKw%2FkgUUDLm6qj2n%2FneRxOgUIKdgnHBOkA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

Location
https://byluxrayor.com/
Non-Authoritative-Reason
HttpsUpgrades
fv.js
propeller-tracking.com/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://propeller-tracking.com/fv.js?t=71022&cb=1153436307
Requested by
Host: byluxrayor.com
URL: https://byluxrayor.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.240 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
0f467a48a494f7f63968707dc43785b728d0c17f93c12937c1e5b12798f3a98a
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
content-encoding
gzip
pragma
no-cache
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
text/javascript; charset=utf8
access-control-allow-origin
access-control-expose-headers
Authorization
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
expires
Tue, 11 Jan 1994 10:00:00 GMT
micro.tag.min.js
choogeet.net/pfe/current/ 		38 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Requested by
Host: byluxrayor.com
URL: https://byluxrayor.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.252 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ee6b3cd40f86564faa08edad2a3540ec618db73a3c61b21318431699c4dad557

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 10:59:38 GMT
content-encoding
gzip
last-modified
Tue, 02 Jul 2024 08:55:53 GMT
server
nginx
etag
W/"6683c099-9863"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
&mprtr=1
byluxrayor.com/ 		548 B
422 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://byluxrayor.com/&mprtr=1
Requested by
Host: byluxrayor.com
URL: https://byluxrayor.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:d171 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXk5%2Bb%2FACu18GWVSYIMXupPcKV6hGa1XlBZGwL8%2FMu3I2aAoGQxyyXX%2Bgh8SyLfgdEbEzzuzTneDBFsZD3oZOgqU8Og7TePqKTxpuLa9xb1xng9%2Bokz6hqWBQf6lSo5etHlS4UU0bJQjYm0Kxg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
89d65e071c0718d8-FRA
alt-svc
h3=":443"; ma=86400
vctx
unphionetor.com/ 		0
570 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://unphionetor.com/vctx?t=71022
Requested by
Host: propeller-tracking.com
URL: https://propeller-tracking.com/fv.js?t=71022&cb=1153436307
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
https://byluxrayor.com
access-control-expose-headers
Authorization
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
expires
Tue, 11 Jan 1994 10:00:00 GMT
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
check-permissions-3479546.js
byluxrayor.com/ 		0
771 B 		Other
General
Check archive.org
Download Go to
Full URL
https://byluxrayor.com/check-permissions-3479546.js?var=%7Bzoneid%7D&ymid=%24%7BSUBID%7D&zoneId=3479546
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 27 Jun 2023 13:07:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"649adf1d-229"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2BQn9dW0j1wjFL4Yxe1Nw3l%2FtQCSk401BqBW2FXHL8jbX54J9dxJ1e%2BVyZCBNdnwYUo7rCMP%2FdcmZqHbxK2bPqq2CGpDVOfICLsVAOmE%2FtWq9FHMmtn8a35%2FxPrdxux%2BJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
89d65e076ec24dbf-FRA
alt-svc
h3=":443"; ma=86400
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
zone
choogeet.net/ 		0
335 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://choogeet.net/zone?&pub=0&zone_id=3479546&is_mobile=false&domain=byluxrayor.com&var=%7Bzoneid%7D&ymid=%24%7BSUBID%7D&var_3=&var_4=&dsig=&tg=1&sw=3.1.530&trace_id=30c1e5c3-c5e9-4c53-8fc1-722adcff2c32&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjYifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjYifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJOb3QvQSlCcmFuZCIsInZlcnNpb24iOiI4LjAuMC4wIn0seyJicmFuZCI6IkNocm9taXVtIiwidmVyc2lvbiI6IjEyNi4wLjY0NzguMTI2In0seyJicmFuZCI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiMTI2LjAuNjQ3OC4xMjYifV0sIm1vYmlsZSI6ZmFsc2UsIm1vZGVsIjoiIiwicGxhdGZvcm0iOiJXaW4zMiIsInBsYXRmb3JtVmVyc2lvbiI6IjEwLjAuMCIsIndvdzY0IjpmYWxzZX0=&drf=
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.252 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server
nginx
access-control-allow-origin
https://byluxrayor.com
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
0
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
gid.js
my.rtmark.net/ 		65 B
544 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=3479546&checkDuplicate=true&ymid=${SUBID}&var={zoneid}&source=pusher
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
9273167ac26805a8ef50b2371ec7200e05b131096dadda8cdf050b24e0f639f7
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://byluxrayor.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
vbl
unphionetor.com/ 		0
569 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://unphionetor.com/vbl?t=71022&bid=undefined&aid=undefined
Requested by
Host: propeller-tracking.com
URL: https://propeller-tracking.com/fv.js?t=71022&cb=1153436307
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
https://byluxrayor.com
access-control-expose-headers
Authorization
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
expires
Tue, 11 Jan 1994 10:00:00 GMT
favicon.ico
byluxrayor.com/ 		0
477 B 		Other
General
Check archive.org
Download Go to
Full URL
https://byluxrayor.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.209.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Wed, 03 Jul 2024 10:59:38 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2BxmnTLc8TiptAOjfv15BfsipWOqapr6S9xK5DAjwNzWan%2FnIAR37xP05OG3RofNRpMTn46%2FDxplmtFPX32%2BIWJuzulEzhpoekJcDc2RQrbAiYGDRe9WikCQSY33UXTOlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=315360000, must-revalidate, proxy-revalidate
