0.listen-heres.com Open in urlscan Pro
104.248.199.158 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/
Effective URL:
https://0.listen-heres.com/index.php?p=muywey3dmi5dinzyge&subid3=dream&=8&subid4=touch
Submission: On February 08 via manual (February 8th 2022, 7:46:31 am UTC) from IT — Scanned from IT

Summary HTTP 37 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 5 domains to perform 37 HTTP transactions. The main IP is 104.248.199.158, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is 0.listen-heres.com.
TLS certificate: Issued by R3 on February 4th 2022. Valid for: 3 months.

This is the only time 0.listen-heres.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poste Italiane (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 24	134.209.252.73 134.209.252.73	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	62.241.12.21 62.241.12.21	15720 (Viale Europa) (Viale Europa)
1	62.241.12.20 62.241.12.20	15720 (Viale Europa) (Viale Europa)
1 4	45.9.150.78 45.9.150.78	49447 (NICEIT) (NICEIT)
2	104.248.199.158 104.248.199.158	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
37	7

24 134.209.252.73 (Frankfurt am Main, Germany) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: host5.webapricot.am

www.fondfreedom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 62.241.12.21 (Rome, Italy)

ASN15720 (Viale Europa, 175, IT)

securelogin.poste.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.241.12.20 (Rome, Italy)

ASN15720 (Viale Europa, 175, IT)

www.poste.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 45.9.150.78 (Switzerland) 1 redirects

ASN49447 (NICEIT, DM)

line.storerightdesicion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
chess.storerightdesicion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.248.199.158 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

listen-heres.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.listen-heres.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	fondfreedom.com 1 redirects www.fondfreedom.com	187 KB
5	poste.it securelogin.poste.it www.poste.it — Cisco Umbrella Rank: 142945	12 KB
4	storerightdesicion.com 1 redirects line.storerightdesicion.com — Cisco Umbrella Rank: 604795 chess.storerightdesicion.com Failed	2 KB
2	listen-heres.com listen-heres.com — Cisco Umbrella Rank: 807523 Failed 0.listen-heres.com	64 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2427	25 KB
37	5

	Domain	Requested by
24	www.fondfreedom.com	1 redirects www.fondfreedom.com
4	securelogin.poste.it	www.fondfreedom.com
3	chess.storerightdesicion.com	line.storerightdesicion.com chess.storerightdesicion.com
1	0.listen-heres.com	listen-heres.com
1	listen-heres.com	chess.storerightdesicion.com
1	line.storerightdesicion.com	www.fondfreedom.com
1	www.poste.it	www.fondfreedom.com
1	stackpath.bootstrapcdn.com	www.fondfreedom.com
37	8

This site contains no links.

Subject Issuer	Validity	Valid
www.fondfreedom.com R3	`2022-01-19` - `2022-04-19`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
securelogin.poste.it GlobalSign Extended Validation CA - SHA256 - G3	`2021-02-24` - `2022-03-28`	a year	crt.sh
www.poste.it GlobalSign Extended Validation CA - SHA256 - G3	`2021-02-24` - `2022-03-28`	a year	crt.sh
line.storerightdesicion.com R3	`2021-12-19` - `2022-03-19`	3 months	crt.sh
chess.storerightdesicion.com R3	`2021-12-19` - `2022-03-19`	3 months	crt.sh
robotchecked.com R3	`2022-02-04` - `2022-05-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://0.listen-heres.com/index.php?p=muywey3dmi5dinzyge&subid3=dream&=8&subid4=touch
Frame ID: FBFAEF2D808CC5CCA961CD831C1C43E6
Requests: 43 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

captcha

Page URL History Show full URLs

https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/ HTTP 302
https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php Page URL
https://chess.storerightdesicion.com/s.php?pid=584-348576743-22 HTTP 302
https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895 Page URL
https://chess.storerightdesicion.com/go.php?id=79699-347-3485623-44 Page URL
https://listen-heres.com/go/muywey3dmi5dinzyge?subid3=dream&=8&subid4=touch Page URL
https://0.listen-heres.com/index.php?p=muywey3dmi5dinzyge&subid3=dream&=8&subid4=touch Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

