urlscan.io logo urlscan.io
SecurityTrails logo

www.wir-zahlen.de Open in urlscan Pro
83.243.58.29  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.wir-zahlen.de/
Submission: On September 02 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 18 IPs in 2 countries across 19 domains to perform 48 HTTP transactions. The main IP is 83.243.58.29, located in Germany and belongs to CRONON-AS Obermuensterstr. 9, DE. The main domain is www.wir-zahlen.de.
TLS certificate: Issued by R10 on September 1st 2024. Valid for: 3 months.
This is the only time www.wir-zahlen.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 83.243.58.29 25504 (CRONON-AS...)
7 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 170.249.194.154 63410 (PRIVATESY...)
1 192.243.61.225 39572 (ADVANCEDH...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 85.13.130.185 34788 (NMM-AS D)
3 162.0.208.108 22612 (NAMECHEAP...)
2 67.222.24.1 63410 (PRIVATESY...)
1 2 213.202.218.154 24961 (MYLOC-AS ...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 64.34.196.230 13768 (COGECO-PEER1)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
3 2a0d:5940:38:... 58212 (DATAFOREST)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2.18.64.27 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
48 18
12    83.243.58.29 (Germany)

ASN25504 (CRONON-AS Obermuensterstr. 9, DE)
PTR: a11.netbeat.de
www.wir-zahlen.de
7    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
adbytes.media
8    170.249.194.154 (United States)

ASN63410 (PRIVATESYSTEMS, US)
PTR: host.1245inc.com
sharemyads.com
crypto-adz.com
1    192.243.61.225 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
www.topcreativeformat.com
1    2606:4700:20::ac43:4739 (United States)

ASN13335 (CLOUDFLARENET, US)
waust.at
1    85.13.130.185 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd45432.kasserver.com
www.disclaimer.de
3    162.0.208.108 (Lebanon, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: nc-ph-2974.zerads.com
ad2bitcoin.com
2    67.222.24.1 (United States)

ASN63410 (PRIVATESYSTEMS, US)
PTR: cp28-ga.privatesystems.net
start-traffic.com
2    213.202.218.154 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: mail.lcmmedia.de
www.lcmmedia.de
1    2606:4700:3037::ac43:8abb (United States)

ASN13335 (CLOUDFLARENET, US)
www.surfujkase.pl
1    64.34.196.230 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
PTR: webstars2k.com
geniecoop.com
2    2606:4700:3036::6815:1d9 (United States)

ASN13335 (CLOUDFLARENET, US)
lltrco.com
3    2a0d:5940:38:3a:: (Germany)

ASN58212 (DATAFOREST, DE)
www.imcounter.com
1    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
coinads.online
1    2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)
whos.amung.us
1    2.18.64.27 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-18-64-27.deploy.static.akamaitechnologies.com
monitor.ebay.com
1    2a00:1450:4001:82a::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
i.ytimg.com
Apex Domain
Subdomains		 Transfer
12 wir-zahlen.de
www.wir-zahlen.de
3 MB
7 adbytes.media
adbytes.media
86 KB
6 sharemyads.com
sharemyads.com
2 KB
3 imcounter.com
www.imcounter.com — Cisco Umbrella Rank: 345254
4 KB
3 ad2bitcoin.com
ad2bitcoin.com
2 lltrco.com
lltrco.com — Cisco Umbrella Rank: 666783
458 B
2 lcmmedia.de
www.lcmmedia.de
155 B
2 start-traffic.com
start-traffic.com
2 crypto-adz.com
crypto-adz.com
766 B
1 ytimg.com
i.ytimg.com — Cisco Umbrella Rank: 117
11 KB
1 ebay.com
monitor.ebay.com — Cisco Umbrella Rank: 22328
770 B
1 amung.us
whos.amung.us — Cisco Umbrella Rank: 10888
213 B
1 coinads.online
coinads.online
755 B
1 geniecoop.com
geniecoop.com
1 surfujkase.pl
www.surfujkase.pl
1 disclaimer.de
www.disclaimer.de
2 KB
1 waust.at
waust.at — Cisco Umbrella Rank: 28960
4 KB
1 topcreativeformat.com
www.topcreativeformat.com — Cisco Umbrella Rank: 53002
0 maxiad.de Failed
maxiad.de Failed
48 19
Domain Requested by
12 www.wir-zahlen.de www.wir-zahlen.de
7 adbytes.media www.wir-zahlen.de
adbytes.media
6 sharemyads.com www.wir-zahlen.de
sharemyads.com
3 www.imcounter.com www.wir-zahlen.de
www.imcounter.com
3 ad2bitcoin.com www.wir-zahlen.de
2 lltrco.com 1 redirects www.wir-zahlen.de
2 www.lcmmedia.de 1 redirects www.wir-zahlen.de
2 start-traffic.com www.wir-zahlen.de
2 crypto-adz.com www.wir-zahlen.de
crypto-adz.com
1 i.ytimg.com www.wir-zahlen.de
1 monitor.ebay.com www.wir-zahlen.de
1 whos.amung.us waust.at
1 coinads.online www.wir-zahlen.de
1 geniecoop.com www.wir-zahlen.de
1 www.surfujkase.pl www.wir-zahlen.de
1 www.disclaimer.de www.wir-zahlen.de
1 waust.at www.wir-zahlen.de
1 www.topcreativeformat.com www.wir-zahlen.de
0 maxiad.de Failed www.wir-zahlen.de
48 19
Subject Issuer Validity Valid
wir-zahlen.de
R10		 2024-09-01 -
2024-11-30		 3 months crt.sh
adbytes.media
WE1		 2024-08-19 -
2024-11-17		 3 months crt.sh
mail.sharemyads.com
R10		 2024-08-05 -
2024-11-03		 3 months crt.sh
topcreativeformat.com
R10		 2024-07-18 -
2024-10-16		 3 months crt.sh
crypto-adz.com
R11		 2024-08-23 -
2024-11-21		 3 months crt.sh
waust.at
WE1		 2024-08-30 -
2024-11-28		 3 months crt.sh
disclaimer.de
R10		 2024-07-11 -
2024-10-09		 3 months crt.sh
ad2bitcoin.com.traffic2bitcoin.com
R11		 2024-08-21 -
2024-11-19		 3 months crt.sh
start-traffic.com
R11		 2024-07-23 -
2024-10-21		 3 months crt.sh
lcmmedia.de
R11		 2024-08-18 -
2024-11-16		 3 months crt.sh
surfujkase.pl
WE1		 2024-08-19 -
2024-11-17		 3 months crt.sh
geniecoop.com
R11		 2024-07-28 -
2024-10-26		 3 months crt.sh
lltrco.com
WE1		 2024-08-07 -
2024-11-05		 3 months crt.sh
imcounter.com
E6		 2024-09-01 -
2024-11-30		 3 months crt.sh
coinads.online
WE1		 2024-07-18 -
2024-10-16		 3 months crt.sh
amung.us
WE1		 2024-07-07 -
2024-10-05		 3 months crt.sh
gisufespipeline22.ebay.com
DigiCert TLS RSA SHA256 2020 CA1		 2024-01-12 -
2025-01-14		 a year crt.sh
edgestatic.com
WR2		 2024-08-05 -
2024-10-28		 3 months crt.sh

