lbg3ncntw5z2.com Open in urlscan Pro
172.67.194.85 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://y9tocksyvbnd.com/
Effective URL:
https://lbg3ncntw5z2.com/QMRB9g
Submission: On October 24 via api (October 24th 2024, 1:05:28 am UTC) from US — Scanned from US

Summary HTTP 30 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 12 domains to perform 30 HTTP transactions. The main IP is 172.67.194.85, located in United States and belongs to CLOUDFLARENET, US. The main domain is lbg3ncntw5z2.com.
TLS certificate: Issued by WE1 on September 26th 2024. Valid for: 3 months.

This is the only time lbg3ncntw5z2.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	172.67.167.14 172.67.167.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	172.67.164.81 172.67.164.81	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	45.133.44.52 45.133.44.52	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	45.133.44.25 45.133.44.25	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	172.67.164.241 172.67.164.241	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	159.69.161.134 159.69.161.134	24940 (HETZNER-AS) (HETZNER-AS)
2	45.133.44.53 45.133.44.53	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	157.90.84.242 157.90.84.242	24940 (HETZNER-AS) (HETZNER-AS)
1	116.202.204.105 116.202.204.105	24940 (HETZNER-AS) (HETZNER-AS)
1	2a01:4f8:c0:3... 2a01:4f8:c0:3902::2	24940 (HETZNER-AS) (HETZNER-AS)
2	172.67.194.85 172.67.194.85	13335 (CLOUDFLAR...) (CLOUDFLARENET)
30	13

2 172.67.167.14 (United States)

ASN13335 (CLOUDFLARENET, US)

y9tocksyvbnd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.67.164.81 (United States)

ASN13335 (CLOUDFLARENET, US)

kordooso.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.133.44.52 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

js.mbidadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.133.44.25 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

bid.mbidtg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.164.241 (United States)

ASN13335 (CLOUDFLARENET, US)

storage.mbidstorage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.69.161.134 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.134.161.69.159.clients.your-server.de

metricswpsh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.133.44.53 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

js.mbidinp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.90.84.242 (Ismaning, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.242.84.90.157.clients.your-server.de

fp.metricswpsh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.204.105 (Nuremberg, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.105.204.202.116.clients.your-server.de

mbddip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:c0:3902::2 (Ehingen, Germany)

ASN24940 (HETZNER-AS, DE)

mbdippex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.194.85 (United States)

ASN13335 (CLOUDFLARENET, US)

lbg3ncntw5z2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	kordooso.net kordooso.net	21 KB
3	metricswpsh.com metricswpsh.com — Cisco Umbrella Rank: 34746 fp.metricswpsh.com — Cisco Umbrella Rank: 37699	637 B
2	lbg3ncntw5z2.com lbg3ncntw5z2.com	2 KB
2	mbidinp.com js.mbidinp.com — Cisco Umbrella Rank: 176549	177 KB
2	mbidadm.com js.mbidadm.com — Cisco Umbrella Rank: 158022	39 KB
2	y9tocksyvbnd.com y9tocksyvbnd.com	22 KB
1	mbdippex.com mbdippex.com — Cisco Umbrella Rank: 174564 Failed
1	mbddip.com mbddip.com — Cisco Umbrella Rank: 168081	201 B
1	mbidstorage.com storage.mbidstorage.com — Cisco Umbrella Rank: 181520
1	mbidtg.com bid.mbidtg.com — Cisco Umbrella Rank: 168153	3 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 10912	545 B
0	google.com Failed accounts.google.com — Cisco Umbrella Rank: 18 Failed
30	12

	Domain	Requested by
12	kordooso.net	y9tocksyvbnd.com kordooso.net
2	lbg3ncntw5z2.com	y9tocksyvbnd.com
2	fp.metricswpsh.com	js.mbidadm.com
2	js.mbidinp.com	js.mbidadm.com js.mbidinp.com
2	js.mbidadm.com	y9tocksyvbnd.com js.mbidadm.com
2	y9tocksyvbnd.com	kordooso.net
1	mbdippex.com	js.mbidinp.com
1	mbddip.com	js.mbidinp.com
1	metricswpsh.com	js.mbidadm.com
1	storage.mbidstorage.com	js.mbidadm.com
1	bid.mbidtg.com	js.mbidadm.com
1	my.rtmark.net	kordooso.net
0	accounts.google.com Failed
30	13

This site contains no links.

