shopdictionary1.xyz Open in urlscan Pro
173.214.240.15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cpasbien.me/
Effective URL:
https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Submission Tags: falconsandbox
Submission: On May 18 via api (May 18th 2021, 4:14:58 pm UTC) from US

Summary HTTP 65 Redirects Behaviour Indicators

Summary

This website contacted 14 IPs in 2 countries across 24 domains to perform 65 HTTP transactions. The main IP is 173.214.240.15, located in United States and belongs to SERVEREL-AS, US. The main domain is shopdictionary1.xyz.
TLS certificate: Issued by R3 on April 13th 2021. Valid for: 3 months.

This is the only time shopdictionary1.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.255.119.60 162.255.119.60	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	2a00:1450:400... 2a00:1450:4001:831::2013	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2009	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
3	184.30.16.149 184.30.16.149	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	23.79.149.111 23.79.149.111	16625 (AKAMAI-AS) (AKAMAI-AS)
10	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1 1	2606:4700:21:... 2606:4700:21::681b:ce5c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.204.217.156 34.204.217.156	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.72.29.7 52.72.29.7	14618 (AMAZON-AES) (AMAZON-AES)
16 21	173.214.240.15 173.214.240.15	15317 (SERVEREL-AS) (SERVEREL-AS)
2	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
17 17	199.182.164.180 199.182.164.180	15317 (SERVEREL-AS) (SERVEREL-AS)
11 33	104.19.134.80 104.19.134.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 4	108.168.193.183 108.168.193.183	36351 (SOFTLAYER) (SOFTLAYER)
6	2600:1f18:40f... 2600:1f18:40f7:9700:3671:48a5:dea9:ae90	14618 (AMAZON-AES) (AMAZON-AES)
3 9	2606:4700:303... 2606:4700:3036::ac43:d89f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	173.192.101.24 173.192.101.24	36351 (SOFTLAYER) (SOFTLAYER)
65	14

1 162.255.119.60 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

cpasbien.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.cpasbien.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.30.16.149 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-16-149.deploy.static.akamaitechnologies.com

eep.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.149.111 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-149-111.deploy.static.akamaitechnologies.com

mc.us20.list-manage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:21::681b:ce5c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.204.217.156 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-217-156.compute-1.amazonaws.com

ps.popcash.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.72.29.7 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-29-7.compute-1.amazonaws.com

fergas-fri.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 173.214.240.15 (United States) 16 redirects

ASN15317 (SERVEREL-AS, US)
PTR: 173.214.240.15.serverel.net

feed.rexadvert.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dualsale1.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
towerfriend1.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ibwood1.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
screenauto.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
shopdictionary1.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 199.182.164.180 (United States) 17 redirects

ASN15317 (SERVEREL-AS, US)

xml.pushking.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xml.cpcmart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xml.ppctraffic.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xml.planetpush.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 104.19.134.80 (United States) 11 redirects

ASN13335 (CLOUDFLARENET, US)

c.adskeeper.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.adskeeper.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 108.168.193.183 (Dallas, United States) 4 redirects

ASN36351 (SOFTLAYER, US)

ngp1.intnotif.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

fikri-ayo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:3036::ac43:d89f (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

b70.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.192.101.24 (Dallas, United States) 2 redirects

ASN36351 (SOFTLAYER, US)
PTR: 18.65.c0ad.ip4.static.sl-reverse.com

ngp4.intnotif.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	adskeeper.co.uk 11 redirects c.adskeeper.co.uk s-img.adskeeper.co.uk	291 KB
10	gstatic.com fonts.gstatic.com	223 KB
9	b70.info 3 redirects b70.info	209 KB
7	pushking.net 7 redirects xml.pushking.net	5 KB
6	screenauto.xyz 4 redirects screenauto.xyz	4 KB
6	fikri-ayo.com fikri-ayo.com	18 KB
6	intnotif.club 6 redirects ngp1.intnotif.club ngp4.intnotif.club	5 KB
5	shopdictionary1.xyz 4 redirects shopdictionary1.xyz	4 KB
5	dualsale1.xyz 3 redirects dualsale1.xyz	5 KB
4	planetpush.net 4 redirects xml.planetpush.net	3 KB
4	cpcmart.com 4 redirects xml.cpcmart.com	2 KB
4	googleapis.com fonts.googleapis.com	3 KB
3	rexadvert.xyz 3 redirects feed.rexadvert.xyz	327 B
3	popcash.net 2 redirects popcash.net ps.popcash.net	1 KB
3	eep.io eep.io	212 KB
3	cpasbien.me 1 redirects cpasbien.me www.cpasbien.me	12 KB
2	ppctraffic.co 2 redirects xml.ppctraffic.co	631 B
2	list-manage.com 1 redirects mc.us20.list-manage.com	3 KB
2	blogger.com www.blogger.com	84 KB
1	ibwood1.xyz 1 redirects ibwood1.xyz	113 B
1	towerfriend1.xyz 1 redirects towerfriend1.xyz	111 B
1	fergas-fri.com 1 redirects fergas-fri.com	906 B
1	blogblog.com resources.blogblog.com	612 B
1	cloudflare.com cdnjs.cloudflare.com	6 KB
65	24

	Domain	Requested by
22	s-img.adskeeper.co.uk	dualsale1.xyz screenauto.xyz shopdictionary1.xyz
11	c.adskeeper.co.uk	11 redirects
10	fonts.gstatic.com	fonts.googleapis.com
9	b70.info	3 redirects dualsale1.xyz screenauto.xyz shopdictionary1.xyz
7	xml.pushking.net	7 redirects
6	screenauto.xyz	4 redirects dualsale1.xyz screenauto.xyz
6	fikri-ayo.com	dualsale1.xyz screenauto.xyz shopdictionary1.xyz
5	shopdictionary1.xyz	4 redirects screenauto.xyz shopdictionary1.xyz
5	dualsale1.xyz	3 redirects ps.popcash.net dualsale1.xyz
4	xml.planetpush.net	4 redirects
4	xml.cpcmart.com	4 redirects
4	ngp1.intnotif.club	4 redirects
4	fonts.googleapis.com	www.cpasbien.me dualsale1.xyz screenauto.xyz shopdictionary1.xyz
3	feed.rexadvert.xyz	3 redirects
3	eep.io	www.cpasbien.me
2	ngp4.intnotif.club	2 redirects
2	xml.ppctraffic.co	2 redirects
2	ps.popcash.net	1 redirects www.cpasbien.me
2	mc.us20.list-manage.com	1 redirects www.cpasbien.me
2	www.blogger.com	www.cpasbien.me
2	www.cpasbien.me	www.cpasbien.me
1	ibwood1.xyz	1 redirects
1	towerfriend1.xyz	1 redirects
1	fergas-fri.com	1 redirects
1	popcash.net	1 redirects
1	resources.blogblog.com	www.cpasbien.me
1	cdnjs.cloudflare.com	www.cpasbien.me
1	cpasbien.me	1 redirects
65	28

This site contains no links.

Subject Issuer	Validity	Valid
*.blogger.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
wildcardsan2.mailchimp.com DigiCert Secure Site ECC CA-1	`2020-08-08` - `2021-11-07`	a year	crt.sh
wildcardsan.list-manage.com DigiCert Secure Site ECC CA-1	`2020-08-26` - `2021-11-25`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
politicalsale1.xyz R3	`2021-04-26` - `2021-07-25`	3 months	crt.sh
fikri-ayo.com Amazon	`2021-03-08` - `2022-04-06`	a year	crt.sh
spectrumtop.xyz R3	`2021-04-18` - `2021-07-17`	3 months	crt.sh
articlesct1.xyz R3	`2021-04-13` - `2021-07-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Frame ID: 8A6D4436476142E69A32F8920333FA1E
Requests: 65 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://cpasbien.me/ HTTP 302
http://www.cpasbien.me/ Page URL
http://popcash.net/world/go/213592/448935 HTTP 301
http://ps.popcash.net/go/213592/448935 Page URL
http://ps.popcash.net/ad/ad?p=213592&w=448935&t=e2d0e5f3422e1ac7&r=aHR0cCUzQSUyRiUyRnd3dy5jcGFzYml... HTTP 303
http://fergas-fri.com/zcvisitor/257945aa-b7f4-11eb-bcbf-0aa2fa0f020d/7fcf9220-c93c-11e7-9820-0e06c... HTTP 302
https://feed.rexadvert.xyz/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=juliet-jot-04kuiue... HTTP 302
https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js Page URL
https://feed.rexadvert.xyz/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet HTTP 302
https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js Page URL
https://feed.rexadvert.xyz/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet HTTP 302
https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

Page Statistics

65
Requests

94 %
HTTPS

47 %
IPv6

24
Domains

28
Subdomains

14
IPs

2
Countries

1065 kB
Transfer

1252 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cpasbien.me/ HTTP 302
http://www.cpasbien.me/ Page URL
http://popcash.net/world/go/213592/448935 HTTP 301
http://ps.popcash.net/go/213592/448935 Page URL
http://ps.popcash.net/ad/ad?p=213592&w=448935&t=e2d0e5f3422e1ac7&r=aHR0cCUzQSUyRiUyRnd3dy5jcGFzYmllbi5tZSUyRg==&vw=1600&vh=1200 HTTP 303
http://fergas-fri.com/zcvisitor/257945aa-b7f4-11eb-bcbf-0aa2fa0f020d/7fcf9220-c93c-11e7-9820-0e06c6fba698?campaignid=18c21260-4e55-11ea-8d5c-12e5dcaa70ed HTTP 302
https://feed.rexadvert.xyz/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=juliet-jot-04kuiuen5_all_fr&kw=arts%2Centertainment%2Cmovies%2Cmusic%2Cmen%2Cwomen%2Cgames&cid=zr257945aab7f411ebbcbf0aa2fa0f020deb73e5697e7f41b2af657214ee4f86c9055912158c3aa81678&u=322 HTTP 302
https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js Page URL
https://feed.rexadvert.xyz/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet HTTP 302
https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js Page URL
https://feed.rexadvert.xyz/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet HTTP 302
https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cpasbien.me/ HTTP 302
http://www.cpasbien.me/

Request Chain 6

http://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0 HTTP 307
https://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0

Request Chain 15

http://popcash.net/world/go/213592/448935 HTTP 301
http://ps.popcash.net/go/213592/448935