This page contains 15 frames:

Primary Page: https://www.wir-zahlen.de/
Frame ID: 7614BA5D8B3B9775A621E5D5AA228C13
Requests: 32 HTTP requests in this frame

Frame: https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=728
Frame ID: AC948098BD19A4C88D707D2968CD2876
Requests: 1 HTTP requests in this frame

Frame: https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=468
Frame ID: C72DCB5A6CDD183A06D81EC73BF3390C
Requests: 1 HTTP requests in this frame

Frame: https://start-traffic.com/b468.php/?flatratemoney
Frame ID: 1D5220F862A96B6BDC209AF457FE1FB2
Requests: 1 HTTP requests in this frame

Frame: https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=300
Frame ID: 866ADA35F33A947692A605847A694113
Requests: 1 HTTP requests in this frame

Frame: https://start-traffic.com/b300.php/?flatratemoney
Frame ID: 801169DC7D8A0A4AA9A4104E6CE7DDC0
Requests: 1 HTTP requests in this frame

Frame: https://www.lcmmedia.de/kamp/ziel.php?uid=13&bid=2094&sid=5730&ns=1
Frame ID: 1902D27659E0CBDA6C5672A2414A1076
Requests: 1 HTTP requests in this frame

Frame: https://www.surfujkase.pl/promuj.php?id=3711
Frame ID: 87677C9AF4FE267AED12E40F0976AD06
Requests: 1 HTTP requests in this frame

Frame: https://geniecoop.com/do/flatratemoney
Frame ID: 8642B7CBD4B18819BFCB3436E8719ECC
Requests: 1 HTTP requests in this frame

Frame: https://lltrco.com/?r=flatratemoney&ai=93697&at=a
Frame ID: 6A1A374B81632504D91E8ADE76395F0D
Requests: 1 HTTP requests in this frame

Frame: https://crypto-adz.com/view/300/fv.php?size=4&ison=1&user=4636&vt=2&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236054086
Frame ID: 2CC74EC639869C99BC99ED14B10230D3
Requests: 1 HTTP requests in this frame

Frame: https://sharemyads.com/view/728/fv.php?size=3&ison=1&user=5685&vt=9&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055922
Frame ID: D01F807DA60A850BE1D1EBCE018D9BD4
Requests: 1 HTTP requests in this frame

Frame: https://sharemyads.com/view/300/fv.php?size=4&ison=1&user=5685&vt=8&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055922
Frame ID: B76F1621C84AD70A3D48B2706241A201
Requests: 1 HTTP requests in this frame

Frame: https://sharemyads.com/view/468/fv.php?size=1&ison=1&user=5685&vt=2&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055923
Frame ID: 8ED05CFF8D360AB81C52CC5DA73791D1
Requests: 1 HTTP requests in this frame

Frame: https://adbytes.media/files/banners/ad-76148b4504078ed.gif
Frame ID: 8F44AAD76B30E22D3A96AA43C1826342
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Geld verdienen im Internet und Geld verdienen im Schlaf! Herzlich Willkommen auf Wir-Zahlen.de

Page Statistics

48
Requests

96 %
HTTPS

47 %
IPv6

19
Domains

19
Subdomains

18
IPs

2
Countries

2716 kB
Transfer

2742 kB
Size

26
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26
  • https://www.lcmmedia.de/kamp/rot.php?art=ztraffic&uid=13&sid=5730 HTTP 302
  • https://www.lcmmedia.de/kamp/ziel.php?uid=13&bid=2094&sid=5730&ns=1
Request Chain 29
  • https://lltrco.com/?r=flatratemoney HTTP 302
  • https://lltrco.com/?r=flatratemoney&ai=93697&at=a

48 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.wir-zahlen.de/ 		26 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
d487ddd88be726dcba8d7a31071dcb04e1da34c264218faca1c286e7da750f41

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
7131
Content-Type
text/html
Date
Mon, 02 Sep 2024 00:13:57 GMT
ETag
"671f-61d91b7e5cabe-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Fri, 19 Jul 2024 03:59:13 GMT
Server
Apache/2.4.61 (Debian)
Vary
Accept-Encoding
show_ads.js
adbytes.media/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adbytes.media/js/show_ads.js
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a921ddf479093157940c92a1cc5708c671cc351732f68acce46d827edfd93083