37
Requests

92 %
HTTPS

17 %
IPv6

5
Domains

8
Subdomains

7
IPs

5
Countries

289 kB
Transfer

967 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/ HTTP 302
https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php Page URL
https://chess.storerightdesicion.com/s.php?pid=584-348576743-22 HTTP 302
https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895 Page URL
https://chess.storerightdesicion.com/go.php?id=79699-347-3485623-44 Page URL
https://listen-heres.com/go/muywey3dmi5dinzyge?subid3=dream&=8&subid4=touch Page URL
https://0.listen-heres.com/index.php?p=muywey3dmi5dinzyge&subid3=dream&=8&subid4=touch Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/ HTTP 302
https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php

Request Chain 31

https://chess.storerightdesicion.com/s.php?pid=584-348576743-22 HTTP 302
https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895

37 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

payment.php Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/
Redirect Chain

https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/
https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php

19 KB
5 KB

173ms
173ms

Document
text/html

134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 7baa865b9dafd450443b1b34e2987cb7bd077992e8debbe47457873b16f1c32e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9

Response headers

server: nginx
date: Tue, 08 Feb 2022 07:46:23 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip

Redirect headers

server: nginx
date: Tue, 08 Feb 2022 07:46:23 GMT
content-type: text/html; charset=UTF-8
location: payment.php
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ 152 KB
25 KB 109ms
72ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css

Requested by

Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fondfreedom.com/
Origin: https://www.fondfreedom.com
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 756
age: 50553
cdn-cachedat: 01/29/2022 12:45:11
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.02
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: b9483e888bfdd43d0392466a26c7e0e6
cf-ray: 6da33e73dfc859ef-MXP
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H/1.1 200
OK logo-poste-italiane-medium.png
securelogin.poste.it/risorse_dt/condivise/immagini/loghi/ 5 KB
5 KB 267ms
29ms Image
image/png 62.241.12.21
Viale Europa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelogin.poste.it/risorse_dt/condivise/immagini/loghi/logo-poste-italiane-medium.png
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 62.241.12.21 Rome, Italy, ASN15720 (Viale Europa, 175, IT),
Reverse DNS
Software: nginx /
Resource Hash: d26cdfa4e4c99bcd4d99047beff09a62f8e0c955654b7a4968acf1ebdc293cb8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 07:46:24 GMT
Last-Modified: Fri, 15 Oct 2021 10:43:02 GMT
Server: nginx
ETag: "61695b36-145d"
Content-Type: image/png
Access-Control-Allow-Origin: https://widget.poste.it, https://postepay.poste.it
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5213

GET
H2 200 simplebar.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/simplebar/css/ 3 KB
1 KB 26ms
23ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/simplebar/css/simplebar.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 199bf5253860461e080930bec92048b82628a653b0d6ccd9dffd54fd0870c468

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-b94"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 perfect-scrollbar.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/perfectscrollbar/css/ 2 KB
695 B 28ms
23ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/perfectscrollbar/css/perfect-scrollbar.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 7df02cbdad5be43843d5494d69649e6d3f15d3695b279f032af44c76c76afa5d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-71b"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 metisMenu.min.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/metismenu/css/ 2 KB
871 B 28ms
24ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/metismenu/css/metisMenu.min.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 099ac56e52f547f59624894dd9416afbcd13ba299bd439f649f597bee2b7a9c6

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-782"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 smart_wizard_all.mi.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/smartwizard/css/ 10 KB
2 KB 28ms
24ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/smartwizard/css/smart_wizard_all.mi.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: e859f0bbbf924a908ddd853c3f3b8736a81d323aaf5b19ccf03ebeb3ba166bbf

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-2629"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 pace.min.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 2 KB
653 B 28ms
25ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/pace.min.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: be8bf51e97b8066bcf004785618cbf545c4dd6d383a1c3490e77ef64bb7a6f8d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-6ca"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 pace.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 12 KB
5 KB 51ms
47ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/pace.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 62fa616e35ad4686909a307b09da66ecd3be9a3a658d58a61f0557ec6d691736

