┌─[live@parrot]─[~]
└──╼ $# Check the balances page to see if it's accessible or redirects
curl -L -i https://affiliate.tothemoon.com/balances | head -50
# Check campaigns page for any exposed data
curl -L -i https://affiliate.tothemoon.com/campaigns | head -50
# Check statistics page
curl -L -i https://affiliate.tothemoon.com/statistics | head -50
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0HTTP/2 200
content-type: text/html; charset=utf-8
content-length: 445709
date: Tue, 24 Feb 2026 01:44:29 GMT
etag: "qtctpivskc9jnc"
content-security-policy: connect-src 'self' blob: https://*.tothemoon.com https://tothemoon.com wss://*.tothemoon.com https://*.tothemoon.com:2083 https://*.cryptology.com https://cryptology.com wss://*.cryptology.com https://*.cryptology.com:2083 https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.firebasedatabase.app wss://*.firebasedatabase.app https://www.facebook.com/tr/ https://*.cookiebot.com/ https://hcaptcha.com https://*.hcaptcha.com https://locales.dev.tothemoon.com/ https://locales.prod.tothemoon.com/ https://locales.staging.tothemoon.com/ localhost:*; font-src data: https://tothemoon.com https://*.tothemoon.com https://fonts.gstatic.com https://static.tildacdn.com/fonts/ localhost:*; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.googleadservices.com https://googleads.g.doubleclick.net https://*.firebasedatabase.app wss://*.firebasedatabase.app https://connect.facebook.net https://*.cookiebot.com/ https://wchat.freshchat.com https://cdn.jsdelivr.net/npm/@fingerprintjs/ https://openfpcdn.io/ https://static.tildacdn.com/js/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com https://static.tracknow.io; frame-src * https://bid.g.doubleclick.net https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' blob: https://*.tothemoon.com 'unsafe-inline' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://fonts.googleapis.com https://wchat.freshchat.com/css/https://static.tildacdn.com/css/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com; img-src 'self' blob: data: https://s3.eu-central-1.amazonaws.com/public-files.prod.partnerka.cryptology.com/https://s3.eu-central-1.amazonaws.com/public-files.staging.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.prod.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.staging.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.payments.cryptology.com/ https://*.tothemoon.com https://tothemoon.com https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.googleapis.com https://stats.g.doubleclick.net https://*.gstatic.com https://*.googleusercontent.com https://googleads.g.doubleclick.net https://*.google.com https://*.google.ru https://*.google.de https://*.google.co.in https://*.google.com.hk https://www.facebook.com/tr/ https://*.cookiebot.com/ https://downloads.intercomcdn.com https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/ https://static.tildacdn.com/ https://thumb.tildacdn.com/; child-src 'self' https://www.facebook.com/ https://staticxx.facebook.com/; default-src 'self'; worker-src 'self' blob:; object-src 'none'; form-action 'self' https://connect.facebook.net https://www.facebook.com/tr/; report-urihttps://affiliate.tothemoon.com/api/report-csp
expect-ct: max-age=2592000, report-uri=https://affiliate.tothemoon.com/api/report-ct
strict-transport-security: max-age=63072000
x-frame-options: deny
x-download-options: noopen
x-content-type-options: nosniff
referrer-policy: same-origin
x-xss-protection: 1
x-nextjs-cache: HIT
x-powered-by: Next.js
cache-control: s-maxage=31536000, stale-while-revalidate
x-cache: Miss from cloudfront
via: 1.1 af295e828987582eb4bf7ae187d33438.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-P2
x-amz-cf-id: FgE03cE2KRGey9-4tRclVdsYZzmEP5C3xn_M7xhUPDPGDVsOnp8Kbw==
Earn affiliate commission from every user you refer | Tothemoon % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0HTTP/2 200
content-type: text/html; charset=utf-8
content-length: 445467
date: Tue, 24 Feb 2026 01:44:32 GMT
etag: "wm4dr7dfp89jgm"
content-security-policy: connect-src 'self' blob: https://*.tothemoon.com https://tothemoon.com wss://*.tothemoon.com https://*.tothemoon.com:2083 https://*.cryptology.com https://cryptology.com wss://*.cryptology.com https://*.cryptology.com:2083 https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.firebasedatabase.app wss://*.firebasedatabase.app https://www.facebook.com/tr/ https://*.cookiebot.com/ https://hcaptcha.com https://*.hcaptcha.com https://locales.dev.tothemoon.com/ https://locales.prod.tothemoon.com/ https://locales.staging.tothemoon.com/ localhost:*; font-src data: https://tothemoon.com https://*.tothemoon.com https://fonts.gstatic.com https://static.tildacdn.com/fonts/ localhost:*; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.googleadservices.com https://googleads.g.doubleclick.net https://*.firebasedatabase.app wss://*.firebasedatabase.app https://connect.facebook.net https://*.cookiebot.com/ https://wchat.freshchat.com https://cdn.jsdelivr.net/npm/@fingerprintjs/ https://openfpcdn.io/ https://static.tildacdn.com/js/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com https://static.tracknow.io; frame-src * https://bid.g.doubleclick.net https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' blob: https://*.tothemoon.com 'unsafe-inline' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://fonts.googleapis.com https://wchat.freshchat.com/css/https://static.tildacdn.com/css/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com; img-src 'self' blob: data: https://s3.eu-central-1.amazonaws.com/public-files.prod.partnerka.cryptology.com/https://s3.eu-central-1.amazonaws.com/public-files.staging.