cf-ray
89d65e079f1c4dbf-FRA
alt-svc
h3=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
zone
choogeet.net/ 		789 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://choogeet.net/zone?&pub=0&zone_id=3479546&is_mobile=false&domain=byluxrayor.com&var=%7Bzoneid%7D&ymid=%24%7BSUBID%7D&var_3=&var_4=&dsig=&tg=1&sw=3.1.530&trace_id=30c1e5c3-c5e9-4c53-8fc1-722adcff2c32&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjYifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjYifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJOb3QvQSlCcmFuZCIsInZlcnNpb24iOiI4LjAuMC4wIn0seyJicmFuZCI6IkNocm9taXVtIiwidmVyc2lvbiI6IjEyNi4wLjY0NzguMTI2In0seyJicmFuZCI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiMTI2LjAuNjQ3OC4xMjYifV0sIm1vYmlsZSI6ZmFsc2UsIm1vZGVsIjoiIiwicGxhdGZvcm0iOiJXaW4zMiIsInBsYXRmb3JtVmVyc2lvbiI6IjEwLjAuMCIsIndvdzY0IjpmYWxzZX0=
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.252 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
bd3c4a8b272acd291efd68b4b507ff43246f288a159e39cb9eeea1367e4eb3da
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:38 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
content-type
application/json; charset=utf-8
access-control-allow-origin
https://byluxrayor.com
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
789
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: choogeet.net
URL: https://choogeet.net/pfe/current/micro.tag.min.js?z=3479546&ymid=${SUBID}&var={zoneid}&sw=/check-permissions-3479546.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
vbri
unphionetor.com/ 		0
569 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://unphionetor.com/vbri?t=71022&bid=undefined&aid=undefined&tp=2231.3999996185303
Requested by
Host: propeller-tracking.com
URL: https://propeller-tracking.com/fv.js?t=71022&cb=1153436307
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://byluxrayor.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 10:59:40 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
https://byluxrayor.com
access-control-expose-headers
Authorization
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
expires
Tue, 11 Jan 1994 10:00:00 GMT
3479550&var=%7Bzoneid%7D
betshucklean.com/4/ 		27 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
Requested by
Host: byluxrayor.com
URL: https://byluxrayor.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
d4a0cfe1f7e346cf4dfd644d5b7f113a41f28d780b4369825c65e0a3f88779bd
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://byluxrayor.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf8
date
Wed, 03 Jul 2024 10:59:41 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
906bc1000259cee9192f38745d738a06
sftouch
betshucklean.com/ 		2 B
604 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/sftouch?userId=00808e355b564029e31cff52e8a67586&z=3479550&p_rid=3c03c320-23b6-4d72-b68d-224ff1ef0a51&p_src=sf&branchId=0&rb=-O7IRHZlGDjTZQr1fpBeVUOU3wcyAfW9_Yne2hVKl4erwOXq6CgUtsEjjnfASkunNwVgd8UXEZXycb1608cVAnUspP9vyE-OGP33OEGl3160cpA7q_mhPoN1tgWuOTgpU9URZn1pmqIQDSSlmR5n4uvyoLz4fQ5mgVwTVchulTPC_wv_DQN-lGhJVzM8nJpf9UabxTpNJzdE4gd7XK2gifcLWqzHhQpkS74N-agjRRk7MYAfN9bfrfpMbJZvlor3Ev6iio3LCaZkX5e8abEWCH3D2oXBoc6tFFnC2ADw9YHDHc5VVxWjcAeQqpGioQI9sQfVng==
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
content-length
2
x-trace-id
11b896d03de2071750a72ec69308a232
pragma
no-cache
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain
access-control-allow-origin
https://betshucklean.com
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
expires
Tue, 11 Jan 1994 10:00:00 GMT
img.gif
my.rtmark.net/ 		43 B
491 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=00808e355b564029e31cff52e8a67586&z=3479550&p_rid=3c03c320-23b6-4d72-b68d-224ff1ef0a51&p_src=sf
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://betshucklean.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
add
betshucklean.com/log/ 		12 B
385 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3c03c320-23b6-4d72-b68d-224ff1ef0a51
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
fe85cceb474303eb80a5ca9a60b16d92208a8e0b38647647654b0c42447b51f7
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Content-Type
text/plain;charset=UTF-8
Referer
https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://betshucklean.com
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
content-length
12
favicon.ico
betshucklean.com/ 		0
150 B 		Other
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/4/3479550&var=%7Bzoneid%7D
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Wed, 03 Jul 2024 10:59:41 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
betshucklean.com/4/7393037/
Redirect Chain
  • https://betshucklean.com/?z=3479550&syncedCookie=true&rhd=false
  • https://betshucklean.com/4/7393037/?var=3479550
27 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/4/7393037/?var=3479550
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
a6ceb9eaa468cd19ad8d56465c845152211fd0d21d5b24b16bba061c035323f3
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Content-Type
application/x-www-form-urlencoded
Origin
https://betshucklean.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-arch
"x86"
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version
"126.0.6478.126"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf8
date
Wed, 03 Jul 2024 10:59:41 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
5b61240b1022b88a96318211222f8306