Request Chain 16

http://ps.popcash.net/ad/ad?p=213592&w=448935&t=e2d0e5f3422e1ac7&r=aHR0cCUzQSUyRiUyRnd3dy5jcGFzYmllbi5tZSUyRg==&vw=1600&vh=1200 HTTP 303
http://fergas-fri.com/zcvisitor/257945aa-b7f4-11eb-bcbf-0aa2fa0f020d/7fcf9220-c93c-11e7-9820-0e06c6fba698?campaignid=18c21260-4e55-11ea-8d5c-12e5dcaa70ed HTTP 302
https://feed.rexadvert.xyz/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=juliet-jot-04kuiuen5_all_fr&kw=arts%2Centertainment%2Cmovies%2Cmusic%2Cmen%2Cwomen%2Cgames&cid=zr257945aab7f411ebbcbf0aa2fa0f020deb73e5697e7f41b2af657214ee4f86c9055912158c3aa81678&u=322 HTTP 302
https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js

Request Chain 18

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_717_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDVlZWJkNTMxNjA0NzIyZWQwZGFiMGZmMWYzMjRjOWM1JTI2cm5kJTNEOTI4MjQzMjI0&t=1621354481928&rnd=94496482&i=1 HTTP 302
https://xml.pushking.net/icon?sid=5eebd531604722ed0dab0ff1f324c9c5&rnd=928243224 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|FII_LYsb2Ap_lZZBRIVERPf2-2CxOu2bz5m5bpLQsPnnAcaqcUaJ9rgRF07glY-z&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f0a33e-b7f4-11eb-81ac-e4434b15122e&psid=776611&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODMyLzMyOHgzMjgvMjA0eDB4NDMweDQzMC9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwWlcxd0x6SXdNVGd0TURVdE1EZ3ZNVEF4T1RJMEx6VmlabVl6TVdVeFpHRTNaVGsxTUdFM1lqVXhaREE0T0dNNE1EZzNPR1E1TG1wd1p6OTBQVEUxTWpVNE5EQTJOVEl6TWpZLndlYnA_dj0xNjIxMzU0NDgwLVdVdU9PRGxzM1JrcDc0TTRpYXE3YXhVdU4ySlRjT29Ra1JNc2lPQ0dneGs= HTTP 301
https://s-img.adskeeper.co.uk/g/8164832/328x328/204x0x430x430/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp?v=1621354480-WUuOODls3Rkp74M4iaq7axUuN2JTcOoQkRMsiOCGgxk

Request Chain 19

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_700_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGUyMTc1ZWE1ZGI0Yjc0YWY2ZjAzODg1OWJjNGVmYjlmJTI2cm5kJTNEOTI4MjQzMjI0&t=1621354481928&rnd=612987909&i=1 HTTP 302
https://xml.pushking.net/icon?sid=e2175ea5db4b74af6f038859bc4efb9f&rnd=928243224 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|PkAwqYpVjrUJFb_qSKsZYqU8xbDH_o8xak2ExdIkymX0xg8Y_UQyhtta96nqCJBa&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f04b34-b7f4-11eb-b42d-e4434b374cb2&psid=776611&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODUzLzMyOHgzMjgvMHgweDQ5Mng0OTIvYUhSMGNEb3ZMMmx0WjJodmMzUnpMbU52YlM5MEx6SXdNakV0TURJdk1UQXhPVEkwTDJVNU5qRmhObVF4TjJVNVlXTTFNVGcyT0Rrek5EQmxOV1l6TW1GbU56QTNMbXB3Wncud2VicD92PTE2MjEzNTQ0ODAtWUE0VjlMZWdKR2tKWWMxZC1uZTBZSHRqR0ZXZjlpb0JRQTVxbVdhT1JQdw== HTTP 301
https://s-img.adskeeper.co.uk/g/8164853/328x328/0x0x492x492/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDIvMTAxOTI0L2U5NjFhNmQxN2U5YWM1MTg2ODkzNDBlNWYzMmFmNzA3LmpwZw.webp?v=1621354480-YA4V9LegJGkJYc1d-ne0YHtjGFWf9ioBQA5qmWaORPw

Request Chain 20

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_651_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDNmM2UzYzA4MTAzNjY0ZTlmYmY0NDFiYWJhMmZkNGZmJTI2cm5kJTNEOTI4MjQzMjI0&t=1621354481928&rnd=481356502&i=1 HTTP 302
https://xml.pushking.net/icon?sid=3f3e3c08103664e9fbf441baba2fd4ff&rnd=928243224 HTTP 302
https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoLgNjQvrdS-FtN06bsjfCZ1FpCJXm0PLqLelTBfxAxq31rCOkguHZOpNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7nm-6nn3jYDUE1jcb7yuP1AwFSbTO-hU6cBE5VCO9MepgXOYVNhySCnyfpJUIbwxYoKUyAkWbj07s2wSYW1snOT4ihZd1qaGQRlwtM0btcGBQYtaAr5OiM68uB30eiZl7A4hUGQMKpauQ5uLIc3P5ry8dR39E_mgDTjoD-LwPRR87PaVri3cOSEcahKPsPHCcWzNSLnjNGeoI_wlU4pvwMAj8LQpPNznx4LrLpELYJ1E6S-GE_0HP-fodISklwG5MKJLMUjW46jzm3mT2mN2aKu1i96flqs3wwgy7_hEYLwf_CPnLY1PtwSv5vWk9g_EnWag9wxUvk-FX_3rAg1eiVrMKKo3zF-Pq7Rg6cYkS2W08Ib9a2SKm0SbIArLxHW6RRfSOb54DUC50bodkFbMADrBJCZodl7iNXXwdTWRPBBMaLFyRytDNzJjXIoHH5gsNMWWtPQbIKTz_Vf0JpEixYJuXRpAYNO7t7t0K6sA_LsbZy7kFbqGwDQewj3XiRXnhavMjzIR9j7fnekkWfz_1S-724vcF2jL25UAwSwTzS5Pw_8qfDDvpqAgDzmB1QJc9TMIv4kBgUWdUYhHle9VmlTrh-H19TVGlcvxZcJ42IhpOZDQWrIOc7azkx_6ZBilCclvUR0J92zq_VPgAuB-0oYP7b6ViW3Xep3QFBGM55CfmUHSCXOIyS9URejQzz0AmRuoahZ9HVqADe3NFNzS_FeytI1VkhObMj_fv8NjGf85ZWMxXBuzd7DNneManwvRmhmc5Y9URsdWud0XVyIGOIvsMtzNUcW4ntVSgC0kdNOcEPoVyrdjMjnjPiirPFtsPaBbMOo6au_PKAye40BufLMzOFpBqPkKr0PA3XeaPSFo9yRmaGF1RaVTgWNezMmX1PjEVEPHGr01LDFLufCFr_YxW08PcnX7W_qhL0VEhikzfi11bAfoswPPDPVkJ0ncivaqBcSzmaSDihqWfMwQ4bi1paskDDOOA_k-VY-xzn5DdrmQ5hdMinPAVepkWegbCCnBPjLv6ixvkQQDWpaZWkCGrVH1509-X58dBaw47Fd_Q8WeeOOllnSc5p8M7jrdURZpwaA0vrSpMZsJUpjgTi7nv0TlcPTiXk7EPAnBzKCMNdjYoh7ndQzYB3_-32DggBk3Alt3r2AylZQesFjPUfMLm2xdWA9sMyrH-R9t3h_E_LG7aXc7mVTimxm1AMk9drxkfI1lgj7kMztdJUaSVBx1NRHZg4bgVN4CGsVNHrS6vNRd9nU9HAAp9bjfNV_CvmAgyBa-zYLDGLx1NM8FqZJxAIAp6oTaVbqA3FwGJ1EdG9lDERZGKPcGY5RyEV3fwN-QezH7l7bchgAzqwbQlEEppkbkZU8IsQQCQh8BpMT9cQI8jtQtR3UzpRIkjP0OzrUJgx0fp7LRj2wB2EeqOsenRVOmD8mGzJFj4t5XX8SP_zP-HgoKx2WYgEse1KWNbiqas-WcYOPzEqi11LuFNnkVni_7oot0HBgJsjdF5uL0K2Y_uFeThZWAMoqXDG66DfKfITs_Xw6ArUquSsniViukvwS0Av_VRRgStGUXu5DIkynudyd_ffHAg040Tb9Q6tf4S-6icKmKcAy6aP9X4erbrDh0SHo8C9cP85X63GqwADeYv6FXR9MOHKVGsrks65Fq5hr_46U4qNJQKkuSY8KGWSQsQHXjql HTTP 302
https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==

Request Chain 21

https://towerfriend1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_5_776_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwuY3BjbWFydC5jb20lMkZpY29uJTNGc2lkJTNEYjk2ODEwN2VkODk4YTVhYzhkMzVmNDYyMGZkZGQ4YTMlMjZybmQlM0Q3Njk1MjExMzE%3D&t=1621354481928&rnd=853313832&i=1 HTTP 302
https://xml.cpcmart.com/icon?sid=b968107ed898a5ac8d35f4620fddd8a3&rnd=769521131 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|wYB-zor5nwPeJg_9o1TXidUBZXglS2GQ7moykPpTt5lqhFidereHmEO_0dstDySB&cid=904958&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25efb732-b7f4-11eb-9f0b-e4434b374c8a&psid=345044&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODM1LzMyOHgzMjgvOTF4Njd4OTY5eDk2OS9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwWlcxd0x6SXdNVGd0TVRBdE1EWXZNVEF4T1RJMEx6Rm1OR0UwTm1Nd04yRTFaVGxpT1RrNU5URmhNalZtWTJZMllqaGlZMlkzTG1wd1pXY19kRDB4TlRNNE9EUTNPREkzTXpRMi53ZWJwP3Y9MTYyMTM1NDQ4MC1qUnhHeEdJUDNPNmF3UHZfM2tmaGM0b3ZSVEhkQ2Frckd4OGpDcGk0ZHQ0 HTTP 301
https://s-img.adskeeper.co.uk/g/8164835/328x328/91x67x969x969/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp?v=1621354480-jRxGxGIP3O6awPv_3kfhc4ovRTHdCakrGx8jCpi4dt4

