www.critch.de Open in urlscan Pro
78.46.10.196 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sp.popcash.net/sgo/ad?p=185&w=433179&t=501f95cd00b71a65&r=aHR0cCUzQSUyRiUyRnd3dzAucHJvamVjdC1mcmVlL...
Effective URL:
http://www.critch.de/nullstartkapital/
Submission: On July 10 via manual (July 10th 2018, 8:38:57 pm UTC) from US

Summary HTTP 42 Redirects Behaviour Indicators

Summary

This website contacted 15 IPs in 7 countries across 40 domains to perform 42 HTTP transactions. The main IP is 78.46.10.196, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.critch.de.

This is the only time www.critch.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	107.21.36.248 107.21.36.248	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	109.206.164.148 109.206.164.148	50245 (SERVEREL-AS) (SERVEREL-AS)
1	104.244.42.1 104.244.42.1	13414 (TWITTER) (TWITTER - Twitter Inc.)
1 2	2a03:2880:f11... 2a03:2880:f11c:8186:face:b00c:0:50fb	32934 (FACEBOOK) (FACEBOOK - Facebook)
4	2a00:1450:400... 2a00:1450:4001:812::200d	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1288:80:... 2a00:1288:80:800::8001	203220 (YAHOO-DEB) (YAHOO-DEB)
1	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY - Fastly)
1 1	2400:cb00:204... 2400:cb00:2048:1::6814:802e	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2	216.172.60.242 216.172.60.242	50245 (SERVEREL-AS) (SERVEREL-AS)
1	34.197.168.203 34.197.168.203	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	35.168.255.103 35.168.255.103	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	64.111.199.222 64.111.199.222	23393 (NUCDN) (NUCDN - NuCDN LLC)
2 2	78.46.155.195 78.46.155.195	24940 (HETZNER-AS) (HETZNER-AS)
1 2	78.46.10.196 78.46.10.196	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
2 4	188.40.20.23 188.40.20.23	24940 (HETZNER-AS) (HETZNER-AS)
1 1	67.199.248.10 67.199.248.10	395224 (BITLY-AS) (BITLY-AS - Bitly Inc)
42	15

3 107.21.36.248 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-107-21-36-248.compute-1.amazonaws.com

sp.popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 109.206.164.148 (Netherlands)

ASN50245 (SERVEREL-AS, NL)
PTR: 109.206.164.148.serverel.net

xebadu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.1 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8186:face:b00c:0:50fb (Ireland) 1 redirects

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::200d (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:817::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

plus.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::8001 (United Kingdom)

ASN203220 (YAHOO-DEB, DE)

www.tumblr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.49 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

de.foursquare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:cb00:2048:1::6814:802e (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.172.60.242 (United States) 1 redirects

ASN50245 (SERVEREL-AS, NL)
PTR: 242.60.serverel.net

18007.adslaney.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
1976879403.nutty.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.197.168.203 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-197-168-203.compute-1.amazonaws.com

sax.peakonspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.168.255.103 (Seattle, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-168-255-103.compute-1.amazonaws.com

eavlqn.peakonsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.111.199.222 (Weehawken, United States) 1 redirects

ASN23393 (NUCDN - NuCDN LLC, US)

syndication.exdynsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 78.46.155.195 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: dedi3961.your-server.de

www1.lustich.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 78.46.10.196 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: dedi1996.your-server.de

www.critch.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 188.40.20.23 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.23.20.40.188.clients.your-server.de

www.privatelink.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.10 (United States) 1 redirects

ASN395224 (BITLY-AS - Bitly Inc, US)

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	google.com 1 redirects accounts.google.com plus.google.com	83 KB
4	privatelink.de 2 redirects www.privatelink.de	533 B
4	popcash.net 3 redirects sp.popcash.net popcash.net	1 KB
2	google-analytics.com www.google-analytics.com	14 KB
2	critch.de 1 redirects www.critch.de	1 KB
2	lustich.de 2 redirects www1.lustich.de	501 B
2	exdynsrv.com 1 redirects syndication.exdynsrv.com	2 KB
2	facebook.com 1 redirects www.facebook.com	13 KB
2	xebadu.com xebadu.com	4 KB
1	bit.ly 1 redirects bit.ly	400 B
1	googletagmanager.com www.googletagmanager.com	24 KB
1	peakonsrv.com 1 redirects eavlqn.peakonsrv.com	896 B
1	peakonspot.com sax.peakonspot.com	7 KB
1	nutty.pro 1976879403.nutty.pro	975 B
1	adslaney.com 1 redirects 18007.adslaney.com	434 B
1	foursquare.com de.foursquare.com	7 KB
1	tumblr.com www.tumblr.com	8 KB
1	twitter.com twitter.com	269 B
0	vk.com Failed vk.com Failed
0	indeed.com Failed secure.indeed.com Failed
0	bitbucket.org Failed bitbucket.org Failed
0	meetup.com Failed secure.meetup.com Failed
0	disqus.com Failed disqus.com Failed
0	airbnb.com Failed www.airbnb.com Failed
0	500px.com Failed 500px.com Failed
0	paypal.com Failed www.paypal.com Failed
0	khanacademy.org Failed www.khanacademy.org Failed
0	slack.com Failed slack.com Failed
0	edx.org Failed courses.edx.org Failed
0	carbonmade.com Failed carbonmade.com Failed
0	medium.com Failed medium.com Failed
0	github.com Failed github.com Failed
0	steampowered.com Failed store.steampowered.com Failed
0	battle.net Failed eu.battle.net Failed
0	pinterest.com Failed www.pinterest.com Failed
0	dropbox.com Failed www.dropbox.com Failed
0	expedia.de Failed www.expedia.de Failed
0	reddit.com Failed www.reddit.com Failed
0	live.com Failed login.live.com Failed
0	squareup.com Failed squareup.com Failed
42	40

