ggth1.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2cd4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Submission: On September 29 via api (September 29th 2024, 1:42:05 am UTC) from US — Scanned from DE

Summary HTTP 46 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 7 domains to perform 46 HTTP transactions. The main IP is 2606:4700:310c::ac42:2cd4, located in United States and belongs to CLOUDFLARENET, US. The main domain is ggth1.pages.dev.
TLS certificate: Issued by WE1 on September 27th 2024. Valid for: 3 months.

This is the only time ggth1.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 31	2606:4700:310... 2606:4700:310c::ac42:2cd4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:211... 2600:9000:211e:6a00:18:6c16:27c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2400:52e0:1e0... 2400:52e0:1e00::1081:1	60068 (CDN77 _) (CDN77 _)
3	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:bdf::64 2620:1ec:bdf::64	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	34.107.203.234 34.107.203.234	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3	20.231.53.73 20.231.53.73	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
46	10

31 2606:4700:310c::ac42:2cd4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ggth1.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:6a00:18:6c16:27c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

tools.luckyorange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1e00::1081:1 (Germany)

ASN60068 (CDN77 _, GB)

plausible.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:bdf::64 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.203.234 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.203.107.34.bc.googleusercontent.com

settings.luckyorange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.231.53.73 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

q.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

userstatics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	pages.dev 1 redirects ggth1.pages.dev	421 KB
5	clarity.ms www.clarity.ms — Cisco Umbrella Rank: 715 q.clarity.ms — Cisco Umbrella Rank: 7358	28 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 57	291 KB
3	luckyorange.com tools.luckyorange.com — Cisco Umbrella Rank: 15785 settings.luckyorange.com — Cisco Umbrella Rank: 15652	5 KB
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3391
2	plausible.io plausible.io — Cisco Umbrella Rank: 9763	2 KB
1	userstatics.com userstatics.com — Cisco Umbrella Rank: 177536	638 B
46	7

	Domain	Requested by
31	ggth1.pages.dev	1 redirects ggth1.pages.dev
3	q.clarity.ms	www.clarity.ms
3	www.googletagmanager.com	ggth1.pages.dev www.googletagmanager.com
2	region1.google-analytics.com	www.googletagmanager.com
2	settings.luckyorange.com	tools.luckyorange.com
2	www.clarity.ms	ggth1.pages.dev www.clarity.ms
2	plausible.io	ggth1.pages.dev plausible.io
1	userstatics.com	ggth1.pages.dev
1	tools.luckyorange.com	ggth1.pages.dev
46	9

This site contains no links.

Subject Issuer	Validity	Valid
ggth1.pages.dev WE1	`2024-09-27` - `2024-12-26`	3 months	crt.sh
luckyorange.com Amazon RSA 2048 M03	`2023-11-18` - `2024-12-15`	a year	crt.sh
plausible.io R10	`2024-09-02` - `2024-12-01`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
settings.luckyorange.com R10	`2024-08-05` - `2024-11-03`	3 months	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
userstatics.com WE1	`2024-09-21` - `2024-12-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Frame ID: EE4938605ECEF1479157A24779C26BAE
Requests: 46 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sicherheitscenter

Page URL History Show full URLs

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/ Page URL
https://ggth1.pages.dev/cdn-cgi/phish-bypass?atok=kMY57ihSQRxUThEFTxNp1mLxYqtHauYBwBQdk42rEPQ-172757... HTTP 301
https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

46
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

9
Subdomains

10
IPs

3
Countries

747 kB
Transfer

1800 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/ Page URL
https://ggth1.pages.dev/cdn-cgi/phish-bypass?atok=kMY57ihSQRxUThEFTxNp1mLxYqtHauYBwBQdk42rEPQ-1727574116-0.0.1.1-%2FW0in0sNw0HeDe01Er057%2F HTTP 301
https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

46 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 4 KB
2 KB 48ms
12ms Document
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d15f54374047871d2aad252e645a69bd9b53d956d1bbd12cac23d867a7438977

