www.bot.upwork-uk.com Open in urlscan Pro
188.239.191.17  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bot.upwork-uk.com/	24 KB 7 KB	407ms 283ms	Document text/html	188.239.191.17 SERVER-FACTORY-CO...
General Check archive.org Show headers Download Go to Full URL https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 188.239.191.17 Eygelshoven, Netherlands, ASN206075 (SERVER-FACTORY-COM Maximilian Jacobsen, DE), Reverse DNS srv2.live-dns.com Software LiteSpeed / Resource Hash 42220e43109e88ef5df2a274dc0f83b8d3762c23f557cc759e36fcdead314ce4 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-cache, private content-encoding br content-length 5688 content-type text/html; charset=UTF-8 date Wed, 20 Nov 2024 06:58:48 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/	227 KB 27 KB	70ms 13ms	Stylesheet text/css	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.bot.upwork-uk.com Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers * content-encoding br etag W/"38d63-xawd7pYctZoEUlbsID9p4xeHL3w" age 1103406 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Wed, 20 Nov 2024 06:58:48 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-eddf8230118-FRA, cache-ams21029-AMS vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 27432 x-jsd-version 5.3.3
GET H2	200	vignette.min.js Show response niphaumeenses.net/	87 KB 36 KB	86ms 25ms	Script application/javascript	139.45.197.243 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://niphaumeenses.net/vignette.min.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.243 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash 12738d617e8014bcb43d7534b4c1c44562b65e9c61c89c98d2f54a69c1f2a8cf Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers strict-transport-security max-age=1 cache-control max-age=86400 timing-allow-origin * content-encoding gzip accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version x-content-type-options nosniff date Wed, 20 Nov 2024 06:58:48 GMT content-type application/javascript server nginx
GET H2	200	sad.min.js Show response sad.adsgram.ai/js/	131 KB 42 KB	86ms 19ms	Script text/javascript	18.66.122.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sad.adsgram.ai/js/sad.min.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-72.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 627aa0365179c9c292b1259c36f5c6707cce1722f296c986f2aaca0b78204838 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers content-encoding br x-amz-version-id l0zSQefFoaBnvC_akXGmIf0qAEwV_akg etag W/"8bacfab7d8a083309a23e2000a881322" age 533 alt-svc h3=":443"; ma=86400 x-cache Hit from cloudfront x-amz-cf-id jCmF6cuEZNqq6uharbZGhlG8GQRpNDrBmA2D1Ly3ZMlO_ZqdStuE7g== date Wed, 20 Nov 2024 06:49:56 GMT content-type text/javascript;charset=utf-8 vary accept-encoding last-modified Thu, 14 Nov 2024 03:27:18 GMT cache-control max-age=600 via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P2 server AmazonS3 x-amz-server-side-encryption AES256
GET H3	200	50 placehold.co/	2 KB 1 KB	23ms 22ms	Image image/svg+xml	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://placehold.co/50 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4319117c6e426ca0c7094e22528987c355ee2235c5702dbbfa0a643c6e9e5a20 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"7e6-7DZBpli1qKWcbpdCwXaNn73gxmA" age 1106354 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nsRR1AraTPpU7rQp%2FZPkK8EvZEHG%2B9Oja%2FF2ljXPykE%2FVzkQRy%2BwTgwkd%2B3MdaPVe2Ivstc8oXDwM%2FGLx0vrff6Q4xar79Ol6mQAzVeJyISF5K7%2FQrYeOt64lgVPTcU%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12137&sent=16&recv=13&lost=0&retrans=0&sent_bytes=6425&recv_bytes=5161&delivery_rate=120832&cwnd=12000&unsent_bytes=0&cid=ea388c977aedc141&ts=114&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type image/svg+xml; charset=utf-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=1209600 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e568dbdbabea018-AMS access-control-allow-origin * server cloudflare
GET H3	200	150 placehold.co/	2 KB 1 KB	60ms 26ms	Image image/svg+xml	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://placehold.co/150 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ef559c04dd1f590a3ada71be39bab8869a4b69ee650afcdbec3758be61def46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"9bb-rGYKc74CvBkc5DuDdWy7pIfSFIA" age 1035770 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lay%2BBBtLJ6DVkkAN1363%2FF4tpF%2F7x2l8yr7%2BfvQX0XXM2tiX4UyITQ70G%2FymTRJLR%2B47TZwizL2ZQfhG0kDSs1stXdGfbMIXo%2Fw%2BK%2BaOUxXOLv6cBcsVTFJyRtMAJtA%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=11869&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4168&recv_bytes=4400&delivery_rate=49470&cwnd=12000&unsent_bytes=0&cid=ea388c977aedc141&ts=37&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type image/svg+xml; charset=utf-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=1209600 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e568dbd3a1aa018-AMS access-control-allow-origin * server cloudflare
GET H/1.1	403 Forbidden	invoke.js www.highperformanceformat.com/8eaa6550b43b230a38b86c0c1b80c422/	0 0	302ms 103ms	Script application/javascript	192.243.61.225 ADVANCEDHOSTERS-A...
