www.passingofferspots.com Open in urlscan Pro
51.89.234.204 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/aHR0cHMlM0ElMkYlMkZ3d3cueG...
Effective URL:
https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
Submission: On March 04 via api (March 4th 2024, 8:58:04 am UTC) from BE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 12 domains to perform 10 HTTP transactions. The main IP is 51.89.234.204, located in London, United Kingdom and belongs to OVH, FR. The main domain is www.passingofferspots.com.
TLS certificate: Issued by R3 on February 14th 2024. Valid for: 3 months.

This is the only time www.passingofferspots.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3032::6815:3a7a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	34.107.223.80 34.107.223.80	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:1f18:454... 2600:1f18:454c:f510:c8b7:b118:c9f3:afb6	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:440... 2606:4700:4400::ac40:96af	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9819	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700::68... 2606:4700::6812:16d7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	51.89.234.204 51.89.234.204	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
1	2606:4700:20:... 2606:4700:20::ac43:485c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
10	9

1 2606:4700:3032::6815:3a7a (United States)

ASN13335 (CLOUDFLARENET, US)

mm.newxdatesofferings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.223.80 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 80.223.107.34.bc.googleusercontent.com

www.xn3j2k.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:454c:f510:c8b7:b118:c9f3:afb6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

ads.traffichunt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:96af (United States)

ASN13335 (CLOUDFLARENET, US)

trk.trk4cash.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9819 (United States)

ASN13335 (CLOUDFLARENET, US)

imedia.servefilesonly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:16d7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

b.greatcontentservice.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.234.204 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ns3163846.ip-51-89-234.eu

www.passingofferspots.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.srv69.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:485c (United States)

ASN13335 (CLOUDFLARENET, US)

api.geoapify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	gstatic.com fonts.gstatic.com	16 KB
1	srv69.eu www.srv69.eu	1 MB
1	geoapify.com api.geoapify.com — Cisco Umbrella Rank: 206528	2 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 760	30 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
1	passingofferspots.com www.passingofferspots.com	6 KB
1	greatcontentservice.top 1 redirects b.greatcontentservice.top	273 B
1	servefilesonly.com imedia.servefilesonly.com — Cisco Umbrella Rank: 316645	85 KB
1	trk4cash.com trk.trk4cash.com	776 B
1	traffichunt.com ads.traffichunt.com — Cisco Umbrella Rank: 157132	726 B
1	xn3j2k.com 1 redirects www.xn3j2k.com	497 B
1	newxdatesofferings.com mm.newxdatesofferings.com	661 B
10	12

	Domain	Requested by
1	fonts.gstatic.com	fonts.googleapis.com
1	www.srv69.eu
1	api.geoapify.com	www.passingofferspots.com
1	code.jquery.com	www.passingofferspots.com
1	fonts.googleapis.com	www.passingofferspots.com
1	www.passingofferspots.com
1	b.greatcontentservice.top	1 redirects
1	imedia.servefilesonly.com	trk.trk4cash.com
1	trk.trk4cash.com	ads.traffichunt.com
1	ads.traffichunt.com
1	www.xn3j2k.com	1 redirects
1	mm.newxdatesofferings.com
10	12

This site contains no links.

Subject Issuer	Validity	Valid
newxdatesofferings.com GTS CA 1P5	`2024-01-19` - `2024-04-18`	3 months	crt.sh
traffichunt.com Amazon RSA 2048 M01	`2023-06-28` - `2024-07-27`	a year	crt.sh
trk4cash.com E1	`2024-02-10` - `2024-05-10`	3 months	crt.sh
servefilesonly.com E1	`2024-02-11` - `2024-05-11`	3 months	crt.sh
passingofferspots.com R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.srv69.eu R3	`2024-02-04` - `2024-05-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
Frame ID: ECEF622A8646FB647B41F321797D9C51
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/aHR0cH... Page URL
https://www.xn3j2k.com/cmp/BC6G71/25D7F3/?source_id=mt&sub1=141&sub2=NXDOS&sub3=ronald.keersmaekers... HTTP 302
https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40g... Page URL
https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaeke... Page URL
https://b.greatcontentservice.top/i?tid=5ddbd778-0730-4abe-a0ee-bc7f52008fa3&cf=ag0ied0ggh HTTP 302
https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pi... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