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8ca84612eafd2ba9-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 29 Sep 2024 01:41:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z90DleRttm%2BGmt84bUE1LXbMaoz0GzZZTLVlEclU%2FzOEnJfczDVwHWnKLKSTh9onVebjP7yTpDotiOYEarYES67H7x72IDLmGPpAl20LvnJ1IIEKERVLEXFgvTlEfsqBeJCJXgKt3GRcF787b2A%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 speculation
ggth1.pages.dev/cdn-cgi/ 2 B
400 B 13ms
13ms Other
application/speculationrules+json 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ggth1.pages.dev/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ggth1.pages.dev
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SEJTUerA90XgB5FcrSj3LNx46Osl%2B18DT1ikRhuLFp1Cnzl%2Fl4MRK76gQORLdz4acvO%2BP7ABHK1rbPbQn3qnHoka4J4oRepLb6x3QrzRVWxHd2rLZ1T3KOxVE4yT5izEKn2Cee%2F8xC4Fr5xd%2F5U%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ca84612fb022ba9-FRA
content-length: 2
date: Sun, 29 Sep 2024 01:41:56 GMT
content-type: application/speculationrules+json
vary: Accept-Encoding
server: cloudflare

GET
H3 200 cf.errors.css
ggth1.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 11ms
11ms Stylesheet
text/css 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"66f525a7-5df3"
x-content-type-options: nosniff
cf-ray: 8ca84612fb032ba9-FRA
expires: Sun, 29 Sep 2024 03:41:56 GMT
date: Sun, 29 Sep 2024 01:41:56 GMT
content-type: text/css
last-modified: Thu, 26 Sep 2024 09:13:11 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
ggth1.pages.dev/cdn-cgi/images/ 452 B
634 B 9ms
9ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "66f525a7-1c4"
x-content-type-options: nosniff
cf-ray: 8ca846131b0a2ba9-FRA
expires: Sun, 29 Sep 2024 03:41:56 GMT
accept-ranges: bytes
content-length: 452
date: Sun, 29 Sep 2024 01:41:56 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 09:13:11 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 favicon.ico
ggth1.pages.dev/ 3 KB
1 KB 70ms
69ms Other
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S4rfRygxQJ0gaQ5YjeUb8Ym7lKydliX3mgSv5PtZ9qzwJDRmHNsoJ50XbJWqKJX9gicndcIiY8Ptn0kTmn8nDD7IQIkWsgOWRrEpoKKE1QPfP4d48ZlArz%2BEGlsBv4s97bWauYSERoaaP8mR2Sc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca846132b0d2ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:41:56 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3

200

Primary Request / Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Redirect Chain

https://ggth1.pages.dev/cdn-cgi/phish-bypass?atok=kMY57ihSQRxUThEFTxNp1mLxYqtHauYBwBQdk42rEPQ-1727574116-0.0.1.1-%2FW0in0sNw0HeDe01Er057%2F
https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

50 KB
9 KB

25ms
24ms

Document
text/html

2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff7a5b82ef2787d493ec28b0bc3543f077879a8ca9194bacecbba86398396537

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8ca846327e062ba9-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 29 Sep 2024 01:42:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKsZjfpRTNMZp7irvopNn9Ncu6J%2F7usm67UUJMBEyhjCF9k4yWkzdLMHQbPOh3EpVLzNxgYjzGkak27zE7%2By%2BEu4vHx4TdiZG%2FqTI23qpU3z0Nk8A0qjqUJwmbu30wV%2Bm4oG8lMP1VJY7Rzzlm8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

cache-control: private, no-cache
cf-ray: 8ca846326e012ba9-FRA
content-length: 167
content-type: text/html
date: Sun, 29 Sep 2024 01:42:01 GMT
location: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 speculation
ggth1.pages.dev/cdn-cgi/ 2 B
403 B 13ms
13ms Other
application/speculationrules+json 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ggth1.pages.dev/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ggth1.pages.dev
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PaqIs8dyV7PAc%2Fujvh6OIXh43%2FXZy6ydNiATVNUXOedMXbUU6ia%2BjA5czE2YaEBDAquPhHbj6gn0Thjbe736KlZ%2FDl%2FS9KDSiOgXdvbH6DethO8479n5fTnUY606oxEnOr2NwMhxnaD%2BW%2BcKfK4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ca84632ae142ba9-FRA
content-length: 2
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/speculationrules+json
vary: Accept-Encoding
server: cloudflare

GET
H2 200 lo.js Show response
tools.luckyorange.com/core/ 13 KB
5 KB 52ms
7ms Script
text/javascript 2600:9000:211e:6a00:18:6c16:27c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tools.luckyorange.com/core/lo.js?site-id=04f93631
Requested by: Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:6a00:18:6c16:27c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: baedbe79b629b2650542bc6671300a75fc88aaacdfa3faed4975591fefaffa56