General Check archive.org Show headers Download Go to Full URL https://www.highperformanceformat.com/8eaa6550b43b230a38b86c0c1b80c422/invoke.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Connection keep-alive Access-Control-Allow-Origin * Content-Length 0 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Date Wed, 20 Nov 2024 06:58:48 GMT Content-Type application/javascript Host www.highperformanceformat.com Server nginx/1.21.6
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/	216 KB 26 KB	38ms 12ms	Stylesheet text/css	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers * content-encoding br etag W/"35e6c-cZlWqlLbTIr9xcDPs8verWJYuKY" age 219968 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Wed, 20 Nov 2024 06:58:48 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-etou8220074-FRA, cache-ams21035-AMS vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 26379 x-jsd-version 5.3.0-alpha1
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/	79 KB 24 KB	13ms 12ms	Script application/javascript	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 061f0b1ea79e6e2ca24f4603e55d3e909f7471ba0b279cdb6dea40554106c6a2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers * content-encoding br etag W/"13ad7-v/eN2cAqUAirQ2QpSHOc5Yx2GyE" age 1482329 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Wed, 20 Nov 2024 06:58:48 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220121-FRA, cache-ams21035-AMS vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 24765 x-jsd-version 5.3.0-alpha1
GET H/1.1	403 Forbidden	invoke.js www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/	0 0	295ms 105ms	Script application/javascript	192.243.61.225 ADVANCEDHOSTERS-A...
General Check archive.org Show headers Download Go to Full URL https://www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/invoke.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Connection keep-alive Access-Control-Allow-Origin * Content-Length 0 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Date Wed, 20 Nov 2024 06:58:48 GMT Content-Type application/javascript Host www.highperformanceformat.com Server nginx/1.21.6
GET H3	200	100 placehold.co/	2 KB 1 KB	24ms 22ms	Image image/svg+xml	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://placehold.co/100 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af4bb8621054264ac72e09517b1eb6758b198cf9dd51c707d8c12674b7e54c13 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"9b3-lV3q5RWN160NXjvy0SQ303r7hOQ" age 491770 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0cE9%2BxUIxW9V35QsoJqtb3RT0BGN3FVI4IqgnpM58KdsspGdgEfuW8DxggW07KLQ7At5BKGxGpItuQb8xWePokvdNF9JjXBsebAC%2F6XRLKTiTgrV7RNR%2FSJ2kHfFw%2BY%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12137&sent=15&recv=13&lost=0&retrans=0&sent_bytes=5726&recv_bytes=5161&delivery_rate=120832&cwnd=12000&unsent_bytes=0&cid=ea388c977aedc141&ts=114&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type image/svg+xml; charset=utf-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=1209600 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e568dbdbabda018-AMS access-control-allow-origin * server cloudflare
GET H/1.1	403 Forbidden	0a96ec1c82ca19856b65dc758e9bb94b.js pl25023760.profitablecpmrate.com/0a/96/ec/	0 0	359ms 114ms	Script application/javascript	172.240.108.76 SERVERS-COM
General Check archive.org Show headers Download Go to Full URL https://pl25023760.profitablecpmrate.com/0a/96/ec/0a96ec1c82ca19856b65dc758e9bb94b.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 172.240.108.76 , United States, ASN7979 (SERVERS-COM, US), Reverse DNS Software nginx/1.21.6 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Connection keep-alive Access-Control-Allow-Origin * Content-Length 0 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Date Wed, 20 Nov 2024 06:58:48 GMT Content-Type application/javascript Host pl25023760.profitablecpmrate.com Server nginx/1.21.6
GET H2	200	R.d4c78c018744a53d7b9bf502ef939e40 th.bing.com/th/id/	48 KB 49 KB	174ms 111ms	Image image/png	184.86.251.29 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://th.bing.com/th/id/R.d4c78c018744a53d7b9bf502ef939e40?rik=5vvMhUTq0TgSEg&pid=ImgRaw&r=0 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.86.251.29 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a184-86-251-29.deploy.static.akamaitechnologies.com Software / Resource Hash 632203ce4cf98806f79cb1c65c2ec08c96202a1013856a0a8512a968ba56c90e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers nel {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} timing-allow-origin * cache-control public, max-age=5120482 report-to {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} access-control-allow-methods GET, POST, OPTIONS x-check-cacheable YES access-control-allow-origin * x-cache TCP_MISS from a184-84-216-31.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-) content-length 49235 alt-svc h3=":443"; ma=93600 date Wed, 20 Nov 2024 06:58:48 GMT akamai-grn 0.1fd854b8.1732085928.3ebf2e83 content-type image/png access-control-allow-headers *
