WEBSITE ANALYSIS REPORT

http://email.bicycleman.live/

21 Nov 2025 · 11:37:57.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:37:33.723 GET No response document 0 B 57 ms 1 alerts

11:37:33.795 GET 200 document 337 B 64 ms 1 alerts

11:37:33.929 GET 200 img 234.9 KB 131 ms 1 alerts

11:37:34.025 GET 404 img 1.4 KB 38 ms 1 alerts

11:37:37.058 GET 200 document 587 B 1010 ms 1 alerts

11:37:38.126 GET 200 document 3.8 KB 132 ms 1 alerts

Transaction #03

Request / response

URL

GET HTTPS

https://andrius.qltrk.com/qlick/blocked

IP / ASN

167.235.217.27

AS24940 · Hetzner Online GmbH

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text
MIME type: text/html; charset=UTF-8
First seen (UTC): 19 Aug 2024 · 13:48:30.718 UTC
Last seen (UTC): 17 Mar 2026 · 06:34:44.742 UTC
Times seen: 6

Size: 3.8 KB (3922 bytes)
MD5: b6a9f56397a567b4a65d74fa407c75f2
SHA1: 9ee8156059e3a0ef37d18a6dc698f23ba52eb3a0
SHA256: 50f89f6e08818ba0330343089ac703aaa92d81ed96f0db685055b2d2d9afcedd