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

content-encoding: gzip
etag: "cf826c613ca8817220b27ee016010218"
age: 3114
x-cache: Hit from cloudfront
x-amz-cf-id: PMAe2swyOJ96XpYJx-SVE48v3Cdpwhk7m66roWxEcttzgol_GiV6XA==
date: Sun, 29 Sep 2024 00:50:08 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 19 Sep 2024 21:16:34 GMT
cache-control: max-age=3600
via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 4675
x-amz-cf-pop: FRA56-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 tapa.css
ggth1.pages.dev/W0in0sNw0HeDe01Er057/css/ 18 KB
5 KB 24ms
23ms Stylesheet
text/css 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/css/tapa.css

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fe7061e7043f8dc11fd8237acefe589710060897ff63553fa1fe19aa4a7db4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"ca209c1a4caeb03cd444994416dc928e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i7JmK0mGC7QzDojpHJGPeHmgjnIK12lhc16zGYKyJyfg9eITY7urQ8vgwkeGfWAcN1VT0DdpnmsRYb7bKkeEGeOq%2FCQeAOPUDmlo%2FcGdZAT9rJ425QBOhJtpxy%2FOyS94Ov1KKqKjzy8JeuMwB4o%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632ae152ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3 200 jquery.min.js Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/ 83 KB
31 KB 27ms
26ms Script
application/javascript 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/jquery.min.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"1f742c403b7bcd94e2b3ff3fb90aaf91"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yb5PlSkubiFYGln1vDwjtQOz3oP5OI08DdV%2FrzZSaJKlnzbH0D0LEYmcglgSiqzcs21zIJN2TCLpI331ABi4j1J3iAi1jvilPBcCD9NaJITYdKt24vi%2BaxnZZYePn0XAWzFKfhA6PcMobKdC%2FjY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632ae162ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 bootstrap.min.js Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/ 59 KB
16 KB 37ms
36ms Script
application/javascript 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/bootstrap.min.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ggth1.pages.dev
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"4c5defc217a778d955c27390fb3f9bd5"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FdGfRcnKdh7tY2kcYoSoYocmydjE0L2dFlMJm5dBlYWSYNjd9hAKP6%2FsJu61bd1XY9MLiRBG3nWkc270ldVfjbRDQltsMdW826USAyY3310AAMQzajDtEZKkbk%2BBekm9a82rwYWLqrdts%2FgIawg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632ae182ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 font-awesome.min.css
ggth1.pages.dev/W0in0sNw0HeDe01Er057/css/ 27 KB
7 KB 39ms
38ms Stylesheet
text/css 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/css/font-awesome.min.css

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"9cf4906dbfb2d924f282bbd986a441d6"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6jv6he%2BmMGETIlYamw7cMa0yVEfFCOWf7dZtsgXAhYbJY0VqNo010IayeGZYzt%2FI14I8zLXNKCwdSrwzPNHk%2BcC20QtEkFay0VmaohcnFpuEFLm3IO%2B%2B2f94anbj1R08q%2BJWK7YJS7mwdi%2BJ77k%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632ae192ba9-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3 200 emojione.min.js Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/ 295 KB
39 KB 37ms
35ms Script
application/javascript 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/emojione.min.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5c06455e539dcd889f7f05d709b5adc76c444099fe57f431365af2fc57e803b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"b6ce2c5ceae856dd5d383e03384c4a68"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=79zll0aP0xTAqRodI18mBXAhhjdXn%2FmUFYPV%2B9JburlIea2Up7tOdnix%2BQCqaYQKvScfY6qCN3iTV6B9T3blhQvYOdrDipOi1h8tCcd4kL8Mgxi6qjETPUnPU0RIbP6jtsvy8ETmlxzoAs1ngXc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe422ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 analytics.js Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/ 438 B
679 B 24ms
24ms Script
application/javascript 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/analytics.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb48873e81d9d3a8d35b1b7a32c524d0f6e4ce291c4329536e046eb89d08874e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"029c57fa022a05985094c3bc4caa2e57"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oVdA6Z1xkUtmEyH4515CkcTVBuZk2ZcY8eMl8z15Rx7SJK%2FbKYPhATI3guMBLmci77vbf5rvCEFM7XUTLL9o1HJWkmKF7KjCgW3yidnaaotbf9y0DPintSl4nz14wKuknb4YtMWXIIoM6yIaPg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632ae1a2ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script.js Show response
plausible.io/js/ 1 KB
1 KB 111ms
64ms Script
application/javascript 2400:52e0:1e00::1081:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL

https://plausible.io/js/script.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1081:1 , Germany, ASN60068 (CDN77 _, GB),