GET H3	200	salary-512.png cdn1.iconfinder.com/data/icons/business-charts/512/	14 KB 15 KB	165ms 132ms	Image image/webp	172.66.42.211 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn1.iconfinder.com/data/icons/business-charts/512/salary-512.png Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.66.42.211 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc120ea34f4f109c3f4eb5ab52ebc7d8bcfef70c0933329a254521c5b32acba7 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers x-request-id 8e1f3bff-0e05-4afa-847f-82fc9aea1415 cf-bgj imgq:100,h2pri cf-cache-status HIT report-to {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1728063412&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=ddToGzmTZCTNR5s%2FAb5iHgwQMsgDEXz%2F6QPLPd8vAfQ%3D"}]} x-content-type-options nosniff expires Thu, 20 Nov 2025 06:58:48 GMT cf-polished origFmt=png, origSize=28361 alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12164&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4294&recv_bytes=4481&delivery_rate=757&cwnd=12000&unsent_bytes=0&cid=b05ecdfa7241fc6d&ts=142&x=1", cfExtPri, cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type image/webp content-disposition inline; filename="salary-512.webp" vary Accept last-modified Fri, 04 Oct 2024 17:36:52 GMT priority u=2,i strict-transport-security max-age=15552000; includeSubDomains; preload reporting-endpoints heroku-nel=https://nel.heroku.com/reports?ts=1728063412&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=ddToGzmTZCTNR5s%2FAb5iHgwQMsgDEXz%2F6QPLPd8vAfQ%3D cache-control public, max-age=31536000 nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} via 1.1 vegur cf-ray 8e568dbde9e00ae0-AMS accept-ranges bytes access-control-allow-origin * content-length 14650 server cloudflare
GET H3	200	withdraw-5.png icons.veryicon.com/png/o/business/work-circle/	34 KB 35 KB	358ms 327ms	Image image/png	104.21.11.28 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://icons.veryicon.com/png/o/business/work-circle/withdraw-5.png Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.11.28 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e8674eea84202384d51e09e80a3b73b29825d1db244918bf408c3d9add0e63f6 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers cf-cache-status REVALIDATED etag "8914-5aa2d3a6c9c80" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ibyJSDMEzy8rABmVdqgZRY3IS5bdUlydy4P3fPzbLi7qUyRrhPVXG2SH2U9VrQzjsn%2FLx4lCBWml4RjoIujLbL5GowPiwQ3UcsTycMCDaeiqbNN3bWg7OiF4GsZ7fDLak22Xj0%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12104&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4175&recv_bytes=4479&delivery_rate=760&cwnd=12000&unsent_bytes=0&cid=5c15c1c5da28776c&ts=334&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type image/png last-modified Sat, 11 Jul 2020 16:48:34 GMT vary Accept-Encoding strict-transport-security max-age=15552000; includeSubDomains; preload cache-control max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e568dbdee236562-AMS accept-ranges bytes content-length 35092 server cloudflare
GET H2	200	R.19fa7497013a87bd77f7adb96beaf768 th.bing.com/th/id/	133 KB 134 KB	104ms 42ms	Image image/png	184.86.251.29 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://th.bing.com/th/id/R.19fa7497013a87bd77f7adb96beaf768?rik=144XvMigWWj2bw&riu=http%3a%2f%2fwww.pngall.com%2fwp-content%2fuploads%2f5%2fUser-Profile-PNG-High-Quality-Image.png&ehk=%2bat%2brmqQuJrWL609bAlrUPYgzj%2b%2f7L1ErXRTN6ZyxR0%3d&risl=&pid=ImgRaw&r=0 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.86.251.29 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a184-86-251-29.deploy.static.akamaitechnologies.com Software / Resource Hash 758df81969d1e3a0c86347649db5feca707448eeae1eb040cb8968795391a6ca Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers nel {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} timing-allow-origin * cache-control public, max-age=5097782 report-to {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} access-control-allow-methods GET, POST, OPTIONS x-check-cacheable YES access-control-allow-origin * x-cache TCP_MISS from a184-84-216-31.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-) content-length 136088 alt-svc h3=":443"; ma=93600 date Wed, 20 Nov 2024 06:58:48 GMT akamai-grn 0.1fd854b8.1732085928.3ebf2e84 content-type image/png access-control-allow-headers *
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/	79 KB 22 KB	14ms 12ms	Script application/javascript	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.bot.upwork-uk.com Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers * content-encoding br etag W/"13b51-3cbp6tbRaukjc5nOQejBYgzFnDY" age 4349418 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Wed, 20 Nov 2024 06:58:48 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230062-FRA, cache-ams21029-AMS vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 22790 x-jsd-version 5.3.3
GET H2	200	telegram-web-app.js Show response telegram.org/js/	106 KB 22 KB	66ms 28ms	Script application/javascript	149.154.167.99 Telegram Telegram...
