urlscan.io logo urlscan.io
SecurityTrails logo

s.viitoz.com Open in urlscan Pro
31.220.27.135  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://fitnesstube.dailydollarprofits.com/
Effective URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3...
Submission: On August 10 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 7 countries across 12 domains to perform 29 HTTP transactions. The main IP is 31.220.27.135, located in Amsterdam, Netherlands and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is s.viitoz.com. The Cisco Umbrella rank of the primary domain is 10458.
TLS certificate: Issued by R3 on May 31st 2022. Valid for: 3 months.
This is the only time s.viitoz.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 3 50.87.151.203 46606 (UNIFIEDLA...)
10 91.211.91.112 206638 (HOSTFORY)
2 2a00:1450:400... 15169 (GOOGLE)
2 143.204.95.64 16509 (AMAZON-02)
1 1 45.155.121.224 35277 (LLHOST-IN...)
1 91.211.91.104 206638 (HOSTFORY)
1 3 185.177.94.108 39572 (ADVANCEDH...)
2 31.220.27.135 39572 (ADVANCEDH...)
1 2a00:1450:400... 15169 (GOOGLE)
3 7 2a02:6b8::1:119 208722 (GLOBAL_DC)
29 10
3    50.87.151.203 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-87-151-203.unifiedlayer.com
fitnesstube.dailydollarprofits.com
fitnesstube.xyz
10    91.211.91.112 (Ukraine)

ASN206638 (HOSTFORY, UA)
ads.specialadves.com
2    2a00:1450:400e:811::200a (Ireland)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    143.204.95.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-64.fra50.r.cloudfront.net
z-na.amazon-adsystem.com
1    45.155.121.224 (Katowice, Poland)

ASN35277 (LLHOST-INC-SRL, RO)
PTR: vps.24399345.llhost-inc.eu
space.bettershitecolumn.com
1    91.211.91.104 (Ukraine)

ASN206638 (HOSTFORY, UA)
door.cofounderspecials.com
3    185.177.94.108 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-94-108.ah-server.com
blueskyactivecontrol.net
0.blueskyactivecontrol.net
2    31.220.27.135 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
s.viitoz.com
1    2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
7    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)
mc.yandex.ru
mc.yandex.com
Apex Domain
Subdomains		 Transfer
10 specialadves.com
ads.specialadves.com
38 KB
5 yandex.com
mc.yandex.com — Cisco Umbrella Rank: 10493
3 KB
3 blueskyactivecontrol.net
blueskyactivecontrol.net Failed
0.blueskyactivecontrol.net
105 KB
2 yandex.ru
mc.yandex.ru — Cisco Umbrella Rank: 3617
71 KB
2 viitoz.com
s.viitoz.com — Cisco Umbrella Rank: 10458
35 KB
2 amazon-adsystem.com
z-na.amazon-adsystem.com — Cisco Umbrella Rank: 6691
16 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
2 KB
2 dailydollarprofits.com
fitnesstube.dailydollarprofits.com
420 B
1 gstatic.com
fonts.gstatic.com
31 KB
1 cofounderspecials.com
door.cofounderspecials.com — Cisco Umbrella Rank: 604253
559 B
1 bettershitecolumn.com
space.bettershitecolumn.com Failed
634 B
1 fitnesstube.xyz
fitnesstube.xyz
41 KB
29 12
Domain Requested by
10 ads.specialadves.com fitnesstube.xyz
5 mc.yandex.com 2 redirects s.viitoz.com
2 mc.yandex.ru 1 redirects s.viitoz.com
2 s.viitoz.com fitnesstube.xyz
s.viitoz.com
2 0.blueskyactivecontrol.net 1 redirects fitnesstube.xyz
2 z-na.amazon-adsystem.com fitnesstube.xyz
2 fonts.googleapis.com fitnesstube.xyz
s.viitoz.com
2 fitnesstube.dailydollarprofits.com 2 redirects
1 fonts.gstatic.com fonts.googleapis.com
1 blueskyactivecontrol.net door.cofounderspecials.com
1 door.cofounderspecials.com fitnesstube.xyz
1 space.bettershitecolumn.com fitnesstube.xyz
1 fitnesstube.xyz
29 13

This site contains no links.