Subject Issuer	Validity	Valid
y9tocksyvbnd.com WE1	`2024-10-09` - `2025-01-07`	3 months	crt.sh
kordooso.net WE1	`2024-10-13` - `2025-01-11`	3 months	crt.sh
js.mbidadm.com R10	`2024-10-15` - `2025-01-13`	3 months	crt.sh
rtmark.net R11	`2024-08-30` - `2024-11-28`	3 months	crt.sh
bid.mbidtg.com R10	`2024-08-29` - `2024-11-27`	3 months	crt.sh
mbidstorage.com WE1	`2024-10-21` - `2025-01-19`	3 months	crt.sh
notification.tubecup.net E5	`2024-10-07` - `2025-01-05`	3 months	crt.sh
js.mbidinp.com R10	`2024-10-19` - `2025-01-17`	3 months	crt.sh
lbg3ncntw5z2.com WE1	`2024-09-26` - `2024-12-25`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://lbg3ncntw5z2.com/QMRB9g
Frame ID: 483116633E44DE11ED8342377C88932E
Requests: 28 HTTP requests in this frame

Frame: https://storage.mbidstorage.com/log/count.html
Frame ID: 6D0883DBE10DF8F12B454C7D5052A1F0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

404 Not Found

Page URL History Show full URLs

https://y9tocksyvbnd.com/ Page URL
https://lbg3ncntw5z2.com/QMRB9g Page URL

Page Statistics

30
Requests

93 %
HTTPS

8 %
IPv6

12
Domains

13
Subdomains

13
IPs

3
Countries

265 kB
Transfer

954 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://y9tocksyvbnd.com/ Page URL
https://lbg3ncntw5z2.com/QMRB9g Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP 302
https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AcMMx-eTinpq7sDVhZix7dCpYogg8P3NayeD6Qu99oPHmtMYNIewpo7ELPypMOn-POxncGN-Tg4bNg HTTP 302
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AcMMx-equgOvL2Gi8hg79uzrXxT1lcJzDW8iOR_mhyWPwTWrqDGEOiGNN7A40TWVmDS6i6-IrsZzYg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2065610138%3A1729731922674453&ddm=0

30 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
y9tocksyvbnd.com/ 47 KB
21 KB 396ms
276ms Document
text/html 172.67.167.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://y9tocksyvbnd.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.167.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.4.16
Resource Hash: 5f74f98608d2a754bce3b3b352a567a16032e66a2e47f048c74c0ede22f1f9fa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d760ed998343360-MIA
content-encoding: br
content-type: text/html
date: Thu, 24 Oct 2024 01:05:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=abrEVwAL8pOLD7BHV6uR4E5SKyqRK62%2BLZNduQEZ9oUsdkluVfrDZIQthkim4vBhwM9dsqLySwA1Zf3wGuSJQ0Hok4SCtdAopZ3AO5YhAdZHIgmXXkJfHGqaImL1jSMmXbYL"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=32345&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4146&recv_bytes=4482&delivery_rate=487&cwnd=12000&unsent_bytes=0&cid=f0ad02979c3b4b84&ts=288&x=1" cfExtPri cfHdrFlush;dur=0
vary: accept-encoding
x-powered-by: PHP/5.4.16

GET
H3 200 micro.tag.min.js Show response
kordooso.net/pfe/current/ 45 KB
19 KB 382ms
318ms Script
application/javascript 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Requested by: Host: y9tocksyvbnd.com
URL: https://y9tocksyvbnd.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c003752f66895b19eead2f05e004a1c92ab021aeae17a6b8d69810ec24f5d61

