urlscan.io logo urlscan.io
SecurityTrails logo

ftp.heaton.live Open in urlscan Pro
185.117.88.130  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ftp.heaton.live/
Effective URL: https://ftp.heaton.live/index.php?lang=en-us
Submission: On June 25 via api from US — Scanned from SE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 5 countries across 6 domains to perform 26 HTTP transactions. The main IP is 185.117.88.130, located in Stockholm, Sweden and belongs to HZ-EU-AS, BG. The main domain is ftp.heaton.live.
TLS certificate: Issued by R3 on June 3rd 2024. Valid for: 3 months.
This is the only time ftp.heaton.live was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 12 185.117.88.130 59711 (HZ-EU-AS)
1 2a00:1450:400... 15169 (GOOGLE)
6 188.42.198.252 7979 (SERVERS-COM)
2 2a00:1450:400... 15169 (GOOGLE)
1 108.138.26.24 16509 (AMAZON-02)
2 185.106.81.236 7979 (SERVERS-COM)
2 18.66.112.85 16509 (AMAZON-02)
1 142.250.185.99 15169 (GOOGLE)
26 9
12    185.117.88.130 (Stockholm, Sweden)

ASN59711 (HZ-EU-AS, BG)
PTR: shared8.yourbestnetwork.net
ftp.heaton.live
1    2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
6    188.42.198.252 (Luxembourg)

ASN7979 (SERVERS-COM, US)
www.travelpayouts.com
aswidgets.travelpayouts.com
suggest.travelpayouts.com
2    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    108.138.26.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-24.fra56.r.cloudfront.net
st.avsplow.com
2    185.106.81.236 (Netherlands)

ASN7979 (SERVERS-COM, US)
avsplow.com
2    18.66.112.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-85.fra56.r.cloudfront.net
pics.avs.io
1    142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
12 heaton.live
ftp.heaton.live
391 KB
6 travelpayouts.com
www.travelpayouts.com — Cisco Umbrella Rank: 183331
aswidgets.travelpayouts.com
suggest.travelpayouts.com — Cisco Umbrella Rank: 423995
31 KB
3 avsplow.com
st.avsplow.com — Cisco Umbrella Rank: 838908
avsplow.com — Cisco Umbrella Rank: 277891
15 KB
3 gstatic.com
fonts.gstatic.com
39 KB
2 avs.io
pics.avs.io — Cisco Umbrella Rank: 890474
11 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
2 KB
26 6
Domain Requested by
12 ftp.heaton.live 1 redirects ftp.heaton.live
4 www.travelpayouts.com ftp.heaton.live
aswidgets.travelpayouts.com
www.travelpayouts.com
3 fonts.gstatic.com fonts.googleapis.com
www.travelpayouts.com
2 pics.avs.io
2 avsplow.com st.avsplow.com
1 suggest.travelpayouts.com aswidgets.travelpayouts.com
1 st.avsplow.com aswidgets.travelpayouts.com
1 aswidgets.travelpayouts.com www.travelpayouts.com
1 fonts.googleapis.com ftp.heaton.live
26 9

This site contains links to these domains. Also see Links.

Domain
www.travelpayouts.com
Subject Issuer Validity Valid
caribemedica.com
R3		 2024-06-03 -
2024-09-01		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
travelpayouts.com
R11		 2024-06-22 -
2024-09-20		 3 months crt.sh
*.gstatic.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
avsplow.com
Amazon RSA 2048 M03		 2024-06-02 -
2025-07-01		 a year crt.sh
avs.io
Amazon RSA 2048 M03		 2024-03-10 -
2025-04-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ftp.heaton.live/index.php?lang=en-us
Frame ID: 851955E6BA5C50F979B056383866C6A0
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Home

Page URL History Show full URLs

  1. https://ftp.heaton.live/ HTTP 301
    https://ftp.heaton.live/index.php?lang=en-us Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