	Domain	Requested by
4	www.privatelink.de	2 redirects www.critch.de
4	accounts.google.com	xebadu.com
3	sp.popcash.net	2 redirects xebadu.com
2	www.google-analytics.com	www.googletagmanager.com www.critch.de
2	www.critch.de	1 redirects syndication.exdynsrv.com
2	www1.lustich.de	2 redirects
2	syndication.exdynsrv.com	1 redirects sax.peakonspot.com
2	www.facebook.com	1 redirects xebadu.com
2	xebadu.com	xebadu.com
1	bit.ly	1 redirects
1	www.googletagmanager.com	www.critch.de
1	eavlqn.peakonsrv.com	1 redirects
1	sax.peakonspot.com	1976879403.nutty.pro
1	1976879403.nutty.pro	sp.popcash.net
1	18007.adslaney.com	1 redirects
1	popcash.net	1 redirects
1	de.foursquare.com	xebadu.com
1	www.tumblr.com	xebadu.com
1	plus.google.com	1 redirects
1	twitter.com	xebadu.com
0	vk.com Failed	xebadu.com
0	secure.indeed.com Failed	xebadu.com
0	bitbucket.org Failed	xebadu.com
0	secure.meetup.com Failed	xebadu.com
0	disqus.com Failed	xebadu.com
0	www.airbnb.com Failed	xebadu.com
0	500px.com Failed	xebadu.com
0	www.paypal.com Failed	xebadu.com
0	www.khanacademy.org Failed	xebadu.com
0	slack.com Failed	xebadu.com
0	courses.edx.org Failed	xebadu.com
0	carbonmade.com Failed	xebadu.com
0	medium.com Failed	xebadu.com
0	github.com Failed	xebadu.com
0	store.steampowered.com Failed	xebadu.com
0	eu.battle.net Failed
0	www.pinterest.com Failed	xebadu.com
0	www.dropbox.com Failed	xebadu.com
0	www.expedia.de Failed	xebadu.com
0	www.reddit.com Failed	xebadu.com
0	login.live.com Failed	xebadu.com
0	squareup.com Failed	xebadu.com
42	42

This site contains no links.

Subject Issuer	Validity	Valid
sax.peakonspot.com COMODO RSA Domain Validation Secure Server CA	`2018-03-08` - `2019-03-08`	a year	crt.sh
exdynsrv.com Let's Encrypt Authority X3	`2018-05-07` - `2018-08-05`	3 months	crt.sh
*.privatelink.de COMODO RSA Domain Validation Secure Server CA	`2017-09-08` - `2020-09-07`	3 years	crt.sh

This page contains 3 frames:

Primary Page: http://www.critch.de/nullstartkapital/
Frame ID: 46D586E0338831BC7D8517A4F6B30B31
Requests: 40 HTTP requests in this frame

Frame: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA
Frame ID: E026FB9FDA54088985C736011DC130F1
Requests: 1 HTTP requests in this frame

Frame: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Frame ID: 55A4922126BBE850E059B0FA23B080B8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://sp.popcash.net/sgo/ad?p=185&w=433179&t=501f95cd00b71a65&r=aHR0cCUzQSUyRiUyRnd3d... HTTP 303
http://xebadu.com/afu.php?var=0&zoneid=1542175 Page URL
http://xebadu.com/?zoneid=1542175&r=%2Fmb%2Fhan%2Fdl&nojs=0&x=1600&y=1200&t=0&ix=0&fs=0&timeou... Page URL
http://popcash.net/world/go/122237/366514 HTTP 301
http://sp.popcash.net/go/122237/366514 Page URL
http://sp.popcash.net/sgo/ad?p=122237&w=366514&t=4839282f132bb76a&r=aHR0cCUzQSUyRiUyRnhlYmFkdS5jb2... HTTP 303
http://18007.adslaney.com/d.php?campaing=18008&link_id=gXs4C&source=366514 HTTP 302
http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086 Page URL
https://sax.peakonspot.com/pops/filter.php?rd=eavlqn.peakonsrv.com&id=15312551233184086071327329&tid=47... Page URL
http://eavlqn.peakonsrv.com/?&version=1&id=15312551233184086071327329&t=imp&tid=4798&filter=1&ftype=js&t... HTTP 302
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMl... Page URL
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMl... HTTP 302
http://www1.lustich.de/link HTTP 301
http://www1.lustich.de/link/ HTTP 302
http://www.critch.de/nullstartkapital HTTP 301
http://www.critch.de/nullstartkapital/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Page Statistics