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://betshucklean.com
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length
0
date
Wed, 03 Jul 2024 10:59:41 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://betshucklean.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location
https://betshucklean.com/4/7393037/?var=3479550
pragma
no-cache
referrer-policy
no-referrer
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
c7f7d03a379519c005c8021a5a37c451
favicon.ico
betshucklean.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/afu.php?zoneid=3479550&var=3479550&rid=UOc2oKHlKAQMxeQ00KE1Mg%3D%3D&rhd=false&ab2r=0&sf=1&os=win32&os_version=10.0.0&is_mobile=false&browser_version=126.0.6478.126
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Wed, 03 Jul 2024 10:59:41 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
sftouch
betshucklean.com/ 		2 B
605 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/sftouch?userId=01808eaeaf8f4f81f358af11e4c84bad&z=7393037&p_rid=b69e1bc5-5cf0-42f8-acee-5313467737c1&p_src=sf&branchId=0&rb=YD6cRAx4BblfTBt73pyy5Sciw2Viny4UxCnFbztpr787zusXw_bU0-_WRcb0_LGOTBC-7zZFz7mfxfh1QVFw_PqZ35VFNrg5T8ShSMMTPQciqxuv3xqwHhbLqODrVVMefVZCeMG-dVtGD3HzNwjFRXTNE5GYPBXVilQPZxc1kSr33Xa6yendtYcWHYdVSTpIk8Nes2ZDpB89gAgpYh5ArWuJlZkW2LhmPVMFlX7ix0IKJj2G24edMjWxQvH1YNXWfmdOPdDsPMyy0x6NXQCebCbmTtChJo73jjPpqVsO8pk=
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/7393037/?var=3479550
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/4/7393037/?var=3479550
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
content-length
2
x-trace-id
0ac79a4fd122903f389aa9de81550989
pragma
no-cache
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain
access-control-allow-origin
https://betshucklean.com
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
expires
Tue, 11 Jan 1994 10:00:00 GMT
img.gif
my.rtmark.net/ 		43 B
506 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=01808eaeaf8f4f81f358af11e4c84bad&z=7393037&p_rid=b69e1bc5-5cf0-42f8-acee-5313467737c1&p_src=sf
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/7393037/?var=3479550
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://betshucklean.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
https://betshucklean.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
add
betshucklean.com/log/ 		12 B
385 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=b69e1bc5-5cf0-42f8-acee-5313467737c1
Requested by
Host: betshucklean.com
URL: https://betshucklean.com/4/7393037/?var=3479550
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Content-Type
text/plain;charset=UTF-8
Referer
https://betshucklean.com/4/7393037/?var=3479550
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 10:59:41 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://betshucklean.com
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
content-length
12
favicon.ico
betshucklean.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/afu.php?zoneid=7393037&var=7393037&rid=UOc2oKHlKAQMxeQ00KE1Mg%3D%3D&rhd=false&ab2r=0&sf=1&os=win32&os_version=10.0.0&is_mobile=false&browser_version=126.0.6478.126
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Wed, 03 Jul 2024 10:59:41 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
Primary Request click.php
sozeight.com/
Redirect Chain
  • https://betshucklean.com/?z=7393037&syncedCookie=false&rhd=false
  • https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&countr...
64 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
13.50.59.231 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
Software
nginx/1.20.2 /
Resource Hash
4cee0d9332bdf04827e7b6c8c03430ab82048871f5b8bae49bc673ef2d5d3f02