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:13 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 23 Mar 2024 07:51:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
403159
etag
W/"65fe8a15-37f3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o03XJMfw%2FmU6sYwM2oCTlJnvCjtqLOfhMVxb9lltRQnpK%2BOlpFxrIPWtuJdpKIsM7578XDmRCv7DplDHluymGDxBey6uU3YM6kzqwvhvj55vg5Qgx8CUIkUNsQenKi4E%2Flqsql3TXOFKNV%2Bk"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=604800
cf-ray
8bc94c795a6c1c6d-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 30 Aug 2024 00:29:59 GMT
rendite.jpg
www.wir-zahlen.de/ 		132 KB
132 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/rendite.jpg
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
f50da79d86cfbb41e607ec26d75d10c928e5dff394cc75e386ab1f348429039d

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Fri, 10 May 2024 14:47:58 GMT
Server
Apache/2.4.61 (Debian)
ETag
"20e64-6181a9f29a194"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
134756
structure.png
www.wir-zahlen.de/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/structure.png
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
2ce9af0920109b9173ed6ae1ebceb4b01ea243b842bf5b2bdc5471bd48010fb8

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Thu, 18 Jul 2024 16:32:38 GMT
Server
Apache/2.4.61 (Debian)
ETag
"8b41-61d88207d0bf8"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
35649
structureline.png
www.wir-zahlen.de/ 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/structureline.png
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
5032e38c1aab52fe6691461cc400b7dbe9a0024c710731d1dc46f231346a5f79

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Thu, 18 Jul 2024 16:32:39 GMT
Server
Apache/2.4.61 (Debian)
ETag
"b1cd-61d882093a14d"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
45517
scorpioplattform.jpg
www.wir-zahlen.de/ 		98 KB
98 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/scorpioplattform.jpg
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
7fd56402e18eba83bb8bbfe2b9d49b48870e324781e1d0067a77ed0c7f03533f

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Mon, 06 May 2024 11:09:44 GMT
Server
Apache/2.4.61 (Debian)
ETag
"18660-617c71b4abd21"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
99936
swap.jpg
www.wir-zahlen.de/ 		132 KB
133 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/swap.jpg
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
c3d483ee3746f6501ba75a324dd40872c3e9eda7e301765655ef0e1aba91c847

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Thu, 23 May 2024 01:35:15 GMT
Server
Apache/2.4.61 (Debian)
ETag
"211b7-6191510147b15"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
135607
/
sharemyads.com/view/728/ 		1 KB
777 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/728/?uid=5685
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
38d637ce5ebc62ead9a7641da8d68b526d948b55dde8e76009c6966734c4109b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, private, must-revalidate
content-length
570
x-xss-protection
1; mode=block
expires
Sat, 26 Jul 1997 05:00:00 GMT
invoke.js
www.topcreativeformat.com/b204798851b4f1e36b195a98d858f3cf/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.topcreativeformat.com/b204798851b4f1e36b195a98d858f3cf/invoke.js
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:14:13 GMT
Server
nginx/1.21.6
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
BeerBiz_728.gif
www.wir-zahlen.de/ 		155 KB
155 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/BeerBiz_728.gif
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
084d5e85fe6d96d2f3326fb81c18b905a28cfc64ee208a292be5ad050c4da0f4

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Thu, 17 Jan 2019 14:45:08 GMT
Server
Apache/2.4.61 (Debian)
ETag
"26b2c-57fa870d82500"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
158508
earnmopoly.png
www.wir-zahlen.de/ 		863 KB
864 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/earnmopoly.png
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
df4aeddaa57614d4c030f70d569de3d8b348644a30654279ef2bca955a9f89e1

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Wed, 15 May 2024 15:33:06 GMT
Server
Apache/2.4.61 (Debian)
ETag
"d7d39-6187fd5bc4e17"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
884025
/
sharemyads.com/view/468/ 		1 KB
602 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/468/?uid=5685
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
59323df028dc5e4957236de0a045fc24a32fe4330ad4c68a4c933321438c25e1
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, private, must-revalidate
content-length
567
x-xss-protection
1; mode=block
expires
Sat, 26 Jul 1997 05:00:00 GMT
/
crypto-adz.com/view/300/ 		1 KB
766 B 		Script
General
Check archive.org
Download Go to
Full URL
https://crypto-adz.com/view/300/?uid=4636
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
c48d1553d6910c4b1c253f503b8d35d93f3a3470e40cde0c2b72a6e64ce65b9c
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, private, must-revalidate
content-length
559
x-xss-protection
1; mode=block
expires
Sat, 26 Jul 1997 05:00:00 GMT
/
sharemyads.com/view/300/ 		1 KB
604 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/300/?uid=5685
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
f1957789fd1ce9c118d961b0c65f812d6b56024a44180f2c54fa9fa024b90e7c
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, private, must-revalidate
content-length
569
x-xss-protection
1; mode=block
expires
Sat, 26 Jul 1997 05:00:00 GMT
microbutton.gif
www.wir-zahlen.de/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/microbutton.gif
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
93450e6bf76c015c257185ba609d0c5865d7cbd0bb41cf432515aab54c374f5d

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Fri, 07 Apr 2023 14:09:10 GMT
Server
Apache/2.4.61 (Debian)
ETag
"64f-5f8bf91b051e8"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1615
s.js
waust.at/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://waust.at/s.js
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4739 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3285
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 12 Jan 2023 17:19:30 GMT
server
cloudflare
etag
W/"63c04122-2170"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Y8WjiSM5lZnPt4FOBNbnDWrs0g8tSRXIXNHJg6VgRx2EOL1f8Fc9POwa%2BdxQcO%2B3RshH1UheOwEF9kENgKln2Ng6AmoluB%2B%2FGmL5B49MdZ4Vs1mwgrHXKZYyjWS9lVy60AXrFpZ"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400
cf-ray
8bc94c79d8cc2bb0-FRA
expires
Mon, 02 Sep 2024 23:19:29 GMT
d_aniwhite.gif
www.disclaimer.de/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.disclaimer.de/images/d_aniwhite.gif
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
85.13.130.185 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd45432.kasserver.com
Software
Apache /
Resource Hash
21f69d0ba18d362981fa39168ad9c58e213c74d2b044a8f930225f7efc1b6829