General Check archive.org Show headers Download Go to Full URL https://telegram.org/js/telegram-web-app.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 149.154.167.99 London, United Kingdom, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 3ab59994e7fad6650796e799102a64bcd660dd1b421887c74989729fcea14efc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"6739f222-1a916" expires Sun, 24 Nov 2024 06:58:48 GMT date Wed, 20 Nov 2024 06:58:48 GMT content-type application/javascript last-modified Sun, 17 Nov 2024 13:39:46 GMT server nginx/1.18.0
GET H2	200	8535337 Show response saukateete.com/401/	2 KB 1 KB	51ms 13ms	XHR application/json	139.45.197.242 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://saukateete.com/401/8535337?oo=1&sw_version=v1.447.0 Requested by Host: niphaumeenses.net URL: https://niphaumeenses.net/vignette.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.242 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash 58a4140e643d4760becad89b468ac380b34ffecff7d708ea16f6619ce24468d4 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers Link content-encoding gzip x-content-type-options nosniff expires Tue, 11 Jan 1994 10:00:00 GMT date Wed, 20 Nov 2024 06:58:48 GMT content-type application/json vary Origin strict-transport-security max-age=1 cache-control no-cache, no-store, no-transform, must-revalidate, private, max-age=0 timing-allow-origin *, * pragma no-cache accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true x-trace-id 28c53101e0b76df217ef9c79d97b1fb4 access-control-allow-origin https://www.bot.upwork-uk.com server nginx
GET H3	200	gid.js Show response my.rtmark.net/	65 B 917 B	51ms 25ms	XHR application/json	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my.rtmark.net/gid.js Requested by Host: niphaumeenses.net URL: https://niphaumeenses.net/vignette.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a7bff025d5865dfe313dbaf52129cebb88284464bf795003dd4fc4e56d178976 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers Authorization content-encoding zstd cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aegIgGifT9pi%2FeCT1Hnq9qFfyMfpgeU1Le1T2aQsVQmdArG6n%2BTSo0s0M6q0Do%2BcsxlYifltfsr2Tl%2Fr2FrlgnVd8xHfW6UH%2FjDEIGcSby52pxOIU0CiFlFTEZX9a8h4"}],"group":"cf-nel","max_age":604800} access-control-allow-methods POST, GET, OPTIONS, PUT, DELETE x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12000&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4089&recv_bytes=4289&delivery_rate=240882&cwnd=12000&unsent_bytes=0&cid=96327c9e8fd74535&ts=29&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type application/json; charset=utf-8 access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token strict-transport-security max-age=1 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} timing-allow-origin *, * access-control-allow-credentials true cf-ray 8e568dbe3820b980-AMS access-control-allow-origin https://www.bot.upwork-uk.com server cloudflare
GET H3	200	stattag.js Show response tzegilo.com/	17 KB 9 KB	63ms 30ms	Script application/javascript	172.67.193.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tzegilo.com/stattag.js Requested by Host: niphaumeenses.net URL: https://niphaumeenses.net/vignette.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.193.52 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 75c91d86601e23ab56d872b31b42660f893fc6d6b0785e085c06c2c038e98fb2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"668fb2be-45d7" age 1259 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JucjxWP29Yvcj0th%2BPOmEjGSWi0%2BV1WMlTlIhMAqyI%2BYkvVdscFdWrBnVqMB1cOQCHeI41Dxk7eRZW1iRyNDf01FU7DXD5wK8yf0YNVU97%2BvgtmAeawu1wAYKHaf3A%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12129&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4138&recv_bytes=4323&delivery_rate=48169&cwnd=12000&unsent_bytes=0&cid=24b624b283a4beb4&ts=40&x=1", cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:48 GMT content-type application/javascript last-modified Thu, 11 Jul 2024 10:23:58 GMT vary Accept-Encoding link <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e568dbe9f831c14-AMS server cloudflare