Request Chain 22

https://ibwood1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_6_694_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHBjdHJhZmZpYy5jbyUyRmljb24lM0ZzaWQlM0RiZThiZDg1MWJkYmNmNWI2YWJiNWI2ZjE1YTljMTI3MSUyNnJuZCUzRDY3NzIxODA4NQ%3D%3D&t=1621354481928&rnd=589625980&i=1 HTTP 302
https://xml.ppctraffic.co/icon?sid=be8bd851bdbcf5b6abb5b6f15a9c1271&rnd=677218085 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|b8NYnhlWBJsMclyDFLvmzKRCOOg4s7bB0r7aAAkMPpLn7FAqDIsf6eX-NLs12Aq7&cid=861229&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f01b54-b7f4-11eb-a42a-e4434b151302&psid=469105&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTkzNTA2LzMyOHgzMjgvODh4MHg0MDF4NDAxL2FIUjBjRG92TDJsdFoyaHZjM1J6TG1OdmJTOTBaVzF3THpJd01UZ3RNRGt0TVRRdk1UQXhPVEkwTHpZMk1UZzROelkwTURZeFpUTmxOR013WkRNMFlXSXhZelEzWVRSak1EQmxMbkJ1Wno5MFBURTFNelk1TkRBeU1qWXlOamMud2VicD92PTE2MjEzNTQ0ODAtR1dmYnFsYTRFUHJ1TWJoR2tkZGp0SFUtLUJabmJvN0ctUDFCdWF2LWFPRQ== HTTP 301
https://s-img.adskeeper.co.uk/g/8193506/328x328/88x0x401x401/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp?v=1621354480-GWfbqla4EPruMbhGkddjtHU--BZnbo7G-P1Buav-aOE

Request Chain 25

https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoLgNjQvrdS-FtN06bsjfCZ1FpCJXm0PLqLelTBfxAxq31rCOkguHZOpNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7nm-6nn3jYDUE1jcb7yuP1AwFSbTO-hU6cBE5VCO9MepgXOYVNhySCnyfpJUIbwxYoKUyAkWbj07s2wSYW1snOT4ihZd1qaGQRlwtM0btcGBQYtaAr5OiM68uB30eiZl7A4hUGQMKpauQ5uLIc3P5ry8dR39E_mgDTjoD-LwPRR87PaVri3cOSEcahKPsPHCcWzNSLnjNGeoI_wlU4pvwMAj8LQpPNznx4LrLpELYJ1E6S-GE_0HP-fodISklwG5MKJLMUjW46jzm3mT2mN2aKu1i96flqs3wwgy7_hEYLwf_CPnLY1PtwSv5vWk9g_EnWag9wxUvk-FX_3rAg1eiVrMKKo3zF-Pq7Rg6cYkS2W08Ib9a2SKm0SbIArLxHW6RRfSOb54DUC50bodkFbMADrBJCZodl7iNXXwdTWRPBBMaLFyRytDNzJjXIoHH5gsNMWWtPQbIKTz_Vf0JpEixYJuXRpAYNO7t7t0K6sA_LsbZy7kFbqGwDQewj3XiRXnhavMjzIR9j7fnekkWfz_1S-724vcF2jL25UAwSwTzS5Pw_8qfDDvpqAgDzmB1QJc9TMIv4kBgUWdUYhHle9VmlTrh-H19TVGlcvxZcJ42IhpOZDQWrIOc7azkx_6ZBilCclvUR0J92zq_VPgAuB-0oYP7b6ViW3Xep3QFBGM55CfmUHSCXOIyS9URejQzz0AmRuoahZ9HVqADe3NFNzS_FeytI1VkhObMj_fv8NjGf85ZWMxXBuzd7DNneManwvRmhmc5Y9URsdWud0XVyIGOIvsMtzNUcW4ntVSgC0kdNOcEPoVyrdjMjnjPiirPFtsPaBbMOo6au_PKAye40BufLMzOFpBqPkKr0PA3XeaPSFo9yRmaGF1RaVTgWNezMmX1PjEVEPHGr01LDFLufCFr_YxW08PcnX7W_qhL0VEhikzfi11bAfoswPPDPVkJ0ncivaqBcSzmaSDihqWfMwQ4bi1paskDDOOA_k-VY-xzn5DdrmQ5hdMinPAVepkWegbCCnBPjLv6ixvkQQDWpaZWkCGrVH1509-X5NnxG25PZpmg HTTP 302
https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==

Request Chain 26

https://xml.cpcmart.com/icon?sid=ddb4e7670a512f5e66e9d3cf128adb07&rnd=769521131 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|XFNQDMrudI_G86kujG4PjBY2kgI_KlftaniUFFAE9Hy0mvqSBMtxk39k52kotIzi&cid=904957&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25eff040-b7f4-11eb-a42a-e4434b151302&psid=345044&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODg5LzMyOHgzMjgvMHgxMjR4NTY1eDU2NS9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwWXk4eU1ERTVMVEEyTHpFd01Ua3lOQzloWTJKaFltUmxNbVJqTlRrek9ERmtNekF5WXpoa01tTTRPREV5T1dFMk55NXFjR2Mud2VicD92PTE2MjEzNTQ0ODAtV2h0S25Wc0s0Zk9tYWxkbUo3MEw5Ui15X1NBVU1QZmFRNHdpRjQzQkFYYw== HTTP 301
https://s-img.adskeeper.co.uk/g/8164889/328x328/0x124x565x565/aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp?v=1621354480-WhtKnVsK4fOmaldmJ70L9R-y_SAUMPfaQ4wiF43BAXc

Request Chain 28

https://xml.cpcmart.com/icon?sid=18d9bd2753d62b946d59ee74706ed720&rnd=769521131 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|qaWuyR2fpZHQuyPs-Drzf043tHj4SEvPcqgbuAejHNUaVVWlVF13a__WcQwv7sZf&cid=904959&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25efbe85-b7f4-11eb-9f0b-e4434b374c8a&psid=345044&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0OTEyLzMyOHgzMjgvMTgxeDB4NzQ0eDc0NC9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwTHpJd01qQXRNRGt2TVRBeE9USTBMMkk1WTJVMk0yRTNaREl5TmpGbFpHRXdNelF6WkRSalpHVmlaRE5tTjJRM0xtcHdaV2Mud2VicD92PTE2MjEzNTQ0ODAtUmNWYmVIR2dBdTNONzVsSE9lbGxRRWFyN2RGeUVHelZPWV9PV0Q4Q0NEcw== HTTP 301
https://s-img.adskeeper.co.uk/g/8164912/328x328/181x0x744x744/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp?v=1621354480-RcVbeHGgAu3N75lHOellQEar7dFyEGzVOY_OWD8CCDs

Request Chain 30

https://xml.ppctraffic.co/icon?sid=6c85c4f181d8d7fd9e3bd06d62cc9047&rnd=677218085 HTTP 302
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=3522&f=/img/6217-0de96f36&ft=1&geo=FR&r=69280-1417 HTTP 302
https://b70.info/img/6217-0de96f36

Request Chain 32

https://xml.cpcmart.com/icon?sid=23d3cdaee57ba15d63490836c91a4a8b&rnd=769521131 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|p3oFVBMD1Uh5lSy4grLklw0r3HmJQLX4tS_Gd3qAB2kMZ8c-0vOFhzz8lI9qb5sN&cid=904956&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f002d7-b7f4-11eb-a42a-e4434b151302&psid=345044&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODg0LzMyOHgzMjgvODF4MHg2Njd4NjY3L2FIUjBjRG92TDJsdFoyaHZjM1J6TG1OdmJTOTBMekl3TWpBdE1EVXZNVEF4T1RJMEx6QTJaV00wTldaa016ZGpabVl4TlRJNE16VmpOakV6TURNeE1tRTVOall4TG1wd1pXYy53ZWJwP3Y9MTYyMTM1NDQ4MC00WnVCVWJ3U25jNHRldDQ4MXR1NEtpeGUxZ29Mak94LUt1Q19icXdRY1ZV HTTP 301
https://s-img.adskeeper.co.uk/g/8164884/328x328/81x0x667x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1621354480-4ZuBUbwSnc4tet481tu4Kixe1goLjOx-KuC_bqwQcVU

Request Chain 39

https://feed.rexadvert.xyz/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet HTTP 302
https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js

Request Chain 41

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_651_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNENDM4OGYyODgzMmU0Y2QzZDljMTQ1YjY1NDkzN2JhZGUlMjZybmQlM0Q5Mzg4MjAzMjc%3D&t=1621354486331&rnd=263004419&i=1 HTTP 302
https://xml.planetpush.net/icon?sid=4388f28832e4cd3d9c145b654937bade&rnd=938820327 HTTP 302
https://ngp4.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoIU1ounBdJvbtN06bsjfCZ0b1aSe-wgCb5V5wVHqST9Hapt5AeAKBV5NZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7nLscu4YPnXRqWalh-86EwYP4WImHc4CLHes7vSvKLyUkz04Vdj936rJEP0dz07Cf4qhZFAebQXFyVWel4pNWmwqXR7C7xwIDrqPqTQPepZkHILQJDdMiAQllaQ3Z3r18_-0Fv0kqC19ISwE7m0h-Daa1dGGgBWWo63MvnqYbzRpqOfdBAghHIKiQKvAn3E5JnwaEcRuQnCU3rcgJd5XHjL02panPEsRExR28KMKPJW5fd1wqYvUyBG3zfNxDf9EWKMLSLR9Qkt_weO4xQv7xLGgV_osR7SFIlZAbmL0tGp5wClZNu5v3Vpmz-Fb5vESjjX5ZRQsQPxBrUXZTYHnIFdtTIi90XTHePqfJlmS4GtXu0U1QnUyppWwZZSGbzgpBxece_W-DTZvUAwyXx1TglwAx-kn29CxbG9MbJ1T_67SDxl2xnUHMgu4zo7pBxVnf5UajW7vq-DWLetZfW0FFg6HVxcRZKkdR2Pc-u7FFnCf9zLMscTYtLuMGM73urtPKZ9Ms2OsOh-rpsvhMOXzNnKMZ54oqcOaMe30S1_XB2f3uQIGXuZo4xO0FYp3fMtwWMs66NrMjpS_Af7bx0xJPMdU98TW5kEUCmM7TJ4UEeXR-SO4RKpDnXWzQ7aGcufVDV87kNmQUFoKadjK60pD98gJQ9pOGhL-izaI0HjbhOQCcACYaqD_gal6qNtwZFXdeFTs-jwvEAoj_TQzswvk8pdnRGuyrhry-TnpKANNQ_E4Xdrf8PB3Rgpn0Mmyud__rZRD_mUEyAPdj6Rr34W_Uv1bBNutKUqxpOXQlgfFNMnyjj2LovOKnaMCaAfzB4v9HLd-BTr6Mnb8VY6Co6CQeUoj-9VcZgV5ExefA8fvv5K68JXNj1hF9xvtwG_KIOf_l8NvlNuctABLXG5GzlntKUvQbrP9PCncS4xa_3dXg5crbzBxpfHTQw1NZSixF3f1UyORE9peLi1WVmvbCjfD1-xf21B9T6fyvFO488r9Djs1jXzQFAKjS5_u9mMA8OguZtMXcmVw5qcM4JI8p-AhfZ29NcH-EwM7xG8dBaw47Fd_Q8WeeOOllnSc5p8M7jrdURVwfABoOA2c6TjeXF2SBRnvYK4zpk73hf5ORSu4I3Ro-pbcK3FAQcEAgRFM9VBZLnASDNEwcqIbCP6DrHPa2e_CX-vGtUKw4_UKr05u0W0OY0-9mJuwX5266t0qicN22UP8cSlUmbkYbfn_GsN42i78pVAU3bmLev62emH7E-36MquKpv6YilcCUWSzJn1GJMFnRaEBdC01B5URpyuZs9-tUFz05-Ol7K0A7FNV-YQvFO45sac3nBIiiZzvgM5JPZ05o2eTZlOHjLe3wCwOFEMB_Z0uZBmt4ZPHElOI4v6NsYnBFZUErePQXVfzivY18rkqQZLHJWm9kibw1cQQ9KlSJHeuxYgPNHYwxuWBJvJEcnR2SJxwQpkiCTbSCFu2lU3UCP5s8Ap0wEsZaaAwenuGFPQ2pc4sC6ceIPjC_t3wrHa0k0auNjWIwN4uFjbIo4g8pC3Zm513tu3Fo_s-omz3J97jQVf9hRjotHLr7sM-P38MGh9YkbRRtJ6WslggAngwoQ9h4SrkMFaUgSg3hxjCR0YounTWv79QrKksLkbnZy3hm3mIVINbUZDZdetrC8Jmp4YasxzMkARem2j8d32CYNb-iWwdA0 HTTP 302
https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==