26
Requests

58 %
HTTPS

25 %
IPv6

6
Domains

9
Subdomains

9
IPs

5
Countries

488 kB
Transfer

591 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ftp.heaton.live/ HTTP 301
    https://ftp.heaton.live/index.php?lang=en-us Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.php
ftp.heaton.live/
Redirect Chain
  • https://ftp.heaton.live/
  • https://ftp.heaton.live/index.php?lang=en-us
10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
d37a3fb26eba74d1c8064798a54c668b0a01024d779ccea9e5f306cb5864abf9

Request headers

Accept-Language
se-SE,se;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/html; charset=utf-8
date
Tue, 25 Jun 2024 11:37:20 GMT
expires
Wed, 17 Aug 2005 00:00:00 GMT
last-modified
Tue, 25 Jun 2024 11:37:20 GMT
pragma
no-cache
server
Apache

Redirect headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
content-type
text/html; charset=utf-8
date
Tue, 25 Jun 2024 11:37:20 GMT
expires
Wed, 17 Aug 2005 00:00:00 GMT
last-modified
Tue, 25 Jun 2024 11:37:20 GMT
location
https://ftp.heaton.live/index.php?lang=en-us
pragma
no-cache
server
Apache
template.css
ftp.heaton.live/templates/protostar/css/ 		160 KB
160 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/templates/protostar/css/template.css?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
26dbcc3db0ada7cb526eb6ad0f173e7d6af22e4b725a90e83cb7e09e0a8faadf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
163929
content-type
text/css
css
fonts.googleapis.com/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Tue, 25 Jun 2024 11:37:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 25 Jun 2024 09:46:25 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 25 Jun 2024 11:37:20 GMT
template.css
ftp.heaton.live/media/mod_languages/css/ 		335 B
400 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/mod_languages/css/template.css?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
df56a3f52cb690e7a1efd23ca7b4c01c5fc95c8b7823f75f995fedd3c8b86f0e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
335
content-type
text/css
jquery.min.js
ftp.heaton.live/media/jui/js/ 		94 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/jui/js/jquery.min.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
46438fa269f3c172286b81be52a5de84753d68dcc6580f6a98b7942cf129bdc1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
96606
content-type
application/javascript
jquery-noconflict.js
ftp.heaton.live/media/jui/js/ 		21 B
67 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/jui/js/jquery-noconflict.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
5b6cf4e6eda02f7c90b60b3c32413c0851915f8f80a268a913b92929085132a6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
21
content-type
application/javascript
jquery-migrate.min.js
ftp.heaton.live/media/jui/js/ 		10 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/jui/js/jquery-migrate.min.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
10056
content-type
application/javascript
caption.js
ftp.heaton.live/media/system/js/ 		491 B
521 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/system/js/caption.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
20f7c83ab9dfdc1e88f4c3fafc0712492200ab738fb30660526bad9dcb7282dc

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
491
content-type
application/javascript
bootstrap.min.js
ftp.heaton.live/media/jui/js/ 		28 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/media/jui/js/bootstrap.min.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
b240d68de7c3795c87771f510527c201d7d67f0e065d973b16bf86855932f9a2

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
29126
content-type
application/javascript
template.js
ftp.heaton.live/templates/protostar/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/templates/protostar/js/template.js?730f9c95f0afb76ae13c32bf400f34ad
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
a180f44bb70df80972bc65b1132581a48a92483cb63e2ffa4ec6c13f52da8b0a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
2020
content-type
application/javascript
caribemed_logo.jpg
ftp.heaton.live/images/headers/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ftp.heaton.live/images/headers/caribemed_logo.jpg
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
8d03ec206f2ea261094a261fc8869c7159b6a801dc057e81ca495b0b690eb25b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
last-modified
Wed, 01 Jul 2020 09:25:58 GMT
server
Apache
accept-ranges
bytes
content-length
84038
content-type
image/jpeg
scripts_en_us.js
www.travelpayouts.com/ducklett/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Requested by
Host: ftp.heaton.live
URL: https://ftp.heaton.live/index.php?lang=en-us
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
61dfcda8f8e277dd9e34e80601b75c871730865c36e75203bf2f6ebe590a1761