Subject Issuer Validity Valid
www.sparktechnews.dailydollarprofits.com
R3		 2022-08-04 -
2022-11-02		 3 months crt.sh
specialadves.com
R3		 2022-08-02 -
2022-10-31		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
ws-na.assoc-amazon.com
Amazon		 2022-01-17 -
2023-01-16		 a year crt.sh
door.cofounderspecials.com
R3		 2022-07-25 -
2022-10-23		 3 months crt.sh
blueskyactivecontrol.com
R3		 2022-07-27 -
2022-10-25		 3 months crt.sh
viitoz.com
R3		 2022-05-31 -
2022-08-29		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
mc.yandex.ru
GlobalSign ECC OV SSL CA 2018		 2022-05-21 -
2022-10-31		 5 months crt.sh

This page contains 1 frames:

Primary Page: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Frame ID: 3761DA86C0331AC4B8C47C8CF63D85D6
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bestätigen Sie den Wechsel auf die Seite

Page URL History Show full URLs

  1. http://fitnesstube.dailydollarprofits.com/ HTTP 301
    https://fitnesstube.dailydollarprofits.com/ HTTP 301
    https://fitnesstube.xyz/ Page URL
  2. https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7 HTTP 302
    https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1w... Page URL
  3. https://blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89 Page URL
  4. https://0.blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89 Page URL
  5. https://0.blueskyactivecontrol.net/?auf=gm4wcodbmy5diojygyxtonbqhextemzpge3dmmbrgi3dkmzy&s=1&sub1=&sub2=stonny8... HTTP 302
    https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

29
Requests

79 %
HTTPS

30 %
IPv6

12
Domains

13
Subdomains

10
IPs

7
Countries

339 kB
Transfer

761 kB
Size

16
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://fitnesstube.dailydollarprofits.com/ HTTP 301
    https://fitnesstube.dailydollarprofits.com/ HTTP 301
    https://fitnesstube.xyz/ Page URL
  2. https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7 HTTP 302
    https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f Page URL
  3. https://blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89 Page URL
  4. https://0.blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89 Page URL
  5. https://0.blueskyactivecontrol.net/?auf=gm4wcodbmy5diojygyxtonbqhextemzpge3dmmbrgi3dkmzy&s=1&sub1=&sub2=stonny89&sub3=&sub4=&cpc=0&cpm=0 HTTP 302
    https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://fitnesstube.dailydollarprofits.com/ HTTP 301
  • https://fitnesstube.dailydollarprofits.com/ HTTP 301
  • https://fitnesstube.xyz/
Request Chain 16
  • https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7 HTTP 302
  • https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
Request Chain 27
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9726.w5qpuoeKIW-rNICvaWqokkmDM2pGNFqrxEwYclG3_3OppUOy-OODTeiXjfnrN86Q.B7osJT16JrNsys0xG7ZfZUuNMxU%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9726.BABALlENQbu2O_WHOkUtr2IGpjmzldiE-PMolAUFp8VqD173JbwMIM7zPJVJ3XV6_WA-E5IYJ995-2y1o_IgFA%2C%2C.eo2LDfsXfnr2WP4RY-IL4SXHHww%2C
Request Chain 29
  • https://mc.yandex.com/watch/73936189?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou%3D%3D%3D%3D%3D%3D%3Fu%3Dhttps%253A%252F%252Foffgate-app-phkr.com%252F4-oudyr-bf7-elkx-c1s6%253Fsubid_1%253D1395230290331477%2526subid_2%253D590151%2526subid_3%253D5713199%2526subid_7%253Dcnv208075b9841683aaf841617dc5508cff&page-ref=https%3A%2F%2F0.blueskyactivecontrol.net%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A396%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A860%3Acn%3A1%3Adp%3A0%3Als%3A1554580972719%3Ahid%3A38774034%3Az%3A0%3Ai%3A20220810101539%3Aet%3A1660126539%3Ac%3A1%3Arn%3A237209199%3Arqn%3A1%3Au%3A1660126539107434132%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1660126538358%3Ads%3A7%2C33%2C25%2C13%2C209%2C0%2C%2C102%2C8%2C%2C%2C%2C391%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1660126539%3At%3ABest%C3%A4tigen%20Sie%20den%20Wechsel%20auf%20die%20Seite&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)rqnl(1)ti(2) HTTP 302
  • https://mc.yandex.com/watch/73936189/1?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou%3D%3D%3D%3D%3D%3D%3Fu%3Dhttps%253A%252F%252Foffgate-app-phkr.com%252F4-oudyr-bf7-elkx-c1s6%253Fsubid_1%253D1395230290331477%2526subid_2%253D590151%2526subid_3%253D5713199%2526subid_7%253Dcnv208075b9841683aaf841617dc5508cff&page-ref=https%3A%2F%2F0.blueskyactivecontrol.net%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A396%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A860%3Acn%3A1%3Adp%3A0%3Als%3A1554580972719%3Ahid%3A38774034%3Az%3A0%3Ai%3A20220810101539%3Aet%3A1660126539%3Ac%3A1%3Arn%3A237209199%3Arqn%3A1%3Au%3A1660126539107434132%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1660126538358%3Ads%3A7%2C33%2C25%2C13%2C209%2C0%2C%2C102%2C8%2C%2C%2C%2C391%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1660126539%3At%3ABest%C3%A4tigen%20Sie%20den%20Wechsel%20auf%20die%20Seite&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29