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
last-modified
Tue, 25 Dec 2018 16:42:13 GMT
server
Apache
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=10368000, public
accept-ranges
bytes
content-length
1862
expires
Tue, 31 Dec 2024 00:14:14 GMT
impressum.png
www.wir-zahlen.de/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/impressum.png
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
e0e09f026644744e1b2377199d1dfab587ae649eca75ad293dba61544d441b44

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Sun, 12 May 2024 21:54:13 GMT
Server
Apache/2.4.61 (Debian)
ETag
"6a3-61848cf398c69"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1699
ca88.png
www.wir-zahlen.de/ 		256 B
540 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/ca88.png
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
9b67886923e5203c58d2009958b1bb3904eca085fce6db0bfa1ffe7034283b0f

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Sun, 12 May 2024 21:53:57 GMT
Server
Apache/2.4.61 (Debian)
ETag
"100-61848ce3e33d6"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
256
bgs.jpg
www.wir-zahlen.de/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wir-zahlen.de/bgs.jpg
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
83.243.58.29 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
a11.netbeat.de
Software
Apache/2.4.61 (Debian) /
Resource Hash
409ce2873c9ad3ed7c3efa0854f957e64e5037e95bc51e07a71b3fd5d68e17a9

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Mon, 02 Sep 2024 00:13:57 GMT
Last-Modified
Mon, 06 May 2024 11:09:43 GMT
Server
Apache/2.4.61 (Debian)
ETag
"11ab99-617c71b44259b"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1158041
tooltip.js
maxiad.de/ma/ 		0
0
mad3.php
maxiad.de/ma/ 		0
0
ad.php
ad2bitcoin.com/ Frame AC94 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=728
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.0.208.108 Lebanon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
nc-ph-2974.zerads.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1518
Content-Type
text/html; charset=UTF-8
Date
Mon, 02 Sep 2024 00:14:14 GMT
Keep-Alive
timeout=5, max=50
Server
Apache
Vary
Accept-Encoding,User-Agent
ad.php
ad2bitcoin.com/ Frame C72D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=468
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.0.208.108 Lebanon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
nc-ph-2974.zerads.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1524
Content-Type
text/html; charset=UTF-8
Date
Mon, 02 Sep 2024 00:14:14 GMT
Keep-Alive
timeout=5, max=50
Server
Apache
Vary
Accept-Encoding,User-Agent
/
start-traffic.com/b468.php/ Frame 1D52 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://start-traffic.com/b468.php/?flatratemoney
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.222.24.1 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
cp28-ga.privatesystems.net
Software
LiteSpeed /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:17 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
ad.php
ad2bitcoin.com/ Frame 866A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad2bitcoin.com/ad.php?ref=flatratemoney&width=300
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.0.208.108 Lebanon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
nc-ph-2974.zerads.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1406
Content-Type
text/html; charset=UTF-8
Date
Mon, 02 Sep 2024 00:14:14 GMT
Keep-Alive
timeout=5, max=50
Server
Apache
Vary
Accept-Encoding,User-Agent
/
start-traffic.com/b300.php/ Frame 8011 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://start-traffic.com/b300.php/?flatratemoney
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.222.24.1 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
cp28-ga.privatesystems.net
Software
LiteSpeed /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:17 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
ziel.php
www.lcmmedia.de/kamp/ Frame 1902
Redirect Chain
  • https://www.lcmmedia.de/kamp/rot.php?art=ztraffic&uid=13&sid=5730
  • https://www.lcmmedia.de/kamp/ziel.php?uid=13&bid=2094&sid=5730&ns=1
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.lcmmedia.de/kamp/ziel.php?uid=13&bid=2094&sid=5730&ns=1
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.202.218.154 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
mail.lcmmedia.de
Software
nginx / PHP/7.4.30 PleskLin
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
server
nginx
x-powered-by
PHP/7.4.30 PleskLin

Redirect headers

content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
location
https://www.lcmmedia.de/kamp/ziel.php?uid=13&bid=2094&sid=5730&ns=1
server
nginx
x-powered-by
PHP/7.4.30 PleskLin
promuj.php
www.surfujkase.pl/ Frame 8767 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.surfujkase.pl/promuj.php?id=3711
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::ac43:8abb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8bc94c7a591c8ff4-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LEFZLTA8Pjjj6xu9Yx8jpaRWJWnmiLDgEYzareq1YYjbQgYlBSqKOxk8afoUZWfdVBzoNci%2FYzIQ60yYMYtIDPNdfriYSKMlKvP6Rkjl5t0tZ6GLLf8yGcPlcoA3kjvRHI2QEUPTU2QLa0KCLC4fBA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
flatratemoney
geniecoop.com/do/ Frame 8642 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://geniecoop.com/do/flatratemoney
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.196.230 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
webstars2k.com
Software
Apache / PHP/5.2.17 PleskLin
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Type
text/html
Date
Mon, 02 Sep 2024 00:13:43 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
X-Powered-By
PHP/5.2.17 PleskLin
/
lltrco.com/ Frame 6A1A
Redirect Chain
  • https://lltrco.com/?r=flatratemoney
  • https://lltrco.com/?r=flatratemoney&ai=93697&at=a
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://lltrco.com/?r=flatratemoney&ai=93697&at=a
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:1d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8bc94c7f0828903c-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:15 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GLOyKJ1n%2FpRpZ9S8GZyFi1X%2FxXbpE8RDaPOZ3KVMip9BgZ%2F0GgwQt8kd1YddaEKEJ8419AvFv8hyHHe2oPBiM9m8A9LhwRoaLucDTdN8%2FD9PlKxq7srGt%2BhBsuREDwDwwEdUaX1UDNEz"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8bc94c7a6e24903c-FRA
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
location
?r=flatratemoney&ai=93697&at=a
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ytmBY7amborasgjYcTpS0IP9nIHRfBJC3VhMKOSK5JPIsQBh0iZle3wjCfYVAu608HIRcQegaeLXdkgZaFSm1YkqxFuFfFAupUTIs48SoMJk70YmOrTyCwxMvS2QmIoJfk8rEd7pm7Jj"}],"group":"cf-nel","max_age":604800}
server
cloudflare
fcount.php
www.imcounter.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.imcounter.com/fcount.php?rnd=85993686846
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0d:5940:38:3a:: , Germany, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
ac5a12454df84800749b6e0b103836cf98b288ce209ec909d6c74e2912cad8b7