Request Chain 42

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_959_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNENmQ4MjAxZWMwZWY4YTY2MjJiNGQwYzZhY2FiNTFkNjAlMjZybmQlM0Q5Mzg4MjAzMjc%3D&t=1621354486331&rnd=725055437&i=1 HTTP 302
https://xml.planetpush.net/icon?sid=6d8201ec0ef8a6622b4d0c6acab51d60&rnd=938820327 HTTP 302
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=4094&f=/img/6217-0de96f36&ft=1&geo=FR&r=69285-2560 HTTP 302
https://b70.info/img/6217-0de96f36

Request Chain 43

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_700_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNEZTJjODI3NzE0ZDBhYWE3NTk5ZjA4MDgxZGM0N2M3NTIlMjZybmQlM0Q5Mzg4MjAzMjc%3D&t=1621354486331&rnd=493817630&i=1 HTTP 302
https://xml.planetpush.net/icon?sid=e2c827714d0aaa7599f08081dc47c752&rnd=938820327 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|ZwjuW_OnsvU4QJTx-6ozMi26-ZpDrp4fRStLUwErRHEUYP3t2cNCkvuFcfGq4CPX&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=28dfc477-b7f4-11eb-820b-e4434b374c12&psid=1226747&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODI4LzMyOHgzMjgvMHgzN3g3Njd4NzY3L2FIUjBjRG92TDJsdFoyaHZjM1J6TG1OdmJTOTBaVzF3THpJd01UZ3RNRE10TWprdk1UQXhPVEkwTDJGak9ETmxOMkl5TWpjd056RmpaR1kxWkdOaFpqWTJaR1UzWWpjNVlqQmhMbkJ1Wno5MFBURTFNakl6TWpjM05UazNORFEud2VicD92PTE2MjEzNTQ0ODUtVTRPNkE0blk5Y1lEQkpFZ3QwdWpzWUxYRmlDenk1bGYteWczd210NkNUbw== HTTP 301
https://s-img.adskeeper.co.uk/g/8164828/328x328/0x37x767x767/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp?v=1621354485-U4O6A4nY9cYDBJEgt0ujsYLXFiCzy5lf-yg3wmt6CTo

Request Chain 44

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_717_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNEZDhkOTNkMmM1NzFjMWE1MDc0ZTRkODFmNWY5ZDQ0MTElMjZybmQlM0Q5Mzg4MjAzMjc%3D&t=1621354486331&rnd=50718045&i=1 HTTP 302
https://xml.planetpush.net/icon?sid=d8d93d2c571c1a5074e4d81f5f9d4411&rnd=938820327 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|FcVHk3zu8NetxhO3XlH9cdOTUbgjjzEvpaJN-WJpTsHJpP50Oc7aK4-YPgE7yM-V&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=28e0844f-b7f4-11eb-bbd5-e4434b374bc6&psid=1226747&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODQ3LzMyOHgzMjgvMTI4eDB4MzMzeDMzMy9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwTHpJd01Ua3RNVEF2TVRBeE9USTBMelZtTURNNVpEVmlNRGMwTnpZNFpEazBNVGsyTXpKaVl6Y3hNakJpTVRKaExtcHdady53ZWJwP3Y9MTYyMTM1NDQ4NS03RkJUa3ZiOVFUZ3ViQ3dSdnZPa3FfeXV0VUU5VWVLNzFnSC1DbmZXNTRz HTTP 301
https://s-img.adskeeper.co.uk/g/8164847/328x328/128x0x333x333/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp?v=1621354485-7FBTkvb9QTgubCwRvvOkq_yutUE9UeK71gH-CnfW54s

Request Chain 45

https://ngp4.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoIU1ounBdJvbtN06bsjfCZ0b1aSe-wgCb5V5wVHqST9Hapt5AeAKBV5NZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7nLscu4YPnXRqWalh-86EwYP4WImHc4CLHes7vSvKLyUkz04Vdj936rJEP0dz07Cf4qhZFAebQXFyVWel4pNWmwqXR7C7xwIDrqPqTQPepZkHILQJDdMiAQllaQ3Z3r18_-0Fv0kqC19ISwE7m0h-Daa1dGGgBWWo63MvnqYbzRpqOfdBAghHIKiQKvAn3E5JnwaEcRuQnCU3rcgJd5XHjL02panPEsRExR28KMKPJW5fd1wqYvUyBG3zfNxDf9EWKMLSLR9Qkt_weO4xQv7xLGgV_osR7SFIlZAbmL0tGp5wClZNu5v3Vpmz-Fb5vESjjX5ZRQsQPxBrUXZTYHnIFdtTIi90XTHePqfJlmS4GtXu0U1QnUyppWwZZSGbzgpBxece_W-DTZvUAwyXx1TglwAx-kn29CxbG9MbJ1T_67SDxl2xnUHMgu4zo7pBxVnf5UajW7vq-DWLetZfW0FFg6HVxcRZKkdR2Pc-u7FFnCf9zLMscTYtLuMGM73urtPKZ9Ms2OsOh-rpsvhMOXzNnKMZ54oqcOaMe30S1_XB2f3uQIGXuZo4xO0FYp3fMtwWMs66NrMjpS_Af7bx0xJPMdU98TW5kEUCmM7TJ4UEeXR-SO4RKpDnXWzQ7aGcufVDV87kNmQUFoKadjK60pD98gJQ9pOGhL-izaI0HjbhOQCcACYaqD_gal6qNtwZFXdeFTs-jwvEAoj_TQzswvk8pdnRGuyrhry-TnpKANNQ_E4Xdrf8PB3Rgpn0Mmyud__rZRD_mUEyAPdj6Rr34W_Uv1bBNutKUqxpOXQlgfFNMnyjj2LovOKnaMCaAfzB4v9HLd-BTr6Mnb8VY6Co6CQeUoj-9VcZgV5ExefA8fvv5K68JXNj1hF9xvtwG_KIOf_l8NvlNuctABLXG5GzlntKUvQbrP9PCncS4xa_3dXg5crbzBxpfHTQw1NZSixF3f1UyORE9peLi1WVmvbCjfD1-xf21B9T6fyvFO488r9Djs1jXzQFAKjS5_u9mMA8OguZtMXcmVw5qcM4JI8p-AhfZ29NcH-EwM7xGNnxG25PZpmg HTTP 302
https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==