42
Requests

10 %
HTTPS

33 %
IPv6

40
Domains

42
Subdomains

15
IPs

7
Countries

164 kB
Transfer

127 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sp.popcash.net/sgo/ad?p=185&w=433179&t=501f95cd00b71a65&r=aHR0cCUzQSUyRiUyRnd3dzAucHJvamVjdC1mcmVlLXR2LmFnJTJGd2F0Y2glMkYlM0ZhZmZfaWQlM0QzNjMxMTg4&vw=1904&vh=977 HTTP 303
http://xebadu.com/afu.php?var=0&zoneid=1542175 Page URL
http://xebadu.com/?zoneid=1542175&r=%2Fmb%2Fhan%2Fdl&nojs=0&x=1600&y=1200&t=0&ix=0&fs=0&timeout=0&var=0&ymid=&pb=692bbb095d8234a53cda2d820525aecb1531262319&pid=&sp= Page URL
http://popcash.net/world/go/122237/366514 HTTP 301
http://sp.popcash.net/go/122237/366514 Page URL
http://sp.popcash.net/sgo/ad?p=122237&w=366514&t=4839282f132bb76a&r=aHR0cCUzQSUyRiUyRnhlYmFkdS5jb20lMkZhZnUucGhwJTNGem9uZWlkJTNEMTIzNzQ1NyUyNnZhciUzRDE1NDIxNzU=&vw=1600&vh=1200 HTTP 303
http://18007.adslaney.com/d.php?campaing=18008&link_id=gXs4C&source=366514 HTTP 302
http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086 Page URL
https://sax.peakonspot.com/pops/filter.php?rd=eavlqn.peakonsrv.com&id=15312551233184086071327329&tid=4798&t=imp&end=2 Page URL
http://eavlqn.peakonsrv.com/?&version=1&id=15312551233184086071327329&t=imp&tid=4798&filter=1&ftype=js&trs=15312551267939846&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined HTTP 302
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI= Page URL
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI%3D&p=https%3A%2F%2Fadexchange-708354.com&tested=1&check=4aac90945af22701a235bc3636c0a0d2&screen_resolution=1600x1200&container_resolution=1600x1200&iframe=0 HTTP 302
http://www1.lustich.de/link HTTP 301
http://www1.lustich.de/link/ HTTP 302
http://www.critch.de/nullstartkapital HTTP 301
http://www.critch.de/nullstartkapital/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://sp.popcash.net/sgo/ad?p=185&w=433179&t=501f95cd00b71a65&r=aHR0cCUzQSUyRiUyRnd3dzAucHJvamVjdC1mcmVlLXR2LmFnJTJGd2F0Y2glMkYlM0ZhZmZfaWQlM0QzNjMxMTg4&vw=1904&vh=977 HTTP 303
http://xebadu.com/afu.php?var=0&zoneid=1542175

Request Chain 3

https://www.facebook.com/login.php?next=https://www.facebook.com/favicon.ico?_rdr=p HTTP 302
https://www.facebook.com/w/

Request Chain 6

https://plus.google.com/up/accounts/upgrade/?continue=https://plus.google.com/favicon.ico HTTP 302
https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico&followup=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico

Request Chain 7

https://login.skype.com/login?message=signin_continue&redirect_uri=https://secure.skype.com/favicon.ico HTTP 302
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1531255119&rver=7.0.6730.0&wp=MBI_SSL&wreply=https%3A%2F%2Flw.skype.com%2Flogin%2Foauth%2Fproxy%3Fredirect_uri%3Dhttps%253A%252F%252Fsecure.skype.com%252Ffavicon.ico%26site_name%3Dlw.skype.com&lc=1033&id=293290&mkt=en&psi=skype&lw=1&cobrandid=2befc4b5-19e3-46e8-8347-77317a16a5a5&client_flight=hsu%2CReservedFlight33%2CReservedFlight67

Request Chain 14

https://eu.battle.net/login/de/index?ref=https://eu.battle.net/favicon.ico HTTP 302
https://eu.battle.net/login/de/?ref=https://eu.battle.net/favicon.ico

Request Chain 32

http://popcash.net/world/go/122237/366514 HTTP 301
http://sp.popcash.net/go/122237/366514

Request Chain 33

http://sp.popcash.net/sgo/ad?p=122237&w=366514&t=4839282f132bb76a&r=aHR0cCUzQSUyRiUyRnhlYmFkdS5jb20lMkZhZnUucGhwJTNGem9uZWlkJTNEMTIzNzQ1NyUyNnZhciUzRDE1NDIxNzU=&vw=1600&vh=1200 HTTP 303
http://18007.adslaney.com/d.php?campaing=18008&link_id=gXs4C&source=366514 HTTP 302
http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086

Request Chain 35

http://eavlqn.peakonsrv.com/?&version=1&id=15312551233184086071327329&t=imp&tid=4798&filter=1&ftype=js&trs=15312551267939846&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined HTTP 302
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI=

Request Chain 37

https://www.privatelink.de/sf/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA HTTP 301
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA

Request Chain 38

http://bit.ly/2oHl00R HTTP 301
https://www.privatelink.de/sf/?http://privatelink.de/%3Fhttps://t.co/z7rulNZ8zx HTTP 301
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx

42 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

afu.php Show response
xebadu.com/
Redirect Chain

http://sp.popcash.net/sgo/ad?p=185&w=433179&t=501f95cd00b71a65&r=aHR0cCUzQSUyRiUyRnd3dzAucHJvamVjdC1mcmVlLXR2LmFnJTJGd2F0Y2glMkYlM0ZhZmZfaWQlM0QzNjMxMTg4&vw=1904&vh=977
http://xebadu.com/afu.php?var=0&zoneid=1542175