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-3005"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.min.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 185 KB
32 KB 51ms
48ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/bootstrap.min.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 4cbca36d802725d8170ee71ee71c8fd2264ca9f2c02604726e17e774e9c2dbc7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-2e3cf"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap-extended.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 9 KB
2 KB 76ms
72ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/bootstrap-extended.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 40ebfe1c6d8aa2e889bb3a14314a9b90ec15715f9d758ea8b4de5ca166ee8967

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-233c"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 app.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 35 KB
8 KB 76ms
72ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/app.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: fbbbf3cf89005ae24594626f6bbda6b07dedb60a1bddb69c498cff56ad73db70

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-8c1c"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 icons.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 114 KB
20 KB 76ms
73ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/icons.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: baa3e37b7cb949cffa48afde899c543fca4f3dab58f1f338935c80b53964a55a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-1c86b"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 dark-theme.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 18 KB
4 KB 76ms
73ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/dark-theme.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: dc12954ae8eba862b6281fd69436a64f45e55ff47f9d587e5391bbce61755a86

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-4701"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 semi-dark.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 3 KB
812 B 76ms
73ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/semi-dark.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 705ab1e8a4c87d391dd8990b5edf1b62eebabf97403cfecded1e88b1529db2da

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-a0b"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 header-colors.css
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/ 5 KB
1 KB 76ms
73ms Stylesheet
text/css 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/css/header-colors.css
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 53d559fbad2132e378cbfb5cf69d1eb9d49b8dd92593f3393b55b01f7df287f3

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-12d2"
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 76 KB
26 KB 77ms
74ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/bootstrap.bundle.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-13131"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 90 KB
35 KB 77ms
74ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/jquery.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 2e90bf023b7b7faf91e6deb6630fa4294a063939b10e250e58085162a7fe28b0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 18:24:17 GMT
server: nginx
etag: W/"620163d1-1682a"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 simplebar.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/simplebar/js/ 57 KB
20 KB 77ms
74ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/simplebar/js/simplebar.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 84575d0fa5cc23015b6b8213423a6fe56584e79ef0e8ed30f5145f9868c8cf89

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-e29f"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 metisMenu.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/metismenu/js/ 13 KB
5 KB 77ms
74ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/metismenu/js/metisMenu.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: cf68bfc0322a1c1b1bcf18aed542e1b4b414f684522f176814891cd90d9fc864

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-34c0"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 perfect-scrollbar.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/perfectscrollbar/js/ 26 KB
7 KB 77ms
74ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/perfectscrollbar/js/perfect-scrollbar.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 13eb5bf323748eeac033a52c0808a6cfd869aead32081ee3a5fd275d12d26134

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-6772"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.smartWizard.min.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/smartwizard/js/ 13 KB
4 KB 77ms
75ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/plugins/smartwizard/js/jquery.smartWizard.min.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: e09644c09a5f7c110e5c815f07b946c7bae88f7f7dbdf380cf4a670ae9550357

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-357d"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 form-wizard.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 3 KB
1001 B 77ms
75ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/form-wizard.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 8027afd3ac51d591ef45c0cad6192c3c7c839293a8501ef289bf9fb9079230d1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-a0e"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 app.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 5 KB
1 KB 77ms
75ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/app.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: c8b64511a8597d713810a56c7baeba21a04950030052f3e231235c9e3c0b98c8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-14dd"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK ico-chiamaci.png
securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ 677 B
1018 B 262ms
30ms Image
image/png 62.241.12.21
Viale Europa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ico-chiamaci.png
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 62.241.12.21 Rome, Italy, ASN15720 (Viale Europa, 175, IT),
Reverse DNS
Software: nginx /
Resource Hash: 4107c25521da5ee37c5d24e380378112c466e5e3d26925e2e296c7783de26f53

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 07:46:24 GMT
Last-Modified: Fri, 15 Oct 2021 10:43:06 GMT
Server: nginx
ETag: "61695b3a-2a5"
Content-Type: image/png
Access-Control-Allow-Origin: https://widget.poste.it, https://postepay.poste.it
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 677

GET
H/1.1 200
OK ico-scrivici.png
securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ 630 B
971 B 261ms
30ms Image
image/png 62.241.12.21
Viale Europa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ico-scrivici.png
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 62.241.12.21 Rome, Italy, ASN15720 (Viale Europa, 175, IT),
Reverse DNS
Software: nginx /
Resource Hash: 9ff77f4a96667c4c35e7572f597b733d13f34396c8d5d4c9fac1d61da11c35f0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 07:46:24 GMT
Last-Modified: Fri, 15 Oct 2021 10:43:06 GMT
Server: nginx
ETag: "61695b3a-276"
Content-Type: image/png
Access-Control-Allow-Origin: https://widget.poste.it, https://postepay.poste.it
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 630

GET
H/1.1 200
OK ico-vieni-in-poste-cerca-up.png
securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ 669 B
1010 B 262ms
30ms Image
image/png 62.241.12.21
Viale Europa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelogin.poste.it/risorse_dt/condivise/immagini/icone/icone-default-on/ico-vieni-in-poste-cerca-up.png
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 62.241.12.21 Rome, Italy, ASN15720 (Viale Europa, 175, IT),
Reverse DNS
Software: nginx /
Resource Hash: f97dc8796d6188136c4f09f80b425be64a2eda69fb9401bf3adf5f383dc34f10

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 07:46:24 GMT
Last-Modified: Fri, 15 Oct 2021 10:43:06 GMT
Server: nginx
ETag: "61695b3a-29d"
Content-Type: image/png
Access-Control-Allow-Origin: https://widget.poste.it, https://postepay.poste.it
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 669

GET
H/1.1 200
OK cresceresostenibili.png
www.poste.it/img/1476527483616/ 3 KB
3 KB 246ms
30ms Image
image/png 62.241.12.20
Viale Europa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.poste.it/img/1476527483616/cresceresostenibili.png
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 62.241.12.20 Rome, Italy, ASN15720 (Viale Europa, 175, IT),
Reverse DNS
Software: nginx /
Resource Hash: 8c8ac2c86181d0dba70a4d86f623c3d6a162ff955bd2a89206110f2b5d09a87a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: public
Date: Tue, 08 Feb 2022 07:46:24 GMT
Last-Modified: Mon, 22 Mar 2021 18:06:05 GMT
Server: nginx
ETag: "6058dc8d-c50"
Content-Type: image/png
Cache-Control: max-age=3600, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3152
Expires: Tue, 08 Feb 2022 08:46:24 GMT

GET
H2 200 valid.js Show response
www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/ 10 KB
4 KB 77ms
75ms Script
application/javascript 134.209.252.73
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/assets/js/valid.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.252.73 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host5.webapricot.am
Software: nginx /
Resource Hash: 9dcc45b03d8ef705eea0bc8d41d77da961e4b5ea4eda67272fb59578da8cb4c1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 07:46:23 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 17:36:31 GMT
server: nginx
etag: W/"6201589f-2761"
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK / Show response
line.storerightdesicion.com/ping/ 1 KB
921 B 172ms
111ms Script
text/plain 45.9.150.78
NICEIT

General

Check archive.org

Show headers Download Go to

Full URL: https://line.storerightdesicion.com/ping/?ftrow.js
Requested by: Host: www.fondfreedom.com
URL: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.9.150.78 , Switzerland, ASN49447 (NICEIT, DM),
Reverse DNS
Software: nginx /
Resource Hash: 50059bd6d627fe34cc644414b2516d08b3ada784803e9873625607e2fc914c42

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 07:46:24 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60

GET s.php
chess.storerightdesicion.com/ 0
0

GET
H/1.1

200
OK

c.php Show response
chess.storerightdesicion.com/
Redirect Chain

https://chess.storerightdesicion.com/s.php?pid=584-348576743-22
https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895

912 B
671 B

123ms
123ms

Document
text/html

45.9.150.78
NICEIT

General

Check archive.org

Show headers Download Go to

Full URL: https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895
Requested by: Host: line.storerightdesicion.com
URL: https://line.storerightdesicion.com/ping/?ftrow.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.9.150.78 , Switzerland, ASN49447 (NICEIT, DM),
Reverse DNS
Software: nginx /
Resource Hash: 80760c513a5854e77007899dd6ac928816279727d308190b8ec4237cbdd005d1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://www.fondfreedom.com/wp-includes/js/tinymce/plugins/directionality/track/payment.php

Response headers

Server: nginx
Date: Tue, 08 Feb 2022 07:46:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 444
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 08 Feb 2022 07:46:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=60
Location: https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895

GET go.php
chess.storerightdesicion.com/ 0
0

GET
H/1.1 200
OK go.php Show response
chess.storerightdesicion.com/ 249 B
416 B 117ms
117ms Document
text/html 45.9.150.78
NICEIT

General

Check archive.org

Show headers Download Go to

Full URL: https://chess.storerightdesicion.com/go.php?id=79699-347-3485623-44
Requested by: Host: chess.storerightdesicion.com
URL: https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.9.150.78 , Switzerland, ASN49447 (NICEIT, DM),
Reverse DNS
Software: nginx /
Resource Hash: b34e8c4aebfeee8a9499df9b0a0d8c85609bdbb572dd1b6a9ca7c47fa9dce655

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://chess.storerightdesicion.com/c.php?id=226-658347-44-223895

Response headers

Server: nginx
Date: Tue, 08 Feb 2022 07:46:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 189
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Content-Encoding: gzip

GET muywey3dmi5dinzyge
listen-heres.com/go/ 0
0

GET
H2 200 muywey3dmi5dinzyge Show response
listen-heres.com/go/ 51 KB
51 KB 134ms
42ms Document
text/html 104.248.199.158
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://listen-heres.com/go/muywey3dmi5dinzyge?subid3=dream&=8&subid4=touch

Requested by

Host: chess.storerightdesicion.com
URL: https://chess.storerightdesicion.com/go.php?id=79699-347-3485623-44

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.248.199.158 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

6078b2290eeb3d9c81ed6ba98019fec326c27a3a1ba4623b82b99397eeb32965

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://chess.storerightdesicion.com/

Response headers

server: nginx
date: Tue, 08 Feb 2022 07:46:24 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6cbf5ff9c2945171c3f93c38e9c67d4b98fb5354a3c95cf4910259780c1fb9b0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a72fd7760f623c9fd5fee0bd98df809a347471902fc479bcdae38681c1a071d1

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca7a07233506b5529a951fd2c4580757f5606d874b8a2b0a153d14a418b201ef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Primary Request index.php Show response
0.listen-heres.com/ 12 KB
13 KB 71ms
41ms Document
text/html 104.248.199.158
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://0.listen-heres.com/index.php?p=muywey3dmi5dinzyge&subid3=dream&=8&subid4=touch

Requested by

Host: listen-heres.com
URL: https://listen-heres.com/go/muywey3dmi5dinzyge?subid3=dream&=8&subid4=touch

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.248.199.158 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

29b21921549776383a351c5a4bf4bbab96a47f1dcc4579f73b7a031979a36343

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://listen-heres.com/

Response headers

server: nginx
date: Tue, 08 Feb 2022 07:46:25 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests

GET
DATA 200
OK truncated
/ 748 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 378 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 377 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: chess.storerightdesicion.com
URL: https://chess.storerightdesicion.com/s.php?pid=584-348576743-22

Domain: chess.storerightdesicion.com
URL: https://chess.storerightdesicion.com/go.php?id=79699-347-3485623-44

Domain: listen-heres.com
URL: https://listen-heres.com/go/muywey3dmi5dinzyge?subid3=dream&=8&subid4=touch

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poste Italiane (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fondfreedom.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2evkipbu686tim8o423t3ur5u2
.listen-heres.com/	1970-01-20 01:28:18	Name: uuid Value: 47208ade-1429-4da3-bf21-551ed12a1744
.0.listen-heres.com/	1970-01-20 01:28:18	Name: uuid Value: 47208ade-1429-4da3-bf21-551ed12a1744