Request Chain 53

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_651_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDAyNWZhMTRhNjJmNTRlMjU1MDAyOTVlZTBjZDI2NmYwJTI2cm5kJTNEMTEyMzYwMTU%3D&t=1621354490670&rnd=839146690&i=1 HTTP 302
https://xml.pushking.net/icon?sid=025fa14a62f54e25500295ee0cd266f0&rnd=11236015 HTTP 302
https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoJ6awBqyP-HetN06bsjfCZ3QBJ6FlRx31aRkPb3ZKFFVRXaOwXa7MgVNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7n5sZvnKCsPSER2cuCMzwJRsJuTI8hO8tIaF3M3JBdlq6qOrJtxJw6aoMvQ2JmygaGTkOFkDfcxr3bJOBQinM2XLKF1QgsFwzMqLmKLbBqFhKzJXeuw4kkDdyTzpYxk1FbbVAztwwj35Oe1jbzwEyaGgzcKVOFgzg1Yo6DaCoGjW3b5rtrLgEXXZ576bTZT0cTpgTRZu2FT2OD_N3t4udeDYvIOwpM4db9ynEGdarpz60izIxlMQ1QFCFuwdnv9nAKd5oJ-C_CQJnVy8wlHglE0phRTMApnd6l907x5aux83mi5vHq133zxZXJ36sM8NZxDrG0vSvFQUmjtr95kI1C3rB4WCB6IH-jOGoV61Iel0JfhEBPHvjAbNa99LO9pVLWi0ylYsebDNYLZcDennHvyLUpYhplAUJs3MUipU2N-GQv4aHBzqVLySQpXI8r5wQvGBYEMoFjye8hscu5rYbVWKA4v5VppPpKYcLwkGV1EvaFSf-ttSkAk-MPx-ZreIWhsM3nnVR-cBWiPxREXqV_99m1RvC2HRNAHiG4HSGlDrn6bMFxeuc6BMnHN-G-hMUxh8ciO3NOwA0NLbGMxN2spCoO7-7EBVxXCIknBCdL_UIVvIOm-Z9UDfsj8qHlijHljxBJwkDpmzZNQRCgYKkhuzaT9E0-4-Gz7KRqmdUmdH5FBAJClvcOthNxOrFzv3bgWnAVz5U5CbByvKc11NRdRJSWl6QnEzr3_43QlvcT_JSEV_bakiOuMXRp4w3wM6RFt4OJGox3SQBkTcakTPJWww3QzLITgA7PiL6Ld-Lmxr0PkuD9dbE7dfL-LkRPz_X-Zc5hmZJHK0NRYcG9HAwwSNShIi1oktqn36Akp_uRoLJd-Bqv5jtd3ra7rY0XRRGvs-Peko1weGYJQLCXYwknsSXjyx-kEgtLdupeAFnGbYAQUntavJvAMZtMH7lZUxNSqPdc62h_h21amGClihE5IkhKAk2hZezhTVByV8wOywXHzxxVgEnVQQzGUNtYlP930zrY4KTKM4fwIpPnLz2ndkTscg3EhOIp8dBaw47Fd_Q8WeeOOllnSc5p8M7jrdURZpwaA0vrSpOmHSr_ypW9sMOzz4Qqz2eU5ORSu4I3Ro_uJ4rjK1rdDVxVr0zg_vzHzzvcnjMHPKRaDMLU2ZBgh_6T2kAd-1OdUKr05u0W0OY0-9mJuwX5266t0qicN22UP8cSlUmbkYa6lBnQSAFXYi2KGP2qsh7h62emH7E-36MquKpv6YilcCUWSzJn1GJMFnRaEBdC01B5URpyuZs9-tUFz05-Ol7KZjFPDcN0LeEeOmEokkDV0BwvNScJDN9lo1zMnzp-0mmMnBs0xIqA-R_Z0uZBmt4ZPHElOI4v6NsYnBFZUErePQXVfzivY18rkqQZLHJWm9lNrE_9HMLopCJHeuxYgPNHYwxuWBJvJEcnR2SJxwQpkiCTbSCFu2lU3UCP5s8Ap0wEsZaaAwenuGFPQ2pc4sC6ceIPjC_t3wrHa0k0auNjWIwN4uFjbIo4g8pC3Zm513tu3Fo_s-omz3J97jQVf9hRjotHLr7sM-P38MGh9YkbRVPqKCwePXn2SSIz77GwdSC83xNnLusksm6DmRqZla4nY7jlhz4QUMJy3hm3mIVINbUZDZdetrC8Jmp4YasxzMkARem2j8d32CYNb-iWwdA0 HTTP 302
https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==

Request Chain 54

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_511_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDI0NWE3MjZlNWQ0MDAyYTQ0ODc1MTNhNDkwNTQzYWQ3JTI2cm5kJTNEMTEyMzYwMTU%3D&t=1621354490670&rnd=96563367&i=1 HTTP 302
https://xml.pushking.net/icon?sid=245a726e5d4002a4487513a490543ad7&rnd=11236015 HTTP 302
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=4094&f=/img/6217-0de96f36&ft=1&geo=FR&r=69289-829 HTTP 302
https://b70.info/img/6217-0de96f36

Request Chain 55

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_717_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDBiNmQ4MTAwNzlkYmFhNWY4YTdiNWZiOWY0MDAxNmQ3JTI2cm5kJTNEMTEyMzYwMTU%3D&t=1621354490670&rnd=179371463&i=1 HTTP 302
https://xml.pushking.net/icon?sid=0b6d810079dbaa5f8a7b5fb9f40016d7&rnd=11236015 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|ci9agS5PuoT-imxJOKGMWaPe-Qldr2erQnD0N6-2NXEDkQfI7lXv4RAAXihySq46&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=2b6fcf7b-b7f4-11eb-81ac-e4434b15122e&psid=776696&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTY0ODcyLzMyOHgzMjgvNDkyeDB4MzI4eDMyOC9hSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwTHpJd01Ua3RNRGN2TVRBeE9USTBMelExWWpGaE5UYzVZekExTWpnelpUTXpZVEl4T0RrMk9EbGlOMkUwTmpGaUxtcHdady53ZWJwP3Y9MTYyMTM1NDQ4OS1GRzF5YldxbkphZzBndUNNRktKZEpPSjZLdzB6dzg5cjlta1hBNktBbVhj HTTP 301
https://s-img.adskeeper.co.uk/g/8164872/328x328/492x0x328x328/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp?v=1621354489-FG1ybWqnJag0guCMFKJdJOJ6Kw0zw89r9mkXA6KAmXc

Request Chain 56

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_700_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGQzODMzZjE1ZmQzZmVkNTBlYTRjMzUyOTQ3ZDgxNWIxJTI2cm5kJTNEMTEyMzYwMTU%3D&t=1621354490670&rnd=279957706&i=1 HTTP 302
https://xml.pushking.net/icon?sid=d3833f15fd3fed50ea4c352947d815b1&rnd=11236015 HTTP 302
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|pZAIluf_2JSZaXUuBwNT3fEMHA3UISBYVhSPglZqmbFjcR4WktuPxK1Oj7KE6gsm&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=2b6f4061-b7f4-11eb-820b-e4434b374c12&psid=776696&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY28udWsvZy84MTkzNTM1LzMyOHgzMjgvOXgweDk5NHg5OTQvYUhSMGNEb3ZMMmx0WjJodmMzUnpMbU52YlM5MFpXMXdMekl3TVRndE1USXRNVFV2TVRBeE9USTBMekJoTWpBelpUSmtZMlJoWWpZNE1USmhaR0ZqTmpVME1UVXlOalV6WmpGaExtcHdaejkwUFRFMU5EUTVNemM0T1RFNU5qRS53ZWJwP3Y9MTYyMTM1NDQ4OS1RUUpsNjk2dndXcnc4X0cwR182b1ltYXV1eWY3UWoyRUwtLXdia3gxbXZr HTTP 301
https://s-img.adskeeper.co.uk/g/8193535/328x328/9x0x994x994/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp?v=1621354489-QQJl696vwWrw8_G0G_6oYmauuyf7Qj2EL--wbkx1mvk

Request Chain 57

https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoJ6awBqyP-HetN06bsjfCZ3QBJ6FlRx31aRkPb3ZKFFVRXaOwXa7MgVNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xCHvs-y4LkGroftWfJ7n5sZvnKCsPSER2cuCMzwJRsJuTI8hO8tIaF3M3JBdlq6qOrJtxJw6aoMvQ2JmygaGTkOFkDfcxr3bJOBQinM2XLKF1QgsFwzMqLmKLbBqFhKzJXeuw4kkDdyTzpYxk1FbbVAztwwj35Oe1jbzwEyaGgzcKVOFgzg1Yo6DaCoGjW3b5rtrLgEXXZ576bTZT0cTpgTRZu2FT2OD_N3t4udeDYvIOwpM4db9ynEGdarpz60izIxlMQ1QFCFuwdnv9nAKd5oJ-C_CQJnVy8wlHglE0phRTMApnd6l907x5aux83mi5vHq133zxZXJ36sM8NZxDrG0vSvFQUmjtr95kI1C3rB4WCB6IH-jOGoV61Iel0JfhEBPHvjAbNa99LO9pVLWi0ylYsebDNYLZcDennHvyLUpYhplAUJs3MUipU2N-GQv4aHBzqVLySQpXI8r5wQvGBYEMoFjye8hscu5rYbVWKA4v5VppPpKYcLwkGV1EvaFSf-ttSkAk-MPx-ZreIWhsM3nnVR-cBWiPxREXqV_99m1RvC2HRNAHiG4HSGlDrn6bMFxeuc6BMnHN-G-hMUxh8ciO3NOwA0NLbGMxN2spCoO7-7EBVxXCIknBCdL_UIVvIOm-Z9UDfsj8qHlijHljxBJwkDpmzZNQRCgYKkhuzaT9E0-4-Gz7KRqmdUmdH5FBAJClvcOthNxOrFzv3bgWnAVz5U5CbByvKc11NRdRJSWl6QnEzr3_43QlvcT_JSEV_bakiOuMXRp4w3wM6RFt4OJGox3SQBkTcakTPJWww3QzLITgA7PiL6Ld-Lmxr0PkuD9dbE7dfL-LkRPz_X-Zc5hmZJHK0NRYcG9HAwwSNShIi1oktqn36Akp_uRoLJd-Bqv5jtd3ra7rY0XRRGvs-Peko1weGYJQLCXYwknsSXjyx-kEgtLdupeAFnGbYAQUntavJvAMZtMH7lZUxNSqPdc62h_h21amGClihE5IkhKAk2hZezhTVByV8wOywXHzxxVgEnVQQzGUNtYlP930zrY4KTKM4fwIpPnLz2ndkTscg3EhOIpNnxG25PZpmg HTTP 302
https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.cpasbien.me/
Redirect Chain

http://cpasbien.me/
http://www.cpasbien.me/

45 KB
9 KB

244ms
201ms

Document
text/html

2a00:1450:4001:831::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.cpasbien.me/

Protocol

HTTP/1.1

Server

2a00:1450:4001:831::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8470e2a8007f8a6d05931efbc084f93b1bc3129b57a8bdf65b1dc1a45be41fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.cpasbien.me
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/html; charset=UTF-8
Expires: Tue, 18 May 2021 16:14:37 GMT
Date: Tue, 18 May 2021 16:14:37 GMT
Cache-Control: private, max-age=0
Last-Modified: Tue, 20 Oct 2020 00:52:45 GMT
ETag: W/"1798b644a7d806ae40b6b812a9cfa6dc8de348e13337b0bf8f5b19680949c55d"
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 8676
Server: GSE

Redirect headers

Server: nginx
Date: Tue, 18 May 2021 16:14:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 46
Connection: keep-alive
Location: http://www.cpasbien.me/
X-Served-By: Namecheap URL Forward

GET
H2 200 1007218368-widget_css_bundle.css
www.blogger.com/static/v1/widgets/ 31 KB
31 KB 88ms
20ms Stylesheet
text/css 2a00:1450:4001:809::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/1007218368-widget_css_bundle.css

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7f0b231a0f8c3dbb14d125b46e8d3b0759ff2f20f60dd370b60228490709867