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"6716523c-b56d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pFTu4koHUo0Nwt3DFC4d2%2BHHhBTTF4j97ma2%2FCp1T3zo8navYBKFYiyTUYTo27wDrZfq0xoF8yYddvzGjMfbvZmVpVqTInldD%2FbyvraU2p14uL6htBSJ31QA%2BSkxOvs%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31508&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4162&recv_bytes=4425&delivery_rate=488&cwnd=12000&unsent_bytes=0&cid=d2f110d38fe93c09&ts=329&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 13:08:12 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8d760edbf99fa512-MIA
server: cloudflare

GET
DATA 200
OK truncated
/ 19 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6678fbb34f3ef18c5649c7cfc1302c671ff5b1c8e9f4365fb51f3d629dab2924

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 scripts.js Show response
js.mbidadm.com/static/ 2 KB
1 KB 183ms
54ms Script
application/javascript 45.133.44.52
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.mbidadm.com/static/scripts.js
Requested by: Host: y9tocksyvbnd.com
URL: https://y9tocksyvbnd.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: cf31e107e8cb091c9477fe99de3a57a65486fe87becf0e8f469846949beff9f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: max-age=300
content-encoding: gzip
etag: W/"6719092e-6c4"
expires: Thu, 24 Oct 2024 01:10:21 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 23 Oct 2024 14:33:18 GMT
server: nginx/1.18.0
x-cdn-host-id: ds8138

GET
H2 200 scripts.m.js Show response
js.mbidadm.com/static/ 117 KB
38 KB 73ms
73ms Script
application/javascript 45.133.44.52
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.mbidadm.com/static/scripts.m.js
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 6913bf4f4d12c66c839af4bfb16272410ec65ac9ab8d703a23f42a677aef06d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: max-age=300
content-encoding: gzip
etag: W/"67190937-1d4b9"
expires: Thu, 24 Oct 2024 01:10:21 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 23 Oct 2024 14:33:27 GMT
server: nginx/1.18.0
x-cdn-host-id: ds8138

GET
H3 200 sw-check-permissions-ea38e.js
y9tocksyvbnd.com/ 0
975 B 305ms
304ms Other
application/javascript 172.67.167.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://y9tocksyvbnd.com/sw-check-permissions-ea38e.js?var=null&ymid=null&zoneId=3439771
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.167.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

content-encoding: gzip
cf-cache-status: MISS
etag: W/"620bf1ad-236"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9AQC59ePury4PHOweRs%2B9%2F9ltKKjN5q0ZOTtkR3J%2FjMtj73JOsphAvbr%2F5ImAeC3pB3rF4H6c4XKKk0PO%2BKkIjK6Pn2AceC1gi31xA7XVAckj6xjZhmRF4pjsKTJqohdwhKg"}],"group":"cf-nel","max_age":604800}
expires: Fri, 25 Oct 2024 01:05:21 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31680&sent=32&recv=22&lost=0&retrans=0&sent_bytes=26208&recv_bytes=5396&delivery_rate=241814&cwnd=24000&unsent_bytes=0&cid=f0ad02979c3b4b84&ts=1056&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/javascript
last-modified: Tue, 15 Feb 2022 18:32:13 GMT
vary: Accept-Encoding
priority: u=4,i
cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d760ede489c3360-MIA
server: cloudflare

POST
H3 200 zone
kordooso.net/ 0
767 B 315ms
315ms Ping
text/plain 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kordooso.net/zone?pub=0&zone_id=3439771&is_mobile=false&domain=y9tocksyvbnd.com&var=null&ymid=null&var_3=&var_4=&dsig=&tg=1&sw=3.1.565&trace_id=177c80ad-eb87-45de-b07b-3a689c6972ae&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=&drf=

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3W7EOLxvJs7XV3zlmMqLXzZXSKFOivUOoTi1G%2BuNsRPrKVXjQPux8wKSHo5c3ePdHZRZ%2BE8cazxnRNV1%2BbbrPDdvXNydPc1%2BTrkGLVM7HRvFbijpeBoskWC38ce5AA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31872&sent=36&recv=32&lost=0&retrans=0&sent_bytes=25921&recv_bytes=10848&delivery_rate=245259&cwnd=24000&unsent_bytes=0&cid=d2f110d38fe93c09&ts=699&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 24 Oct 2024 01:05:21 GMT
priority: u=4,i
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
cf-ray: 8d760ede4e2ba512-MIA
access-control-allow-origin: https://y9tocksyvbnd.com
content-length: 0
server: cloudflare

POST
H3 200 event
kordooso.net/ 0
0 303ms
302ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
545 B 694ms
138ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=3439771&checkDuplicate=true&ymid=null&var=null&source=pusher

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

970a262debb269e8bd811774720a51b650b9f4af1d3b4db523dd18552bc6571b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

strict-transport-security: max-age=1
access-control-expose-headers: Authorization
timing-allow-origin: *, *
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
x-content-type-options: nosniff
access-control-allow-origin: https://y9tocksyvbnd.com
content-length: 65
date: Thu, 24 Oct 2024 01:05:22 GMT
content-type: application/json; charset=utf-8
server: nginx
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token

POST
H3 200 event
kordooso.net/ 0
0 299ms
297ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 302ms
300ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 309ms
306ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 318ms
316ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

GET
H2 200 242901 Show response
bid.mbidtg.com/tags/ 2 KB
3 KB 306ms
175ms XHR
application/json 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.mbidtg.com/tags/242901?version_name=c&domain=y9tocksyvbnd.com
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.24.0 /
Resource Hash: e444b7862c76704a9b96180dbdc6ef23edb69e13c532331418fcd43e82401a2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

x-proxy-cache: MISS
cache-control: max-age=300, public
access-control-allow-origin: *
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/json
server: nginx/1.24.0
x-cdn-host-id: ds8138

GET
H3 200 zone Show response
kordooso.net/ 567 B
1 KB 302ms
300ms Fetch
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kordooso.net/zone?pub=0&zone_id=3439771&is_mobile=false&domain=y9tocksyvbnd.com&var=null&ymid=null&var_3=&var_4=&dsig=&tg=1&sw=3.1.565&trace_id=177c80ad-eb87-45de-b07b-3a689c6972ae&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiIiLCJiaXRuZXNzIjoiIiwiYnJhbmRzIjpbXSwiZnVsbFZlcnNpb25MaXN0IjpbXSwibW9iaWxlIjpmYWxzZSwibW9kZWwiOiIiLCJwbGF0Zm9ybSI6IiIsInBsYXRmb3JtVmVyc2lvbiI6IiIsIndvdzY0IjpmYWxzZX0=

Requested by

Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c510330d2074cb8a6dbad34818e6158c4ad715171245b303c5bf29773a1680fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3XH8oFzYpHoRJZc%2FMbUCk4FbiaXYS%2F37n1BjxbiCI%2BRy8zgJysbb0dp0GyTEPlASLdeGBHo1zLtPQarBvEt7Kti8ZQzSYFeDROaU1NLMe0oBC66a5ZnNEJvmhh6vnCQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32840&sent=43&recv=36&lost=0&retrans=0&sent_bytes=29326&recv_bytes=11047&delivery_rate=10976&cwnd=24000&unsent_bytes=0&cid=d2f110d38fe93c09&ts=738&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 24 Oct 2024 01:05:21 GMT
content-type: application/json; charset=utf-8
priority: u=1,i
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
cf-ray: 8d760edeaedca512-MIA
access-control-allow-origin: https://y9tocksyvbnd.com
server: cloudflare

POST
H3 200 event
kordooso.net/ 0
0 309ms
303ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