Reverse DNS

Software

BunnyCDN-DE1-1081 /

Resource Hash

965387ce9489d0167cf33444ab52d064bb3fab35e94b12082ff5eb00a34c070c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

cdn-status: 200
content-encoding: br
x-content-type-options: nosniff
alt-svc: h3=":9443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cachedat: 09/28/2024 11:55:43
cdn-cache: HIT
cdn-requestpullcode: 200
cache-control: public, must-revalidate, max-age=86400
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cdn-requestid: f71b1c01b2c695840ec09bf62f8e1183
cross-origin-resource-policy: cross-origin
cdn-pullzone: 682664
cdn-proxyver: 1.04
application: 127.0.0.1
permissions-policy: interest-cohort=()
access-control-allow-origin: *
cdn-edgestorageid: 1079
server: BunnyCDN-DE1-1081
cdn-requestcountrycode: DE

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 311 KB
103 KB 80ms
40ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-YXSXZH41HG

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ace7657fb93ec375eb9c9d422194f5583eec2d508667c9f0c992e3aa078c87a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 29 Sep 2024 01:42:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105648
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 script.compat.js Show response
ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/ 1 KB
1 KB 30ms
28ms Script
application/javascript 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/script.compat.js

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63438ac53941d537540dd5687ab8c1f1319509a2f6c419731d5e21cd3a850796

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"0fbb46c71d768dc9d0430ba006348598"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SrX%2B3G7DVioPCea3sAaWlYY1KqixXeCIjF2E6h06of6ia0nWM0QnnLg28cak7T1pqUAuYw%2BtdVZs54qbbmZQhPImdowNYkLOQqz3QKmIHFvJQuf%2B%2BJY0GF13su6Pwn90B%2BLTgHsdwGDT6TqQgs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe432ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 f24.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 90 KB
90 KB 26ms
25ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/f24.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

643bd80e1c21153482bf540db69364a477abcba1e9f045627d6a556b34c9893c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "431c7115ad3fb66b9a7523827b674e74"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QZ%2BzNbKwJwqDJkEwnWdBdNq9ouTaTwtffD9ZJF4br%2BU5c%2FfxOY24aqZ8bUIKGv%2BhjMoMfqtZhFx5NxggI51yQUVktWagD1G2%2Frkbzk7hXsXkuuefvAwpg4dxIUISSV3QuegcJk0aj%2BLchUpU1o8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632be212ba9-FRA
access-control-allow-origin: *
content-length: 92102
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 mnc.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 187 B
652 B 21ms
20ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/mnc.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "653967a2ac91034b61d1ad76540b8eb4"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K6NYEXedZHkjCcUpBBgD2GWgIIb9wIHQL8McA3fb2ydRpKdQFLVHfMAkSpJCDGXyNp4ezkUAbbMMe8F6lMpgtN30%2BmnzFIhLTfN3R9vK8wC9MGert9HmJy82MEM5FP4aShvHXobyFtxO9S4xTh4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632de272ba9-FRA
access-control-allow-origin: *
content-length: 187
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 msmm.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 168 B
636 B 49ms
48ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/msmm.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "8ca71578100459238fb030f8dd97e8bb"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dxBJFcY0J%2B%2Bat%2B8kJMdJWhQsXKZims7ZhGe18OUXFDLUHjmbNnc6eAMYfbECH27VoQFQiBxG3oui1piJVadS3Bh4oOYrGXPiSnhxKJCBGb65Uc9q8iehCxAKPvgPT0zI97P4lALAy%2BZXhVulCPI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe3c2ba9-FRA
access-control-allow-origin: *
content-length: 168
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 set.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 364 B
827 B 29ms
27ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/set.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "ee63d8b934f54cf7e606ebae2b4bfcf6"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O75R3PTIdmaayMxA0p9sntKorVmAVf4NlASviOdg3lOevTxi9%2FoLlF0bkucHqBewaz5pXaCqNXsRFsBgWUaNJGW7xETvr0fC9eFVAv0iixOjke3zo7%2BbcC9XApALymslrbWvrOV6QcwrVlNgpo4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe3e2ba9-FRA
access-control-allow-origin: *
content-length: 364
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 vsc.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 722 B
1 KB 33ms
31ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/vsc.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "da27b6888c7cff8c20811d9d856d5f9d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yikdcQs2BuQd9dvMA9z5UzFSdspONnzsA9tjNzgY09bOO1CMh1LIm%2Bzdmi9Zn%2FERCblTbGWGvPhKOVmCXw8SPjcrnLWqZ%2BzPl8AeFWkgr9scASojyfQyqiaM4YJfaF%2FeCg4LvAyxOxWEIxNxYXM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe402ba9-FRA
access-control-allow-origin: *
content-length: 722
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 bel.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 276 B
744 B 35ms
34ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/bel.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c1606563842cce5f1788329d4417ae3618b33c6365c56a7122439b6ab45c977