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 14 May 2021 12:05:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 09:23:08 GMT
server: sffe
age: 360552
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31627
x-xss-protection: 0
expires: Sat, 14 May 2022 12:05:26 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 15ms
13ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:38 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2238465
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5631
cf-request-id: 0a21db120e00004ac2f0264000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r6mYDv7PvS1tTJJ9ZVrENaRLXYRjVZCI72z572GrS6zcGd8LU4acvUra8Oo%2FhzqxMVAMtxYsuqX3PZt9dZmcfTRMZ%2FzojGerPENuEJW8lHyqnNYj9F1Ts2Ob5O4UE4W%2BqA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 651661301bc14ac2-FRA
expires: Sun, 08 May 2022 16:14:38 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 17 KB
1 KB 25ms
24ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow:400,400i,700,700i|Montserrat:400,400i,700,700i|Raleway:400,400i,700,700i

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6b1a462e8a583814bbdcaedc645b15bdac617e0a44b087c2cfdadccee0ad0f55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 18 May 2021 16:14:38 GMT
server: ESF
date: Tue, 18 May 2021 16:14:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 18 May 2021 16:14:38 GMT

GET
H2 200 790768cd-990a-4c56-beff-3c8aa2872b4c.jpg
eep.io/mc-gallery/b45188d81e97f11a3d6e10689/images/ 36 KB
37 KB 123ms
45ms Image
image/jpeg 184.30.16.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eep.io/mc-gallery/b45188d81e97f11a3d6e10689/images/790768cd-990a-4c56-beff-3c8aa2872b4c.jpg
Requested by: Host: www.cpasbien.me
URL: http://www.cpasbien.me/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 184.30.16.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-149.deploy.static.akamaitechnologies.com
Software: UploadServer /
Resource Hash: c09e28b2ca8f4af46d7eed363b2f98e0109f10a938c45438c1cb5d55107abe60

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:38 GMT
content-type: image/jpeg
x-guploader-uploadid: ABg5-Uz-ZmxxVoqEEeiko78-t2U8od6HvmQig6YPYWCjQAfcjqjjAYK73yA57MAc-FM7n2pnxVgfUVf0NHubh02SSWI
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 37170
last-modified: Thu, 03 Oct 2019 15:56:17 GMT
server: UploadServer
etag: "b062b4921e31b1eed17f29b1d7268133"
x-goog-hash: crc32c=puVEVQ==, md5=sGK0kh4xse7Rfymx1yaBMw==
x-goog-generation: 1570118177889222
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37170
accept-ranges: bytes
x-robots-tag: noindex, nofollow
expires: Wed, 18 May 2022 16:14:38 GMT

GET
H2 404 mclandingpage.js
eep.io/mc-release/1.1.19f92e61c6ba1af3e562392fb5dec50bb23c82140/js/mojo/ 0
0 455ms
357ms Script
text/html 184.30.16.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eep.io/mc-release/1.1.19f92e61c6ba1af3e562392fb5dec50bb23c82140/js/mojo/mclandingpage.js
Requested by: Host: www.cpasbien.me
URL: http://www.cpasbien.me/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 184.30.16.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-149.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

open
mc.us20.list-manage.com/pages/track/
Redirect Chain

http://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0
https://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0

0
1 KB

260ms
175ms

Script
application/json

23.79.149.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0
Requested by: Host: www.cpasbien.me
URL: http://www.cpasbien.me/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.79.149.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-149-111.deploy.static.akamaitechnologies.com
Software: openresty /
Resource Hash

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:38 GMT
content-encoding: gzip
referrer-policy: same-origin
server: openresty
vary: Accept-Encoding
content-type: application/json
content-length: 20
x-ua-compatible: IE=edge,chrome=1

Redirect headers

Location: https://mc.us20.list-manage.com/pages/track/open?u=b45188d81e97f11a3d6e10689&id=030080f9e1f0
Date: Tue, 18 May 2021 16:14:38 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H2 200 icon18_wrench_allbkg.png
resources.blogblog.com/img/ 475 B
612 B 13ms
6ms Image
image/png 2a00:1450:4001:809::2009
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 15 May 2021 05:47:31 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 12:12:59 GMT
server: sffe
age: 296827
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 475
x-xss-protection: 0
expires: Sat, 22 May 2021 05:47:31 GMT

GET
H/1.1 200
OK cookienotice.js Show response
www.cpasbien.me/js/ 6 KB
2 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:831::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.cpasbien.me/js/cookienotice.js

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

HTTP/1.1

Server

2a00:1450:4001:831::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.cpasbien.me
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://www.cpasbien.me/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 18 May 2021 03:59:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 17 May 2021 21:21:58 GMT
Server: sffe
Age: 44108
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=604800
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Content-Length: 2026
X-XSS-Protection: 0
Expires: Tue, 25 May 2021 03:59:30 GMT

GET
H3-29 200 75914390-widgets.js Show response
www.blogger.com/static/v1/widgets/ 145 KB
53 KB 36ms
10ms Script
text/javascript 2a00:1450:4001:809::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/75914390-widgets.js

Requested by

Host: www.cpasbien.me
URL: http://www.cpasbien.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c733c892b5b0c222708477ba428d1838215af99ef8b04c5934c8a32d07fe82f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 20:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 18:50:45 GMT
server: sffe
age: 416863
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53850
x-xss-protection: 0
expires: Fri, 13 May 2022 20:26:55 GMT

GET
H2 200 5c396408-c271-4316-8668-3af5df8ca040.jpg
eep.io/mc-gallery/b45188d81e97f11a3d6e10689/images/ 174 KB
175 KB 82ms
68ms Image
image/jpeg 184.30.16.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eep.io/mc-gallery/b45188d81e97f11a3d6e10689/images/5c396408-c271-4316-8668-3af5df8ca040.jpg
Requested by: Host: www.cpasbien.me
URL: http://www.cpasbien.me/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 184.30.16.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-149.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 618665c855f4c22e31426142bf580d63586f7fa483043fa1967614a8f8418e9c

Request headers

Referer: http://www.cpasbien.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:38 GMT
last-modified: Thu, 03 Oct 2019 15:46:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA54
etag: "855d82194a91e01b754e94ec3a58172c"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 178255
x-amz-cf-id: H_qaSiXamj-XzEv_fj4OrbI0CtQ70s3oibYHM_QdjWN2irC12hRrJw==
expires: Wed, 18 May 2022 16:14:38 GMT

GET
H2 200 tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXw.woff2
fonts.gstatic.com/s/archivonarrow/v12/ 18 KB
18 KB 21ms
14ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo+Narrow:400,400i,700,700i|Montserrat:400,400i,700,700i|Raleway:400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79a55cb67645da5f76d990ad52d179d986e1658149d6d67cf63394417eb10b2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://www.cpasbien.me
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 16 May 2021 05:35:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 01 Sep 2020 03:49:20 GMT
server: sffe
age: 211127
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18008
x-xss-protection: 0
expires: Mon, 16 May 2022 05:35:51 GMT

GET
H2 200 tss3ApVBdCYD5Q7hcxTE1ArZ0b5LrGld-9I.woff2
fonts.gstatic.com/s/archivonarrow/v12/ 18 KB
18 KB 19ms
13ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/archivonarrow/v12/tss3ApVBdCYD5Q7hcxTE1ArZ0b5LrGld-9I.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo+Narrow:400,400i,700,700i|Montserrat:400,400i,700,700i|Raleway:400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

221815c51fde0eb187cdcee6d505f8c37bce4a4879df22bd0cdc39becdba8df1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://www.cpasbien.me
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 22:12:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 01 Sep 2020 03:49:22 GMT
server: sffe
age: 410535
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18048
x-xss-protection: 0
expires: Fri, 13 May 2022 22:12:23 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v19/ 46 KB
46 KB 18ms
13ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo+Narrow:400,400i,700,700i|Montserrat:400,400i,700,700i|Raleway:400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://www.cpasbien.me
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 10:38:22 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:37:32 GMT
server: sffe
age: 452176
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47272
x-xss-protection: 0
expires: Fri, 13 May 2022 10:38:22 GMT

GET
H2 200 1Ptsg8zYS_SKggPNyCg4TYFq.woff2
fonts.gstatic.com/s/raleway/v19/ 48 KB
48 KB 21ms
16ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptsg8zYS_SKggPNyCg4TYFq.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo+Narrow:400,400i,700,700i|Montserrat:400,400i,700,700i|Raleway:400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71867ca10f1cd0c8ff620addb9fc27494f1681f0359a9e3fc8a0e26b7f93a102

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://www.cpasbien.me
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 May 2021 21:40:18 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:22:16 GMT
server: sffe
age: 585260
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49400
x-xss-protection: 0
expires: Wed, 11 May 2022 21:40:18 GMT

GET
H/1.1

200
OK

448935
ps.popcash.net/go/213592/
Redirect Chain

http://popcash.net/world/go/213592/448935
http://ps.popcash.net/go/213592/448935

470 B
497 B

205ms
178ms

Document
text/html

34.204.217.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://ps.popcash.net/go/213592/448935
Requested by: Host: www.cpasbien.me
URL: http://www.cpasbien.me/
Protocol: HTTP/1.1
Server: 34.204.217.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-204-217-156.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Host: ps.popcash.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.cpasbien.me/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://www.cpasbien.me/

Response headers

Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 18 May 2021 16:14:39 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 309
Connection: keep-alive

Redirect headers

Date: Tue, 18 May 2021 16:14:39 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: http://ps.popcash.net/go/213592/448935
CF-Cache-Status: DYNAMIC
cf-request-id: 0a21db14e400002bd6470b0000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MjCI1qWidR6tx32dna%2BQRMToBH1o6O2x0ZgUQ2in1dpfSzdqMDP1Qz3tOGhuZHMJPMt8kJ25GnYR3DfC%2FSLEr9Avs1XFHkvCv5X7VpziycWsPBx%2FXeZlNA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 651661349d4f2bd6-FRA

GET
H2

200

sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js Show response
dualsale1.xyz/
Redirect Chain

http://ps.popcash.net/ad/ad?p=213592&w=448935&t=e2d0e5f3422e1ac7&r=aHR0cCUzQSUyRiUyRnd3dy5jcGFzYmllbi5tZSUyRg==&vw=1600&vh=1200
http://fergas-fri.com/zcvisitor/257945aa-b7f4-11eb-bcbf-0aa2fa0f020d/7fcf9220-c93c-11e7-9820-0e06c6fba698?campaignid=18c21260-4e55-11ea-8d5c-12e5dcaa70ed
https://feed.rexadvert.xyz/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=juliet-jot-04kuiuen5_all_fr&kw=arts%2Centertainment%2Cmovies%2Cmusic%2Cmen%2Cwomen%2Cgames&cid=zr257945aab7f411e...
https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js