9 KB
3 KB

25ms
12ms

Document
text/html

109.206.164.148
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xebadu.com/afu.php?var=0&zoneid=1542175
Protocol: HTTP/1.1
Server: 109.206.164.148 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 109.206.164.148.serverel.net
Software: nginx /
Resource Hash: add9578341b29c26a3dae5700028ecd79f42ce75e33f5055a13284d48a268b5f

Request headers

Host: xebadu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31

Response headers

Server: nginx
Date: Tue, 10 Jul 2018 20:38:39 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
Timing-Allow-Origin: *

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Tue, 10 Jul 2018 20:38:39 GMT
Location: http://xebadu.com/afu.php?var=0&zoneid=1542175
Server: nginx/1.12.2
Content-Length: 77
Connection: keep-alive

GET login
squareup.com/ 0
0

GET
S 404 login
twitter.com/ 0
269 B 142ms
116ms Image
text/plain 104.244.42.1
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twitter.com/login?redirect_after_login=/favicon.ico
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 104.244.42.1 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: tsa_o /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
x-response-time: 109
date: Tue, 10 Jul 2018 20:38:39 GMT
server: tsa_o
x-connection-hash: e84056f40f1e4af92d55e597c6e9fe1b
content-length: 0

GET
S

200

/
www.facebook.com/w/
Redirect Chain

https://www.facebook.com/login.php?next=https://www.facebook.com/favicon.ico?_rdr=p
https://www.facebook.com/w/

0
13 KB

126ms
126ms

Image
text/html

2a03:2880:f11c:8186:face:b00c:0:50fb
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/w/
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a03:2880:f11c:8186:face:b00c:0:50fb , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
access-control-allow-methods: OPTIONS
content-type: text/html; charset="utf-8"
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

x-fb-debug: VRRg5lhR49t22uiyac+V5uGpG++i+VCGLw2re8JePCVeXYV5Fm08l3Lj7n8fQLbK9XPV+6LpLdt5dcXJ2Ym9zQ==
vary: Origin
status: 302
location: https://www.facebook.com/w/
date: Tue, 10 Jul 2018 20:38:39 GMT
strict-transport-security: max-age=15552000; preload
access-control-allow-methods: OPTIONS
content-type: text/html; charset="utf-8"
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
access-control-allow-credentials: true
content-length: 0

GET
S 200 ServiceLogin
accounts.google.com/ 0
11 KB 100ms
74ms Image
text/html 2a00:1450:4001:812::200d
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.google.com/favicon.ico&uilel=3&hl=en&service=mail
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a00:1450:4001:812::200d , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html; charset=utf-8

GET
S 200 ServiceLogin
accounts.google.com/ 0
8 KB 75ms
48ms Image
text/html 2a00:1450:4001:812::200d
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.youtube.com/favicon.ico&uilel=3&hl=en&service=youtube
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a00:1450:4001:812::200d , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html; charset=utf-8

GET
S

200

ServiceLogin
accounts.google.com/
Redirect Chain

https://plus.google.com/up/accounts/upgrade/?continue=https://plus.google.com/favicon.ico
https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico&followup=https://plus.google.com...

0
28 KB

49ms
49ms

Image
text/html

2a00:1450:4001:812::200d
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico&followup=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a00:1450:4001:812::200d , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html; charset=utf-8

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy-report-only: script-src 'report-sample' 'nonce-lqlvvQmu/9XGA/ih+nHlA5zIhZY' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /_/PlusAppUi/cspreport
server: ESF
status: 302
date: Tue, 10 Jul 2018 20:38:39 GMT
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
location: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico&followup=https://plus.google.com/up/accounts/upgrade/?continue%3Dhttps://plus.google.com/favicon.ico
x-xss-protection: 1; mode=block
content-security-policy: script-src 'report-sample' 'nonce-lqlvvQmu/9XGA/ih+nHlA5zIhZY' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /_/PlusAppUi/cspreport, script-src 'nonce-lqlvvQmu/9XGA/ih+nHlA5zIhZY' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://s.ytimg.com https://www.googleapis.com https://support.google.com https://youtube.com https://youtube.googleapis.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/PlusAppUi/cspreport
content-type: application/binary
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 0
x-content-type-options: nosniff

GET

https://login.skype.com/login?message=signin_continue&redirect_uri=https://secure.skype.com/favicon.ico
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1531255119&rver=7.0.6730.0&wp=MBI_SSL&wreply=https%3A%2F%2Flw.skype.com%2Flogin%2Foauth%2Fproxy%3Fredirect_uri%3Dhttps%253A%252F%252Fsecur...