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "f4e0dc23fa0c9a87dc8527d52bd80a1e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u5lzR%2FQ6bZgmVmsd7SIQ4dNYIXlK8h8Es%2FpsVJAfH7evEbl%2F1zuWd1T1ASbOQw755uADPz8SbZxX1wWnfxrG3JRX8dZHJMza9SCk0bcHjw8jpr1VOtJ%2B7nGvpSrrqFARFjXeInvIIERkFmj6EjE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe442ba9-FRA
access-control-allow-origin: *
content-length: 276
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 dm.png
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 35 KB
35 KB 33ms
32ms Image
image/png 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/dm.png

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

426eec34428ca37958c3697503680648f7d9658ae0fe6300e80ddc17797ceb85

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "610e50a97ed65b5b127c3b7685d8b3b7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SPUkJ28xsJls%2BeBIwYFHBBRrzcRJ3dXvIt3mdjLQssiKFJJo5wdWLeXecPgW65cWmD%2Fe3DjSE5u%2FPOyFI0ZbWAHYHAa%2BrUINu9vx%2F%2BKwZMFXILlMTPul0GEgMwUWQNrzj3BuUpdNORLb2ZzaQYM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe452ba9-FRA
access-control-allow-origin: *
content-length: 35689
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
H3 200 re.gif
ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/ 14 KB
15 KB 36ms
35ms Image
image/gif 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/images/re.gif

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "100a9924b8b50ce024e2fa5b31934d7f"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JfGc%2BmtZAONVW721%2FPtWkyKVrRwTBxJCcjLdgMzFypbohGdRT89GrYgM3NgQVEZRA0og2DOWFGqmnOulUo8HATpfa7jw4D80%2F7wOBtMbbMlpeyxQk%2By2PSFCDf%2BG%2F566LpoO5FutQLlEajEtLZo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84632fe462ba9-FRA
access-control-allow-origin: *
content-length: 14751
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
84 KB 71ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXX-X

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

47b5dbbd9a39906e4f023353995c55411d211b2d1e62a65a6a7c6b1d45cdb4c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 29 Sep 2024 01:42:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 29 Sep 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 85416
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 mcdfgm3r6d Show response
www.clarity.ms/tag/ 501 B
756 B 232ms
193ms Script
application/x-javascript 2620:1ec:bdf::64
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/mcdfgm3r6d
Requested by: Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 00766fbcc6b5d3d8ef8579955eb9bbf31bd5345a6892c468665e573bb36997ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 501
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/x-javascript
x-azure-ref: 20240929T014201Z-17b7969cc4bxsnddq16tn8h1us00000009bg00000000d3tm

GET
DATA 200
OK truncated
/ 349 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 beep.mp3
ggth1.pages.dev/W0in0sNw0HeDe01Er057/media/ 8 KB
9 KB 25ms
24ms Media
audio/mpeg 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/media/beep.mp3

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "0825ebad9a641a19e1944426ffe4916e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJsqSWtofLBR0HlbQij0G%2BEK0rbyj4fu5mBH160y8MyguS1xFKzU%2F77FgjdA4Tn%2FYmURBDhZ%2BPa%2FUI2l%2B1fb%2BmxxXNn7F1tNn%2BTZkkprKq1T5bvHUGkzVFVoMBGz92y48oUl8%2FelHjZtnrLPk54%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca846330e482ba9-FRA
access-control-allow-origin: *
content-length: 8405
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: audio/mpeg
vary: Accept-Encoding
server: cloudflare

GET
H3 200 _Fm7-alert.mp3
ggth1.pages.dev/W0in0sNw0HeDe01Er057/media/ 144 KB
145 KB 48ms
47ms Media
audio/mpeg 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/media/_Fm7-alert.mp3

Requested by

Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961dca6395d83887823fc7267079c85a2beb574fe840fa7885821ee98c44041a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "8ba5895c611c248973a707cd20f0b651"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FC3HgJDHk2xLWWgfQxjPG7hC62i2yGlCWOStVG2Jwufi3bjy%2F8r3yuGrovrSqbUk2Gs0zNaVlQvinau1X6gxSj%2BEovF6EQ7%2B1FTXkaX1%2F2GJzzkvdKuA8L%2F4F496cTGI6fHNyQnXj2x8gkD0iT4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca846330e492ba9-FRA
access-control-allow-origin: *
content-length: 147840
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: audio/mpeg
vary: Accept-Encoding
server: cloudflare