10 KB
4 KB

831ms
158ms

Document
text/html

173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Requested by: Host: ps.popcash.net
URL: http://ps.popcash.net/go/213592/448935
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: 4ab0afd73797c23b9621ca47eb651f12bd043bed9acfd524731b5d2ff99fa997

Request headers

:method: GET
:authority: dualsale1.xyz
:scheme: https
:path: /sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: http://ps.popcash.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://ps.popcash.net/go/213592/448935

Response headers

server: nginx
date: Tue, 18 May 2021 16:14:41 GMT
content-type: text/html
content-encoding: gzip

Redirect headers

server: nginx
date: Tue, 18 May 2021 16:14:41 GMT
location: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js

GET
H2 200 css
fonts.googleapis.com/ 6 KB
803 B 23ms
17ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Requested by

Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a717ffda5397cefca88d5c009df837db88d5be739693c6e7d350bfdb2726e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 18 May 2021 14:45:22 GMT
server: ESF
date: Tue, 18 May 2021 16:14:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 18 May 2021 16:14:42 GMT

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp
s-img.adskeeper.co.uk/g/8164832/328x328/204x0x430x430/
Redirect Chain

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_717_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDVlZWJkNTMxNjA0NzIyZWQwZGFiMGZmMWYzMjRjOWM1JTI2cm5...
https://xml.pushking.net/icon?sid=5eebd531604722ed0dab0ff1f324c9c5&rnd=928243224
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|FII_LYsb2Ap_lZZBRIVERPf2-2CxOu2bz5m5bpLQsPnnAcaqcUaJ9rgRF07glY-z&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f0a33e-b7f4-11eb-81ac-...
https://s-img.adskeeper.co.uk/g/8164832/328x328/204x0x430x430/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp?v=...

5 KB
6 KB

49ms
40ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164832/328x328/204x0x430x430/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp?v=1621354480-WUuOODls3Rkp74M4iaq7axUuN2JTcOoQkRMsiOCGgxk
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08174b3d13ab074e28edde32bceddeca919ea330ee3740d62185af9af11a75b9

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: HIT
x-mg-request-uuid: f7835adc-0235-4e6a-beff-629bcc07ac67
age: 2200720
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5348
cf-request-id: 0a21db26ed000032aaaf27c000000001
last-modified: Mon, 08 Feb 2021 10:22:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661517ffd32aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 27c78dbe-2b5b-4501-9f36-394b9ae173db
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164832/328x328/204x0x430x430/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp?v=1621354480-WUuOODls3Rkp74M4iaq7axUuN2JTcOoQkRMsiOCGgxk
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614fcbab32aa-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db25db000032aa63a56000000001
server: cloudflare

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDIvMTAxOTI0L2U5NjFhNmQxN2U5YWM1MTg2ODkzNDBlNWYzMmFmNzA3LmpwZw.webp
s-img.adskeeper.co.uk/g/8164853/328x328/0x0x492x492/
Redirect Chain

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_700_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGUyMTc1ZWE1ZGI0Yjc0YWY2ZjAzODg1OWJjNGVmYjlmJTI2cm5...
https://xml.pushking.net/icon?sid=e2175ea5db4b74af6f038859bc4efb9f&rnd=928243224
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|PkAwqYpVjrUJFb_qSKsZYqU8xbDH_o8xak2ExdIkymX0xg8Y_UQyhtta96nqCJBa&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f04b34-b7f4-11eb-b42d-...
https://s-img.adskeeper.co.uk/g/8164853/328x328/0x0x492x492/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDIvMTAxOTI0L2U5NjFhNmQxN2U5YWM1MTg2ODkzNDBlNWYzMmFmNzA3LmpwZw.webp?v=1621354480-YA4V9LegJGkJYc1d-ne0...

4 KB
4 KB

41ms
28ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164853/328x328/0x0x492x492/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDIvMTAxOTI0L2U5NjFhNmQxN2U5YWM1MTg2ODkzNDBlNWYzMmFmNzA3LmpwZw.webp?v=1621354480-YA4V9LegJGkJYc1d-ne0YHtjGFWf9ioBQA5qmWaORPw
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca5b07bfc5efde012c887bc6d600039d9368a9aa5221ea7cdfba4f1a253212e6

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: HIT
x-mg-request-uuid: d03ca842-7379-4f7a-b04e-83acf1c428a7
age: 2196955
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4196
cf-request-id: 0a21db26db000032aa40032000000001
last-modified: Mon, 08 Feb 2021 10:25:43 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661515fb832aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 825159f8-b15d-41f7-9eba-00d158fa64cd
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164853/328x328/0x0x492x492/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDIvMTAxOTI0L2U5NjFhNmQxN2U5YWM1MTg2ODkzNDBlNWYzMmFmNzA3LmpwZw.webp?v=1621354480-YA4V9LegJGkJYc1d-ne0YHtjGFWf9ioBQA5qmWaORPw
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614fcbb832aa-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db25dc000032aa7f883000000001
server: cloudflare

GET
H2

200

Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJ...
fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/
Redirect Chain

https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_651_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDNmM2UzYzA4MTAzNjY0ZTlmYmY0NDFiYWJhMmZkNGZmJTI2cm5...
https://xml.pushking.net/icon?sid=3f3e3c08103664e9fbf441baba2fd4ff&rnd=928243224
https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoLgNjQvrdS-FtN06bsjfCZ1FpCJXm0PLqLelTBfxAxq31rCOkguHZOpNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIm...

3 KB
3 KB

98ms
97ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:43 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:43 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==
access-control-allow-methods: POST

GET
H2

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp
s-img.adskeeper.co.uk/g/8164835/328x328/91x67x969x969/
Redirect Chain

https://towerfriend1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_5_776_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwuY3BjbWFydC5jb20lMkZpY29uJTNGc2lkJTNEYjk2ODEwN2VkODk4YTVhYzhkMzVmNDYyMGZkZGQ4YTMlMjZybm...
https://xml.cpcmart.com/icon?sid=b968107ed898a5ac8d35f4620fddd8a3&rnd=769521131
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|wYB-zor5nwPeJg_9o1TXidUBZXglS2GQ7moykPpTt5lqhFidereHmEO_0dstDySB&cid=904958&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25efb732-b7f4-11eb-9f0b-...
https://s-img.adskeeper.co.uk/g/8164835/328x328/91x67x969x969/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp?v...

11 KB
11 KB

54ms
53ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164835/328x328/91x67x969x969/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp?v=1621354480-jRxGxGIP3O6awPv_3kfhc4ovRTHdCakrGx8jCpi4dt4
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c87525169a7284c9966c919fa3a68fc2d8051200a53ce84c6ec3a83f67d1ec

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: HIT
x-mg-request-uuid: e2b86c52-e42b-4e0a-8351-41b5a2a46236
age: 2200765
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10854
cf-request-id: 0a21db266d0000ee4c7eb51000000001
last-modified: Mon, 08 Feb 2021 10:20:33 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 65166150aee1ee4c-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 91fca302-2765-46cb-9a3b-693c9dd8c722
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164835/328x328/91x67x969x969/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp?v=1621354480-jRxGxGIP3O6awPv_3kfhc4ovRTHdCakrGx8jCpi4dt4
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614fbba632aa-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db25d8000032aa75265000000001
server: cloudflare

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp
s-img.adskeeper.co.uk/g/8193506/328x328/88x0x401x401/
Redirect Chain

https://ibwood1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_6_694_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHBjdHJhZmZpYy5jbyUyRmljb24lM0ZzaWQlM0RiZThiZDg1MWJkYmNmNWI2YWJiNWI2ZjE1YTljMTI3MSUyNnJuZCU...
https://xml.ppctraffic.co/icon?sid=be8bd851bdbcf5b6abb5b6f15a9c1271&rnd=677218085
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|b8NYnhlWBJsMclyDFLvmzKRCOOg4s7bB0r7aAAkMPpLn7FAqDIsf6eX-NLs12Aq7&cid=861229&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f01b54-b7f4-11eb-a42a-...
https://s-img.adskeeper.co.uk/g/8193506/328x328/88x0x401x401/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp?v=1...

11 KB
12 KB

46ms
41ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8193506/328x328/88x0x401x401/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp?v=1621354480-GWfbqla4EPruMbhGkddjtHU--BZnbo7G-P1Buav-aOE
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f3d3c8458599c1a2156ff679d6300402d42a93410d795609e7cb9087c735046

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: HIT
x-mg-request-uuid: 7d23a5fb-e070-4484-9a12-4117c7bceb1b
age: 2200060
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11518
cf-request-id: 0a21db2748000032aaa68c3000000001
last-modified: Wed, 10 Feb 2021 07:16:13 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 65166152096832aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:43 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: fca0cc88-f9e4-487d-96ac-5449ed9b7d8a
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8193506/328x328/88x0x401x401/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp?v=1621354480-GWfbqla4EPruMbhGkddjtHU--BZnbo7G-P1Buav-aOE
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614fcbaa32aa-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db269a000032aab23ae000000001
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp
s-img.adskeeper.co.uk/g/8164832/492x328/96x0x652x434/ 8 KB
8 KB 282ms
30ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164832/492x328/96x0x652x434/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDUtMDgvMTAxOTI0LzViZmYzMWUxZGE3ZTk1MGE3YjUxZDA4OGM4MDg3OGQ5LmpwZz90PTE1MjU4NDA2NTIzMjY.webp?v=1621354480-Va09xx3vZnZUr-0xMK8t7Yo4C1I1993rtbiCf8BT3hg
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56a28f2d9efbcc5908c310f42bf9fc6cdbb5aadd42f79365a60e5b226af2e62c

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 5a634b80-b935-4a45-9e8f-84bbf1d4c137
age: 2200727
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8408
cf-request-id: 0a21db22dd0000ee4cdd28b000000001
last-modified: Mon, 08 Feb 2021 10:20:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614afb21ee4c-CDG

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzM6MixjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDIxLTAyLzEwMTkyNC9lOTYxYTZkMTdlOWFjNTE4N...
s-img.adskeeper.co.uk/g/8164853/492x328/-/ 8 KB
8 KB 279ms
28ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164853/492x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzM6MixjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDIxLTAyLzEwMTkyNC9lOTYxYTZkMTdlOWFjNTE4Njg5MzQwZTVmMzJhZjcwNy5qcGc.webp?v=1621354480-7oBSIqe2eSwhBkFfHv38PI9f6GuGFA_8V2Baj2nU7mw
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f59e7ae8d406307c55571fc0f090138ed57825217bc4e5f83898a325bbed9301

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 8bd338f4-bc39-4054-a29d-d4a0ec0a01ee
age: 2200741
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8184
cf-request-id: 0a21db22de0000ee4cc80c7000000001
last-modified: Mon, 08 Feb 2021 10:20:27 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614afb26ee4c-CDG

GET
H2

200

https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoLgNjQvrdS-FtN06bsjfCZ1FpCJXm0PLqLelTBfxAxq31rCOkguHZOpNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIm...