0
0

GET login
www.reddit.com/ 0
0

GET
S 200 login
www.tumblr.com/ 0
8 KB 212ms
177ms Image
text/html 2a00:1288:80:800::8001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tumblr.com/login?redirect_to=/favicon.ico
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a00:1288:80:800::8001 , United Kingdom, ASN203220 (YAHOO-DEB, DE),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8

GET login
www.expedia.de/user/ 0
0

GET login
www.dropbox.com/ 0
0

GET /
www.pinterest.com/login/ 0
0

GET
S 200 login
de.foursquare.com/ 0
7 KB 128ms
103ms Image
text/html 151.101.114.49
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://de.foursquare.com/login?continue=/favicon.ico
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 151.101.114.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
content-type: text/html; charset=utf-8

GET

/
eu.battle.net/login/de/
Redirect Chain

https://eu.battle.net/login/de/index?ref=https://eu.battle.net/favicon.ico
https://eu.battle.net/login/de/?ref=https://eu.battle.net/favicon.ico

0
0

GET /
store.steampowered.com/login/ 0
0

GET
S 200 ServiceLogin
accounts.google.com/ 0
34 KB 60ms
59ms Image
text/html 2a00:1450:4001:812::200d
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?service=blogger&hl=de&passive=1209600&continue=https://www.blogger.com/favicon.ico
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: SPDY
Server: 2a00:1450:4001:812::200d , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html; charset=utf-8

GET login
github.com/ 0
0

GET signin
medium.com/m/ 0
0

GET signin
carbonmade.com/ 0
0

GET login
courses.edx.org/ 0
0

GET checkcookie
slack.com/ 0
0

GET login
www.khanacademy.org/ 0
0

GET signin
www.paypal.com/ 0
0

GET login
500px.com/ 0
0

GET login
www.airbnb.com/ 0
0

GET /
disqus.com/profile/login/ 0
0

GET /
secure.meetup.com/login/ 0
0

GET /
bitbucket.org/account/signin/ 0
0

GET login
secure.indeed.com/account/ 0
0

GET login
vk.com/ 0
0

GET
H/1.1 200
OK Cookie set / Show response
xebadu.com/ 661 B
1 KB 151ms
151ms Document
text/html 109.206.164.148
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xebadu.com/?zoneid=1542175&r=%2Fmb%2Fhan%2Fdl&nojs=0&x=1600&y=1200&t=0&ix=0&fs=0&timeout=0&var=0&ymid=&pb=692bbb095d8234a53cda2d820525aecb1531262319&pid=&sp=
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: HTTP/1.1
Server: 109.206.164.148 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 109.206.164.148.serverel.net
Software: nginx /
Resource Hash: e8fcf3e82abbc3dc3f06e411f67e0a64d36f847a0ddf23e115e81d0b15646494

Request headers

Host: xebadu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31
Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175

Response headers

Server: nginx
Date: Tue, 10 Jul 2018 20:38:39 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: OACCAP=AA3WRAAAAAAAAAAB; Path=/; Expires=Thu, 09 Aug 2018 20:38:39 GMT OACBLOCK=AA3WRAAAAABbRRlP; Path=/; Expires=Thu, 09 Aug 2018 20:38:39 GMT OXCCLK=AA3WRAAAAAAAAAAB; Path=/; Expires=Wed, 11 Jul 2018 20:38:39 GMT OXPCLK=AACG5QAAAAAAAAAB; Path=/; Expires=Wed, 11 Jul 2018 20:38:39 GMT ppucnt=0; Path=/; Expires=Wed, 11 Jul 2018 20:38:39 GMT ppucnt=1; Path=/; Expires=Wed, 11 Jul 2018 20:38:39 GMT
Content-Encoding: gzip
Timing-Allow-Origin: *

GET
H/1.1

200
OK

366514 Show response
sp.popcash.net/go/122237/
Redirect Chain

http://popcash.net/world/go/122237/366514
http://sp.popcash.net/go/122237/366514

519 B
575 B

100ms
100ms

Document
text/html

107.21.36.248
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://sp.popcash.net/go/122237/366514
Requested by: Host: xebadu.com
URL: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Protocol: HTTP/1.1
Server: 107.21.36.248 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-21-36-248.compute-1.amazonaws.com
Software: nginx/1.12.2 /
Resource Hash: ca84cc75bfa3028861a534aee7998fc6a8c319748a988a93eba0b8246bfc2b9c

Request headers

Host: sp.popcash.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175
Accept-Encoding: gzip, deflate
Cookie: __cfduid=d3280d0aa7334f626ed72938e7f0c26291531255119
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31
Referer: http://xebadu.com/afu.php?zoneid=1237457&var=1542175

Response headers

Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 10 Jul 2018 20:38:39 GMT
Server: nginx/1.12.2
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive

Redirect headers

Date: Tue, 10 Jul 2018 20:38:39 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Set-Cookie: __cfduid=d3280d0aa7334f626ed72938e7f0c26291531255119; expires=Wed, 10-Jul-19 20:38:39 GMT; path=/; domain=.popcash.net; HttpOnly
Location: http://sp.popcash.net/go/122237/366514
Server: cloudflare
CF-RAY: 4385d5d2c4a66415-FRA

GET
H/1.1

200
OK

go.php Show response
1976879403.nutty.pro/
Redirect Chain

http://sp.popcash.net/sgo/ad?p=122237&w=366514&t=4839282f132bb76a&r=aHR0cCUzQSUyRiUyRnhlYmFkdS5jb20lMkZhZnUucGhwJTNGem9uZWlkJTNEMTIzNzQ1NyUyNnZhciUzRDE1NDIxNzU=&vw=1600&vh=1200
http://18007.adslaney.com/d.php?campaing=18008&link_id=gXs4C&source=366514
http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086

2 KB
975 B

1917ms
929ms

Document
text/html

216.172.60.242
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086
Requested by: Host: sp.popcash.net
URL: http://sp.popcash.net/go/122237/366514
Protocol: HTTP/1.1
Server: 216.172.60.242 , United States, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 242.60.serverel.net
Software: nginx / PHP/5.6.30
Resource Hash: 435d69e246f35abec4a9f0614050f100cf42deeb274e8cc0b15fcfec7d694806

Request headers

Host: 1976879403.nutty.pro
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://sp.popcash.net/go/122237/366514
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31
Referer: http://sp.popcash.net/go/122237/366514

Response headers

Server: nginx
Date: Tue, 10 Jul 2018 20:38:46 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.30
Expires: Tue, 10 Jul 2018 20:38:46 GMT
Last-Modified: Tue, 10 Jul 2018 20:38:46 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 10 Jul 2018 20:38:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.30
Expires: Tue, 10 Jul 2018 20:38:44 GMT
Last-Modified: Tue, 10 Jul 2018 20:38:44 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086

GET
H/1.1 200
OK filter.php Show response
sax.peakonspot.com/pops/ 7 KB
7 KB 398ms
99ms Document
text/html 34.197.168.203
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://sax.peakonspot.com/pops/filter.php?rd=eavlqn.peakonsrv.com&id=15312551233184086071327329&tid=4798&t=imp&end=2
Requested by: Host: 1976879403.nutty.pro
URL: http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.168.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-197-168-203.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 02615a8a90b2d919c973e769b5655fb61068f6398c1320e74af4dacbcce49553

Request headers

Host: sax.peakonspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31
Referer: http://1976879403.nutty.pro/go.php?aid=5b451953daf9b4.91194086

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 Jul 2018 20:38:46 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Server: nginx
Content-Length: 7135
Connection: keep-alive

GET
H/1.1

200
OK

cimp.php Show response
syndication.exdynsrv.com/
Redirect Chain

http://eavlqn.peakonsrv.com/?&version=1&id=15312551233184086071327329&t=imp&tid=4798&filter=1&ftype=js&trs=15312551267939846&end=1&fwidth=1600&fheight=1200&fiframe=false&fiframesandbox=undefined
https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERV...

3 KB
1 KB

267ms
90ms

Document
text/html

64.111.199.222
NuCDN LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI=
Requested by: Host: sax.peakonspot.com
URL: https://sax.peakonspot.com/pops/filter.php?rd=eavlqn.peakonsrv.com&id=15312551233184086071327329&tid=4798&t=imp&end=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.111.199.222 Weehawken, United States, ASN23393 (NUCDN - NuCDN LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 99eaf3fabda7d9e5ba07f2a3b00a6cbc7a37c73603e74e6537405c43579c6e82

Request headers

Host: syndication.exdynsrv.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31

Response headers

Server: nginx
Date: Tue, 10 Jul 2018 20:38:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

Redirect headers

Content-Type: text/html; charset=UTF-8
Date: Tue, 10 Jul 2018 20:38:47 GMT
Location: https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI=
Server: nginx
Content-Length: 0
Connection: keep-alive

GET
H/1.1

200
OK

Primary Request / Show response
www.critch.de/nullstartkapital/
Redirect Chain

https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERV...
http://www1.lustich.de/link
http://www1.lustich.de/link/
http://www.critch.de/nullstartkapital
http://www.critch.de/nullstartkapital/

851 B
841 B

3ms
3ms

Document
text/html

78.46.10.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.critch.de/nullstartkapital/
Requested by: Host: syndication.exdynsrv.com
URL: https://syndication.exdynsrv.com/cimp.php?data=TVRVek1USTFOVEV5TTN4aU56bGhaREEyTVRNMU9EQTVaR0UwTjJSak5ETXpOMlZqWmpWak5ERTNNUT09fGh0dHA6Ly93d3cxLmx1c3RpY2guZGUvbGlua3xodHRwc3wxNDguMjUxLjQ1LjI1NHxERVV8NDF8YWRleGNoYW5nZS03MDgzNTQuY29tfDUyNjE5MHw1MzAzNDB8NzA4MzU0fDI4NjIzNDJ8NTEzfDIzNTg3MzB8MjAwNjczODZ8MTZ8MnwwfDB8MzM1OTY1ODJ8NDc5OHwxMS4xfDgwfFVTRHxFVVJ8MS4xNjkxfDEuMTY5MXwyMnx8MXxERVV8fDYwfDJ8MXx8NDc2ZDVmOGQxY2M5OWE5MTIyM2ExMDkyZjI2NmI1NTN8ZWMzYzJhMjdmODhlYzY3NGJmMDZmMDZlMDQ5NzY1N2V8MHwyfDQ3OTgtZjYwZTE5ZTJmZDBkNTQ2ZjkxMjRhYjQ0NjU3ZjI2MGQucGVha2FkeC5jb218MHwwfDB8MHwxfDB8ZXhjaGFuZ2VfbGlua3xiZjQ4NmYzYWJhNGM0MzI2MzJiZGVkMGY5OWE3YmQ0MnwwfDB8MHwwfC0xfDB8MHxob3N0aW5nfHwxfDE0NDB8fDJ8T0t8MWZlODlkOTc4M2VlZjVjMzA2ZTQ4NDdmN2VmZjc1MjI=
Protocol: HTTP/1.1
Server: 78.46.10.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: dedi1996.your-server.de
Software: Apache /
Resource Hash: 978cb2529f18f0753d371f9333ca146d8f29d3af037a12288452d543b31cdff5