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
date
Mon, 02 Sep 2024 00:14:14 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.22.1
content-type
application/javascript
coinadsadnetwork.php
coinads.online/ 		391 B
755 B 		Script
General
Check archive.org
Download Go to
Full URL
https://coinads.online/coinadsadnetwork.php?codeversion=azedkozkaodkaozd@ZOzeza5e65arptprtzokozkropazklekKEOKz%E9)%E9%E0oerle
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
04a83be117a6445c46ee498f02de38ff178acdf3eec34afbe19f888c3eda831e

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bscKIdRJibN6gJxbSjUE2Y%2BLuxoAbU8lOT%2BtgjbtmWLxbC6e9abkmFc%2Bbdo%2B0TN1TS921Z7zr2Gv0D01wk8%2FSI4JIUj4r7Z8i1LxxIY0cIBF%2FF95tG9YD6u%2B03rXG2AK4F7TLJYbe9oOTh8qag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript;charset=UTF-8
x-turbo-charged-by
LiteSpeed
cf-ray
8bc94c7a79bf8fdd-FRA
alt-svc
h3=":443"; ma=86400
/
whos.amung.us/pingjs/ 		28 B
213 B 		Script
General
Check archive.org
Download Go to
Full URL
https://whos.amung.us/pingjs/?k=ysrodxrei6&t=Geld%20verdienen%20im%20Internet%20und%20Geld%20verdienen%20im%20Schlaf!%20Herzlich%20Willkommen%20auf&c=s&x=https%3A%2F%2Fwww.wir-zahlen.de%2F&y=&a=0&d=0.637&v=27&r=6125
Requested by
Host: waust.at
URL: https://waust.at/s.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d21c4f522d09e2a8274f8a99e0d7a0e06d9375ab7b9f52f817b4d5d8825e6437

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:14 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
8bc94c7a9c591e3e-FRA
alt-svc
h3=":443"; ma=86400
content-type
text/javascript;charset=UTF-8
fv.php
crypto-adz.com/view/300/ Frame 2CC7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://crypto-adz.com/view/300/fv.php?size=4&ison=1&user=4636&vt=2&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236054086
Requested by
Host: crypto-adz.com
URL: https://crypto-adz.com/view/300/?uid=4636
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
private, must-revalidate
content-encoding
gzip
content-length
341
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
server
Apache/2
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
id
adbytes.media/ 		15 B
887 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adbytes.media/id
Requested by
Host: adbytes.media
URL: https://adbytes.media/js/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Mon, 02 Sep 2024 00:14:15 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET, POST, OPTIONS, PUT
p3p
policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.wir-zahlen.de
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tHEH7RmPudmPLHVrS%2FQD%2F4R0VvNSZnDgcR4Hp39WkDPHcMi7fs5OlnV8yKNslPPIPyOvcw90dXjsY%2Bogs8LgUGlEcoFu4trBuprwLoPmji3vzKaYvPkOKwZO9WlFOvDCuTCsgLenbyzU%2B0yK"}],"group":"cf-nel","max_age":604800}
content-type
text/json;charset=UTF-8
access-control-allow-credentials
true
cf-ray
8bc94c7e0b5d382b-FRA
access-control-allow-headers
Content-Type, Content-Range, Content-Disposition, Content-Description, Accept, Authorization, Cache-Control, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Requested-With
alt-svc
h3=":443"; ma=86400
id
adbytes.media/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://adbytes.media/id
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.wir-zahlen.de
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Range, Content-Disposition, Content-Description, Accept, Authorization, Cache-Control, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Requested-With
access-control-allow-methods
GET, POST, OPTIONS, PUT
access-control-allow-origin
https://www.wir-zahlen.de
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8bc94c7a89a3d351-FRA
content-type
text/json;charset=UTF-8
date
Mon, 02 Sep 2024 00:14:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5FK4RqnzORmQ6fbvaJVPsWbN%2BwwEFLjZYXT43p4heMACySBh1x%2B00eYO4OCzHYsnUrTYQJ2%2F3qcbP3NBT%2FGsULccb%2FTaVbccngX2EJlV8IvDlt9mQbVt1eC%2BRuD4LoeJLHZyBqAl%2F9wAiqs9"}],"group":"cf-nel","max_age":604800}
server
cloudflare
display
adbytes.media/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://adbytes.media/display
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.wir-zahlen.de
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Range, Content-Disposition, Content-Description, Accept, Authorization, Cache-Control, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Requested-With
access-control-allow-methods
GET, POST, OPTIONS, PUT
access-control-allow-origin
https://www.wir-zahlen.de
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8bc94c858ca4d351-FRA
content-type
text/json;charset=UTF-8
date
Mon, 02 Sep 2024 00:14:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5xYxSyORzJOIAjvFrhcVw5YCVAiT%2BDi5v4POuZjqhnjwAvseEJLXj6YcaGT00eYP16EzbqnG3XKhFZt2EvGavmRgm%2FTn%2Fvufbcgoki8QPNO%2BusunElThOnprXcEdv0CtnZi%2BHW5UeBgnJOd3"}],"group":"cf-nel","max_age":604800}
server
cloudflare
display
adbytes.media/ 		408 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://adbytes.media/display
Requested by
Host: adbytes.media
URL: https://adbytes.media/js/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b81e5a24d99217a51317bdc232e7e158d0118c17cebd6748b46457d35ee4cc28