GET
H2 200 04f93631 Show response
settings.luckyorange.com/ 149 B
239 B 256ms
255ms Fetch
application/json 34.107.203.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/04f93631
Requested by: Host: tools.luckyorange.com
URL: https://tools.luckyorange.com/core/lo.js?site-id=04f93631
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash: cbc0008dc0cd5ed8f6a82fb3a255df97c25e6e943526ef50663736c7faae76f1

Request headers

x-lucky-uid: undefined
Referer: https://ggth1.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-lucky-referrer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://ggth1.pages.dev
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding

OPTIONS
H2 200 04f93631
settings.luckyorange.com/ 0
0 146ms
120ms Preflight 34.107.203.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/04f93631
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-lucky-referrer,x-lucky-uid
Access-Control-Request-Method: GET
Origin: https://ggth1.pages.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Origin,Authorization,Content-Type,X-Lucky-Uid,X-Lucky-Site-Id,X-Lucky-Impersonate,X-Lucky-Session-Id,X-Lucky-Referrer
access-control-allow-methods: POST,GET,PUT,PATCH,DELETE,OPTIONS
access-control-allow-origin: https://ggth1.pages.dev
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 29 Sep 2024 01:42:01 GMT
via: 1.1 google

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 62ms
28ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-XXXXXXXXX-X&gtm=45je49p0za200&_p=1727574121432&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=218319949.1727574122&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1727574121&sct=1&seg=0&dl=https%3A%2F%2Fggth1.pages.dev%2FW0in0sNw0HeDe01Er057%2F&dr=https%3A%2F%2Fggth1.pages.dev%2FW0in0sNw0HeDe01Er057%2F&dt=Sicherheitscenter&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=204
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXX-X
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://ggth1.pages.dev
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 311 KB
103 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-YXSXZH41HG&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXX-X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3aa224a84c77d8d8a59e43e155f2140be1282778c10605d53f071512102d5a39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 29 Sep 2024 01:42:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105668
x-xss-protection: 0
server: Google Tag Manager

POST
H2 202 event Show response
plausible.io/api/ 2 B
537 B 48ms
21ms XHR
text/plain 2400:52e0:1e00::1081:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://plausible.io/api/event
Requested by: Host: plausible.io
URL: https://plausible.io/js/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1081:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1081 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://ggth1.pages.dev/

Response headers

x-request-id: F_mTgrBIT9tHI3JxbyuE
alt-svc: h3=":9443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: text/plain; charset=utf-8
cdn-cachedat: 09/29/2024 01:42:01
cdn-requestpullcode: 202
cache-control: must-revalidate, max-age=0, private
cdn-requestpullsuccess: True
cdn-requesttime: 1
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cdn-requestid: 5a2dd851b0d82d7e81fa2908e98baa43
access-control-allow-credentials: true
cdn-pullzone: 682664
cdn-proxyver: 1.04
application: 127.0.0.1
permissions-policy: interest-cohort=()
x-plausible-dropped: 1
access-control-allow-origin: *
content-length: 2
cdn-edgestorageid: 1081
server: BunnyCDN-DE1-1081
cdn-requestcountrycode: DE

POST
H3 405 event Show response
ggth1.pages.dev/api/ 0
412 B 16ms
14ms XHR
text/plain 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ggth1.pages.dev/api/event
Requested by: Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/script.compat.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KbyIjozhfyJypuf3%2FG7BVdMBMOfTYrQ83uyRDWT%2Bsipal4y6pHum0rpaPiOjZeJBUOhe0vNmr7%2B2SLdjxywt%2Bj%2FnnjZftjCqqBS%2Fkn1Cvq%2FjsE7Ue8w61mCEMOFStFtFQ0SQXKOlstTuQiZ0%2BzA%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84633be812ba9-FRA
access-control-allow-origin: *
content-length: 0
date: Sun, 29 Sep 2024 01:42:01 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 35ms
27ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-YXSXZH41HG&gtm=45je49p0v9173874466za200&_p=1727574121432&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=218319949.1727574122&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1727574121&sct=1&seg=0&dl=https%3A%2F%2Fggth1.pages.dev%2FW0in0sNw0HeDe01Er057%2F&dr=https%3A%2F%2Fggth1.pages.dev%2FW0in0sNw0HeDe01Er057%2F&dt=Sicherheitscenter&en=page_view&_fv=1&_ss=1&_ee=1&tfd=231
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-YXSXZH41HG
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://ggth1.pages.dev
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.47/ 64 KB
27 KB 25ms
24ms Script
application/javascript 2620:1ec:bdf::64
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.47/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/mcdfgm3r6d
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 30adbc7e799238c336b56a1e20db67910f2a114fc3bc6ced6c550b4c873318aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