29 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
fitnesstube.xyz/
Redirect Chain
  • http://fitnesstube.dailydollarprofits.com/
  • https://fitnesstube.dailydollarprofits.com/
  • https://fitnesstube.xyz/
120 KB
41 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.151.203 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
50-87-151-203.unifiedlayer.com
Software
Apache /
Resource Hash
16bb9a4a497bf5c93efbdd3bdda84c2750f5343cdfd33f83b1ca992ddd47da38

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:29 GMT
link
<https://fitnesstube.xyz/wp-json/>; rel="https://api.w.org/", <https://fitnesstube.xyz/>; rel=shortlink
server
Apache
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:28 GMT
location
https://fitnesstube.xyz/
server
Apache
x-redirect-by
WordPress
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/css/dist/block-library/style_min_css&ver=5.2.15
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:31 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/plugins/auto-terms-of-service-and-privacy-policy/css/wpautoterms_css&ver=5.2.15
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:32 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/plugins/contact-form-7/includes/css/styles_css&ver=5.1.4
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:32 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/plugins/wp-automatic/css/wp-automatic_css&ver=5.2.15
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:32 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/themes/mh-magazine/style_css&ver=3.8.3
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:32 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:32 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
css
fonts.googleapis.com/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Muli:300,400,400italic,600,700
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2cfa4311b1cd0687fff7318cdc6a1ebb60cedd900289d199a3cd100a259be861
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 10 Aug 2022 10:15:30 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 10 Aug 2022 10:15:30 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 10 Aug 2022 10:15:30 GMT
onejs
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-64.fra50.r.cloudfront.net
Software
Server /
Resource Hash
c85aed8a6d37d97faaaf3e23d3e083fc4a49a11df3fca4cb3c2af8b07ddc3783

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
Public
date
Wed, 10 Aug 2022 01:06:48 GMT
content-encoding
gzip
server
Server
age
32922
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
FRA50-C1
content-length
7990
via
1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
x-amz-cf-id
smiQRP62VONt6UN1w4E-QeRKmOFV32n66KK1OJQge1wrMYeg3oByIA==
expires
Thu, 11 Aug 2022 01:06:48 GMT
steingerball.js
ads.specialadves.com/ 		0
0
steingerball.js
ads.specialadves.com/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/uploads/nc-efi-placeholder-326x245.png
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:35 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
q
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/q?ServiceVersion=20070822&Operation=GetScript&ID=OneJS&WS=1
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-64.fra50.r.cloudfront.net
Software
Server /
Resource Hash
ef7e699a976719ce8cde53b31345568dc3d17434becbfced4b45ddd7d1b31d1d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
Public
date
Wed, 10 Aug 2022 01:19:57 GMT
content-encoding
gzip
server
Server
age
32136
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
FRA50-C1
content-length
7981
via
1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
x-amz-cf-id
Dc7GkxEHRkdJuG2o6kN-jmvssFLR9TmvNUNcMKesuO9ldG-f16ebEQ==
expires
Thu, 11 Aug 2022 01:19:57 GMT
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/plugins/contact-form-7/includes/js/scripts_js&ver=5.1.4
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:34 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/wp-embed_min_js&ver=5.2.15
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:34 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
steingerball.js
ads.specialadves.com/ 		14 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/jquery/jquery_js&ver=1.12.4-wp
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.112 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fitnesstube.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Wed, 10 Aug 2022 10:15:34 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
nginx
Connection
keep-alive
Vary
Accept-Encoding
Content-Type
text/plain; charset=utf-8
cadfl8k.php
space.bettershitecolumn.com/ 		0
0
way.php
door.cofounderspecials.com/
Redirect Chain
  • https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7
  • https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
844 B
559 B 		Document
General
Check archive.org
Download Go to
Full URL
https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.211.91.104 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000;

Request headers

Referer
https://fitnesstube.xyz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
416
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:37 GMT
server
nginx
strict-transport-security
max-age=15768000;
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 10 Aug 2022 10:15:36 GMT
Location
https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
Server
nginx/1.22.0
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
cadfl8k.php
space.bettershitecolumn.com/ 		0
0
/
blueskyactivecontrol.net/ 		0
0
/
blueskyactivecontrol.net/ 		52 KB
52 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89
Requested by
Host: door.cofounderspecials.com
URL: https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433&uclick=qdgha1wj&uclickhash=qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.177.94.108 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
ip-185-177-94-108.ah-server.com
Software
nginx /
Resource Hash
1f99dd361ce21497f3eee75047aa018b0e1069f0038cb3500deecd8937a536ba
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://door.cofounderspecials.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:37 GMT
server
nginx
strict-transport-security
max-age=31536000
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/gif
/
0.blueskyactivecontrol.net/ 		52 KB
52 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://0.blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.177.94.108 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
ip-185-177-94-108.ah-server.com
Software
nginx /
Resource Hash
f08da2fc699bec059ebf03ecb33675b3db92972f68bbfd0f59f3142a520e2fe8
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blueskyactivecontrol.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:38 GMT
server
nginx
strict-transport-security
max-age=31536000
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/gif
Primary Request noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhu...
s.viitoz.com/h/1166/
Redirect Chain
  • https://0.blueskyactivecontrol.net/?auf=gm4wcodbmy5diojygyxtonbqhextemzpge3dmmbrgi3dkmzy&s=1&sub1=&sub2=stonny89&sub3=&sub4=&cpc=0&cpm=0
  • https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2...
86 KB
35 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Requested by
Host: fitnesstube.xyz
URL: https://fitnesstube.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.220.27.135 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.0 /
Resource Hash
a50b7b5368b9a9a7ef23153e63318ced1d29f0a6d5a4e6dd6bc6331f1217e96b