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:20 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=0
timing-allow-origin
*
x-promo-id
4019
content-length
981
x-robots-tag
noindex
x-request-id
c3e2757bef783b55d00c4a95201257ca
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://ftp.heaton.live
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 18 Jun 2024 14:48:09 GMT
x-content-type-options
nosniff
age
593352
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18668
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:00:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 18 Jun 2025 14:48:09 GMT
scripts_en_us.js
aswidgets.travelpayouts.com/ducklett/ 		67 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aswidgets.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Requested by
Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
73ed9ba7aad14a65d9a2889d9c0ad34708b7346c17d1fb6cfe0a141cec7f6a82

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
content-encoding
gzip
last-modified
Thu, 04 Nov 2021 11:39:20 GMT
server
nginx
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600
x-request-id
c8ac748f25601834d7f12dee7ec49641
sp.js
st.avsplow.com/19.18.9/ 		42 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.avsplow.com/19.18.9/sp.js
Requested by
Host: aswidgets.travelpayouts.com
URL: https://aswidgets.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-26-24.fra56.r.cloudfront.net
Software
/
Resource Hash
953af01affd97621869fdb141a98da9fd0e2a1417ae0e3f27c0c3cd49032f5af

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 06 May 2024 03:26:05 GMT
content-encoding
gzip
via
1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
last-modified
Wed, 20 Dec 2023 07:57:47 GMT
x-amz-cf-pop
FRA56-P7
age
4349476
etag
W/"fb6c75c607bf3120c5b82845fbd28e71"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
cache-control
public,max-age=31536000
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
lUQbvHL_GvpuHyBtto1vak5OIj5Sl9odUwlovxJyG29jxe6hh8WpQA==
styles.css
www.travelpayouts.com/ducklett/ 		27 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.travelpayouts.com/ducklett/styles.css
Requested by
Host: aswidgets.travelpayouts.com
URL: https://aswidgets.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
894f5817294ecbf5e0f840b0236b08ac97741ce1a2790ce0d251957e5ad4c3b9

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
content-encoding
gzip
last-modified
Thu, 04 Nov 2021 11:39:20 GMT
server
nginx
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=600
x-request-id
5618b05394fc322364754dc4d4562c11
ducklett_special_offers
suggest.travelpayouts.com/aviasales/v3/ 		2 KB
773 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://suggest.travelpayouts.com/aviasales/v3/ducklett_special_offers?origin=&destination=&airline=&locale=en_us&currency=usd&limit=2
Requested by
Host: aswidgets.travelpayouts.com
URL: https://aswidgets.travelpayouts.com/ducklett/scripts_en_us.js?v=1&marker=177858&widget_type=brickwork&host=search.jetradar.com&locale=en_us&currency=usd&limit=2&powered_by=false&width=800
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
364f77502ae258a270015a1d673062b53d1dbef199b4114b341dd0265b1c42b7

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-robots-tag
noindex
content-length
585
x-request-id
eb7962c79dfb903f8be81dd45d03ebfd
MTP_ySUJH_bn48VBG8sNShampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/opensans/v13/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNShampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/ducklett/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
417e156e282af4b7d146d16b8fc9505255de2d8d085d40e37afe5089b8fe9b77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.travelpayouts.com/
Origin
https://ftp.heaton.live
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 05:11:54 GMT
x-content-type-options
nosniff
age
23127
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10328
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:45:49 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Jun 2025 05:11:54 GMT
j
avsplow.com/a/ 		2 B
338 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://avsplow.com/a/j
Requested by
Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://ftp.heaton.live
date
Tue, 25 Jun 2024 11:37:21 GMT
access-control-allow-credentials
true
content-type
text/plain; charset=UTF-8
server
nginx
content-length
2
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
j
avsplow.com/a/ 		2 B
337 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://avsplow.com/a/j
Requested by
Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://ftp.heaton.live
date
Tue, 25 Jun 2024 11:37:21 GMT
access-control-allow-credentials
true
content-type
text/plain; charset=UTF-8
server
nginx
content-length
2
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
favicon.ico
ftp.heaton.live/templates/protostar/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ftp.heaton.live/templates/protostar/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.117.88.130 Stockholm, Sweden, ASN59711 (HZ-EU-AS, BG),
Reverse DNS
shared8.yourbestnetwork.net
Software
Apache /
Resource Hash
7bd9b59d14b126e8c5abcb1c89b60c79e2b2e17c15745fe8d385204d87c40765

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/index.php?lang=en-us
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
last-modified
Mon, 27 Jan 2020 18:47:10 GMT
server
Apache
accept-ranges
bytes
content-length
2019
content-type
image/x-icon
D8@2x.png
pics.avs.io/122/56/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pics.avs.io/122/56/D8@2x.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-85.fra56.r.cloudfront.net
Software
/
Resource Hash
8dcedc1616e2df4feec9a49f8f6ffda4146a56b821a0a118ebe80481fb8f3537
Security Headers
Name Value
Content-Security-Policy script-src 'none'

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 06 Jan 2024 20:07:55 GMT
content-security-policy
script-src 'none'
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
14743766
etag
"1QE1_Q6gxSyZn9rJymycUVHcEEJQ1q0iFQmub1OHAko/RImI4MDNjM2Y4OGIxYmEzNjgzZDdkNTMwNWE5MGUyNjIxIg"
vary
Accept
x-cache
Hit from cloudfront
content-type
image/avif
cache-control
public,s-maxage=31536000,max-age=900
content-disposition
inline; filename="D8.avif"
alt-svc
h3=":443"; ma=86400
content-length
4429
x-amz-cf-id
CpsUy_vKjRWomqUFAVYJK6nuDknk88d81GPqCPe3DyJwmSaHoEu6jw==
x-request-id
j24a7fH-ITF2B3PVYZTD8
currency-regular-webfont.woff2
www.travelpayouts.com/currency_fonts/ 		4 KB
4 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.travelpayouts.com/currency_fonts/currency-regular-webfont.woff2
Requested by
Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/ducklett/styles.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
4ba3cac275ae4d06824607aa55da87e077a60cc9608aa0d6d8b6004922573d2e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.travelpayouts.com/ducklett/styles.css
Origin
https://ftp.heaton.live
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
last-modified
Tue, 14 May 2024 12:08:58 GMT
server
nginx
etag
"6643545a-e08"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3592
x-request-id
fe6a644dcb578ebc998cab9b257be7ae
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		430 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb3a07d6089689f493d73c7c854ec1f0c636929bae185da47db328972c819c2a

Request headers

Accept-Language
se-SE,se;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
W6@2x.png
pics.avs.io/122/56/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pics.avs.io/122/56/W6@2x.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-85.fra56.r.cloudfront.net
Software
/
Resource Hash
ada2e645b028185dff4c5b90b3d7290649dc3b4907051fd2548ac772d8de9510
Security Headers
Name Value
Content-Security-Policy script-src 'none'

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 18 Sep 2023 17:10:27 GMT
content-security-policy
script-src 'none'
via
1.1 eb6e5773d654b9aeadbed8169564506c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
age
24258414
etag
"1QE1_Q6gxSyZn9rJymycUVHcEEJQ1q0iFQmub1OHAko/RIjVjOTJkMDZmMTExODU4MzE0ZDYzN2YzMDA3NzRkOTFmIg"
vary
Accept
x-cache
Hit from cloudfront
content-type
image/avif
cache-control
public,s-maxage=31536000,max-age=900
content-disposition
inline; filename="W6.avif"
alt-svc
h3=":443"; ma=86400
content-length
5876
x-amz-cf-id
KWYvWz---49beE7mi5m3eKqI5N5omnvnwhMlc8VVUjwZueP7thzMjw==
x-request-id
ZBjIQtCTYRdvEUsCQnWYu
cJZKeOuBrn4kERxqtaUH3ZBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/opensans/v13/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3ZBw1xU1rKptJj_0jans920.woff2
Requested by
Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/ducklett/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
732d5765c33eff81c7825dcc5e8cd1eda32dc04f39da7cae66accf9580b1e3a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.travelpayouts.com/
Origin
https://ftp.heaton.live
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 22 Jun 2024 09:04:54 GMT
x-content-type-options
nosniff
age
268347
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10352
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:45:29 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 22 Jun 2025 09:04:54 GMT
tp.png
www.travelpayouts.com/powered_by/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.travelpayouts.com/powered_by/img/tp.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.42.198.252 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
2485b6352182e9b84c6010dedea330b64058983d22008327a64fd7d9b10df905