POST H/1.1	200 OK	add Show response fleraprt.com/log/	12 B 491 B	66ms 16ms	XHR application/json	139.45.195.254 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=6a8e3f79-ef63-44d2-8d74-b89de255d9dc Requested by Host: tzegilo.com URL: https://tzegilo.com/stattag.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.195.254 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx/1.19.10 / Resource Hash fe85cceb474303eb80a5ca9a60b16d92208a8e0b38647647654b0c42447b51f7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.bot.upwork-uk.com/ Response headers Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Methods POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin https://www.bot.upwork-uk.com Content-Length 12 Date Wed, 20 Nov 2024 06:58:48 GMT Content-Type application/json; charset=utf-8 Server nginx/1.19.10 Access-Control-Allow-Headers Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
POST H/1.1	200 OK	add Show response fleraprt.com/async_log/	0 431 B	61ms 13ms	XHR text/plain	139.45.195.254 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://fleraprt.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=6a8e3f79-ef63-44d2-8d74-b89de255d9dc Requested by Host: tzegilo.com URL: https://tzegilo.com/stattag.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.195.254 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx/1.19.10 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.bot.upwork-uk.com/ Response headers Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Methods POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin https://www.bot.upwork-uk.com Content-Length 0 Date Wed, 20 Nov 2024 06:58:48 GMT Server nginx/1.19.10 Access-Control-Allow-Headers Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
GET H2	200	8535337 Show response saukateete.com/500/	9 KB 4 KB	63ms 62ms	XHR application/javascript	139.45.197.242 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://saukateete.com/500/8535337?excludes=&oaid=08011aa214084449f28489f89c1d2d97&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=1570&wy=1170&ww=1600&wh=1285&cw=1600&wiw=1600&wih=1200&wfc=0&pl=https%3A%2F%2Fwww.bot.upwork-uk.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&tzofs=60&btz=Europe%2FAmsterdam&bto=-60&jsp=1&is_mobile=false&js_build=8&sw_version=v1.447.0 Requested by Host: niphaumeenses.net URL: https://niphaumeenses.net/vignette.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.242 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash 9fb00f218ed7f5e52a2cb76cb6b21e8edfffe1fc3f39831d641af9ed57d64e02 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type application/json Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers Link content-encoding gzip x-content-type-options nosniff expires Tue, 11 Jan 1994 10:00:00 GMT date Wed, 20 Nov 2024 06:58:49 GMT content-type application/javascript vary Origin strict-transport-security max-age=1 cache-control no-cache, no-store, no-transform, must-revalidate, private, max-age=0 timing-allow-origin *, * pragma no-cache accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true x-trace-id ebc4bcda25cd4219e85e95fbbdec91fd access-control-allow-origin https://www.bot.upwork-uk.com server nginx
GET H/1.1	403 Forbidden	invoke.js www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/	0 0	100ms 100ms	Script application/javascript	192.243.61.225 ADVANCEDHOSTERS-A...