Request headers

Referer
https://0.blueskyactivecontrol.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Width, Viewport-Width, DPR, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 10 Aug 2022 10:15:38 GMT
server
nginx/1.19.0
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 10 Aug 2022 10:15:38 GMT
location
https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
server
nginx
strict-transport-security
max-age=31536000
css2
fonts.googleapis.com/ 		3 KB
658 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:wght@400;700&display=swap
Requested by
Host: s.viitoz.com
URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
63e55165cb26efa3df20628f8c2dfc0b13e7d7e7629761fe9f43b34d5498ea46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.viitoz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 10 Aug 2022 08:24:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 10 Aug 2022 10:15:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 10 Aug 2022 10:15:38 GMT
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s.viitoz.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 03:24:20 GMT
x-content-type-options
nosniff
age
543078
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30928
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:57:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 04 Aug 2023 03:24:20 GMT
tag.js
mc.yandex.ru/metrika/ 		205 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: s.viitoz.com
URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
4c7f7718e32f02dd00533f7f87feae91e37e68b9e7df0bda0e62cba8441d1972
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.viitoz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 10 Aug 2022 10:15:38 GMT
content-encoding
br
last-modified
Tue, 09 Aug 2022 11:59:17 GMT
etag
"62f221e5-118d1"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
71889
expires
Wed, 10 Aug 2022 11:15:38 GMT
index
s.viitoz.com/cnt/api/ 		0
143 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://s.viitoz.com/cnt/api/index
Requested by
Host: s.viitoz.com
URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.220.27.135 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.0 / PHP/7.2.24-0ubuntu0.18.04.4
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 10 Aug 2022 10:15:38 GMT
content-encoding
gzip
server
nginx/1.19.0
x-powered-by
PHP/7.2.24-0ubuntu0.18.04.4
content-type
text/html; charset=UTF-8
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9726.w5qpuoeKIW-rNICvaWqokkmDM2pGNFqrxEwYclG3_3OppUOy-OODTeiXjfnrN86Q.B7osJT16JrNsys0xG7ZfZUuNMxU%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9726.BABALlENQbu2O_WHOkUtr2IGpjmzldiE-PMolAUFp8VqD173JbwMIM7zPJVJ3XV6_WA-E5IYJ995-2y1o_IgFA%2C%2C.eo2LDfsXfnr2WP4RY-IL4SXHHww%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9726.BABALlENQbu2O_WHOkUtr2IGpjmzldiE-PMolAUFp8VqD173JbwMIM7zPJVJ3XV6_WA-E5IYJ995-2y1o_IgFA%2C%2C.eo2LDfsXfnr2WP4RY-IL4SXHHww%2C
Requested by
Host: s.viitoz.com
URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.viitoz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 10 Aug 2022 10:15:39 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9726.BABALlENQbu2O_WHOkUtr2IGpjmzldiE-PMolAUFp8VqD173JbwMIM7zPJVJ3XV6_WA-E5IYJ995-2y1o_IgFA%2C%2C.eo2LDfsXfnr2WP4RY-IL4SXHHww%2C
date
Wed, 10 Aug 2022 10:15:39 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
advert.gif
mc.yandex.com/metrika/ 		43 B
135 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: s.viitoz.com
URL: https://s.viitoz.com/h/1166/noehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou======?u=https%3A%2F%2Foffgate-app-phkr.com%2F4-oudyr-bf7-elkx-c1s6%3Fsubid_1%3D1395230290331477%26subid_2%3D590151%26subid_3%3D5713199%26subid_7%3Dcnv208075b9841683aaf841617dc5508cff
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.viitoz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 10 Aug 2022 10:15:39 GMT
last-modified
Tue, 09 Aug 2022 11:59:17 GMT
etag
"62f221e5-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Wed, 10 Aug 2022 11:15:39 GMT
1
mc.yandex.com/watch/73936189/
Redirect Chain
  • https://mc.yandex.com/watch/73936189?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfw...
  • https://mc.yandex.com/watch/73936189/1?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2d...
331 B
464 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/73936189/1?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou%3D%3D%3D%3D%3D%3D%3Fu%3Dhttps%253A%252F%252Foffgate-app-phkr.com%252F4-oudyr-bf7-elkx-c1s6%253Fsubid_1%253D1395230290331477%2526subid_2%253D590151%2526subid_3%253D5713199%2526subid_7%253Dcnv208075b9841683aaf841617dc5508cff&page-ref=https%3A%2F%2F0.blueskyactivecontrol.net%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A396%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A860%3Acn%3A1%3Adp%3A0%3Als%3A1554580972719%3Ahid%3A38774034%3Az%3A0%3Ai%3A20220810101539%3Aet%3A1660126539%3Ac%3A1%3Arn%3A237209199%3Arqn%3A1%3Au%3A1660126539107434132%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1660126538358%3Ads%3A7%2C33%2C25%2C13%2C209%2C0%2C%2C102%2C8%2C%2C%2C%2C391%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1660126539%3At%3ABest%C3%A4tigen%20Sie%20den%20Wechsel%20auf%20die%20Seite&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
9ce392e60ff722768dcd0bb280a7c2cb11a0935599cb1d8a5a99d4094c8fbd78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.viitoz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 10 Aug 2022 10:15:39 GMT
x-content-type-options
nosniff
last-modified
Wed, 10-Aug-2022 10:15:39 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://s.viitoz.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
331
x-xss-protection
1; mode=block
expires
Wed, 10-Aug-2022 10:15:39 GMT