x-azure-ref: 20240929T014201Z-17b7969cc4bxsnddq16tn8h1us00000009bg00000000d3u5
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DCDE837DF4C2B0"
x-fd-int-roxy-purgeid: 51562430
x-ms-request-id: cd404d95-701e-0001-7ee7-107107000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 26 Sep 2024 23:32:31 GMT

GET
H3 200 w3
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 0
478 B 30ms
30ms Other
application/octet-stream 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/w3

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "af1349b9f5f9a1a6a0404dea36dcc949"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UC7%2BBN2TG3ZT0AvyjEAl2QYZagsMvgUOsRsCExXlt2yjGw7XkEWUtopBatWvjOUzDHlW5r69DEbyeAYjdw7vtyOdzuhKPR%2B%2F6okaXWscb%2B3y8bYB5P7GSyifYG0lnoYj3HGlL55RbbpHJl%2BWPKo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84634def52ba9-FRA
access-control-allow-origin: *
content-length: 0
date: Sun, 29 Sep 2024 01:42:01 GMT
content-type: application/octet-stream
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 398ms
201ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://ggth1.pages.dev/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://ggth1.pages.dev
Date: Sun, 29 Sep 2024 01:42:02 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 script.js Show response
userstatics.com/get/ 133 B
638 B 106ms
82ms Script
text/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://userstatics.com/get/script.js?referrer=https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/
Requested by: Host: ggth1.pages.dev
URL: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/js/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.1
Resource Hash: df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, POST
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R23rUMMPeiO2E9c9jybIVXLRkcLKAgFncpPPJhs4mQWZiWMdmH7%2Fnx66oEjLDLDQd%2FAAH1b73aqdVo31a%2FfFk8SWBmTgD2%2FdXx3L%2FRzRH1vfmx2L5yg2PelaW7ES0OBHZSA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ca846394dc5bb47-FRA
access-control-allow-origin: https://ggth1.pages.dev
date: Sun, 29 Sep 2024 01:42:02 GMT
content-type: text/javascript; charset=utf-8
x-powered-by: PHP/8.2.1
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: X-Requested-With,content-type