General Check archive.org Show headers Download Go to Full URL https://www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/invoke.js Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Connection keep-alive Access-Control-Allow-Origin * Content-Length 0 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Date Wed, 20 Nov 2024 06:58:48 GMT Content-Type application/javascript Host www.highperformanceformat.com Server nginx/1.21.6
OPTIONS H2	200	8535337 saukateete.com/500/	0 0	36ms 12ms	Preflight	139.45.197.242 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://saukateete.com/500/8535337?excludes=&oaid=08011aa214084449f28489f89c1d2d97&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=1570&wy=1170&ww=1600&wh=1285&cw=1600&wiw=1600&wih=1200&wfc=0&pl=https%3A%2F%2Fwww.bot.upwork-uk.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&tzofs=60&btz=Europe%2FAmsterdam&bto=-60&jsp=1&is_mobile=false&js_build=8&sw_version=v1.447.0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.242 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.bot.upwork-uk.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.bot.upwork-uk.com access-control-max-age 600 allow GET, OPTIONS content-length 0 date Wed, 20 Nov 2024 06:58:48 GMT server nginx strict-transport-security max-age=1 timing-allow-origin * vary Origin Access-Control-Request-Method Access-Control-Request-Headers x-content-type-options nosniff
GET H2	200	0377052970676.png byzoruator.com/contents/s/fa/09/c3/d0d05f7d01ec388b4373228077/	2 KB 3 KB	45ms 12ms	Image image/png	139.45.197.168 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Show image Full URL https://byzoruator.com/contents/s/fa/09/c3/d0d05f7d01ec388b4373228077/0377052970676.png Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 139.45.197.168 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash dfc621aca09ed0c1488b5131d842363a53b81589c81e60fd0de8d639f927acc6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range access-control-expose-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range etag "606f118e-932" access-control-allow-methods GET, POST, OPTIONS, HEAD accept-ranges bytes access-control-allow-origin * content-length 2354 date Wed, 20 Nov 2024 06:58:49 GMT content-type image/png last-modified Thu, 08 Apr 2021 14:22:06 GMT server nginx vary Accept-Encoding
GET H2	200	8495407 Show response pausoawhais.com/400/	83 KB 35 KB	62ms 24ms	Script application/javascript	139.45.197.244 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://pausoawhais.com/400/8495407 Requested by Host: www.bot.upwork-uk.com URL: https://www.bot.upwork-uk.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.244 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash 84cb10908f30d7c5599694cafbedc82f1223f0d77b7c509eb7633d48a4d57749 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers Link content-encoding gzip x-content-type-options nosniff expires Tue, 11 Jan 1994 10:00:00 GMT date Wed, 20 Nov 2024 06:58:49 GMT content-type application/javascript vary Origin strict-transport-security max-age=1 cache-control no-cache, no-store, no-transform, must-revalidate, private, max-age=0 timing-allow-origin *, * pragma no-cache accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true x-trace-id 9a7d8bd8294cf97d8539331d305f914b access-control-allow-origin * server nginx
GET H2	200	favicon.ico www.bot.upwork-uk.com/	0 131 B	17ms 16ms	Other image/x-icon	188.239.191.17 SERVER-FACTORY-CO...
General Check archive.org Show headers Download Go to Full URL https://www.bot.upwork-uk.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 188.239.191.17 Eygelshoven, Netherlands, ASN206075 (SERVER-FACTORY-COM Maximilian Jacobsen, DE), Reverse DNS srv2.live-dns.com Software LiteSpeed / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers cache-control public, max-age=604800 expires Wed, 27 Nov 2024 06:58:49 GMT accept-ranges bytes content-length 0 date Wed, 20 Nov 2024 06:58:49 GMT content-type image/x-icon last-modified Mon, 21 Oct 2024 00:59:42 GMT server LiteSpeed
GET H2	200	8495407 Show response pausoawhais.com/500/	990 B 2 KB	110ms 110ms	XHR application/javascript	139.45.197.244 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://pausoawhais.com/500/8495407?excludes=&oaid=08011aa214084449f28489f89c1d2d97&tgp=unknown&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=1570&wy=1170&ww=1600&wh=1285&cw=1600&wiw=1600&wih=1200&wfc=0&pl=https%3A%2F%2Fwww.bot.upwork-uk.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&tzofs=60&btz=Europe%2FAmsterdam&bto=-60&jsp=1&is_mobile=false&js_build=8&sw_version=v1.447.0 Requested by Host: pausoawhais.com URL: https://pausoawhais.com/400/8495407 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.244 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash e6ce2510f7a26840760259884241be1d6ace3466489a4e03ce46992c945ded4c Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type application/json Referer https://www.bot.upwork-uk.com/ Response headers access-control-expose-headers Link x-content-type-options nosniff expires Tue, 11 Jan 1994 10:00:00 GMT date Wed, 20 Nov 2024 06:58:49 GMT content-type application/javascript vary Origin strict-transport-security max-age=1 cache-control no-cache, no-store, no-transform, must-revalidate, private, max-age=0 timing-allow-origin *, * pragma no-cache accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true x-trace-id 9fdf3a79cc89df5b6244efe4a4026730 access-control-allow-origin https://www.bot.upwork-uk.com content-length 990 server nginx
OPTIONS H2	200	8495407 pausoawhais.com/500/	0 0	36ms 12ms	Preflight	139.45.197.244 RETN-AS RETN Limited
General Check archive.org Show headers Download Go to Full URL https://pausoawhais.com/500/8495407?excludes=&oaid=08011aa214084449f28489f89c1d2d97&tgp=unknown&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=1570&wy=1170&ww=1600&wh=1285&cw=1600&wiw=1600&wih=1200&wfc=0&pl=https%3A%2F%2Fwww.bot.upwork-uk.com%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&tzofs=60&btz=Europe%2FAmsterdam&bto=-60&jsp=1&is_mobile=false&js_build=8&sw_version=v1.447.0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 139.45.197.244 , United Kingdom, ASN9002 (RETN-AS RETN Limited, GB), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.bot.upwork-uk.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.bot.upwork-uk.com access-control-max-age 600 allow GET, OPTIONS content-length 0 date Wed, 20 Nov 2024 06:58:49 GMT server nginx strict-transport-security max-age=1 timing-allow-origin * vary Origin Access-Control-Request-Method Access-Control-Request-Headers x-content-type-options nosniff
GET H3	200	b66dd8e52ce4d5aa18d212f1e5e9627b.jpg onmanectrictor.com/www/images/	28 KB 29 KB	134ms 32ms	Image image/jpeg	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://onmanectrictor.com/www/images/b66dd8e52ce4d5aa18d212f1e5e9627b.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9b10fcb43ba56961ad4d59d4f8afcf642bf738349880e6d3aa12716ce4cb69b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.bot.upwork-uk.com/ Response headers access-control-max-age 86400 cf-cache-status HIT etag "673b427f-7067" age 61248 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4QeeKxCjnEYxk9dClUI5Oliec9kTXySFbhP77oxX31a7i1ibwAF5bYfFUq31PjheDgspDMDeoiGrFUEGlFyGBmFAz2Pv%2B%2BcRw7CeDbS2%2BtHPdhOTZfoQM%2BQn7crTlikBsZXxWA%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, POST, OPTIONS expires Wed, 20 Nov 2024 13:58:01 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12081&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4168&recv_bytes=4488&delivery_rate=48325&cwnd=12000&unsent_bytes=0&cid=33a5ace51f6b3b5a&ts=111&x=1", cfExtPri, cfHdrFlush;dur=0 date Wed, 20 Nov 2024 06:58:49 GMT content-type image/jpeg last-modified Mon, 18 Nov 2024 13:34:55 GMT vary Accept-Encoding priority u=1,i access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type cache-control max-age=86400 timing-allow-origin * nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials true cf-ray 8e568dc409b16654-AMS accept-ranges bytes content-length 28775 server cloudflare