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.prod.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.staging.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.payments.cryptology.com/ https://*.tothemoon.com https://tothemoon.com https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.googleapis.com https://stats.g.doubleclick.net https://*.gstatic.com https://*.googleusercontent.com https://googleads.g.doubleclick.net https://*.google.com https://*.google.ru https://*.google.de https://*.google.co.in https://*.google.com.hk https://www.facebook.com/tr/ https://*.cookiebot.com/ https://downloads.intercomcdn.com https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/ https://static.tildacdn.com/ https://thumb.tildacdn.com/; child-src 'self' https://www.facebook.com/ https://staticxx.facebook.com/; default-src 'self'; worker-src 'self' blob:; object-src 'none'; form-action 'self' https://connect.facebook.net https://www.facebook.com/tr/; report-urihttps://affiliate.tothemoon.com/api/report-csp
expect-ct: max-age=2592000, report-uri=https://affiliate.tothemoon.com/api/report-ct
strict-transport-security: max-age=63072000
x-frame-options: deny
x-download-options: noopen
x-content-type-options: nosniff
referrer-policy: same-origin
x-xss-protection: 1
x-nextjs-cache: HIT
x-powered-by: Next.js
cache-control: s-maxage=31536000, stale-while-revalidate
x-cache: Miss from cloudfront
via: 1.1 b3db664103a27e8d1a37699ada8e2a30.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-P2
x-amz-cf-id: RCCujJJ4G9XnJIoyczqcT3mbFQpGOjt5m0bU9QisC_WbviDaRrxA-A==
Earn affiliate commission from every user you refer | Tothemoon % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0HTTP/2 200
content-type: text/html; charset=utf-8
content-length: 445485
date: Tue, 24 Feb 2026 01:44:33 GMT
etag: "180q6lxrlwr9jh4"
content-security-policy: connect-src 'self' blob: https://*.tothemoon.com https://tothemoon.com wss://*.tothemoon.com https://*.tothemoon.com:2083 https://*.cryptology.com https://cryptology.com wss://*.cryptology.com https://*.cryptology.com:2083 https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.firebasedatabase.app wss://*.firebasedatabase.app https://www.facebook.com/tr/ https://*.cookiebot.com/ https://hcaptcha.com https://*.hcaptcha.com https://locales.dev.tothemoon.com/ https://locales.prod.tothemoon.com/ https://locales.staging.tothemoon.com/ localhost:*; font-src data: https://tothemoon.com https://*.tothemoon.com https://fonts.gstatic.com https://static.tildacdn.com/fonts/ localhost:*; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://fonts.gstatic.com https://stats.g.doubleclick.net/ https://*.googleadservices.com https://googleads.g.doubleclick.net https://*.firebasedatabase.app wss://*.firebasedatabase.app https://connect.facebook.net https://*.cookiebot.com/ https://wchat.freshchat.com https://cdn.jsdelivr.net/npm/@fingerprintjs/ https://openfpcdn.io/ https://static.tildacdn.com/js/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com https://static.tracknow.io; frame-src * https://bid.g.doubleclick.net https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' blob: https://*.tothemoon.com 'unsafe-inline' https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://fonts.googleapis.com https://wchat.freshchat.com/css/https://static.tildacdn.com/css/ https://project2622214.tilda.ws/ https://hcaptcha.com https://*.hcaptcha.com; img-src 'self' blob: data: https://s3.eu-central-1.amazonaws.com/public-files.prod.partnerka.cryptology.com/https://s3.eu-central-1.amazonaws.com/public-files.staging.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.partnerka.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.prod.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.staging.payments.cryptology.com/ https://s3.eu-central-1.amazonaws.com/public-files.dev.payments.cryptology.com/ https://*.tothemoon.com https://tothemoon.com https://googletagmanager.com https://*.googletagmanager.com https://tagmanager.google.com https://*.tagmanager.google.com https://*.google-analytics.com https://*.googleapis.com https://stats.g.doubleclick.net https://*.gstatic.com https://*.googleusercontent.com https://googleads.g.doubleclick.net https://*.google.com https://*.google.ru https://*.google.de https://*.google.co.in https://*.google.com.hk https://www.facebook.com/tr/ https://*.cookiebot.com/ https://downloads.intercomcdn.com https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/ https://static.tildacdn.com/ https://thumb.tildacdn.com/; child-src 'self' https://www.facebook.com/ https://staticxx.facebook.com/; default-src 'self'; worker-src 'self' blob:; object-src 'none'; form-action 'self' https://connect.facebook.net https://www.facebook.com/tr/; report-urihttps://affiliate.tothemoon.com/api/report-csp
expect-ct: max-age=2592000, report-uri=https://affiliate.tothemoon.com/api/report-ct
strict-transport-security: max-age=63072000
x-frame-options: deny
x-download-options: noopen
x-content-type-options: nosniff
referrer-policy: same-origin
x-xss-protection: 1
x-nextjs-cache: HIT
x-powered-by: Next.js
cache-control: s-maxage=31536000, stale-while-revalidate
x-cache: Miss from cloudfront
via: 1.1 e906845ac8d5de91848ee474d762fa58.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-P2
x-amz-cf-id: QzbPVkG89gQDOqEasthbwdreLB29NxSfrHe3qDT_6jRRq3Fwy6mWwQ==
Earn affiliate commission from every user you refer | Tothemoon┌─[live@parrot]─[~]
└──╼ $