82 %
IPv6

12
Domains

12
Subdomains

9
IPs

3
Countries

1191 kB
Transfer

1260 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/aHR0cHMlM0ElMkYlMkZ3d3cueG4zajJrLmNvbSUyRmNtcCUyRkJDNkc3MSUyRjI1RDdGMyUyRiUzRnNvdXJjZV9pZCUzRG10JTI2c3ViMSUzRDE0MSUyNnN1YjIlM0ROWERPUyUyNnN1YjMlM0Ryb25hbGQua2VlcnNtYWVrZXJzJTQwZ21haWwuY29tJTI2c3ViNCUzRGFsaQ==?c=47874677 Page URL
https://www.xn3j2k.com/cmp/BC6G71/25D7F3/?source_id=mt&sub1=141&sub2=NXDOS&sub3=ronald.keersmaekers@gmail.com&sub4=ali HTTP 302
https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376 Page URL
https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaekers@gmail.com&subPublisher=FM-376&loading=1&portal=fun Page URL
https://b.greatcontentservice.top/i?tid=5ddbd778-0730-4abe-a0ee-bc7f52008fa3&cf=ag0ied0ggh HTTP 302
https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://www.xn3j2k.com/cmp/BC6G71/25D7F3/?source_id=mt&sub1=141&sub2=NXDOS&sub3=ronald.keersmaekers@gmail.com&sub4=ali HTTP 302
https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 aHR0cHMlM0ElMkYlMkZ3d3cueG4zajJrLmNvbSUyRmNtcCUyRkJDNkc3MSUyRjI1RDdGMyUyRiUzRnNvdXJjZV9pZCUzRG10JTI2c3ViMSUzRDE0MSUyNnN1YjIlM0ROWERPUyUyNnN1YjMlM0Ryb25hbGQua2VlcnNtYWVrZXJzJTQwZ21haWwuY29tJTI2c3ViN... Show response
mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/ 168 B
661 B 407ms
332ms Document
text/html 2606:4700:3032::6815:3a7a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/aHR0cHMlM0ElMkYlMkZ3d3cueG4zajJrLmNvbSUyRmNtcCUyRkJDNkc3MSUyRjI1RDdGMyUyRiUzRnNvdXJjZV9pZCUzRG10JTI2c3ViMSUzRDE0MSUyNnN1YjIlM0ROWERPUyUyNnN1YjMlM0Ryb25hbGQua2VlcnNtYWVrZXJzJTQwZ21haWwuY29tJTI2c3ViNCUzRGFsaQ==?c=47874677
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:3a7a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.1.25
Resource Hash: 73b387529fa8af089ab72ecc69ef195387e8dcca11e7b05abb4c4e3ca1f88c6c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=2592000
cf-cache-status: DYNAMIC
cf-ray: 85f0a96dad0f66ec-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 04 Mar 2024 08:57:58 GMT
expires: Wed, 03 Apr 2024 08:57:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r19Q%2Bj%2BLKqSocWSLjGJqAToY3S1Ed7TH8BBwXUDa4bLfao%2B9a4HyX1HgAxyoKlQzXQlqp%2FCgHFb63HdA9CSASYYZG7wccKHuIjMWxYzYdgnlwFPTXRb6ZriNa8f9n89pUPoB6JSr%2BbYwDKLF2mGz0zgYtXz51eWX"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.1.25

GET
H2

200

link Show response
ads.traffichunt.com/adx-dir-d/
Redirect Chain

https://www.xn3j2k.com/cmp/BC6G71/25D7F3/?source_id=mt&sub1=141&sub2=NXDOS&sub3=ronald.keersmaekers@gmail.com&sub4=ali
https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376