Redirect headers

pragma
no-cache
date
Wed, 10 Aug 2022 10:15:39 GMT
last-modified
Wed, 10-Aug-2022 10:15:39 GMT
location
/watch/73936189/1?wmode=7&page-url=https%3A%2F%2Fs.viitoz.com%2Fh%2F1166%2Fnoehsxfg2fnhtz6ytcswisfbs3gmassj47mjrjnez3cvm6rapfwquxqpoquvgke63d3n4322hdluv32z2bk25pkb3ez7hycj3fi2dfwmycnihq54ckbwaofakwvb7klihc7e5jobtpi2zlohw2ldhjsouxazxunmvxd3nfrt2zg6xhehzwu23r5wsyz4mtkiznjhueaxrbfud72uj5f4cefikzj4qs3izjkepc3cwts63dbqtnvduukmxh5vh5pwkhqevtfcqwlepakt2nlluo2iteyvpt2pvpnlnq2uvbgwrecskz5fozsimvqa47c2bjxxo6swmjhgm2yapnnqmz32opivi6kg2a4udrxirjgvxjwslrgfggdbge4dndscbexn2vjul3xvngsxwtsgtydzvdltbilizh4upmlaomntujakpfiqeyl2ffmgqtdfmqahucctgb3x6udgjfrtmw34lqbg4lbna7ihuvo2hltlh3su3zewcudyssppjpkwvjkfx5tdi7hyk2x5jnyylb3wtzrupt4fnleexanf425lfjwh7ueuq52djvigo7rnaq2usy37bmwfsbd3pmwqiykvgy3qwlcekrxs242qnemw2yqlfmfcf64k5wx6lkuewzngd2ngvlee4mmtyhkmfqnws3g2stqt4h5mjtcrlcb4zigfjmrwe4t4lqwaqn2bgbtilqnpy57g44rqjby4t6khnoo5k4dnki4etcl7gq77iie5wsme4zv5bqgr4wy3ou%3D%3D%3D%3D%3D%3D%3Fu%3Dhttps%253A%252F%252Foffgate-app-phkr.com%252F4-oudyr-bf7-elkx-c1s6%253Fsubid_1%253D1395230290331477%2526subid_2%253D590151%2526subid_3%253D5713199%2526subid_7%253Dcnv208075b9841683aaf841617dc5508cff&page-ref=https%3A%2F%2F0.blueskyactivecontrol.net%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A396%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A860%3Acn%3A1%3Adp%3A0%3Als%3A1554580972719%3Ahid%3A38774034%3Az%3A0%3Ai%3A20220810101539%3Aet%3A1660126539%3Ac%3A1%3Arn%3A237209199%3Arqn%3A1%3Au%3A1660126539107434132%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1660126538358%3Ads%3A7%2C33%2C25%2C13%2C209%2C0%2C%2C102%2C8%2C%2C%2C%2C391%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1660126539%3At%3ABest%C3%A4tigen%20Sie%20den%20Wechsel%20auf%20die%20Seite&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29
strict-transport-security
max-age=31536000
access-control-allow-origin
https://s.viitoz.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Wed, 10-Aug-2022 10:15:39 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ads.specialadves.com
URL
https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/uploads/nc-efi-placeholder-80x60.png
Domain
space.bettershitecolumn.com
URL
https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7
Domain
space.bettershitecolumn.com
URL
https://space.bettershitecolumn.com/cadfl8k.php?key=qt4w11lvd4cqgqmzqs1h&lp_type=pixel
Domain
blueskyactivecontrol.net
URL
https://blueskyactivecontrol.net/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny89

