hajoopteg.com Open in urlscan Pro
188.42.224.12  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://bankgarrate.cf/ Page URL
2. http://dolohen.com/afu.php?zoneid=2374779 Page URL
3. http://dolohen.com/?z=2374779 Page URL
4. https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response bankgarrate.cf/	10 KB 5 KB	83ms 37ms	Document text/html	2606:4700:30::6818:74b9 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://bankgarrate.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::6818:74b9 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3d32148e898e0abc59a664eaddc1e7389a037561484ea3fb9f8c08da6fc94308 Request headers :method GET :authority bankgarrate.cf :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Thu, 04 Apr 2019 16:24:34 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d650bf28270aa27d1bd73f52f7c83a21a1554395074; expires=Fri, 03-Apr-20 16:24:34 GMT; path=/; domain=.bankgarrate.cf; HttpOnly expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4c24a21d1a9e97f2-FRA content-encoding br
GET H2	200	dojo.js Show response ajax.googleapis.com/ajax/libs/dojo/1.13.0/dojo/	120 KB 43 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:81d::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/dojo/1.13.0/dojo/dojo.js Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2a00:1450:4001:81d::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash f3ac93bf15e041612af6abe9e066bcb4621fc885c151cfe38ba25c4e54033598 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 09 Mar 2019 05:09:48 GMT content-encoding gzip x-content-type-options nosniff age 2286886 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 44301 x-xss-protection 1; mode=block last-modified Thu, 14 Dec 2017 11:00:15 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 08 Mar 2020 05:09:48 GMT
GET H/1.1	200 OK	jquery-3.3.1.js Show response code.jquery.com/	265 KB 79 KB	31ms 8ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.js Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:34 GMT Content-Encoding gzip Last-Modified Sat, 20 Jan 2018 17:26:44 GMT Server nginx ETag "5a637bd4-42587" Vary Accept-Encoding X-HW 1554395074.dop005.fr8.shc,1554395074.dop005.fr8.t,1554395074.cds048.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 80268
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81d::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2a00:1450:4001:81d::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 09 Mar 2019 04:41:30 GMT content-encoding gzip x-content-type-options nosniff age 2288584 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 30399 x-xss-protection 1; mode=block last-modified Thu, 25 Jan 2018 15:33:24 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 08 Mar 2020 04:41:30 GMT
GET H/1.1	200 OK	jquery-ui.min.js Show response code.jquery.com/ui/1.12.1/	248 KB 67 KB	27ms 7ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/ui/1.12.1/jquery-ui.min.js Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5 Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:34 GMT Content-Encoding gzip Last-Modified Wed, 14 Sep 2016 16:34:16 GMT Server nginx ETag W/"57d97c08-3dee4" Vary Accept-Encoding X-HW 1554395074.dop005.fr8.shc,1554395074.dop005.fr8.t,1554395074.cds053.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 67751
GET H2	200	zocial.min.css cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.3.0/css/	44 KB 23 KB	27ms 25ms	Stylesheet text/css	2606:4700::6813:c797 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.3.0/css/zocial.min.css Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 933445a3c79afe2f3b2ca1a1435c5604ce919b7cd9060230569751f25e9d96af Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 04 Apr 2019 16:24:34 GMT content-encoding br cf-cache-status HIT status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Thu, 17 May 2018 09:18:36 GMT server cloudflare etag W/"5afd48ec-afc6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * expires Tue, 24 Mar 2020 16:24:34 GMT cache-control public, max-age=30672000 cf-ray 4c24a21d5a4696dc-FRA served-in-seconds 0.001