371 B
726 B

312ms
108ms

Document
text/html

2600:1f18:454c:f510:c8b7:b118:c9f3:afb6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:454c:f510:c8b7:b118:c9f3:afb6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: 2db19db15117fe7867ddb05f55516b13823f399e1df33e36bb3b7bb3276b42bf

Request headers

Referer: https://mm.newxdatesofferings.com/campaign/clicked/NDc4NzQ2Nzc=__MTE1NA==__MTgwNDE1Mg==__MTQx__18__0__2/aHR0cHMlM0ElMkYlMkZ3d3cueG4zajJrLmNvbSUyRmNtcCUyRkJDNkc3MSUyRjI1RDdGMyUyRiUzRnNvdXJjZV9pZCUzRG10JTI2c3ViMSUzRDE0MSUyNnN1YjIlM0ROWERPUyUyNnN1YjMlM0Ryb25hbGQua2VlcnNtYWVrZXJzJTQwZ21haWwuY29tJTI2c3ViNCUzRGFsaQ==?c=47874677
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-encoding: gzip
content-type: text/html;charset=ISO-8859-1
date: Mon, 04 Mar 2024 08:57:59 GMT
expires: Sat, 1 May 2020 12:00:00 GMT
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
pragma: no-cache
server: nginx
vary: Accept-Encoding

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 167
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 08:57:59 GMT
location: https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: d12016c0-d27a-4877-abe4-dcb5fc423d4d

GET
H2 200 / Show response
trk.trk4cash.com/epassing/ 961 B
776 B 749ms
555ms Document
text/html 2606:4700:4400::ac40:96af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaekers@gmail.com&subPublisher=FM-376&loading=1&portal=fun
Requested by: Host: ads.traffichunt.com
URL: https://ads.traffichunt.com/adx-dir-d/link?aid=8751050&nid=3&imp=1&w=1&h=1&email=ronald.keersmaekers%40gmail.com&sub=376
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:96af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3c441fdd5adf9cccd5c97a5b0f680c95ef6eeef8a3ec9784702fc7e6a66d6e7

Request headers

Referer: https://ads.traffichunt.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-ray: 85f0a9745a933636-FRA
content-encoding: gzip
content-type: text/html
date: Mon, 04 Mar 2024 08:58:00 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 e6fb957c-3af2-41e6-9ce2-6d3114f8b8c8.gif
imedia.servefilesonly.com/ 85 KB
85 KB 46ms
18ms Image
image/gif 2606:4700:4400::ac40:9819
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imedia.servefilesonly.com/e6fb957c-3af2-41e6-9ce2-6d3114f8b8c8.gif
Requested by: Host: trk.trk4cash.com
URL: https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaekers@gmail.com&subPublisher=FM-376&loading=1&portal=fun
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9819 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49ad40864d85d905b89218a290ec3639308089c74dc584b7e6a8e360a3bb4308

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.trk4cash.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 08:58:00 GMT
via: 1.1 b7c8b552077b93dc0acaa0b82d11fa62.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: FRA56-P8
age: 1110
x-cache: Hit from cloudfront
content-length: 86669
last-modified: Wed, 28 Sep 2022 04:09:36 GMT
server: cloudflare
etag: "9ea22800efe4c281b773b3570a9fcb3e"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=691200
accept-ranges: bytes
cf-ray: 85f0a977ffb791e7-FRA
x-amz-cf-id: e6sNgTCkkcsvx9fOlbF_cUuJxQQ0H7-Q7SxcYHsTVhbWCflPZrsjpQ==
expires: Tue, 12 Mar 2024 08:58:00 GMT

GET
H2

200

Primary Request / Show response
www.passingofferspots.com/
Redirect Chain

https://b.greatcontentservice.top/i?tid=5ddbd778-0730-4abe-a0ee-bc7f52008fa3&cf=ag0ied0ggh
https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult

17 KB
6 KB

330ms
23ms

Document
text/html

51.89.234.204
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.89.234.204 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns3163846.ip-51-89-234.eu
Software: nginx / PHP/8.2.13
Resource Hash: 5d7a0807723c821fcc93cfbf76f5e4e6088fc0c805b72d7c84e19c07ec6fa9b1