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ftp.heaton.live/
Accept-Language
se-SE,se;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 11:37:21 GMT
last-modified
Mon, 13 Nov 2023 11:56:56 GMT
server
nginx
content-type
image/png
cache-control
no-store, no-cache
accept-ranges
bytes
x-robots-tag
noindex
content-length
3584
x-request-id
032e0c38ed83db624063791c9417b6fa

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage undefined| $ function| jQuery function| JCaption object| jQuery112406870208477952287 string| prefix string| path string| addy55d0e04ef28d31ed6d1bfc7af3cb8b2b string| addy_text55d0e04ef28d31ed6d1bfc7af3cb8b2b object| ducklett string| target_src_string function| ResizeSensor object| GSN function| mamka object| TP_POWERED_BY_DATA object| DucklettGlobals

2 Cookies

Domain/Path Name / Value
ftp.heaton.live/ Name: 1cf6cc4ebd18fa85f15a58f5fab17ad3
Value: 58515947c5bdb16f7e5a6e16822c1fbd
.avsplow.com/ Name: nuid
Value: 4107cfbf-73d6-47f8-a7e0-8386bbdfe7e5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aswidgets.travelpayouts.com
avsplow.com
fonts.googleapis.com
fonts.gstatic.com
ftp.heaton.live
pics.avs.io
st.avsplow.com
suggest.travelpayouts.com
www.travelpayouts.com
108.138.26.24
142.250.185.99
18.66.112.85
185.106.81.236
185.117.88.130
188.42.198.252
2a00:1450:4001:806::2003
2a00:1450:4001:80e::200a
20f7c83ab9dfdc1e88f4c3fafc0712492200ab738fb30660526bad9dcb7282dc
2485b6352182e9b84c6010dedea330b64058983d22008327a64fd7d9b10df905
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
26dbcc3db0ada7cb526eb6ad0f173e7d6af22e4b725a90e83cb7e09e0a8faadf
364f77502ae258a270015a1d673062b53d1dbef199b4114b341dd0265b1c42b7
417e156e282af4b7d146d16b8fc9505255de2d8d085d40e37afe5089b8fe9b77
46438fa269f3c172286b81be52a5de84753d68dcc6580f6a98b7942cf129bdc1
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4ba3cac275ae4d06824607aa55da87e077a60cc9608aa0d6d8b6004922573d2e
5b6cf4e6eda02f7c90b60b3c32413c0851915f8f80a268a913b92929085132a6
61dfcda8f8e277dd9e34e80601b75c871730865c36e75203bf2f6ebe590a1761
732d5765c33eff81c7825dcc5e8cd1eda32dc04f39da7cae66accf9580b1e3a7
73ed9ba7aad14a65d9a2889d9c0ad34708b7346c17d1fb6cfe0a141cec7f6a82
7bd9b59d14b126e8c5abcb1c89b60c79e2b2e17c15745fe8d385204d87c40765
894f5817294ecbf5e0f840b0236b08ac97741ce1a2790ce0d251957e5ad4c3b9
8d03ec206f2ea261094a261fc8869c7159b6a801dc057e81ca495b0b690eb25b
8dcedc1616e2df4feec9a49f8f6ffda4146a56b821a0a118ebe80481fb8f3537
953af01affd97621869fdb141a98da9fd0e2a1417ae0e3f27c0c3cd49032f5af
a180f44bb70df80972bc65b1132581a48a92483cb63e2ffa4ec6c13f52da8b0a
ada2e645b028185dff4c5b90b3d7290649dc3b4907051fd2548ac772d8de9510
b240d68de7c3795c87771f510527c201d7d67f0e065d973b16bf86855932f9a2
bb3a07d6089689f493d73c7c854ec1f0c636929bae185da47db328972c819c2a
c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4
d37a3fb26eba74d1c8064798a54c668b0a01024d779ccea9e5f306cb5864abf9
df56a3f52cb690e7a1efd23ca7b4c01c5fc95c8b7823f75f995fedd3c8b86f0e
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6