GET H2	200	mini-default.min.css cdnjs.cloudflare.com/ajax/libs/mini.css/3.0.0/	46 KB 8 KB	26ms 26ms	Stylesheet text/css	2606:4700::6813:c797 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/mini.css/3.0.0/mini-default.min.css Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash f974ac5ee7ee44972499b48e21c3bffd7d935f9ba498deea2de43c1f1a30f0ef Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 04 Apr 2019 16:24:34 GMT content-encoding br cf-cache-status HIT status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Tue, 29 May 2018 07:45:50 GMT server cloudflare etag W/"5b0d052e-b727" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * expires Tue, 24 Mar 2020 16:24:34 GMT cache-control public, max-age=30672000 cf-ray 4c24a21d5a4c96dc-FRA served-in-seconds 0.002
GET H2	200	spectre.min.css cdnjs.cloudflare.com/ajax/libs/spectre.css/0.5.3/	43 KB 9 KB	27ms 26ms	Stylesheet text/css	2606:4700::6813:c797 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/spectre.css/0.5.3/spectre.min.css Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7816a0d03364b0e12379b56b0d207139859a22c440e51073cff3d642d9209af3 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 04 Apr 2019 16:24:34 GMT content-encoding br cf-cache-status HIT status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Tue, 19 Jun 2018 01:45:50 GMT server cloudflare etag W/"5b28604e-adea" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * expires Tue, 24 Mar 2020 16:24:34 GMT cache-control public, max-age=30672000 cf-ray 4c24a21d5a4d96dc-FRA served-in-seconds 0.001
GET H2	200	Je-dors-donc-je-maigris_width1024.jpg img3.topsante.com/var/topsante/storage/images/minceur/soins-minceur/astuces-minceur/je-dors-donc-je-maigris/169294-1-fre-FR/	52 KB 53 KB	297ms 149ms	Image image/jpeg	52.222.150.120 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://img3.topsante.com/var/topsante/storage/images/minceur/soins-minceur/astuces-minceur/je-dors-donc-je-maigris/169294-1-fre-FR/Je-dors-donc-je-maigris_width1024.jpg Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.222.150.120 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-222-150-120.fra53.r.cloudfront.net Software nginx / Resource Hash de66e178c0daaf93a11c87d1143bd7cc4ee6cf326bf5a030715dab11cdd13785 Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 04 Apr 2019 16:24:34 GMT via 1.1 b7f7970e9c911e165d4cb9f70deac42a.cloudfront.net (CloudFront) x-cacheable YES age 0 grace none x-cache Miss from cloudfront status 200 x-ua-device pc content-length 53408 served-by topsante.com last-modified Fri, 31 Mar 2017 14:03:53 GMT server nginx etag "1490969033-53408" x-varnish 856643484 cache-control public, max-age=7776000, s-maxage=7776000 accept-ranges bytes content-type image/jpeg x-amz-cf-id xXu03F2sdYzjm2D75DbuNZzTTWcMo3KZoc8BqSFehei05U3NSgWJoQ== expires Wed, 03 Jul 2019 16:24:34 GMT
GET H/1.1	200 OK	3095018649_1_5_LRxogU9J.jpg auto.img.v4.skyrock.net/7007/75527007/pics/	42 KB 43 KB	86ms 36ms	Image image/jpeg	91.203.187.6 SKYROCK
General Check archive.org Show headers Download Go to Show image Full URL http://auto.img.v4.skyrock.net/7007/75527007/pics/3095018649_1_5_LRxogU9J.jpg Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol HTTP/1.1 Server 91.203.187.6 , France, ASN41064 (SKYROCK, FR), Reverse DNS vip-p-skyrock-static-lbs.skyrock.net Software nginx / Resource Hash abac073278e9e1dd52aed51898b46b11352d829ceadc8b911eeb02388a8a3009 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:34 GMT Last-Modified Mon, 04 Aug 2014 13:46:46 GMT Server nginx Age 421550 ETag "53df8ec6-a9b2" Content-Type image/jpeg Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Content-Length 43442
GET H/1.1	200 OK	diets_1 thedarkcorner.org/	197 B 547 B	947ms 947ms	Script application/javascript	193.238.153.177 ITLAS