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Mon, 02 Sep 2024 00:14:16 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET, POST, OPTIONS, PUT
p3p
policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.wir-zahlen.de
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=slZi%2FDmR3%2B2YWm18XW7XChlEIJN5FvCLQ2eCWg4dXNz22qOP98wgfC%2Fi13a9%2FCFoEOsobSpT9UmwzdbeaRrOXrK%2FN6nOd0o7tC3Smn39kDmLQKLxUqvmHhaD8rDP0m0nQXF2mpgJJlQl7NM6"}],"group":"cf-nel","max_age":604800}
content-type
text/json;charset=UTF-8
access-control-allow-credentials
true
cf-ray
8bc94c88babb382b-FRA
access-control-allow-headers
Content-Type, Content-Range, Content-Disposition, Content-Description, Accept, Authorization, Cache-Control, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Requested-With
alt-svc
h3=":443"; ma=86400
storesweb
monitor.ebay.com/csp-report/storenode/ 		0
770 B 		Other
General
Check archive.org
Download Go to
Full URL
https://monitor.ebay.com/csp-report/storenode/storesweb?id=877595335435374121&rid=t6pqiufkicffiiw%3F%3Ctwjtbmjbb%60jhs.0d37c21%3B%3Cd*40nl%3A-191b0150bc5-0x2503
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2.18.64.27 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-18-64-27.deploy.static.akamaitechnologies.com
Software
ebay-proxy-server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type
application/csp-report

Response headers

pragma
no-cache
date
Mon, 02 Sep 2024 00:14:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
accept-ch
sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-ua-full-version
server
ebay-proxy-server
x-ebay-pop-id
SLBSLCAZ01
x-frame-options
SAMEORIGIN
cache-control
max-age=0, no-cache, no-store
x-envoy-upstream-service-time
56
rlogid
t6dlure%60uwjuckjkc51%3F%3Ctofanpp%60bpuowfioif74*rnek%7B(rbpv6612-191b015104c-0x405
content-length
0
x-xss-protection
1; mode=block
expires
Mon, 02 Sep 2024 00:14:16 GMT
fv.php
sharemyads.com/view/728/ Frame D01F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/728/fv.php?size=3&ison=1&user=5685&vt=9&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055922
Requested by
Host: sharemyads.com
URL: https://sharemyads.com/view/728/?uid=5685
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
private, must-revalidate
content-encoding
gzip
content-length
870
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:16 GMT
expires
Wed, 02 Oct 2024 00:14:16 GMT
server
Apache/2
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
fv.php
sharemyads.com/view/300/ Frame B76F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/300/fv.php?size=4&ison=1&user=5685&vt=8&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055922
Requested by
Host: sharemyads.com
URL: https://sharemyads.com/view/300/?uid=5685
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
private, must-revalidate
content-encoding
gzip
content-length
890
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:16 GMT
expires
Wed, 02 Oct 2024 00:14:16 GMT
server
Apache/2
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
fv.php
sharemyads.com/view/468/ Frame 8ED0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sharemyads.com/view/468/fv.php?size=1&ison=1&user=5685&vt=2&dref=https://www.wir-zahlen.de/&scrw=1600&scrh=1200&timestamp=1725236055923
Requested by
Host: sharemyads.com
URL: https://sharemyads.com/view/468/?uid=5685
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.249.194.154 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.1245inc.com
Software
Apache/2 /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.wir-zahlen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
private, must-revalidate
content-encoding
gzip
content-length
943
content-type
text/html; charset=UTF-8
date
Mon, 02 Sep 2024 00:14:16 GMT
expires
Wed, 02 Oct 2024 00:14:16 GMT
server
Apache/2
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
fcounter.php
www.imcounter.com/ 		543 B
625 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.imcounter.com/fcounter.php?test=1&rnd=16430055&s=blue&id=42738&l=de-DE&u=&w=1600&h=1200
Requested by
Host: www.imcounter.com
URL: https://www.imcounter.com/fcount.php?rnd=85993686846
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0d:5940:38:3a:: , Germany, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
73a8795c13e463ea2732c6df026074f2c9d465ef20000abe37edddcfd08a40f8

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:15 GMT
server
nginx/1.22.1
content-length
543
content-type
text/javascript;charset=UTF-8
truncated
/ 		439 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
imcounter-banner-blue.gif
www.imcounter.com/CIncludes/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.imcounter.com/CIncludes/img/imcounter-banner-blue.gif
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0d:5940:38:3a:: , Germany, ASN58212 (DATAFOREST, DE),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
5aa1b7aabf21d2a9f5a1bdd8678751c95120b788deae1847d535843c9713f281

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:16 GMT
last-modified
Sun, 03 Dec 2023 14:24:20 GMT
server
nginx/1.22.1
accept-ranges
bytes
etag
"656c8f94-83d"
content-length
2109
content-type
image/gif
ad-76148b4504078ed.gif
adbytes.media/files/banners/ Frame 8F44 		76 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adbytes.media/files/banners/ad-76148b4504078ed.gif
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bac4fb79ee5dcc8c76baa5e96091aab9ff732c1ec8ce2edc467bd417264d885b