Request headers

Host: www.critch.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31

Response headers

Date: Tue, 10 Jul 2018 20:38:48 GMT
Server: Apache
Last-Modified: Sun, 24 Jun 2018 10:29:49 GMT
ETag: "353-56f60bea0febc-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 520
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Tue, 10 Jul 2018 20:38:48 GMT
Server: Apache
Location: http://www.critch.de/nullstartkapital/
Content-Length: 309
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
S 200 js Show response
www.googletagmanager.com/gtag/ 69 KB
24 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:817::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-117671757-2

Requested by

Host: www.critch.de
URL: http://www.critch.de/nullstartkapital/

Protocol

SPDY

Server

2a00:1450:4001:817::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

1fd259f055f8efadde95a31bc1d046ad3e12bb931a01125f8763c537525d61f5

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.critch.de/nullstartkapital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 10 Jul 2018 20:38:48 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 24842
x-xss-protection: 1; mode=block
expires: Tue, 10 Jul 2018 20:38:48 GMT

GET
H/1.1

200
OK

/
www.privatelink.de/ Frame E026
Redirect Chain

https://www.privatelink.de/sf/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA

0
0

2ms
1ms

Document
text/html

188.40.20.23
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA
Requested by: Host: www.critch.de
URL: http://www.critch.de/nullstartkapital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.20.23 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.23.20.40.188.clients.your-server.de
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Host: www.privatelink.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=BA42FEC6CC0D047BA8CCA7EFFECBAE47
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31

Response headers

Server: Apache-Coyote/1.1
Referrer-Policy: no-referrer
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 5005
Date: Tue, 10 Jul 2018 20:38:47 GMT

Redirect headers

Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=BA42FEC6CC0D047BA8CCA7EFFECBAE47; Path=/; Secure; HttpOnly
Referrer-Policy: no-referrer
Location: /?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2F4e8w176lgA
Content-Length: 0
Date: Tue, 10 Jul 2018 20:38:47 GMT

GET
H/1.1

200
OK

/
www.privatelink.de/ Frame 55A4
Redirect Chain

http://bit.ly/2oHl00R
https://www.privatelink.de/sf/?http://privatelink.de/%3Fhttps://t.co/z7rulNZ8zx
https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx

0
0

2ms
2ms

Document
text/html

188.40.20.23
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.privatelink.de/?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Requested by: Host: www.critch.de
URL: http://www.critch.de/nullstartkapital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.20.23 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.23.20.40.188.clients.your-server.de
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Host: www.privatelink.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=BA42FEC6CC0D047BA8CCA7EFFECBAE47
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 46D586E0338831BC7D8517A4F6B30B31

Response headers

Server: Apache-Coyote/1.1
Referrer-Policy: no-referrer
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 5005
Date: Tue, 10 Jul 2018 20:38:47 GMT

Redirect headers

Server: Apache-Coyote/1.1
Referrer-Policy: no-referrer
Location: /?http%3A%2F%2Fprivatelink.de%2F%3Fhttps%3A%2F%2Ft.co%2Fz7rulNZ8zx
Content-Length: 0
Date: Tue, 10 Jul 2018 20:38:47 GMT

GET
S 200 analytics.js Show response
www.google-analytics.com/ 34 KB
14 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:817::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-117671757-2

Protocol

SPDY

Server

2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.critch.de/nullstartkapital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 18 May 2018 01:10:24 GMT
server: Golfe2
age: 5636
date: Tue, 10 Jul 2018 19:04:52 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 14386
expires: Tue, 10 Jul 2018 21:04:52 GMT

GET
S 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:817::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j68&a=956462482&t=pageview&_s=1&dl=http%3A%2F%2Fwww.critch.de%2Fnullstartkapital%2F&ul=en-us&de=UTF-8&dt=Buch%20geschenkt%20-%20Critch%20Bonus&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=944406097&gjid=1776467172&cid=959743185.1531255128&tid=UA-117671757-2&_gid=691414530.1531255128&_r=1&gtm=u6c&z=1146753413

Requested by

Host: www.critch.de
URL: http://www.critch.de/nullstartkapital/

Protocol

SPDY

Server

2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.critch.de/nullstartkapital/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Jul 2018 20:38:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: squareup.com
URL: https://squareup.com/login?return_to=/favicon.ico

Domain: login.live.com
URL: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1531255119&rver=7.0.6730.0&wp=MBI_SSL&wreply=https%3A%2F%2Flw.skype.com%2Flogin%2Foauth%2Fproxy%3Fredirect_uri%3Dhttps%253A%252F%252Fsecure.skype.com%252Ffavicon.ico%26site_name%3Dlw.skype.com&lc=1033&id=293290&mkt=en&psi=skype&lw=1&cobrandid=2befc4b5-19e3-46e8-8347-77317a16a5a5&client_flight=hsu%2CReservedFlight33%2CReservedFlight67

Domain: www.reddit.com
URL: https://www.reddit.com/login?dest=https://www.reddit.com/favicon.ico

Domain: www.expedia.de
URL: https://www.expedia.de/user/login?ckoflag=0&selc=0&uurl=qscr=reds&rurl=%2Ffavicon.ico

Domain: www.dropbox.com
URL: https://www.dropbox.com/login?cont=https://www.dropbox.com/static/images/favicon.ico

Domain: www.pinterest.com
URL: https://www.pinterest.com/login/?next=https://www.pinterest.com/favicon.ico

Domain: eu.battle.net
URL: https://eu.battle.net/login/de/?ref=https://eu.battle.net/favicon.ico