Certificate information

Issuer: GoGetSSL · GoGetSSL RSA DV SSL CA 2
Subject: *.qltrk.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: D3:08:D0:2C:0A:2B:A8:5D:41:73:14:EC:C7:E4:EA:20:EB:B0:B4:A5
Valid from: Tue, 28 Oct 2025 00:00:00 GMT
Valid until: Wed, 28 Oct 2026 23:59:59 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)
PHP:8.3.23 (Programming languages)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Hagezi Threat Feed Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /qlick/blocked HTTP/1.1
Host: andrius.qltrk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: lpp=1; XSRF-TOKEN=eyJpdiI6IlVmNmI4WmY0anlzcktGRUtraDVkalE9PSIsInZhbHVlIjoiUnczUy9XckFDK0ZwMW1jMUFmRzQ5VnlIQW16aE5kUkl2TjNpWGxaRWVLeExhcE12ajh3bzhvWWdYQTl1bnF2Q1lLb24wcW10My9UZnBJb0tDSG1keWZEMHIyZEdHSGlHSFA4LzhVemthaFR0Z0NqY24wdWE4bGM4OEJEa0FTdTkiLCJtYWMiOiJkOTcwNGMyYTExMTE2ZjcxNjUyNDM0ZTljZmVhYTRjMjJlOTlkZjdhODNiYmU1Zjg0YWJkNjRkZjJkNzM1NWZmIiwidGFnIjoiIn0%3D; qlikersession=eyJpdiI6Ik5CUTBSOGFqbjFyRWNmNm56MDNOZHc9PSIsInZhbHVlIjoiUmJCVC9EMWl2TWYyazNxa0x2UUZWNms5MWI5eVA5dXpVRlMzUUJZa1hJWSt1NC81MHFaWTE4ODNUaUZmOE9aMzVUM051TjVoYXJPWW12ZTNlek5mVnNiZ2I2akZUK0lkRENqSlR6bVhWZnB1VFJ6UUVpUUVla3FSalpYb3pQM3IiLCJtYWMiOiJiZTA1ZGM5NjdkMmExZTRjOWFkMTgxMjQwZmYxMGU2MGJhZTE0OTQzY2ExOTRhMmMzMGNkNGQyMzE4YWE0ODQyIiwidGFnIjoiIn0%3D; rn=eyJpdiI6IkYrS3kxcEx1Tk8wU0pwQ0N2R3lyVGc9PSIsInZhbHVlIjoiUmMrSUxmeUxjQUo3Sy81clFhV1diZW93TmNkMWVaMGRjbjBnSEdod0g1VXZNL3YrZlptdmNIbDhkK1l2NTE1cWliektxZjE3VjN1czY3WWhldkZsbENpZ0dQbWQ4bHQxczBBdCsxUitMOG89IiwibWFjIjoiMDhmOWRjNzI1YzQzN2EyYTk1ODkxM2UzZTg0YzBhMzU4YzhiOWNkYzRhY2JiM2IzNzYwODc1NmI4MzI1NTdiNSIsInRhZyI6IiJ9; rnl=eyJpdiI6Ijd5VHBVQTMwWTZKS2FYUGVYTlZjT0E9PSIsInZhbHVlIjoiUENMZC8zYVNwbTVRY2pjMHlQNFRDVS9IL2FzUEVHNko3VS9sQjdFRE80U2tzTWlwem9za0RHY2lvU0R6UkM4ZUFGMnBzMFh1bCtqcFE1MCtLM1grbktaVUpiNURYdTZxR3FaaEtmSmQ4Rzg9IiwibWFjIjoiNWJlNjcwYTYyMGIxYjk0MGJkMzE1MzQ1ZmZiMTI0OTE3ZjJlNTU0ODQ3MzNmNjQxMGMzZDg0YzE5OGJmMzNkOCIsInRhZyI6IiJ9; QLAPI=f75a68d64f7c9c1831efe1947d7637bc|aSBPB|aSBPB
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: nginx
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/8.3.23
date: Fri, 21 Nov 2025 11:37:38 GMT
x-ratelimit-limit: 200
x-ratelimit-remaining: 199
set-cookie: XSRF-TOKEN=eyJpdiI6IlJkVjNBbW9SM0x0a3UxbWdzejAwSVE9PSIsInZhbHVlIjoiaGNaNklOUkdQNHVzbEh6UFhlbC9GRmdyUktLVjdhQ1FqV04yTndBZ1JJZTlMRFQrT1NnbDdmWk5JNTgyeWxNQkkzanNlUzVqZEw4U05ET1hiNEhINnFpTWpOMmVOY2dhREZKOEI1azNwSlQ4TWhZejVaMVFJMVpYbksxQVdUUUEiLCJtYWMiOiI4Yjg4OWE2ZTllODY2Y2Y3OThkNzRlNzk5MTZlMjIzYTRmNTMzYTcyZjVhYmVlZmNkNDJmZjY5YzU1Y2Q4MmVmIiwidGFnIjoiIn0%3D; expires=Sat, 26 Dec 2026 11:37:38 GMT; Max-Age=34560000; path=/; domain=qltrk.com; secure; samesite=lax
qlikersession=eyJpdiI6IkhEQWtBeFJnWWM5SDcvV282MDYyYVE9PSIsInZhbHVlIjoidmVOTzNQMlZXK2NhdnU0ZjhGMzNBaGlKWEhRbzVtV3hsVEJEWEdKeGtXWmhSM3AydUlmMHZqQ2pZMkNLTllIRHo5TVZpZU43Q2hDZHNvMHpqS0dnaEZObUFRa2R5Zll0VnlJK0NIZ0JrUUVQVmFYQ1YyV1hkdkFUdzZyMDY2YjciLCJtYWMiOiI0ZTY2ZWVkZjJmYzI1ZWFiNjU0MWU5NTk4N2FhOTdjYzI1MjU3YTU2ZDg3MmM2ODdkZTkzYWFkNDE0NWQwMmExIiwidGFnIjoiIn0%3D; expires=Sat, 26 Dec 2026 11:37:38 GMT; Max-Age=34560000; path=/; domain=qltrk.com; secure; samesite=lax
cache-control: no-cache, private, no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

11:37:38.309 GET 200 stylesheet 9.5 KB 179 ms —

11:37:38.458 GET 200 img 0 B 26 ms 1 alerts

11:37:38.469 GET 200 img 114.2 KB 102 ms 1 alerts

11:37:38.476 GET 200 font 14.5 KB 150 ms —

11:37:38.481 GET 200 font 14.4 KB 149 ms —

http://email.bicycleman.live/

Domain graph

Hostnames

Connections