Request headers

Referer: https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaekers@gmail.com&subPublisher=FM-376&loading=1&portal=fun
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
content-encoding: gzip
content-length: 5573
content-type: text/html; charset=UTF-8
date: Mon, 04 Mar 2024 08:58:01 GMT
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/8.2.13

Redirect headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 85f0a97e9ee41c79-FRA
content-length: 0
date: Mon, 04 Mar 2024 08:58:01 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
location: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
referer: b.montpti.top
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
1 KB 38ms
17ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&family=Roboto+Flex:opsz,wght@8..144,100..1000&display=swap

Requested by

Host: www.passingofferspots.com
URL: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8125ea2b56a31ead2d8527f37225a3c5e0e675fbf30045414ec75868c9f633e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.passingofferspots.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Mar 2024 08:58:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 08:58:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Mar 2024 08:58:01 GMT

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 37ms
6ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: www.passingofferspots.com
URL: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.passingofferspots.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 08:58:01 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 2000300
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-fra-eddf8230045-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1709542682.981348,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 15, 1675761

GET
H2 200 ipinfo Show response
api.geoapify.com/v1/ 1 KB
2 KB 134ms
99ms Fetch
application/json 2606:4700:20::ac43:485c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.geoapify.com/v1/ipinfo?&ip=45.141.152.77&apiKey=80028b9afb88405fb48abf65eddc09e2
Requested by: Host: www.passingofferspots.com
URL: https://www.passingofferspots.com/?page=newmessage&email=ronald.keersmaekers@gmail.com&pi=passrer5pemclicks&pid=1&gerne=adult
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:485c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70f683b7f2ff73f361df7ad26adf9cc81e53e8946cab23e477de1b0e6922ba85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.passingofferspots.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 08:58:02 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, DELETE, OPTIONS, PUT
content-type: application/json; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FOOFpUXrg3UJ5UvDjphIsCDgAI5dR6dC7hKfMHo1RmDi1V8oKMoN%2F0HPmVR8VC61xiK9GXrUtWUWUZuFbeIZFCSO3h4rQEpzzDAkDoitplXZNSofYqO2iUaOrDnIU69Jvxdy8VppgwHyz47OBQQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
api-version: 1.0
cf-ray: 85f0a982b90c18d7-FRA
access-control-allow-headers: accept, accept-language, content-language, access-control-max-age, access-control-allow-headers, access-control-allow-methods, access-control-allow-origin, allow, api-version, cf-ray, content-encoding, content-type, date, expect-ct, server, status, vary, cache-control, etag, last-modified, expires, host, cf-timezone, cf-pseudo-ipv4, accept-encoding, x-forwarded-for, x-forwarded-proto, cf-visitor, pragma, user-agent, origin, sec-fetch-site, sec-fetch-mode, sec-fetch-dest, referer, cf-connecting-ip, cdn-loop, cf-ipcity, cf-ipcontinent, cf-ipcountry, cf-iplatitude, cf-iplongitude, cf-postal-code, cf-region, cf-region-code, x-forwarded-port

GET
H2 200 o6CLDOZQO610du6FKlpvFLB1uQScsbsLCKPiv6ap.jpg
www.srv69.eu/slp/5/img/default/ 1 MB
1 MB 160ms
35ms Image
image/jpeg 51.89.234.204
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.srv69.eu/slp/5/img/default/o6CLDOZQO610du6FKlpvFLB1uQScsbsLCKPiv6ap.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.89.234.204 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns3163846.ip-51-89-234.eu
Software: nginx /
Resource Hash: b4f0c9a4ebdbee4d9a493c7985b466f68749e9d4c0b6faf8f5874ceaacfff222

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.passingofferspots.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 08:58:02 GMT
last-modified: Thu, 24 Feb 2022 08:20:48 GMT
server: nginx
accept-ranges: bytes
etag: "62173fe0-105daf"
content-length: 1072559
content-type: image/jpeg