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| initb145b4849 object| m951 object| adda function| ym object| Ya object| yaCounter73936189

16 Cookies

Domain/Path Name / Value
space.bettershitecolumn.com/ Name: uclick
Value: qdgha1wj
space.bettershitecolumn.com/ Name: uclickhash
Value: qdgha1wj-qdgha1wj-i4-0-i4-dz-bl-9c2b5f
.blueskyactivecontrol.net/ Name: uuid
Value: b11fee17-3e06-4fe1-be3e-f9b819a903bc
.0.blueskyactivecontrol.net/ Name: uuid
Value: b11fee17-3e06-4fe1-be3e-f9b819a903bc
0.blueskyactivecontrol.net/ Name: uuid
Value: b11fee17-3e06-4fe1-be3e-f9b819a903bc
.viitoz.com/ Name: _ym_uid
Value: 1660126539107434132
.viitoz.com/ Name: _ym_d
Value: 1660126539
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 3728187719fake
.viitoz.com/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 3204693588fake
.yandex.com/ Name: yandexuid
Value: 6106076971660126539
.yandex.com/ Name: yuidss
Value: 6106076971660126539
mc.yandex.com/ Name: yabs-sid
Value: 1015708601660126539
.yandex.com/ Name: i
Value: H3IdK9XxcihdQme/ZmqhsMw8oSuKU9pIYc/mTAht1XK1r6R+Da70rNVgisHT2RYwCPG4F4kUfrAC/Lkr3v1jBWd3+lc=
.yandex.com/ Name: ymex
Value: 1691662539.yrts.1660126539#1691662539.yrtsi.1660126539
.viitoz.com/ Name: _ym_visorc
Value: b

1 Console Messages

Source Level URL
Text
network error URL: https://mc.yandex.com/sync_cookie_image_decide?token=9726.BABALlENQbu2O_WHOkUtr2IGpjmzldiE-PMolAUFp8VqD173JbwMIM7zPJVJ3XV6_WA-E5IYJ995-2y1o_IgFA%2C%2C.eo2LDfsXfnr2WP4RY-IL4SXHHww%2C
Message:
Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.blueskyactivecontrol.net
ads.specialadves.com
blueskyactivecontrol.net
door.cofounderspecials.com
fitnesstube.dailydollarprofits.com
fitnesstube.xyz
fonts.googleapis.com
fonts.gstatic.com
mc.yandex.com
mc.yandex.ru
s.viitoz.com
space.bettershitecolumn.com
z-na.amazon-adsystem.com
ads.specialadves.com
blueskyactivecontrol.net
space.bettershitecolumn.com
143.204.95.64
185.177.94.108
2a00:1450:4001:808::2003
2a00:1450:400e:811::200a
2a02:6b8::1:119
31.220.27.135
45.155.121.224
50.87.151.203
91.211.91.104
91.211.91.112
16bb9a4a497bf5c93efbdd3bdda84c2750f5343cdfd33f83b1ca992ddd47da38
1f99dd361ce21497f3eee75047aa018b0e1069f0038cb3500deecd8937a536ba
2cfa4311b1cd0687fff7318cdc6a1ebb60cedd900289d199a3cd100a259be861
4c7f7718e32f02dd00533f7f87feae91e37e68b9e7df0bda0e62cba8441d1972
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
63e55165cb26efa3df20628f8c2dfc0b13e7d7e7629761fe9f43b34d5498ea46
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7
75cd954d2b175505ce95a7395cca6f67c2a2205bf79cab5c13eb80f5163b8212
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
9ce392e60ff722768dcd0bb280a7c2cb11a0935599cb1d8a5a99d4094c8fbd78
a50b7b5368b9a9a7ef23153e63318ced1d29f0a6d5a4e6dd6bc6331f1217e96b
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
c85aed8a6d37d97faaaf3e23d3e083fc4a49a11df3fca4cb3c2af8b07ddc3783
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef7e699a976719ce8cde53b31345568dc3d17434becbfced4b45ddd7d1b31d1d
f08da2fc699bec059ebf03ecb33675b3db92972f68bbfd0f59f3142a520e2fe8