General Check archive.org Show headers Download Go to Full URL https://thedarkcorner.org/diets_1?keyword=donc%20je%20perds%20du%20poids%20et%20toi Requested by Host: bankgarrate.cf URL: https://bankgarrate.cf/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.238.153.177 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS ds26.friendhosting.net Software nginx/1.14.1 / PHP/5.4.16 Resource Hash Request headers Referer https://bankgarrate.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Pragma no-cache Date Thu, 04 Apr 2019 16:24:35 GMT Last-Modified Thu, 04 Apr 2019 16:24:34 GMT Server nginx/1.14.1 X-Powered-By PHP/5.4.16 Transfer-Encoding chunked Content-Type application/javascript; charset=utf-8 Cache-Control max-age=0 Connection keep-alive Expires Thu, 21 Jul 1977 07:30:00 GMT
GET H/1.1	200 OK	Cookie set afu.php Show response dolohen.com/	9 KB 5 KB	37ms 15ms	Document text/html	88.85.66.250 WEBZILLA
General Check archive.org Show headers Download Go to Full URL http://dolohen.com/afu.php?zoneid=2374779 Requested by Host: thedarkcorner.org URL: https://thedarkcorner.org/diets_1?keyword=donc%20je%20perds%20du%20poids%20et%20toi Protocol HTTP/1.1 Server 88.85.66.250 , Netherlands, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash 90b19dbcfe41df9bf044f5821c2f4cd5cdefefe22987bf62bbe27a578c8f6638 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Host dolohen.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx Date Thu, 04 Apr 2019 16:24:35 GMT Content-Type text/html; charset=utf8 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Origin Access-Control-Allow-Methods POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Headers Accept, Content-Type, Content-Length, Accept-Encoding Pragma no-cache Cache-Control no-store, no-cache, must-revalidate, max-age=0 Expires Tue, 11 Jan 1994 10:00:00 GMT X-Trace-Id 611f66124d869fd71fcbbf411c117c49 Set-Cookie OAID=e1e39fe87f764497a2aa9f2434c54c0b; expires=Fri, 03 Apr 2020 16:24:35 GMT oaidts=1554395075; expires=Fri, 03 Apr 2020 16:24:35 GMT Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Timing-Allow-Origin * Content-Encoding gzip
GET H/1.1	200 OK	img.gif my.rtmark.net/	43 B 366 B	34ms 15ms	Image image/gif	188.42.160.69 WEBZILLA
General Check archive.org Show headers Download Go to Show image Full URL http://my.rtmark.net/img.gif?f=merge&userId=e1e39fe87f764497a2aa9f2434c54c0b Requested by Host: dolohen.com URL: http://dolohen.com/afu.php?zoneid=2374779 Protocol HTTP/1.1 Server 188.42.160.69 , Luxembourg, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Referer http://dolohen.com/afu.php?zoneid=2374779 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:35 GMT X-Content-Type-Options nosniff Server nginx Strict-Transport-Security max-age=1 Content-Type image/gif Connection keep-alive Timing-Allow-Origin * Content-Length 43
POST H/1.1	200 OK	Cookie set / Show response dolohen.com/	2 KB 2 KB	25ms 24ms	Document text/html	88.85.66.250 WEBZILLA
General Check archive.org Show headers Download Go to Full URL http://dolohen.com/?z=2374779 Requested by Host: dolohen.com URL: http://dolohen.com/afu.php?zoneid=2374779 Protocol HTTP/1.1 Server 88.85.66.250 , Netherlands, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash 823139c543cc67bc7c1e99adceae3db5904f1d1d0dce3c590fdabd720b8c2470 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Host dolohen.com Connection keep-alive Content-Length 483 Pragma no-cache Cache-Control no-cache Origin http://dolohen.com Upgrade-Insecure-Requests 1 Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer http://dolohen.com/afu.php?zoneid=2374779&var=2374779&rid=wfxzsvAkbQDjdtH2xjZy_Q%3D%3D Accept-Encoding gzip, deflate Cookie OAID=e1e39fe87f764497a2aa9f2434c54c0b; oaidts=1554395075 Origin http://dolohen.com Upgrade-Insecure-Requests 1 Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://dolohen.com/afu.php?zoneid=2374779&var=2374779&rid=wfxzsvAkbQDjdtH2xjZy_Q%3D%3D Response headers Server nginx Date Thu, 04 Apr 2019 