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:16 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
248505
alt-svc
h3=":443"; ma=86400
content-length
77379
last-modified
Sat, 23 Mar 2024 07:50:06 GMT
server
cloudflare
etag
"65fe89ae-12e43"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TP1QmTsIxaxZjnTvKd9Os%2FCCl9HkzFDfpnsWrNY7xppt18OjDHu2nOpaYPYplzUDwdoxMvwyVnhXS1are9yTxRU6cbiAPmB73cz6%2FT63EBTuNhpYeqhehNqGQjiDKEHv5eH%2FD0b1%2FQ7JNjqI"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
8bc94c8a2b80382b-FRA
expires
Wed, 04 Sep 2024 14:06:15 GMT
adbytes_icon_small.png
adbytes.media/images/ Frame 8F44 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adbytes.media/images/adbytes_icon_small.png?v=1
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41609a65a2386d4635482fe27ff4d895b4ccc1653478a64c5fb51a559c1747ce

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:16 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
184028
alt-svc
h3=":443"; ma=86400
content-length
3194
last-modified
Sat, 23 Mar 2024 07:51:49 GMT
server
cloudflare
etag
"65fe8a15-c7a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S9WvlMfjWFCYjOB%2B6dr7epXB7lqPnTyChvIrk36Bpg39yCeir5W1Ze3E10H6uThDfS31dI02mnuBNQI0OYyMxzikFH%2FKZtocJ84VPwh%2B0YVtSIe4nQWItvQzc6IZ7fGrZ8dPKCh0mGtwRGc8"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
8bc94c8a2b81382b-FRA
expires
Fri, 06 Sep 2024 00:33:40 GMT
mqdefault.jpg
i.ytimg.com/vi/445HhW0xLkg/ 		11 KB
11 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://i.ytimg.com/vi/445HhW0xLkg/mqdefault.jpg?sqp=-oaymwEmCMACELQB8quKqQMa8AEB-AH-BIAC6AKKAgwIABABGGUgZShlMA8=&rs=AOn4CLAjGQqZtmJxTJrYv8u9jc-drdXJlw
Requested by
Host: www.wir-zahlen.de
URL: https://www.wir-zahlen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
99ac89ff16266643d3cb86c6e9a6d9683f54f42fbdc17b3a9d3275a74c9c0130
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.wir-zahlen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 02 Sep 2024 00:14:19 GMT
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11221
x-xss-protection
0
server
sffe
etag
"0"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/jpeg
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Mon, 02 Sep 2024 02:14:19 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
maxiad.de
URL
http://maxiad.de/ma/tooltip.js
Domain
maxiad.de
URL
http://maxiad.de/ma/mad3.php?eid=flatratemoney&eba=js&az=6&hg=FFB17D

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 function| _0x28a9 function| _0x43b306 function| _0x35a2 object| x function| a0_0x478eb1 string| show_key function| a0_0x39c5 function| createCookie function| readCookie function| eraseCookie function| a0_0x4ddb function| checkAdHeights function| dom_ready object| atOptions object| _wau number| fcr object| _fcc object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| pool_300 number| pid object| f4 string| au0 string| au1 string| au2 string| au5 string| au7 string| au8 string| au9 string| au10 string| ion boolean| adbytes_ads_loading object| ad_list object| xmlhttpId object| xmlhttp object| pool_728 number| pidu number| u object| f3 object| pool_468 object| f1 number| cid object| style object| fjs object| st object| fci string| x1 object| adDivs string| aduserid

26 Cookies

Domain/Path Name / Value
dobrefakty.pl/ekogroszek-przyszlosc-ogrzewania-domow Name: TESTCOOKIESENABLED
Value: 1
.www.rotate4all.com/ Name: referral
Value: BASEL2025
.www.rotate4all.com/ Name: refid
Value: NVVRU0hVWHpyY2x6U2J3TWNzaThjZz09
.www.rotate4all.com/ Name: http_referrer
Value: cXk3QmdNT3NDelJsemlrakowdE5BN0hXN3hkQjM0YkRDNlZuek5lb3hkWT0%253D
.www.rotate4all.com/ Name: recog
Value: 4abe821e90441e2884276ddf1e87d491
.www.rotate4all.com/ Name: real_input
Value: 3e79a8ccb8fc75e28ee10f51087b15d8
.www.rotate4all.com/ Name: visit_session
Value: 4e1332cae58f955c50271c8e74e24032eeede8ec
adbytes.media/ Name: ad_visitor_id
Value: c3cb2a013a330c92a90e151f1159e5a1bb78f92c7b58185a91c2c383070ffec7
.rotate4all.com/ Name: dest_src
Value: 45602
t-adbar.com/ Name: sou
Value: eyJyIjoiaHR0cHM6XC9cL3d3dy5yb3RhdGU0YWxsLmNvbVwvIiwidSI6Im1pa3BhIn0%3D
.pixel.leadsleap.net/ Name: lltkra247318
Value: 426349.02
.pixel.leadsleap.net/ Name: lltkrb247318
Value: 426349.02
www.wir-zahlen.de/ Name: adbytes-viewed-ads
Value: 20994
t-adbar1.com/ Name: sou
Value: eyJyIjpudWxsLCJ1IjoibWlrcGEifQ%3D%3D
llclick.com/ Name: hidead
Value: 1
.hit.gemius.pl/ Name: receive-cookie-deprecation
Value: 1
.pixel.leadsleap.net/ Name: lltkra188808
Value: 426366.02
.pixel.leadsleap.net/ Name: lltkrb188808
Value: 426366.02
.myao.adocean.pl/ Name: GAD
Value: KlSL3MaGQMGG-xFRYEoyoHoUssGMXP8cfRySssX6xssGvaGpI7EPoGCsL18GYsCFS8mUu6aGmGvJX-SM6BeSsss6Ss8.
.youtube.com/ Name: YSC
Value: 4zG-ubAH6z4
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: M7_l3G4yKmM
.youtube.com/ Name: VISITOR_PRIVACY_METADATA
Value: CgJERRIEEgAgDQ%3D%3D
.hit.gemius.pl/ Name: Gdyn
Value: KlQrAMXGQMQGvll2REoyoHoUssGMv1DoL6PxsG..
.hit.gemius.pl/ Name: Gdynp
Value: 8nN1GPWdjxMk2R_7B_xlgFoAeuYuohBgtELkz_In4x...7
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.gpl.adocean.pl/ Name: GAD
Value: KlGdnMXGQMQGrBBczEGyoHoUssGMv1DoL6PxGsRP5x7YaGQsG0gRi7yGxoGtFlM2xgGWi1BpY8Rs1uY1lSjDrS8HnM8lf5nG