GET
H3 200 count.html
storage.mbidstorage.com/log/ Frame 6D08 0
0 248ms
192ms Document
text/html 172.67.164.241
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.mbidstorage.com/log/count.html
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.m.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://y9tocksyvbnd.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d760ee0f97d748a-MIA
content-encoding: br
content-type: text/html
date: Thu, 24 Oct 2024 01:05:22 GMT
last-modified: Mon, 18 Sep 2023 14:39:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FqoIQRSCWvVGqikF8kOlGqsEIiEF4jAH5K08MJ%2Ff9c8jxcfVjjCjSs9gJyZ5GuFbVMbKeo0H8TwB%2By67WCjR%2BmsewfAV9SpAtDJSrGiPZQjhiqyZhqq0sT6OjdqZ1%2FCgyUtdoQ0y26WN%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=31500&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4174&recv_bytes=4510&delivery_rate=490&cwnd=12000&unsent_bytes=0&cid=40bc12b6ce6f3abe&ts=202&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-request-id: f1e4ad98ed350b3131210982d1b959f7

GET
H2 200 track Show response
metricswpsh.com/in/ 0
201 B 462ms
151ms XHR
text/plain 159.69.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://metricswpsh.com/in/track?data=eyJ3bCI6MSwic3ViaWQiOjAsInVzZXJfaWQiOiI2OTQzMTQxODY5OTQ5MjU2MDAwIiwidGltZXpvbmUiOi0xMCwidmVyIjoiMy4xMzEuMSIsInRhZ19pZCI6MjQyOTAxLCJzY3JlZW5fcmVzb2x1dGlvbiI6IjE2MDB4MTIwMCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiUGFjaWZpYy9Ib25vbHVsdSIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjMzLCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjB9
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.m.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 159.69.161.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.134.161.69.159.clients.your-server.de
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: *
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Oct 2024 01:05:22 GMT
vary: Origin
server: nginx/1.18.0
access-control-allow-headers: Content-Type

GET
H2 200 npush.m.js Show response
js.mbidinp.com/npc/sdk/wpu/ 185 KB
51 KB 249ms
113ms Script
application/javascript 45.133.44.53
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.mbidinp.com/npc/sdk/wpu/npush.m.js
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e515313a3b4f38bca8e2e85b2147ede397c086dc829b815215ce057d23b5c6aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: max-age=300
content-encoding: gzip
etag: W/"671780aa-2e315"
expires: Thu, 24 Oct 2024 01:10:22 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
date: Thu, 24 Oct 2024 01:05:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 22 Oct 2024 10:38:34 GMT
server: nginx/1.18.0
x-cdn-host-id: ds8138

POST
H/1.1 200
OK fp
fp.metricswpsh.com/ 60 B
436 B 477ms
159ms XHR
application/json 157.90.84.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fp.metricswpsh.com/fp?tag_id=242901
Requested by: Host: js.mbidadm.com
URL: https://js.mbidadm.com/static/scripts.m.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 157.90.84.242 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.242.84.90.157.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://y9tocksyvbnd.com
Content-Length: 60
Date: Thu, 24 Oct 2024 01:05:22 GMT
Content-Type: application/json; charset=UTF-8
Vary: Origin
Server: nginx/1.20.1

OPTIONS
H/1.1 204
No Content fp
fp.metricswpsh.com/ Frame 0
0 473ms
154ms Preflight 157.90.84.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fp.metricswpsh.com/fp?tag_id=242901
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 157.90.84.242 Ismaning, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.242.84.90.157.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://y9tocksyvbnd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: https://y9tocksyvbnd.com
Connection: keep-alive
Date: Thu, 24 Oct 2024 01:05:22 GMT
Server: nginx/1.20.1
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H3 200 event
kordooso.net/ 0
0 167ms
166ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

GET

identifier
accounts.google.com/v3/signin/
Redirect Chain

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AcMMx-eTinpq7sDVhZix7dCpYogg8P3NayeD6Qu99oPHmtMYNIewpo7ELPypM...
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AcMMx-equgOvL2Gi8hg79uzrXxT1lcJzDW8iOR_mhyWPwTWrqDGEOiGNN7A40TWVmDS6i6-IrsZzYg&passive...