16:24:35 GMT Content-Type text/html; charset=utf8 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Origin http://dolohen.com Access-Control-Allow-Methods POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Headers Accept, Content-Type, Content-Length, Accept-Encoding Pragma no-cache Cache-Control no-store, no-cache, must-revalidate, max-age=0 Expires Tue, 11 Jan 1994 10:00:00 GMT X-Trace-Id 7e36e6345b350a117032fcb5485a22b9 Set-Cookie OAID=e1e39fe87f764497a2aa9f2434c54c0b; expires=Fri, 03 Apr 2020 16:24:35 GMT oaidts=1554395075; expires=Fri, 03 Apr 2020 16:24:35 GMT OXCCLK=1932583.1; expires=Fri, 03 Apr 2020 16:24:35 GMT allcnt=1; expires=Fri, 03 Apr 2020 16:24:35 GMT Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Timing-Allow-Origin * Content-Encoding gzip
GET H/1.1	404 Not Found	sc.php trecurlik.com/	0 162 B	41ms 13ms	Image text/plain	88.85.66.186 WEBZILLA
General Check archive.org Show headers Download Go to Show image Full URL http://trecurlik.com/sc.php?bannerid=2664065&clickid=137705531774078976 Requested by Host: dolohen.com URL: http://dolohen.com/?z=2374779 Protocol HTTP/1.1 Server 88.85.66.186 , Netherlands, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://dolohen.com/?z=2374779 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:35 GMT Server nginx Connection keep-alive Content-Length 0 Content-Type text/plain; charset=utf-8
GET H/1.1	200 OK	Primary Request Cookie set / Show response hajoopteg.com/	2 KB 1 KB	96ms 43ms	Document text/html	188.42.224.12 WEBZILLA
General Check archive.org Show headers Download Go to Full URL https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Requested by Host: dolohen.com URL: http://dolohen.com/?z=2374779 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 188.42.224.12 , Luxembourg, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / PHP/7.2.9 Resource Hash 189ed5f0bee5cedd7976b7755980f2ea5b80fe4ee12074dfe70d91cae29569ed Request headers Host hajoopteg.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer http://dolohen.com/?z=2374779 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://dolohen.com/?z=2374779 Response headers Server nginx Date Thu, 04 Apr 2019 16:24:36 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/7.2.9 Set-Cookie reverse=5H8JGbimGVrN_Tlxi_g04Rk7PnmGWenRt59ifZPz1Qk; expires=Thu, 04-Apr-2019 17:24:36 GMT; Max-Age=3600; path=/ Content-Encoding gzip
GET H/1.1	200 OK	style.css static.hajoopteg.com/custom/push-confirm-step2/build/css/	4 KB 2 KB	59ms 13ms	Stylesheet text/css	188.42.224.12 WEBZILLA
General Check archive.org Show headers Download Go to Full URL https://static.hajoopteg.com/custom/push-confirm-step2/build/css/style.css?v=1526050534700 Requested by Host: hajoopteg.com URL: https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 188.42.224.12 , Luxembourg, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash 04f6f610ddc8f7e0bb93c90bfb4944fad6d900d9835ff821de6d12cdceb45bd7 Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host static.hajoopteg.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,*/*;q=0.1 Referer https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Connection keep-alive Cache-Control no-cache Referer https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:36 GMT Content-Encoding gzip Last-Modified Thu, 04 Apr 2019 10:10:29 GMT Server nginx ETag W/"5ca5d815-fca" Vary Accept-Encoding Access-Control-Allow-Methods GET, POST, OPTIONS, HEAD Content-Type text/css Access-Control-Allow-Origin * Access-Control-Expose-Headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
GET H/1.1	200 OK	0960517494268.png static.hajoopteg.com/contents/s/a3/8d/53/46c1b5b48f88597056624f76cd/	5 KB 5 KB	73ms 28ms	Image image/png	188.42.224.12 WEBZILLA