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Content-Type
application/x-www-form-urlencoded
Origin
https://betshucklean.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-arch
"x86"
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version
"126.0.6478.126"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 03 Jul 2024 10:59:41 GMT
Server
nginx/1.20.2
Transfer-Encoding
chunked

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://betshucklean.com
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length
0
date
Wed, 03 Jul 2024 10:59:41 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://sozeight.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica o2 germany gmbh co.ohg&user_activity=high&countryname=DE
pragma
no-cache
referrer-policy
no-referrer
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
3978e25edfac7ac81875534599545619
favicon.ico
betshucklean.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://betshucklean.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
Referer
https://betshucklean.com/afu.php?zoneid=7393037&var=7393037&rid=UOc2oKHlKAQMxeQ00KE1Mg%3D%3D&rhd=false&ab2r=0&sf=1&os=win32&os_version=10.0.0&is_mobile=false&browser_version=126.0.6478.126
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Wed, 03 Jul 2024 10:59:41 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
arrow__up.png
sozeight.com/landers/block_land_dm_de/ 		32 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sozeight.com/landers/block_land_dm_de/arrow__up.png
Requested by
Host: sozeight.com
URL: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
13.50.59.231 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
Software
nginx/1.20.2 /
Resource Hash
4399fd13a2b71e3f70846fd5de33d293ecbba9d870115a1fdef53b3a142b62fb

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 10:59:41 GMT
Last-Modified
Mon, 07 Aug 2023 12:31:45 GMT
Server
nginx/1.20.2
ETag
"64d0e431-81c7"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33223
jquery-3.3.1.min.js
sozeight.com/landers/block_land_dm_de/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sozeight.com/landers/block_land_dm_de/jquery-3.3.1.min.js
Requested by
Host: sozeight.com
URL: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
13.50.59.231 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
Software
nginx/1.20.2 /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Origin
https://sozeight.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 10:59:41 GMT
Last-Modified
Mon, 07 Aug 2023 12:31:45 GMT
Server
nginx/1.20.2
ETag
"64d0e431-1538f"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86927
background.jpg
update48451.xyz/5005acpl00110/ 		0
0
top__icon.png
sozeight.com/landers/block_land_dm_de/ 		981 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sozeight.com/landers/block_land_dm_de/top__icon.png
Requested by
Host: sozeight.com
URL: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
13.50.59.231 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
Software
nginx/1.20.2 /
Resource Hash
247447fc2ac2e2779d5303604f23610264f15bacbdcbf0dce6532e75b6ad4512