0
0

GET
H2 200 nmain.m.js Show response
js.mbidinp.com/skins/ 535 KB
127 KB 64ms
63ms Script
application/javascript 45.133.44.53
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.mbidinp.com/skins/nmain.m.js
Requested by: Host: js.mbidinp.com
URL: https://js.mbidinp.com/npc/sdk/wpu/npush.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 3bd07f8473833018a981c20ef4c2faad96989ee59540635827dce4b8dda1d03f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: max-age=300
content-encoding: gzip
etag: W/"671780a4-85bed"
expires: Thu, 24 Oct 2024 01:10:22 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
date: Thu, 24 Oct 2024 01:05:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 22 Oct 2024 10:38:28 GMT
server: nginx/1.18.0
x-cdn-host-id: ds8138

GET
H2 200 dip
mbddip.com/in/ 0
201 B 469ms
147ms XHR
text/plain 116.202.204.105
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mbddip.com/in/dip?site=native-push&wl=1&event_id=b50b6a16-bf75-4f06-955d-7d035ad96cf0&subid=1338910650&sid=1832830232&spot_id=2004487&created_at=2024-10-23&timezone=-10&ver=8.196.0&is_native=1
Requested by: Host: js.mbidinp.com
URL: https://js.mbidinp.com/npc/sdk/wpu/npush.m.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 116.202.204.105 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.105.204.202.116.clients.your-server.de
Software: nginx/1.24.0 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://y9tocksyvbnd.com/

Response headers

cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: *
access-control-allow-origin: *
content-length: 0
date: Thu, 24 Oct 2024 01:05:22 GMT
vary: Origin
server: nginx/1.24.0
access-control-allow-headers: Content-Type

POST multy
mbdippex.com/in/ 0
0

OPTIONS
H2 204 multy
mbdippex.com/in/ Frame 0
0 470ms
149ms Preflight 2a01:4f8:c0:3902::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mbdippex.com/in/multy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a01:4f8:c0:3902::2 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: nginx/1.24.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://y9tocksyvbnd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: *
access-control-allow-origin: *
cache-control: no-transform, no-cache, no-store, must-revalidate
date: Thu, 24 Oct 2024 01:05:22 GMT
pragma: no-cache
server: nginx/1.24.0
vary: Origin

POST
H3 200 event
kordooso.net/ 0
0 171ms
171ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

POST
H3 200 event
kordooso.net/ 0
0 183ms
182ms Ping
application/json 172.67.164.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kordooso.net/event
Requested by: Host: kordooso.net
URL: https://kordooso.net/pfe/current/micro.tag.min.js?z=3439771&sw=/sw-check-permissions-ea38e.js&ymid=null&var=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.164.81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://y9tocksyvbnd.com/

Response headers

GET
H3 404 Primary Request QMRB9g Show response
lbg3ncntw5z2.com/ 147 B
786 B 367ms
310ms Document
text/html 172.67.194.85
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lbg3ncntw5z2.com/QMRB9g
Requested by: Host: y9tocksyvbnd.com
URL: https://y9tocksyvbnd.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.85 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54

Request headers

Referer: https://y9tocksyvbnd.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d760ee50ae6748e-MIA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 24 Oct 2024 01:05:23 GMT
expires: Thu, 24 Oct 2024 01:05:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qLRKbCuSGyML7PYsaawXeFWSdmaBAob%2FBiApLQCdtax7n8Rgcbac4m5ER8%2FcpDSDizvlOEPCfRXylHig4P29CzFn4X9OK4JgLVilXLiXJXwjXemCcB0NjiaANMgzMlRCGLJb"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=34598&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4174&recv_bytes=4504&delivery_rate=496&cwnd=12000&unsent_bytes=0&cid=4aa43d2c990c6c9f&ts=318&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H3 404 favicon.ico
lbg3ncntw5z2.com/ 548 B
753 B 284ms
284ms Other
text/html 172.67.194.85
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lbg3ncntw5z2.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.85 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://lbg3ncntw5z2.com/QMRB9g