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 25ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto&family=Roboto+Flex:opsz,wght@8..144,100..1000&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.passingofferspots.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:48:58 GMT
x-content-type-options: nosniff
age: 518944
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:48:58 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| redirectToServer function| GaNaarDeUrl

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.xn3j2k.com/	1970-01-20 18:53:49	Name: uniqueClick_25D7F3 Value: 9d3c2895-8f7e-461b-98be-8bb0f72b712a:1709542679
www.xn3j2k.com/	1970-01-20 21:01:58	Name: transaction_id Value: d7b808bffeca4785aba156de0037a009
ads.traffichunt.com/	1970-01-20 21:01:58	Name: new_adx_profile_guid Value: 5791a7a6-3e86-4616-92fb-2ba459d78410
ads.traffichunt.com/	1970-01-20 21:01:58	Name: adx_profile_guid Value: 5791a7a6-3e86-4616-92fb-2ba459d78410
.trk4cash.com/	1970-01-20 18:52:24	Name: __cf_bm Value: hTlgGevBfq3.rlv9iadr9N70VmA8nQgVnhxVAcaTuqA-1709542680-1.0.1.1-_QgIq4prRC4dxUYDkgDxvqalfejWAv3qi45STmG42Aa_FwOcUL4nXcaXuSSvkzXSliNfTCuXlHbwzrmzfQ1e0A
.servefilesonly.com/	1970-01-20 18:52:24	Name: __cf_bm Value: 8fMLP_FkE.GsjGe3pKujq7lUb8QcEmna_39qZd6.zTY-1709542680-1.0.1.1-MaEhLq.U3SDgEE8PmmWkcHiZ.5KAQDupWHzDskUdQ3oXt26iY_.emqJ7wbq3XNH4defg0mertB9WvrGdN5eKlg

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://trk.trk4cash.com/epassing/?tpcampid=d1caee6c-bf09-4c98-8249-c00a7eac9e4e&el=ronald.keersmaekers@gmail.com&subPublisher=FM-376&loading=1&portal=fun Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.traffichunt.com
api.geoapify.com
b.greatcontentservice.top
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
imedia.servefilesonly.com
mm.newxdatesofferings.com
trk.trk4cash.com
www.passingofferspots.com
www.srv69.eu
www.xn3j2k.com
2600:1f18:454c:f510:c8b7:b118:c9f3:afb6
2606:4700:20::ac43:485c
2606:4700:3032::6815:3a7a
2606:4700:4400::ac40:96af
2606:4700:4400::ac40:9819
2606:4700::6812:16d7
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200a
2a04:4e42:600::649
34.107.223.80
51.89.234.204
2db19db15117fe7867ddb05f55516b13823f399e1df33e36bb3b7bb3276b42bf
49ad40864d85d905b89218a290ec3639308089c74dc584b7e6a8e360a3bb4308
5d7a0807723c821fcc93cfbf76f5e4e6088fc0c805b72d7c84e19c07ec6fa9b1
70f683b7f2ff73f361df7ad26adf9cc81e53e8946cab23e477de1b0e6922ba85
73b387529fa8af089ab72ecc69ef195387e8dcca11e7b05abb4c4e3ca1f88c6c
8125ea2b56a31ead2d8527f37225a3c5e0e675fbf30045414ec75868c9f633e7
b4f0c9a4ebdbee4d9a493c7985b466f68749e9d4c0b6faf8f5874ceaacfff222
d3c441fdd5adf9cccd5c97a5b0f680c95ef6eeef8a3ec9784702fc7e6a66d6e7
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.passingofferspots.com Open in urlscan Pro 51.89.234.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

82 %IPv6

12 Domains

12 Subdomains

9 IPs

3 Countries

1191 kBTransfer

1260 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

6 Cookies

1 Console Messages

Indicators

www.passingofferspots.com Open in urlscan Pro
51.89.234.204 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

82 %
IPv6

12
Domains

12
Subdomains

9
IPs

3
Countries

1191 kB
Transfer

1260 kB
Size

6
Cookies

10 HTTP transactions
0 data transactions