7 Console Messages

Source Level URL
Text
security warning URL: https://www.wir-zahlen.de/
Message:
Mixed Content: The page at 'https://www.wir-zahlen.de/' was loaded over HTTPS, but requested an insecure element 'http://www.disclaimer.de/images/d_aniwhite.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://www.wir-zahlen.de/
Message:
Mixed Content: The page at 'https://www.wir-zahlen.de/' was loaded over HTTPS, but requested an insecure script 'http://maxiad.de/ma/tooltip.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.wir-zahlen.de/
Message:
Mixed Content: The page at 'https://www.wir-zahlen.de/' was loaded over HTTPS, but requested an insecure script 'http://maxiad.de/ma/mad3.php?eid=flatratemoney&eba=js&az=6&hg=FFB17D'. This request has been blocked; the content must be served over HTTPS.
network error URL: https://www.topcreativeformat.com/b204798851b4f1e36b195a98d858f3cf/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
security warning URL: https://www.wir-zahlen.de/(Line 609)
Message:
Mixed Content: The page at 'https://www.wir-zahlen.de/' was loaded over HTTPS, but requested an insecure element 'http://www.disclaimer.de/images/d_aniwhite.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://www.wir-zahlen.de/(Line 407)
Message:
Mixed Content: The page at 'https://www.wir-zahlen.de/' was loaded over HTTPS, but requested an insecure frame 'http://www.xiji.de/zufall/zufall_traffic.php?id=1709&aid=9427'. This request has been blocked; the content must be served over HTTPS.
security error
Message:
[Report Only] Refused to frame 'https://www.ebay.de/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.ebay.com *.ebay.de *.ebaystatic.com *.ebaystatic.de".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad2bitcoin.com
adbytes.media
coinads.online
crypto-adz.com
geniecoop.com
i.ytimg.com
lltrco.com
maxiad.de
monitor.ebay.com
sharemyads.com
start-traffic.com
waust.at
whos.amung.us
www.disclaimer.de
www.imcounter.com
www.lcmmedia.de
www.surfujkase.pl
www.topcreativeformat.com
www.wir-zahlen.de
maxiad.de
162.0.208.108
170.249.194.154
192.243.61.225
2.18.64.27
213.202.218.154
2606:4700:10::6816:4bab
2606:4700:20::ac43:4739
2606:4700:3036::6815:1d9
2606:4700:3037::ac43:8abb
2a00:1450:4001:82a::2016
2a06:98c1:3120::3
2a06:98c1:3121::3
2a0d:5940:38:3a::
64.34.196.230
67.222.24.1
83.243.58.29
85.13.130.185
04a83be117a6445c46ee498f02de38ff178acdf3eec34afbe19f888c3eda831e
084d5e85fe6d96d2f3326fb81c18b905a28cfc64ee208a292be5ad050c4da0f4
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1
21f69d0ba18d362981fa39168ad9c58e213c74d2b044a8f930225f7efc1b6829
2ce9af0920109b9173ed6ae1ebceb4b01ea243b842bf5b2bdc5471bd48010fb8
38d637ce5ebc62ead9a7641da8d68b526d948b55dde8e76009c6966734c4109b
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
409ce2873c9ad3ed7c3efa0854f957e64e5037e95bc51e07a71b3fd5d68e17a9
41609a65a2386d4635482fe27ff4d895b4ccc1653478a64c5fb51a559c1747ce
5032e38c1aab52fe6691461cc400b7dbe9a0024c710731d1dc46f231346a5f79
59323df028dc5e4957236de0a045fc24a32fe4330ad4c68a4c933321438c25e1
5aa1b7aabf21d2a9f5a1bdd8678751c95120b788deae1847d535843c9713f281
73a8795c13e463ea2732c6df026074f2c9d465ef20000abe37edddcfd08a40f8
7fd56402e18eba83bb8bbfe2b9d49b48870e324781e1d0067a77ed0c7f03533f
93450e6bf76c015c257185ba609d0c5865d7cbd0bb41cf432515aab54c374f5d
99ac89ff16266643d3cb86c6e9a6d9683f54f42fbdc17b3a9d3275a74c9c0130
9b67886923e5203c58d2009958b1bb3904eca085fce6db0bfa1ffe7034283b0f
a921ddf479093157940c92a1cc5708c671cc351732f68acce46d827edfd93083
ac5a12454df84800749b6e0b103836cf98b288ce209ec909d6c74e2912cad8b7
b81e5a24d99217a51317bdc232e7e158d0118c17cebd6748b46457d35ee4cc28
bac4fb79ee5dcc8c76baa5e96091aab9ff732c1ec8ce2edc467bd417264d885b
c3d483ee3746f6501ba75a324dd40872c3e9eda7e301765655ef0e1aba91c847
c48d1553d6910c4b1c253f503b8d35d93f3a3470e40cde0c2b72a6e64ce65b9c
d21c4f522d09e2a8274f8a99e0d7a0e06d9375ab7b9f52f817b4d5d8825e6437
d487ddd88be726dcba8d7a31071dcb04e1da34c264218faca1c286e7da750f41
df4aeddaa57614d4c030f70d569de3d8b348644a30654279ef2bca955a9f89e1
e0e09f026644744e1b2377199d1dfab587ae649eca75ad293dba61544d441b44
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1957789fd1ce9c118d961b0c65f812d6b56024a44180f2c54fa9fa024b90e7c
f50da79d86cfbb41e607ec26d75d10c928e5dff394cc75e386ab1f348429039d
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac