redirect.bitlabs.ai Open in urlscan Pro
2606:4700:20::681a:4c5  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Page URL
2. https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

35 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/	3 KB 2 KB	148ms 86ms	Document text/html	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cd42d1ab1e0c010a18dd70fbffc89bdfe76a6270ba16a5268ecca33eb71033b3 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-cache-status DYNAMIC cf-ray 813526c1fdc8373b-FRA content-encoding br content-type text/html; charset=utf-8 date Mon, 09 Oct 2023 08:11:11 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cM6W87JK%2FRo0N%2FHwhYXKt0Fwth4FErdv8jWisFTApgQ3TN8H4%2FodR36Ddf4TGHerQeNCJloU1TxnJmjJek42sCa74J4f8RXns8UCjeUVQCMBI6NH1AFn0%2FvFdTXowa0VVXUZYZjSUnsMupHdGS%2B0"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	loading.gif portal.fraud.ink/	66 KB 66 KB	33ms 31ms	Image image/gif	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://portal.fraud.ink/loading.gif Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ea314fdb418403576b31ae91cefdd602e81f0154733cadce3f676f238b005f11 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3685 alt-svc h3=":443"; ma=86400 content-length 67389 referrer-policy strict-origin-when-cross-origin server cloudflare etag "f7a67b43eee13c998f214b521f8b1b65" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2FVTy%2BgZnxopuV1NIYBzoJZr3bqO00l1szRjeCcb7hJGcHavWKxPfJUy%2Fy5C2tUtPsn3yNeasUZFYj%2BmyvT0Umf%2BohNQGn38VfoCO%2Bj3Ta7OAiMroqoXmumafkX3KgeGdNasD3lzXAgVmxyRQ3%2FX"}],"group":"cf-nel","max_age":604800} content-type image/gif access-control-allow-origin * cache-control public, max-age=14400, must-revalidate accept-ranges bytes cf-ray 813526c28e5c373b-FRA
GET H2	200	finished.gif portal.fraud.ink/	10 KB 10 KB	55ms 53ms	Image image/gif	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://portal.fraud.ink/finished.gif Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7ee54e34257aca98e69ed6a4ce451c433fcaa560cd602cdf41880c96bff6bcb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3025 alt-svc h3=":443"; ma=86400 content-length 10017 referrer-policy strict-origin-when-cross-origin server cloudflare etag "a50265dbe210d097608b51e7a9e300c8" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1m005HPqqqZ2c9KHbV0CxvfizvC1Ox6NtrAv6j2oTRS6KIeHj0UR6S630QBBFhYfeavlayefWmW6oIIXfZ%2F8wdqZ8dvoj9Y2ODKRWMNQtXiPHa%2BmKMbiTIA6d7YYDENHu5MgKKcNOxU59mHJ9wXW"}],"group":"cf-nel","max_age":604800} content-type image/gif access-control-allow-origin * cache-control public, max-age=14400, must-revalidate accept-ranges bytes cf-ray 813526c28e63373b-FRA
GET H2	200	sc_review_lib_secured_v1-2.min.js Show response prod.rtymgt.com/static/js/review/	9 KB 9 KB	370ms 146ms	Script application/javascript	75.2.69.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://prod.rtymgt.com/static/js/review/sc_review_lib_secured_v1-2.min.js?v=1.0.1 Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.69.97 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a3f2c118684a26706.awsglobalaccelerator.com Software nginx/1.10.3 (Ubuntu) / Resource Hash 688eeeaf91db19ffca01e7f4653986a6b14f2c48ca6abc4235de377c25824932 Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT last-modified Fri, 06 Mar 2020 08:13:03 GMT server nginx/1.10.3 (Ubuntu) etag "1583482383.0-8788-1388455265" content-type application/javascript cache-control public, max-age=43200 accept-ranges bytes content-length 8788 expires Mon, 09 Oct 2023 20:11:11 GMT
GET H2	200	cleanid-v3.current.min.js Show response idsuite.navigatorsurveys.com/	91 KB 91 KB	163ms 31ms	Script application/x-javascript	2600:9000:2057:3c00:15:ad1b:c280:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:3c00:15:ad1b:c280:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0d05c9546b8ecc4f9a2e40becf83a1d67f9df1103706219998a5a939e8d8ea67 Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 03:23:11 GMT via 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront) last-modified Thu, 07 Sep 2023 09:12:57 GMT server AmazonS3 x-amz-cf-pop FRA6-C1 age 17293 x-amz-server-side-encryption AES256 etag "5b5c0252cde500e5b45385d8d9c16f7c" vary Origin x-cache Hit from cloudfront content-type application/x-javascript accept-ranges bytes content-length 92909 x-amz-cf-id lzcYLRZzxmf0awomxxRg2d0FQvU51LPvF7SEkdplYdL_2sKaZsgVyA==
GET H2	200	index-10d702d7.js Show response portal.fraud.ink/assets/	105 KB 35 KB	56ms 55ms	Script application/javascript	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://portal.fraud.ink/assets/index-10d702d7.js Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cdca09ba4888e7ff84a44276026a31ab89ca9e5af164f7592675c8cb784e95d Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Origin https://portal.fraud.ink accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 717 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"d15a601a26e5d0f1ff06bf2265523fc4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9TT8IMnB84IMwvJDem26NxVLZUcZHmoAGCohbYyoQWRDyvHcwwMdn64gAfJcxv9j2pFtCXA18ZsUNZ%2FCSx35vk4PwE4Q7ccydPI5UHQ%2Fab4%2FHL%2B6YR8RkGN4m7II6H%2Fd1uZs"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=14400, must-revalidate cf-ray 813526c28e62373b-FRA
GET H2	200	index-a8b915e8.css portal.fraud.ink/assets/	207 B 454 B	55ms 54ms	Stylesheet text/css	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://portal.fraud.ink/assets/index-a8b915e8.css Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a8b915e863f867447a763852dae9303abf202594342465adbac5f46555a11547 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 816 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"37e45680a77572d6cac141d254d9e383" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ldVn0EnCCevZ8sNB88%2BWxczMPPQh8tlmk4qxwiFMNhy0BpXs7RKzm44xFZ4dOFkv4eB%2B1nqhLI7LGq1C3niU0U7dDFtzdhcXKcRlqRV1a26%2Bj5WkLVskYBaLPFKekrhyIFz31antaAW4y%2FxTWBoI"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=14400, must-revalidate cf-ray 813526c28e5e373b-FRA
GET H2	200	request.js Show response script.anura.io/	54 KB 20 KB	187ms 110ms	Script application/javascript	52.56.178.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/request.js?instance=842046990&source=5D2D900AFE163478D92478A2BBDF5E51-30005-1&callback=IDSuite.anuraCallback&501427242599 Requested by Host: idsuite.navigatorsurveys.com URL: https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.56.178.14 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-178-14.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash b9b3968418bd12385e97a0b71be9d21b2a30d0de0f0b94a7d8cbf0c5ec753e73 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 08:11:11 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
POST H2	200	/ Show response o494432.ingest.sentry.io/api/4505034569089024/envelope/	2 B 324 B	97ms 26ms	Fetch application/json	34.120.195.249 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://o494432.ingest.sentry.io/api/4505034569089024/envelope/?sentry_key=167353bb7c5141308b120e473e8f9ce0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.48.0 Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.195.249 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 249.195.120.34.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://portal.fraud.ink/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Mon, 09 Oct 2023 08:11:11 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 google server nginx vary origin,access-control-request-method,access-control-request-headers content-type application/json access-control-allow-origin * access-control-expose-headers x-sentry-error,x-sentry-rate-limits,retry-after x-envoy-upstream-service-time 2 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2
GET H2	200	cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 trkr6.fraud.ink/v2/	0 0	93ms 26ms	Fetch	2603:1020:201:e::1ac MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://trkr6.fraud.ink/v2/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2603:1020:201:e::1ac Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-origin * date Mon, 09 Oct 2023 08:11:11 GMT content-length 0 vary Origin
GET H2	200	YPgyyJwT5CiEdABa Show response fraud.ink/f710gooQjG1ZfKwS/	127 KB 46 KB	238ms 176ms	Script text/javascript	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fraud.ink/f710gooQjG1ZfKwS/YPgyyJwT5CiEdABa?apiKey=H5GYk2ozDguZKwJ03vbl Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21f83799aaed597550feff6a938ce9d55789d17ee9e39f78dd46520661369890 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://portal.fraud.ink/ Origin https://portal.fraud.ink accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT via 1.1 ca6974974a9175b71fb6a84145111ed2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 22 x-amz-cf-pop ZRH55-P1 content-encoding br x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 server cloudflare etag W/"fhEpa41UfxvnDvAx1lbiCHv7c7I" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Tu13%2FetpWu%2Bs0nqherrtWJHcwvjBvXaDX56kCdk24GCcKmZIQAYNujzgASgcIuQz7NMHc7VUN6%2F1jlmoMeDZM%2FcOjk%2FIsi5G95DvQpADEUJq8IJBcFrvsp36X%2F8juvKzCgB4xFl4iQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=3600, s-maxage=60 cf-ray 813526c57d359a18-FRA timing-allow-origin * x-amz-cf-id 9rWxouo5h2QNK26RZpeNWRU0uz2-_P97avHxcDiDDlCtfD_b8bourw==
GET		/ cfa41b71-7a0c-4c16-b4c4-b13d5e311da4-rlv.yourlast.click/	0 0
GET BLOB	200 OK	d3514ba9-e3c4-474b-808d-efa2b71567ad https://portal.fraud.ink/	185 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://portal.fraud.ink/d3514ba9-e3c4-474b-808d-efa2b71567ad Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/tx/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/?mb=fg Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 852941709b55524e1a728401963117506c38343fb0983164bd61ceaf153a55cb Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Length 185 Content-Type text/javascript
GET H2	200	orid.min.html Show response idsuite.navigatorsurveys.com/ Frame 23A7	793 B 1 KB	22ms 21ms	Document text/html	2600:9000:2057:3c00:15:ad1b:c280:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://idsuite.navigatorsurveys.com/orid.min.html Requested by Host: idsuite.navigatorsurveys.com URL: https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:3c00:15:ad1b:c280:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash a70b6b0c23364446cc6edbb5b488b1d9124dde88aeb128174dae1b2018fc8024 Request headers Referer https://portal.fraud.ink/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 6396 content-length 793 content-type text/html date Mon, 09 Oct 2023 06:24:35 GMT etag "cb69550948c82c76210bc704121c8124" last-modified Tue, 02 Aug 2022 08:38:52 GMT server AmazonS3 vary Origin via 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront) x-amz-cf-id amrXH5u0ARpeEVA6hb_ngEUluNoEf82o5h85hXJ4INBiLMK8Xwb2sg== x-amz-cf-pop FRA6-C1 x-cache Hit from cloudfront
GET H2	200	showads.js Show response ads.anura.io/	0 352 B	83ms 21ms	XHR application/javascript	18.66.147.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.anura.io/showads.js?947864383297 Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-5.fra60.r.cloudfront.net Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 01:01:09 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA60-P4 age 25802 vary Accept-Encoding x-cache Hit from cloudfront access-control-allow-methods GET access-control-allow-origin * content-type application/javascript; charset=utf-8 x-amz-cf-id GywozDJsF2GHS-mvxoNmWnNIS9Rlmve09m4giMaAmCB8VeAiQz-YDA==
GET H2	200	4GWb_ Show response fraud.ink/f710gooQjG1ZfKwS/gLtg0Pey3cTCG1l8/R6JpC/_yXaBL/r4vX2zR/	96 B 570 B	56ms 55ms	XHR text/plain	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fraud.ink/f710gooQjG1ZfKwS/gLtg0Pey3cTCG1l8/R6JpC/_yXaBL/r4vX2zR/4GWb_?region=eu Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cdf01e603bf2b5354393a14f4261d519c836b7296ba383c61810433eb0bc9fd9 Security Headers Name Value Content-Security-Policy default-src 'none'; frame-ancestors 'none' X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://portal.fraud.ink/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:11 GMT content-security-policy default-src 'none'; frame-ancestors 'none' x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy no-referrer server cloudflare x-frame-options DENY report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZczU%2B%2BKfHTsRXJz2TfRwGnpnK3Hh0VXR9QR14%2FhpgW5BvfUFEVyfB2d0q448SHKSYb961eI5e0xNfsLYR7HZgROxG5cfvjs7nQ6eae74ddEUehpgHoNqD30omt4Xqo729QhO3Ti2ehI%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=utf-8 access-control-allow-origin * access-control-expose-headers Retry-After cache-control max-age=31534000, immutable, private vary Accept-Encoding cf-ray 813526c6ee969a18-FRA timing-allow-origin * x-robots-tag noindex
POST H2	200	response.json Show response script.anura.io/	146 B 483 B	341ms 271ms	XHR application/json	52.56.178.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/response.json Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.56.178.14 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-178-14.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 6297e155823fabf466d1f16cda9f9e9181905174c304e42dc800fb77d7eb9eb8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://portal.fraud.ink/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 09 Oct 2023 08:11:12 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding access-control-allow-methods POST content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
POST H3	200	gLtg0Pey3cTCG1l8 Show response fraud.ink/f710gooQjG1ZfKwS/	344 B 1 KB	125ms 101ms	XHR text/plain	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fraud.ink/f710gooQjG1ZfKwS/gLtg0Pey3cTCG1l8?region=eu&ci=js/3.8.25&ii=fingerprintjs-pro-cloudflare/1.4.0/procdn Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d77efddb60d3b18d699db5884baa6dde90c1f0bcd85f7f2e870bc7e99a4ba7dd Security Headers Name Value Content-Security-Policy default-src 'none'; frame-ancestors 'none' X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://portal.fraud.ink/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain Response headers date Mon, 09 Oct 2023 08:11:12 GMT content-security-policy default-src 'none'; frame-ancestors 'none' x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy no-referrer server cloudflare vary Origin, Accept-Encoding x-frame-options DENY content-type text/plain access-control-allow-origin https://portal.fraud.ink report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g4WGBxj1AB%2Fp0b4rjkv65%2FfIKc%2B88azFOXXz8PQuUP%2FyFF2UaSVAN3t4ofEaKvbdl7iFiNyxm4%2FKaYz6Ix%2Fl5DXKCeq2HKrlUBTfu6OCc%2FKBtvJ%2BCFW7BJCIofwBNBJLCfp6ZaM2LwE%3D"}],"group":"cf-nel","max_age":604800} access-control-expose-headers Retry-After access-control-allow-credentials true cf-ray 813526cadc594dbe-FRA timing-allow-origin *
GET H3	200	challenge Show response click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/	135 B 635 B	98ms 98ms	Fetch application/json	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/challenge Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4a9956f92c11a973a5fcb0d09903765c631b7c3b35abfc32862080fc9b922b79 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://portal.fraud.ink/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-type application/json; charset=UTF-8 Response headers date Mon, 09 Oct 2023 08:11:13 GMT strict-transport-security max-age=15724800; includeSubDomains content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wwe54B9a%2FJtWqqd9FPN%2BxOUm%2B9OagMQ3Vq6gHLdMNXXHcHVO3l0RkOhGOn%2BZd7NDKEMyQRB%2B2WI269hNOxZIQXTIAjgwvCqZ5jYUTwHGPPyY7EqaU7BnqimOc8Sx%2BfRZQgf%2BADajRIxXWN%2F0JcY%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://portal.fraud.ink cf-ray 813526d1e9ae6909-FRA alt-svc h3=":443"; ma=86400
OPTIONS H2	200	challenge click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/ Frame	0 0	60ms 51ms	Preflight	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4/challenge Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://portal.fraud.ink Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-headers Content-Type access-control-allow-methods GET access-control-allow-origin https://portal.fraud.ink access-control-max-age 300 alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 813526d199359a18-FRA content-length 0 date Mon, 09 Oct 2023 08:11:13 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7YgwryEmei9Urqth51DINWgTgGO1IBjngi%2BYB38yjVQzxnkd6WQqHxYjpCevPH%2BN158Qgbwo9Zrp4J8o66qKgx%2BM60eQif9NLTPuv4jX8W99MWeElgRNryArlVQ7RUgiZ0VExR36d9Smkdo7GOc%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15724800; includeSubDomains vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H3	200	cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Show response click.fraud.ink/v1/results/	325 B 738 B	438ms 437ms	Fetch application/json	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4?mb=fg Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 27fcd802810ce95ad35a2dba5aec72300ea19594a6694ca80beed64cf173b8b0 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://portal.fraud.ink/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-type application/json; charset=UTF-8 Response headers date Mon, 09 Oct 2023 08:11:14 GMT strict-transport-security max-age=15724800; includeSubDomains content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fw8%2FAsgIhoGmuNf%2BPhmns3cIQt2P%2BFKqqnu8az%2F%2FtOcZIgEsZ3wHg1qejZKjIobaogYiHl1mArwkIJK%2Fqka%2FV6DYRcM9J%2FhwUkc0B%2B%2BGVqvB0tU5G8tPuzreut0x6UXtoZHVg10KW%2BOPTHTF02c%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://portal.fraud.ink cf-ray 813526d30a946909-FRA alt-svc h3=":443"; ma=86400
OPTIONS H3	200	cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 click.fraud.ink/v1/results/ Frame	0 0	77ms 76ms	Preflight	2606:4700:3031::ac43:9cf9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://click.fraud.ink/v1/results/cfa41b71-7a0c-4c16-b4c4-b13d5e311da4?mb=fg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:9cf9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://portal.fraud.ink Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-headers Content-Type access-control-allow-methods POST access-control-allow-origin https://portal.fraud.ink access-control-max-age 300 alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 813526d28a386909-FRA content-length 0 date Mon, 09 Oct 2023 08:11:13 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WtE%2Fe9dRg6Os9%2BKuQw2lQsrkWk%2Bnzct96rLyV1DDCvKmitl1RmhmQCICzUEuei9Efy2VeYDvvr3pbIDIWRwB3Ed7e7UxJpuNzUeEgeNe5K6%2FoUiVzvtOEda7ebp6ujlbytghPJ5%2FOkbl%2F29osNA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15724800; includeSubDomains vary Origin Access-Control-Request-Method Access-Control-Request-Headers
GET H2	200	Primary Request / Show response redirect.bitlabs.ai/	1 KB 1 KB	155ms 98ms	Document text/html	2606:4700:20::681a:4c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Requested by Host: portal.fraud.ink URL: https://portal.fraud.ink/assets/index-10d702d7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:4c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c7116ac35f2e14bff4ac0f00ab43aadd9e2efbd6264f00026b821c64bf9ea0f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://portal.fraud.ink/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control public, max-age=5184000, immutable cf-cache-status DYNAMIC cf-ray 813526db3d88913c-FRA content-encoding br content-type text/html date Mon, 09 Oct 2023 08:11:15 GMT last-modified Fri, 05 May 2023 16:36:28 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy same-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LwhRtbGtGKl%2FEBWoGqBW%2BR5ssCeLfHPN2VDqHd%2FItAuuF2BtjwQLCw%2BEZGb56dfGsPwZm%2FvlqCdJ8uUnYIuTg5ZVWPJRzRt4Qm1RSJbj2OzLauMH6D%2B%2BHiyd2fMB3Ld3OvTVu2n7Ho9dtvfg81GACEU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=10886400; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff x-dns-prefetch-control off x-xss-protection 1; mode=block
POST		/ o494432.ingest.sentry.io/api/4505034569089024/envelope/	0 0
GET H2	200	sc_review_lib_secured_v1-2.min.js Show response prod.rtymgt.com/static/js/review/	9 KB 9 KB	147ms 146ms	Script application/javascript	75.2.69.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://prod.rtymgt.com/static/js/review/sc_review_lib_secured_v1-2.min.js?v=1.0.1 Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.69.97 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a3f2c118684a26706.awsglobalaccelerator.com Software nginx/1.10.3 (Ubuntu) / Resource Hash 688eeeaf91db19ffca01e7f4653986a6b14f2c48ca6abc4235de377c25824932 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:15 GMT last-modified Fri, 06 Mar 2020 08:13:03 GMT server nginx/1.10.3 (Ubuntu) etag "1583482383.0-8788-1388455265" content-type application/javascript cache-control max-age=43200, public accept-ranges bytes content-length 8788 expires Mon, 09 Oct 2023 20:11:15 GMT
GET H2	200	cleanid-v3.current.min.js Show response idsuite.navigatorsurveys.com/	91 KB 91 KB	23ms 23ms	Script application/x-javascript	2600:9000:2057:3c00:15:ad1b:c280:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:3c00:15:ad1b:c280:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0d05c9546b8ecc4f9a2e40becf83a1d67f9df1103706219998a5a939e8d8ea67 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 03:23:11 GMT via 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront) last-modified Thu, 07 Sep 2023 09:12:57 GMT server AmazonS3 x-amz-cf-pop FRA6-C1 age 17297 x-amz-server-side-encryption AES256 etag "5b5c0252cde500e5b45385d8d9c16f7c" vary Origin x-cache Hit from cloudfront content-type application/x-javascript accept-ranges bytes content-length 92909 x-amz-cf-id gbWFu46J9h6RQFF-wP5W5Y5b_6tyUk9Wrl40BLP32HkSRBqVgEt3cQ==
GET H2	200	chunk-vendors.10855e6e.js Show response redirect.bitlabs.ai/js/	540 KB 175 KB	43ms 42ms	Script text/javascript	2606:4700:20::681a:4c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://redirect.bitlabs.ai/js/chunk-vendors.10855e6e.js Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:4c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0dbcbb3c144bfc5e165583c0eb1019a764322d6d001bd2f36cf3ea9791b595c9 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:15 GMT strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6868848 x-dns-prefetch-control off content-encoding br x-xss-protection 1; mode=block referrer-policy same-origin last-modified Fri, 05 May 2023 16:36:28 GMT server cloudflare etag W/"39807387" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=snwvZiVyeFuPLj55lv%2BSkD0YDaxGmRSaz688VfWdnK%2BzUeeyg1nqJU2TBZ1DCkG%2BFyaQHSxOQXDIoImRub1Y7LSRQgSeEglvBPnHttnhwfaxjW3EFWPYQBXu6mYyo5G%2BIgOwF5D3ccVBSGRkl7iGLqk%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control public, max-age=31536000, immutable cf-ray 813526dc1e90913c-FRA
GET H2	200	app.eaa5ddfa.js Show response redirect.bitlabs.ai/js/	12 KB 5 KB	31ms 30ms	Script text/javascript	2606:4700:20::681a:4c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://redirect.bitlabs.ai/js/app.eaa5ddfa.js Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:4c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 447d7d3187f8438a72766a84e1c60919169fb49313c9d3df35bc5c277f9d8146 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:15 GMT strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6868194 x-dns-prefetch-control off content-encoding br x-xss-protection 1; mode=block referrer-policy same-origin last-modified Fri, 05 May 2023 16:36:28 GMT server cloudflare etag W/"39807387" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rtu0VVLvRBIAjT1zKysFOqhFexW1Pb85h4lGwpvjXUEoezVXejrZmS94n71YEZgMuGGmeuvz8XQEDCZNf6uzVcX%2FAImbwxmDOmLZZ0ysg4WwjvltQaDZvOFaWBDH1GF%2Bo9m50170js7mksSM9rjYpwk%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control public, max-age=31536000, immutable cf-ray 813526dcbf47913c-FRA
GET H2	200	app.0c7d4d39.css redirect.bitlabs.ai/css/	173 KB 17 KB	31ms 30ms	Stylesheet text/css	2606:4700:20::681a:4c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://redirect.bitlabs.ai/css/app.0c7d4d39.css Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:4c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72f5f6939b271ad531f04cecaa3a1819f6d6e75400492ebf7d84ca4c04555344 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://redirect.bitlabs.ai/?app=512&cid=true&clk=224b13d6-a4c7-40ed-88c8-1c0bfb157761&country=NG&network=16&sc_s=true&survey=486220&token=9d99b4f7-8b05-4205-bdd3-f97d9b80031b&tx=414379531&user_id=177877372&fitx=cfa41b71-7a0c-4c16-b4c4-b13d5e311da4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:15 GMT strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6868195 x-dns-prefetch-control off content-encoding br x-xss-protection 1; mode=block referrer-policy same-origin last-modified Fri, 05 May 2023 16:36:28 GMT server cloudflare etag W/"39807387" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0%2BpVeJPH9k8LVtIJ2JR72FaaFFpOPUkd7fu2uQd0BUXLMm3k%2FuxMiTVRyrLfWpZ4kvsvyoi4s3MlXEN%2B15No0K7lZUhtCzjmaRgsRW%2BCY2x%2FbYCiNFcyxmFdoeW5Gj0MSAdmzQaIjoNSx89%2F18G56I%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=31536000, immutable cf-ray 813526dbee4e913c-FRA