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=45lzPXFd4WkFMBOnQn8FSXMym4%2BG89JUhmNVI2ouFFg1Q3uhduguO89Yv4LyqLTuwrwN2yBrRZ6E0Tn1xIq3Fz3vah7lvSewAqr1TEhdAZAg0eCz3gqGS0NyLvaRa5bknWp4"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d760ee74ea6748e-MIA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=35816&sent=16&recv=13&lost=0&retrans=0&sent_bytes=5055&recv_bytes=4942&delivery_rate=22018&cwnd=12000&unsent_bytes=0&cid=4aa43d2c990c6c9f&ts=647&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 24 Oct 2024 01:05:23 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: accounts.google.com
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=AcMMx-equgOvL2Gi8hg79uzrXxT1lcJzDW8iOR_mhyWPwTWrqDGEOiGNN7A40TWVmDS6i6-IrsZzYg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2065610138%3A1729731922674453&ddm=0

Domain: mbdippex.com
URL: https://mbdippex.com/in/multy

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			my.rtmark.net/	1970-01-21 09:14:27	Name: ID Value: 0180ffacbd6841a5ebc4e8160b196241
			fp.metricswpsh.com/	1970-01-21 09:14:27	Name: id Value: 9385712931218153094

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://y9tocksyvbnd.com/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A0601D00140E0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://y9tocksyvbnd.com/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A0301D00140E0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://lbg3ncntw5z2.com/QMRB9g Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lbg3ncntw5z2.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
bid.mbidtg.com
fp.metricswpsh.com
js.mbidadm.com
js.mbidinp.com
kordooso.net
lbg3ncntw5z2.com
mbddip.com
mbdippex.com
metricswpsh.com
my.rtmark.net
storage.mbidstorage.com
y9tocksyvbnd.com
accounts.google.com
mbdippex.com
116.202.204.105
139.45.195.8
157.90.84.242
159.69.161.134
172.67.164.241
172.67.164.81
172.67.167.14
172.67.194.85
2a01:4f8:c0:3902::2
45.133.44.25
45.133.44.52
45.133.44.53
3bd07f8473833018a981c20ef4c2faad96989ee59540635827dce4b8dda1d03f
5f74f98608d2a754bce3b3b352a567a16032e66a2e47f048c74c0ede22f1f9fa
6678fbb34f3ef18c5649c7cfc1302c671ff5b1c8e9f4365fb51f3d629dab2924
6913bf4f4d12c66c839af4bfb16272410ec65ac9ab8d703a23f42a677aef06d3
8c003752f66895b19eead2f05e004a1c92ab021aeae17a6b8d69810ec24f5d61
970a262debb269e8bd811774720a51b650b9f4af1d3b4db523dd18552bc6571b
c510330d2074cb8a6dbad34818e6158c4ad715171245b303c5bf29773a1680fb
cf31e107e8cb091c9477fe99de3a57a65486fe87becf0e8f469846949beff9f3
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e444b7862c76704a9b96180dbdc6ef23edb69e13c532331418fcd43e82401a2b
e515313a3b4f38bca8e2e85b2147ede397c086dc829b815215ce057d23b5c6aa
ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54

lbg3ncntw5z2.com Open in urlscan Pro 172.67.194.85 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

30 Requests

93 %HTTPS

8 %IPv6

12 Domains

13 Subdomains

13 IPs

3 Countries

265 kBTransfer

954 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

lbg3ncntw5z2.com Open in urlscan Pro
172.67.194.85 Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

93 %
HTTPS

8 %
IPv6

12
Domains

13
Subdomains

13
IPs

3
Countries

265 kB
Transfer

954 kB
Size

2
Cookies

30 HTTP transactions
1 data transactions