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 10:59:41 GMT
Last-Modified
Mon, 07 Aug 2023 12:31:45 GMT
Server
nginx/1.20.2
ETag
"64d0e431-3d5"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
981
firefox__icon.png
sozeight.com/landers/block_land_dm_de/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sozeight.com/landers/block_land_dm_de/firefox__icon.png
Requested by
Host: sozeight.com
URL: https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
13.50.59.231 Stockholm, Sweden, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-50-59-231.eu-north-1.compute.amazonaws.com
Software
nginx/1.20.2 /
Resource Hash
610d547defd7fd85dc8909abe252fe3da2baa75b77a0ac9b6ee359308180dc06

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://sozeight.com/click.php?key=m1t3aj9kajenezm6xo2u&visitor_id=832321302869319924&cost=0.009812&zoneid=7393037&campaignid=8226595&device=desktop&browser=chrome&os=windows&osversion=win10&country=DE&language=de&isp=telefonica%20o2%20germany%20gmbh%20co.ohg&user_activity=high&countryname=DE
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 10:59:41 GMT
Last-Modified
Mon, 07 Aug 2023 12:31:45 GMT
Server
nginx/1.20.2
ETag
"64d0e431-15ce"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5582

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
update48451.xyz
URL
https://update48451.xyz/5005acpl00110/background.jpg

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery

6 Cookies

Domain/Path Name / Value
my.rtmark.net/ Name: ID
Value: 01808eaeaf8f4f81f358af11e4c84bad
betshucklean.com/ Name: oaidts
Value: 1720004381
betshucklean.com/ Name: OAID
Value: 01808eaeaf8f4f81f358af11e4c84bad
betshucklean.com/ Name: syncedCookie
Value: true
sozeight.com/ Name: uclick
Value: gx16ghg5m7
sozeight.com/ Name: uclickhash
Value: gx16ghg5m7-gx16ghg5m7-g6vr-4pb4-2ta36o-ci1nvr-ci1ni4-de0ff2

2 Console Messages

Source Level URL
Text
network error URL: https://byluxrayor.com/&mprtr=1
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://update48451.xyz/5005acpl00110/background.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

betshucklean.com
byluxrayor.com
choogeet.net
jouteetu.net
my.rtmark.net
propeller-tracking.com
sozeight.com
unphionetor.com
update48451.xyz
update48451.xyz
13.50.59.231
139.45.195.8
139.45.197.236
139.45.197.240
139.45.197.251
139.45.197.252
172.67.209.113
2606:4700:3037::ac43:d171
0f467a48a494f7f63968707dc43785b728d0c17f93c12937c1e5b12798f3a98a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1c707b27dad20a094fc32b05a308adc79701ea8bb288b78ed96faf455f247cac
247447fc2ac2e2779d5303604f23610264f15bacbdcbf0dce6532e75b6ad4512
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
4399fd13a2b71e3f70846fd5de33d293ecbba9d870115a1fdef53b3a142b62fb
4cee0d9332bdf04827e7b6c8c03430ab82048871f5b8bae49bc673ef2d5d3f02
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
610d547defd7fd85dc8909abe252fe3da2baa75b77a0ac9b6ee359308180dc06
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7
9273167ac26805a8ef50b2371ec7200e05b131096dadda8cdf050b24e0f639f7
a6ceb9eaa468cd19ad8d56465c845152211fd0d21d5b24b16bba061c035323f3
bd3c4a8b272acd291efd68b4b507ff43246f288a159e39cb9eeea1367e4eb3da
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d4a0cfe1f7e346cf4dfd644d5b7f113a41f28d780b4369825c65e0a3f88779bd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee6b3cd40f86564faa08edad2a3540ec618db73a3c61b21318431699c4dad557
fe85cceb474303eb80a5ca9a60b16d92208a8e0b38647647654b0c42447b51f7