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.listen-heres.com
chess.storerightdesicion.com
line.storerightdesicion.com
listen-heres.com
securelogin.poste.it
stackpath.bootstrapcdn.com
www.fondfreedom.com
www.poste.it
chess.storerightdesicion.com
listen-heres.com
104.248.199.158
134.209.252.73
2606:4700::6812:bcf
45.9.150.78
62.241.12.20
62.241.12.21
099ac56e52f547f59624894dd9416afbcd13ba299bd439f649f597bee2b7a9c6
13eb5bf323748eeac033a52c0808a6cfd869aead32081ee3a5fd275d12d26134
199bf5253860461e080930bec92048b82628a653b0d6ccd9dffd54fd0870c468
29b21921549776383a351c5a4bf4bbab96a47f1dcc4579f73b7a031979a36343
2e90bf023b7b7faf91e6deb6630fa4294a063939b10e250e58085162a7fe28b0
40ebfe1c6d8aa2e889bb3a14314a9b90ec15715f9d758ea8b4de5ca166ee8967
4107c25521da5ee37c5d24e380378112c466e5e3d26925e2e296c7783de26f53
4cbca36d802725d8170ee71ee71c8fd2264ca9f2c02604726e17e774e9c2dbc7
50059bd6d627fe34cc644414b2516d08b3ada784803e9873625607e2fc914c42
53d559fbad2132e378cbfb5cf69d1eb9d49b8dd92593f3393b55b01f7df287f3
6078b2290eeb3d9c81ed6ba98019fec326c27a3a1ba4623b82b99397eeb32965
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
62fa616e35ad4686909a307b09da66ecd3be9a3a658d58a61f0557ec6d691736
6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d
6cbf5ff9c2945171c3f93c38e9c67d4b98fb5354a3c95cf4910259780c1fb9b0
705ab1e8a4c87d391dd8990b5edf1b62eebabf97403cfecded1e88b1529db2da
7baa865b9dafd450443b1b34e2987cb7bd077992e8debbe47457873b16f1c32e
7df02cbdad5be43843d5494d69649e6d3f15d3695b279f032af44c76c76afa5d
8027afd3ac51d591ef45c0cad6192c3c7c839293a8501ef289bf9fb9079230d1
80760c513a5854e77007899dd6ac928816279727d308190b8ec4237cbdd005d1
84575d0fa5cc23015b6b8213423a6fe56584e79ef0e8ed30f5145f9868c8cf89
8c8ac2c86181d0dba70a4d86f623c3d6a162ff955bd2a89206110f2b5d09a87a
9dcc45b03d8ef705eea0bc8d41d77da961e4b5ea4eda67272fb59578da8cb4c1
9ff77f4a96667c4c35e7572f597b733d13f34396c8d5d4c9fac1d61da11c35f0
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
a72fd7760f623c9fd5fee0bd98df809a347471902fc479bcdae38681c1a071d1
b34e8c4aebfeee8a9499df9b0a0d8c85609bdbb572dd1b6a9ca7c47fa9dce655
baa3e37b7cb949cffa48afde899c543fca4f3dab58f1f338935c80b53964a55a
be8bf51e97b8066bcf004785618cbf545c4dd6d383a1c3490e77ef64bb7a6f8d
c8b64511a8597d713810a56c7baeba21a04950030052f3e231235c9e3c0b98c8
ca7a07233506b5529a951fd2c4580757f5606d874b8a2b0a153d14a418b201ef
cf68bfc0322a1c1b1bcf18aed542e1b4b414f684522f176814891cd90d9fc864
d26cdfa4e4c99bcd4d99047beff09a62f8e0c955654b7a4968acf1ebdc293cb8
dc12954ae8eba862b6281fd69436a64f45e55ff47f9d587e5391bbce61755a86
e09644c09a5f7c110e5c815f07b946c7bae88f7f7dbdf380cf4a670ae9550357
e859f0bbbf924a908ddd853c3f3b8736a81d323aaf5b19ccf03ebeb3ba166bbf
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e
f97dc8796d6188136c4f09f80b425be64a2eda69fb9401bf3adf5f383dc34f10
fbbbf3cf89005ae24594626f6bbda6b07dedb60a1bddb69c498cff56ad73db70

0.listen-heres.com Open in urlscan Pro 104.248.199.158 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

92 %HTTPS

17 %IPv6

5 Domains

8 Subdomains

7 IPs

5 Countries

289 kBTransfer

967 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

0.listen-heres.com Open in urlscan Pro
104.248.199.158 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

92 %
HTTPS

17 %
IPv6

5
Domains

8
Subdomains

7
IPs

5
Countries

289 kB
Transfer

967 kB
Size

3
Cookies

37 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!