General Check archive.org Show headers Download Go to Show image Full URL https://static.hajoopteg.com/contents/s/a3/8d/53/46c1b5b48f88597056624f76cd/0960517494268.png Requested by Host: hajoopteg.com URL: https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 188.42.224.12 , Luxembourg, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash 89de4daa1076660cd265f07e945f57a4eb45a2c23d2dd9153be405c55f57cfbf Security Headers Name Value Strict-Transport-Security max-age=60 X-Content-Type-Options nosniff Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host static.hajoopteg.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Connection keep-alive Cache-Control no-cache Referer https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Apr 2019 16:24:36 GMT X-Content-Type-Options nosniff Last-Modified Fri, 11 May 2018 14:49:54 GMT Server nginx ETag "5af5ad92-13d9" Strict-Transport-Security max-age=60 Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 5081
GET H/1.1	200 OK	ntfc.php Show response pushokey.com/	60 KB 19 KB	108ms 38ms	Script application/javascript	188.72.213.156 WEBZILLA
General Check archive.org Show headers Download Go to Full URL https://pushokey.com/ntfc.php?p=2490389&ucis=true&m=https&nbinp=true&var=2374779 Requested by Host: hajoopteg.com URL: https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 188.72.213.156 , Netherlands, ASN35415 (WEBZILLA, NL), Reverse DNS Software nginx / Resource Hash b02a6afc75a09fe406df57bd26f8f731d93d7d5743362fd23364e8a138feff9b Request headers Referer https://hajoopteg.com/?b=2664065&ba=0&campid=1932583&did=2&dm=0&ep=0&fp=0&g=DE&hr=0&i18db=1&l=jMo3Pf3Tgd14BVg&oaid=e1e39fe87f764497a2aa9f2434c54c0b&pshr=0&rd=0&s=137705531774078976&ssk=e1cffe4e012d278fedcfe8b6712cdced&svar=1554395075&vi=0&vo=0&z=2374779&tr=default User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Pragma no-cache Date Thu, 04 Apr 2019 16:24:28 GMT Content-Encoding gzip Content-Type application/javascript; charset=utf-8 Server nginx Transfer-Encoding chunked Access-Control-Allow-Methods GET, POST, OPTIONS P3P CP="CUR ADM OUR NOR STA NID" Access-Control-Max-Age 86400 Cache-Control private, max-age=0, no-cache Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Expires Mon, 26 Jul 1997 05:00:00 GMT

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| sdk boolean| installOnFly

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hajoopteg.com/	1970-01-18 23:46:38	Name: reverse Value: 5H8JGbimGVrN_Tlxi_g04Rk7PnmGWenRt59ifZPz1Qk

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://ajax.googleapis.com/ajax/libs/dojo/1.13.0/dojo/dojo.js(Line 34) Message: Error: multipleDefine

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
auto.img.v4.skyrock.net
bankgarrate.cf
cdnjs.cloudflare.com
code.jquery.com
dolohen.com
hajoopteg.com
img3.topsante.com
my.rtmark.net
pushokey.com
static.hajoopteg.com
thedarkcorner.org
trecurlik.com
188.42.160.69
188.42.224.12
188.72.213.156
193.238.153.177
205.185.208.52
2606:4700:30::6818:74b9
2606:4700::6813:c797
2a00:1450:4001:81d::200a
52.222.150.120
88.85.66.186
88.85.66.250
91.203.187.6
04f6f610ddc8f7e0bb93c90bfb4944fad6d900d9835ff821de6d12cdceb45bd7
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
189ed5f0bee5cedd7976b7755980f2ea5b80fe4ee12074dfe70d91cae29569ed
3d32148e898e0abc59a664eaddc1e7389a037561484ea3fb9f8c08da6fc94308
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
7816a0d03364b0e12379b56b0d207139859a22c440e51073cff3d642d9209af3
823139c543cc67bc7c1e99adceae3db5904f1d1d0dce3c590fdabd720b8c2470
89de4daa1076660cd265f07e945f57a4eb45a2c23d2dd9153be405c55f57cfbf
90b19dbcfe41df9bf044f5821c2f4cd5cdefefe22987bf62bbe27a578c8f6638
933445a3c79afe2f3b2ca1a1435c5604ce919b7cd9060230569751f25e9d96af
abac073278e9e1dd52aed51898b46b11352d829ceadc8b911eeb02388a8a3009
b02a6afc75a09fe406df57bd26f8f731d93d7d5743362fd23364e8a138feff9b
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
de66e178c0daaf93a11c87d1143bd7cc4ee6cf326bf5a030715dab11cdd13785
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3ac93bf15e041612af6abe9e066bcb4621fc885c151cfe38ba25c4e54033598
f974ac5ee7ee44972499b48e21c3bffd7d935f9ba498deea2de43c1f1a30f0ef