GET H2	200	request.js Show response script.anura.io/	54 KB 20 KB	67ms 67ms	Script application/javascript	52.56.178.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/request.js?instance=842046990&source=5D2D900AFE163478D92478A2BBDF5E51-30005-1&callback=IDSuite.anuraCallback&83381059837 Requested by Host: idsuite.navigatorsurveys.com URL: https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.56.178.14 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-178-14.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash ae4890079634b3e76da21c00a12220c1f2ed33101e7c0e8df066f015907a92ad Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 08:11:15 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
GET H2	200	poppins-regular-400.497ba086.ttf redirect.bitlabs.ai/fonts/	141 KB 65 KB	33ms 33ms	Font font/ttf	2606:4700:20::681a:4c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://redirect.bitlabs.ai/fonts/poppins-regular-400.497ba086.ttf Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/css/app.0c7d4d39.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:4c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 577dfb678b8fc1bda8ef0fabd74611675013ae08ae3b0045b8adcb1c6fa01eb9 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redirect.bitlabs.ai/css/app.0c7d4d39.css Origin https://redirect.bitlabs.ai accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 08:11:15 GMT strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6868847 x-dns-prefetch-control off content-encoding br x-xss-protection 1; mode=block referrer-policy same-origin last-modified Fri, 05 May 2023 16:36:28 GMT server cloudflare etag W/"39807387" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FZdD9LMo8YI2hgCvQdeldk2GdwbOpqhoG3BLOEHEwT5%2BWrPloKF3eaCGRAET1sx5N0z40gnwl3qJyp1XsEgdRhwsVve9mRWrm5EY2CL7gBf%2FhPjw9yjxt4PIyPkvAtXBtC4rTfagFS2qpbKpCu5a3HE%3D"}],"group":"cf-nel","max_age":604800} content-type font/ttf cache-control public, max-age=31536000, immutable cf-ray 813526dd0fa2913c-FRA
GET H2	200	orid.min.html Show response idsuite.navigatorsurveys.com/ Frame 7300	793 B 1 KB	22ms 21ms	Document text/html	2600:9000:2057:3c00:15:ad1b:c280:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://idsuite.navigatorsurveys.com/orid.min.html Requested by Host: idsuite.navigatorsurveys.com URL: https://idsuite.navigatorsurveys.com/cleanid-v3.current.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:3c00:15:ad1b:c280:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash a70b6b0c23364446cc6edbb5b488b1d9124dde88aeb128174dae1b2018fc8024 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 6400 content-length 793 content-type text/html date Mon, 09 Oct 2023 06:24:35 GMT etag "cb69550948c82c76210bc704121c8124" last-modified Tue, 02 Aug 2022 08:38:52 GMT server AmazonS3 vary Origin via 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront) x-amz-cf-id YRZ9LpG0Rz31q58lhJUO2C0a0ai7LBIloHc0UCAbWND1AkzFnomrkQ== x-amz-cf-pop FRA6-C1 x-cache Hit from cloudfront
GET H2	200	showads.js Show response ads.anura.io/	0 353 B	22ms 22ms	XHR application/javascript	18.66.147.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.anura.io/showads.js?159331498460 Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/js/chunk-vendors.10855e6e.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-5.fra60.r.cloudfront.net Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 01:01:09 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA60-P4 age 25806 vary Accept-Encoding x-cache Hit from cloudfront access-control-allow-methods GET access-control-allow-origin * content-type application/javascript; charset=utf-8 x-amz-cf-id r2Dwin_E9K9-ZcEWTV4VCZLQNHyj9gKCGGCogLwhnCXSnLUOfPPVDA==
POST H2	200	response.json Show response script.anura.io/	146 B 481 B	173ms 173ms	XHR application/json	52.56.178.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/response.json Requested by Host: redirect.bitlabs.ai URL: https://redirect.bitlabs.ai/js/chunk-vendors.10855e6e.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.56.178.14 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-178-14.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash dd99b9296e49b3eb82a752d4936001441f78b1b232373102eec05c25da2d005b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 09 Oct 2023 08:11:16 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding access-control-allow-methods POST content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
POST		cleanid gateway.navigatorsurveys.com/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cfa41b71-7a0c-4c16-b4c4-b13d5e311da4-rlv.yourlast.click

URL

https://cfa41b71-7a0c-4c16-b4c4-b13d5e311da4-rlv.yourlast.click/

Domain

o494432.ingest.sentry.io

URL

https://o494432.ingest.sentry.io/api/4505034569089024/envelope/?sentry_key=167353bb7c5141308b120e473e8f9ce0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.48.0

Domain

gateway.navigatorsurveys.com

URL

https://gateway.navigatorsurveys.com/cleanid

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _0x49ea function| _0x4650 function| scReviewLib object| CleanID boolean| cleanIDAlreadyCalled object| IDSuite object| Forensic object| webpackChunkbitlabs_redirect object| __SENTRY__ object| FontAwesomeConfig object| ___FONT_AWESOME___ boolean| __VUE__ object| Anura

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.fraud.ink/	1970-01-21 00:06:15	Name: _iidt Value: nfilyMA1iPDbODWP3Q5MSBYYOhJXg9J2Bd0EVZz0+bO2+9B16YordS3HU/3gYxRJ1XUv9xg5TqjE1xGh9Y9XZ4Q=
			.fraud.ink/	1970-01-21 00:06:15	Name: _vid_t Value: oEw1np+y7WTwK55QL4dRAaRElZSVMWlhPpddyphUca2INMNK8z5LHr5xlYk3044xuRiOvkpPSHcJph4XvTzECGQ=
			portal.fraud.ink/	1970-01-20 15:22:05	Name: visitorId Value: WH8B2KQ6Wvq4yCQYfNFQ

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.anura.io
cfa41b71-7a0c-4c16-b4c4-b13d5e311da4-rlv.yourlast.click
click.fraud.ink
fraud.ink
gateway.navigatorsurveys.com
idsuite.navigatorsurveys.com
o494432.ingest.sentry.io
portal.fraud.ink
prod.rtymgt.com
redirect.bitlabs.ai
script.anura.io
trkr6.fraud.ink
cfa41b71-7a0c-4c16-b4c4-b13d5e311da4-rlv.yourlast.click
gateway.navigatorsurveys.com
o494432.ingest.sentry.io
18.66.147.5
2600:9000:2057:3c00:15:ad1b:c280:93a1
2603:1020:201:e::1ac
2606:4700:20::681a:4c5
2606:4700:3031::ac43:9cf9
34.120.195.249
52.56.178.14
75.2.69.97
0d05c9546b8ecc4f9a2e40becf83a1d67f9df1103706219998a5a939e8d8ea67
0dbcbb3c144bfc5e165583c0eb1019a764322d6d001bd2f36cf3ea9791b595c9
21f83799aaed597550feff6a938ce9d55789d17ee9e39f78dd46520661369890
27fcd802810ce95ad35a2dba5aec72300ea19594a6694ca80beed64cf173b8b0
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
447d7d3187f8438a72766a84e1c60919169fb49313c9d3df35bc5c277f9d8146
4a9956f92c11a973a5fcb0d09903765c631b7c3b35abfc32862080fc9b922b79
577dfb678b8fc1bda8ef0fabd74611675013ae08ae3b0045b8adcb1c6fa01eb9
5cdca09ba4888e7ff84a44276026a31ab89ca9e5af164f7592675c8cb784e95d
6297e155823fabf466d1f16cda9f9e9181905174c304e42dc800fb77d7eb9eb8
688eeeaf91db19ffca01e7f4653986a6b14f2c48ca6abc4235de377c25824932
72f5f6939b271ad531f04cecaa3a1819f6d6e75400492ebf7d84ca4c04555344
7ee54e34257aca98e69ed6a4ce451c433fcaa560cd602cdf41880c96bff6bcb9
852941709b55524e1a728401963117506c38343fb0983164bd61ceaf153a55cb
8c7116ac35f2e14bff4ac0f00ab43aadd9e2efbd6264f00026b821c64bf9ea0f
a70b6b0c23364446cc6edbb5b488b1d9124dde88aeb128174dae1b2018fc8024
a8b915e863f867447a763852dae9303abf202594342465adbac5f46555a11547
ae4890079634b3e76da21c00a12220c1f2ed33101e7c0e8df066f015907a92ad
b9b3968418bd12385e97a0b71be9d21b2a30d0de0f0b94a7d8cbf0c5ec753e73
cd42d1ab1e0c010a18dd70fbffc89bdfe76a6270ba16a5268ecca33eb71033b3
cdf01e603bf2b5354393a14f4261d519c836b7296ba383c61810433eb0bc9fd9
d77efddb60d3b18d699db5884baa6dde90c1f0bcd85f7f2e870bc7e99a4ba7dd
dd99b9296e49b3eb82a752d4936001441f78b1b232373102eec05c25da2d005b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea314fdb418403576b31ae91cefdd602e81f0154733cadce3f676f238b005f11