GET
H3 200 w3.html
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 3 KB
1 KB 35ms
35ms Other
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/w3.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vUnqxIVRxiqyVoVoeADwexTFiL8S952n4zP0M8hmRLFZq0n3m1VObveBZaNIquVX9s%2FcBsKkow7uCY4%2BL7kUqsrxsUizeSQ9dpabC%2F8j9%2Frq2Ci2WrwqUs4JlaagChvolp3Sho6akuzy4FU1dp0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca8463948a22ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:02 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 95ms
93ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://ggth1.pages.dev/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://ggth1.pages.dev
Date: Sun, 29 Sep 2024 01:42:02 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 w1.html
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 3 KB
1 KB 39ms
39ms Other
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/w1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H6HGtHl8%2Bfjhyv0COrEyK32i9zXNpJRFa%2BAC6gC4LJZErruYzEs5%2Fo8DV3EFvW8DcP0YeK45YIq6FWpOT9FbD%2BNxoYJEJ%2FfiqOxlg7JwpBd%2BA8azvr7LDY%2BtA7BFfnQHWLEVno3KJ%2Bcr%2BgWc4tM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca8463f8b022ba9-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sun, 29 Sep 2024 01:42:03 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3 200 w3.html
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 3 KB
1 KB 36ms
36ms Other
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/w3.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SuxfhehsP72Dg7HbeAhlie1tIRGgam6F1duLBUIjFhu7jb9nyWYhtg%2FHmqIlVcEwe8WC3r4hLUfSObODjXwN3zzMGrGF8%2BgYdUZuB6yWxvruLSmPcS4sjLxyGRV1RoEIkkVlzQ0njfSFq1WYKqQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca84645cd542ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:04 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 94ms
92ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://ggth1.pages.dev/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://ggth1.pages.dev
Date: Sun, 29 Sep 2024 01:42:05 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 w1.html
ggth1.pages.dev/W0in0sNw0HeDe01Er057/ 3 KB
1 KB 35ms
34ms Other
text/html 2606:4700:310c::ac42:2cd4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/w1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ggth1.pages.dev/W0in0sNw0HeDe01Er057/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4%2BqVEd%2F2xEmlXP6ff042c3nXDLvMD2zbgBlOozu%2Fo8gL8jtxdJ0WWWIDwxCEEyuTD6na28SIOPzLVQVTccSOUjE9mQD6fHxmIWKM%2FfKh9j07OZw2znuAsu%2BjG8aaVtKbHAZnBGLreU%2FMkaQCfU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ca8464c0f2d2ba9-FRA
access-control-allow-origin: *
date: Sun, 29 Sep 2024 01:42:05 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer) Generic Cloudflare (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ggth1.pages.dev/W0in0sNw0HeDe01Er057	1970-01-20 23:53:33	Name: PHPREFS Value: full
.ggth1.pages.dev/	1970-01-20 23:54:20	Name: __cf_mw_byp Value: kMY57ihSQRxUThEFTxNp1mLxYqtHauYBwBQdk42rEPQ-1727574116-0.0.1.1-/W0in0sNw0HeDe01Er057/
.ggth1.pages.dev/	1970-01-21 09:28:54	Name: _ga_XXXXXXXXX-X Value: GS1.1.1727574121.1.0.1727574121.0.0.0
.ggth1.pages.dev/	1970-01-21 09:28:54	Name: _ga Value: GA1.1.218319949.1727574122
.ggth1.pages.dev/	1970-01-21 09:28:54	Name: _ga_YXSXZH41HG Value: GS1.1.1727574121.1.0.1727574121.0.0.0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ggth1.pages.dev/api/event Message: Failed to load resource: the server responded with a status of 405 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ggth1.pages.dev
plausible.io
q.clarity.ms
region1.google-analytics.com
settings.luckyorange.com
tools.luckyorange.com
userstatics.com
www.clarity.ms
www.googletagmanager.com
188.114.97.3
20.231.53.73
2001:4860:4802:34::36
2400:52e0:1e00::1081:1
2600:9000:211e:6a00:18:6c16:27c0:93a1
2606:4700:310c::ac42:2cd4
2620:1ec:bdf::64
2a00:1450:4001:831::2008
34.107.203.234
00766fbcc6b5d3d8ef8579955eb9bbf31bd5345a6892c468665e573bb36997ca
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
0fe7061e7043f8dc11fd8237acefe589710060897ff63553fa1fe19aa4a7db4f
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
1ace7657fb93ec375eb9c9d422194f5583eec2d508667c9f0c992e3aa078c87a
2009f2cb9c1d737fce71915a3077657513e591715dbbac03461775919c212704
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
30adbc7e799238c336b56a1e20db67910f2a114fc3bc6ced6c550b4c873318aa
31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd
3aa224a84c77d8d8a59e43e155f2140be1282778c10605d53f071512102d5a39
426eec34428ca37958c3697503680648f7d9658ae0fe6300e80ddc17797ceb85
436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
47b5dbbd9a39906e4f023353995c55411d211b2d1e62a65a6a7c6b1d45cdb4c2
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
4c1606563842cce5f1788329d4417ae3618b33c6365c56a7122439b6ab45c977
63438ac53941d537540dd5687ab8c1f1319509a2f6c419731d5e21cd3a850796
643bd80e1c21153482bf540db69364a477abcba1e9f045627d6a556b34c9893c
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
961dca6395d83887823fc7267079c85a2beb574fe840fa7885821ee98c44041a
965387ce9489d0167cf33444ab52d064bb3fab35e94b12082ff5eb00a34c070c
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a
baedbe79b629b2650542bc6671300a75fc88aaacdfa3faed4975591fefaffa56
c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41
cbc0008dc0cd5ed8f6a82fb3a255df97c25e6e943526ef50663736c7faae76f1
ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04
d15f54374047871d2aad252e645a69bd9b53d956d1bbd12cac23d867a7438977
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f5c06455e539dcd889f7f05d709b5adc76c444099fe57f431365af2fc57e803b
fb48873e81d9d3a8d35b1b7a32c524d0f6e4ce291c4329536e046eb89d08874e
ff7a5b82ef2787d493ec28b0bc3543f077879a8ca9194bacecbba86398396537

ggth1.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2cd4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

46 Requests

100 %HTTPS

67 %IPv6

7 Domains

9 Subdomains

10 IPs

3 Countries

747 kBTransfer

1800 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

46 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ggth1.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2cd4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

46
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

9
Subdomains

10
IPs

3
Countries

747 kB
Transfer

1800 kB
Size

5
Cookies

46 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!