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| zfgstorage object| m0krrshmzy9 object| zfgformats object| webpushlogs function| show_8535337 object| SAD object| Adsgram object| atOptions object| syncCallbacks boolean| __lwkemfd9q__ number| uidEvent object| bootstrap function| showSection object| Telegram function| TelegramGameProxy_receiveEvent object| TelegramGameProxy string| csrfToken

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.bot.upwork-uk.com/	1970-01-21 01:08:13	Name: XSRF-TOKEN Value: eyJpdiI6Imo3ZXNCL0FlT0FXeGthQll4QjF1cHc9PSIsInZhbHVlIjoiYzJIVjJHK285ZjNCc1RGNlpUMVh2Mnh3ZzdYWXFUcm1SNlhsRlIzOTFNK0NzbUhndytmVGNLMWpxREtZeko3K0VVV1hlNlo4U2xZczBjNTlXaWRvQzRCc3dRcFNwWnZTZS9rQmUrc3FQWnFuSHh2em9ha3g4LzBIc2VXK3FBd3IiLCJtYWMiOiI5Y2Y3NTczZjRmN2E5Y2IzODZkNzc1ZjcyZTM3ZjZkYTgyNjkyZDE3MzVkNTEzOGY4MTk3ODQ1MjY0OGMxODBmIiwidGFnIjoiIn0%3D
			www.bot.upwork-uk.com/	1970-01-21 01:08:13	Name: laravel_session Value: eyJpdiI6IjRGT2o0Vkk2Y0p2dXVIYmdHU3MzNWc9PSIsInZhbHVlIjoiT0dZSTFsVHZCeGNDbDM1ZnNkZHRTRDloZVhHWEhXK2MxckIrV0dJeVlXTmowdnZmVVN5UXY2UVZiRWRIUk5ueWFUVlJ4bEMyWUtob0FvcXhJSWNGTXB3NGVNa2tpd0dxaHY0SUU1U3Azbng4Uno1MU9LbWowaWFadzBHaFhWM2UiLCJtYWMiOiIzZjVkMjE4N2ZlNjhlZDdhYzliNTg4ZjEzN2E3MzllZGY5Y2JkZjExMzQ1ZTQ0M2FiZjgxNmZkZTE1MDk3ZGI5IiwidGFnIjoiIn0%3D
			my.rtmark.net/	1970-01-21 09:53:41	Name: ID Value: 08011aa214084449f28489f89c1d2d97
			saukateete.com/	1970-01-21 09:53:41	Name: OAID Value: 08011aa214084449f28489f89c1d2d97
			pausoawhais.com/	1970-01-21 09:53:41	Name: OAID Value: 08011aa214084449f28489f89c1d2d97

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.bot.upwork-uk.com/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A080FC0D04300000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://www.highperformanceformat.com/8eaa6550b43b230a38b86c0c1b80c422/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://pl25023760.profitablecpmrate.com/0a/96/ec/0a96ec1c82ca19856b65dc758e9bb94b.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://www.highperformanceformat.com/7ff8c6f50deaedcacb3ca44e364e1203/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

byzoruator.com
cdn.jsdelivr.net
cdn1.iconfinder.com
fleraprt.com
icons.veryicon.com
my.rtmark.net
niphaumeenses.net
onmanectrictor.com
pausoawhais.com
pl25023760.profitablecpmrate.com
placehold.co
sad.adsgram.ai
saukateete.com
telegram.org
th.bing.com
tzegilo.com
www.bot.upwork-uk.com
www.highperformanceformat.com
104.21.11.28
139.45.195.254
139.45.197.168
139.45.197.242
139.45.197.243
139.45.197.244
149.154.167.99
151.101.65.229
172.240.108.76
172.66.42.211
172.67.193.52
18.66.122.72
184.86.251.29
188.114.97.3
188.239.191.17
192.243.61.225
061f0b1ea79e6e2ca24f4603e55d3e909f7471ba0b279cdb6dea40554106c6a2
0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c
12738d617e8014bcb43d7534b4c1c44562b65e9c61c89c98d2f54a69c1f2a8cf
2ef559c04dd1f590a3ada71be39bab8869a4b69ee650afcdbec3758be61def46
3ab59994e7fad6650796e799102a64bcd660dd1b421887c74989729fcea14efc
3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8
42220e43109e88ef5df2a274dc0f83b8d3762c23f557cc759e36fcdead314ce4
4319117c6e426ca0c7094e22528987c355ee2235c5702dbbfa0a643c6e9e5a20
58a4140e643d4760becad89b468ac380b34ffecff7d708ea16f6619ce24468d4
627aa0365179c9c292b1259c36f5c6707cce1722f296c986f2aaca0b78204838
632203ce4cf98806f79cb1c65c2ec08c96202a1013856a0a8512a968ba56c90e
758df81969d1e3a0c86347649db5feca707448eeae1eb040cb8968795391a6ca
75c91d86601e23ab56d872b31b42660f893fc6d6b0785e085c06c2c038e98fb2
84cb10908f30d7c5599694cafbedc82f1223f0d77b7c509eb7633d48a4d57749
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
9fb00f218ed7f5e52a2cb76cb6b21e8edfffe1fc3f39831d641af9ed57d64e02
a7bff025d5865dfe313dbaf52129cebb88284464bf795003dd4fc4e56d178976
a9b10fcb43ba56961ad4d59d4f8afcf642bf738349880e6d3aa12716ce4cb69b
af4bb8621054264ac72e09517b1eb6758b198cf9dd51c707d8c12674b7e54c13
dc120ea34f4f109c3f4eb5ab52ebc7d8bcfef70c0933329a254521c5b32acba7
dfc621aca09ed0c1488b5131d842363a53b81589c81e60fd0de8d639f927acc6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6ce2510f7a26840760259884241be1d6ace3466489a4e03ce46992c945ded4c
e8674eea84202384d51e09e80a3b73b29825d1db244918bf408c3d9add0e63f6
fe85cceb474303eb80a5ca9a60b16d92208a8e0b38647647654b0c42447b51f7