Domain: store.steampowered.com
URL: https://store.steampowered.com/login/?redir=favicon.ico

Domain: github.com
URL: https://github.com/login?return_to=https://github.com/favicon.ico?id=1

Domain: medium.com
URL: https://medium.com/m/signin?redirect=https://medium.com/favicon.ico&loginType=default

Domain: carbonmade.com
URL: https://carbonmade.com/signin?returnTo=favicon.ico

Domain: courses.edx.org
URL: https://courses.edx.org/login?next=/favicon.ico

Domain: slack.com
URL: https://slack.com/checkcookie?redir=https://slack.com/favicon.ico

Domain: www.khanacademy.org
URL: https://www.khanacademy.org/login?continue=https://www.khanacademy.org/favicon.ico

Domain: www.paypal.com
URL: https://www.paypal.com/signin?returnUri=https://t.paypal.com/ts?v=1.0.0

Domain: 500px.com
URL: https://500px.com/login?r=/favicon.ico

Domain: www.airbnb.com
URL: https://www.airbnb.com/login?redirect_params[action]=favicon.ico&redirect_params[controller]=home

Domain: disqus.com
URL: https://disqus.com/profile/login/?next=https://disqus.com/favicon.ico

Domain: secure.meetup.com
URL: https://secure.meetup.com/login/?returnUri=https://www.meetup.com/img/ajax_loader_trans.gif

Domain: bitbucket.org
URL: https://bitbucket.org/account/signin/?next=/favicon.ico

Domain: secure.indeed.com
URL: https://secure.indeed.com/account/login?continue=/favicon.ico

Domain: vk.com
URL: https://vk.com/login?u=2&to=ZmF2aWNvbi5pY28-

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.privatelink.de/	1969-12-31 23:59:59	Name: JSESSIONID Value: BA42FEC6CC0D047BA8CCA7EFFECBAE47
.critch.de/	1970-01-18 17:22:21	Name: _gid Value: GA1.2.691414530.1531255128
.critch.de/	1970-01-18 17:20:55	Name: _gat_gtag_UA_117671757_2 Value: 1
.critch.de/	1970-01-19 10:52:07	Name: _ga Value: GA1.2.959743185.1531255128

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

18007.adslaney.com
1976879403.nutty.pro
500px.com
accounts.google.com
bit.ly
bitbucket.org
carbonmade.com
courses.edx.org
de.foursquare.com
disqus.com
eavlqn.peakonsrv.com
eu.battle.net
github.com
login.live.com
medium.com
plus.google.com
popcash.net
sax.peakonspot.com
secure.indeed.com
secure.meetup.com
slack.com
sp.popcash.net
squareup.com
store.steampowered.com
syndication.exdynsrv.com
twitter.com
vk.com
www.airbnb.com
www.critch.de
www.dropbox.com
www.expedia.de
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.khanacademy.org
www.paypal.com
www.pinterest.com
www.privatelink.de
www.reddit.com
www.tumblr.com
www1.lustich.de
xebadu.com
500px.com
bitbucket.org
carbonmade.com
courses.edx.org
disqus.com
eu.battle.net
github.com
login.live.com
medium.com
secure.indeed.com
secure.meetup.com
slack.com
squareup.com
store.steampowered.com
vk.com
www.airbnb.com
www.dropbox.com
www.expedia.de
www.khanacademy.org
www.paypal.com
www.pinterest.com
www.reddit.com
104.244.42.1
107.21.36.248
109.206.164.148
151.101.114.49
188.40.20.23
216.172.60.242
2400:cb00:2048:1::6814:802e
2a00:1288:80:800::8001
2a00:1450:4001:812::200d
2a00:1450:4001:817::2008
2a00:1450:4001:817::200e
2a03:2880:f11c:8186:face:b00c:0:50fb
34.197.168.203
35.168.255.103
64.111.199.222
67.199.248.10
78.46.10.196
78.46.155.195
02615a8a90b2d919c973e769b5655fb61068f6398c1320e74af4dacbcce49553
1fd259f055f8efadde95a31bc1d046ad3e12bb931a01125f8763c537525d61f5
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
435d69e246f35abec4a9f0614050f100cf42deeb274e8cc0b15fcfec7d694806
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
978cb2529f18f0753d371f9333ca146d8f29d3af037a12288452d543b31cdff5
99eaf3fabda7d9e5ba07f2a3b00a6cbc7a37c73603e74e6537405c43579c6e82
add9578341b29c26a3dae5700028ecd79f42ce75e33f5055a13284d48a268b5f
ca84cc75bfa3028861a534aee7998fc6a8c319748a988a93eba0b8246bfc2b9c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8fcf3e82abbc3dc3f06e411f67e0a64d36f847a0ddf23e115e81d0b15646494

www.critch.de Open in urlscan Pro 78.46.10.196 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

42 Requests

10 %HTTPS

33 %IPv6

40 Domains

42 Subdomains

15 IPs

7 Countries

164 kBTransfer

127 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

42 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

4 Cookies

Indicators

www.critch.de Open in urlscan Pro
78.46.10.196 Public Scan

Screenshot
Live screenshot

Full Image

42
Requests

10 %
HTTPS

33 %
IPv6

40
Domains

42
Subdomains

15
IPs

7
Countries

164 kB
Transfer

127 kB
Size

4
Cookies

42 HTTP transactions
0 data transactions