3 KB
3 KB

312ms
100ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:42 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/25fa3570-b7f4-11eb-b0ec-0a5b35dc083d/2/8da89260-c0c7-11e8-b146-0ae8b840b174/Fs1rbBOT_YjFJJsnz2SiBR3_xjwjY8inLfKCDCl6wasOu2SO2y6EJpJIZDKQOs0X3G6ZPZy9tmro9PVazl_tauFmEN8CsIme-5Tc1A2ZOkgfx6rkPLsLGOe-DouvtthATrO1IIOaJakgxdSGs_9EEAaEogXeEwlOJRzDyqOxWHWXnGTds12Q-CQlNqr8T4SP1IpoJAzHsDNav7nv1fMnv7LDRBLxYFlOu_7yKlUkhja6PdAZA4WEw9FsjxGFx1m0vSDtuMoemFkaprlYvonB7eKI6eLaCq3pqtJGMkbhJgCka2v3aQEfgh6w7_zmJ7hB06q59FpbIj6CI8weLHwcUa3pHcqaaMOk2ODwbeoMvQYoZeMrbHPikq-33EOmHQjHsMS04y7kIFrG4qEhhmW2iEfxHX-xPuR0gF9-Aa3pz26dDQMQyWWvsyUBJnZ_KvyYKeCAb-04p8QuZ20w6AsB6P2iFP8PUcPBdIVIyVnT7nLnL0L3ginBF3eFKY8dPNw7Bbl5zASNIh_TWdRH-TBywZps_dR2f5gfDS8PGtwd77S0xsENecYk-HO-WO_frHdz92JsdOW0dKQ0XV7w84SrC2Oodbbqdebbrm1ehnYYOEkeqFu_lDWc_64a3AUkKD67WgIoV7vUpkBGrpeJLZA826YYHp4_K74ulNmSTl-45qaNrtfXFoxSpg05K6l9Q_gbw93pqWPXxFdKDNkr3eHDnj_X_HLFtFEEh7PoXbFVYyMlX5mAFM8zMA==.2D1Qt-4T2Tixu-2I3xmRAg==
access-control-allow-methods: POST

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp
s-img.adskeeper.co.uk/g/8164889/328x328/0x124x565x565/
Redirect Chain

https://xml.cpcmart.com/icon?sid=ddb4e7670a512f5e66e9d3cf128adb07&rnd=769521131
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|XFNQDMrudI_G86kujG4PjBY2kgI_KlftaniUFFAE9Hy0mvqSBMtxk39k52kotIzi&cid=904957&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25eff040-b7f4-11eb-a42a-...
https://s-img.adskeeper.co.uk/g/8164889/328x328/0x124x565x565/aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp?v=1621354480-WhtKnVsK4fOmaldmJ...

15 KB
16 KB

89ms
89ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164889/328x328/0x124x565x565/aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp?v=1621354480-WhtKnVsK4fOmaldmJ70L9R-y_SAUMPfaQ4wiF43BAXc
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbfabc91b64aa11c14ed6cfe66d6a9d04973d0b2172bb9f0fa08b13c4728f994

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 692de8f3-5b96-489f-a2d9-d41def09d1fe
age: 2200726
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15734
cf-request-id: 0a21db2512000032aa968ae000000001
last-modified: Mon, 08 Feb 2021 10:20:40 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614e888d32aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 90c236d9-eb64-4805-a2ad-9d05bbabc1a3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164889/328x328/0x124x565x565/aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp?v=1621354480-WhtKnVsK4fOmaldmJ70L9R-y_SAUMPfaQ4wiF43BAXc
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614df8dcee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db24c00000ee4c8c362000000001
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp
s-img.adskeeper.co.uk/g/8164889/492x328/0x124x565x376/ 18 KB
18 KB 304ms
54ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164889/492x328/0x124x565x376/aHR0cDovL2ltZ2hvc3RzLmNvbS90Yy8yMDE5LTA2LzEwMTkyNC9hY2JhYmRlMmRjNTkzODFkMzAyYzhkMmM4ODEyOWE2Ny5qcGc.webp?v=1621354480-6aZfy2JTE31oqEO-3dmd0CGF_EJHEYV9ktiUIu8KXcs
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9147e56702cac804cff4b646db96efe455be370caeba029965acd0f375d00da1

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 2c294377-9430-4479-aa14-deb25497a6bc
age: 2200776
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18200
cf-request-id: 0a21db22e10000ee4c8180d000000001
last-modified: Mon, 08 Feb 2021 10:20:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614afb2aee4c-CDG

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp
s-img.adskeeper.co.uk/g/8164912/328x328/181x0x744x744/
Redirect Chain

https://xml.cpcmart.com/icon?sid=18d9bd2753d62b946d59ee74706ed720&rnd=769521131
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|qaWuyR2fpZHQuyPs-Drzf043tHj4SEvPcqgbuAejHNUaVVWlVF13a__WcQwv7sZf&cid=904959&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25efbe85-b7f4-11eb-9f0b-...
https://s-img.adskeeper.co.uk/g/8164912/328x328/181x0x744x744/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp?v=1621354480-RcVbeHGgAu3N75lHO...

9 KB
10 KB

61ms
61ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164912/328x328/181x0x744x744/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp?v=1621354480-RcVbeHGgAu3N75lHOellQEar7dFyEGzVOY_OWD8CCDs
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d59d021664d5ed1b12affa7a3b96d567b4a42c8f325e9233fdb5d26d1298a67

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 9b7c2f98-4fc4-4d2c-af6a-78c35d080306
age: 2200730
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9718
cf-request-id: 0a21db2513000032aa922e0000000001
last-modified: Mon, 08 Feb 2021 10:20:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614e888e32aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: a8b60589-dda7-4679-ad8c-9155d4c1996b
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164912/328x328/181x0x744x744/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp?v=1621354480-RcVbeHGgAu3N75lHOellQEar7dFyEGzVOY_OWD8CCDs
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614df8dbee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db24bf0000ee4c9987d000000001
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp
s-img.adskeeper.co.uk/g/8164912/492x328/0x0x1081x720/ 12 KB
13 KB 287ms
45ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164912/492x328/0x0x1081x720/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDkvMTAxOTI0L2I5Y2U2M2E3ZDIyNjFlZGEwMzQzZDRjZGViZDNmN2Q3LmpwZWc.webp?v=1621354480-VNbBmxpTzImNr31feQVFxVEXEkZ8AS4NIrcWKmYg29Y
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9890b523125c63685ab6e157e022072740363afb75a023b694cec0b986a25481

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: 2b9d4d2e-5aad-4fcd-95bd-b5197d2ae17a
age: 2200784
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12790
cf-request-id: 0a21db22df0000ee4ca606a000000001
last-modified: Mon, 08 Feb 2021 10:20:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614afb2cee4c-CDG

GET
H3-29

200

6217-0de96f36
b70.info/img/
Redirect Chain

https://xml.ppctraffic.co/icon?sid=6c85c4f181d8d7fd9e3bd06d62cc9047&rnd=677218085
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=3522&f=/img/6217-0de96f36&ft=1&geo=FR&r=69280-1417
https://b70.info/img/6217-0de96f36

18 KB
19 KB

14ms
13ms

Image
image/png

2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217-0de96f36
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7327e3c5fb6bd317798360df415b74870a7062841f7ed1c8bd2912916a3c6fa8

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185359
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18410
cf-request-id: 0a21db24e400004e3df7873000000001
last-modified: Sun, 16 May 2021 12:18:01 GMT
server: cloudflare
etag: "60a10d79-47ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ensc3I913HOMscdFKSlI%2BEWJlDXyCaK%2Fs01IOps9vJcvFkkMBaqdP2WKso%2FK70Q%2BjxsWUwBUJgb%2FKPFxM0AeNoJ1XJnluDPNTzK144dFXQGpAYSK3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6516614e3e784e3d-FRA

Redirect headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0meoFTwF%2FLaWKzREBiXQBZfqDDSB%2BbYmRtLueNxwvsUtP%2Fpp41ktQRP2iq%2FZhG86SYtxN2qIP0Bg2KCs6hGMMLBM%2BawZzQ48vYfNTgHmqVxOcP01EQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: , /img/6217-0de96f36
cf-ray: 6516614dfded4e3d-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db24ba00004e3d998e9000000001

GET
H2 200 6217_64ca0074
b70.info/img/ 50 KB
51 KB 156ms
12ms Image
image/jpeg 2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217_64ca0074
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a62b37d39aecb605aaadcd802af573faec6534c89679556ed46462ed72295b1

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185359
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51539
cf-request-id: 0a21db23aa00004e132a28e000000001
last-modified: Sun, 16 May 2021 12:26:28 GMT
server: cloudflare
etag: "60a10f74-c953"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=56BCYvvMTDcCIkNEvDL8nMqEb4pvLzpypXHEIrTLVIpwM4YWmD0eUGNLiHSMSY4MTUzmsLnfTIU3rQyRx98G5it1XdyDGPqwJGRsiwb035Hthdb0Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6516614c4fb94e13-FRA

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp
s-img.adskeeper.co.uk/g/8164884/328x328/81x0x667x667/
Redirect Chain

https://xml.cpcmart.com/icon?sid=23d3cdaee57ba15d63490836c91a4a8b&rnd=769521131
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|p3oFVBMD1Uh5lSy4grLklw0r3HmJQLX4tS_Gd3qAB2kMZ8c-0vOFhzz8lI9qb5sN&cid=904956&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=25f002d7-b7f4-11eb-a42a-...
https://s-img.adskeeper.co.uk/g/8164884/328x328/81x0x667x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1621354480-4ZuBUbwSnc4tet481t...

17 KB
17 KB

62ms
61ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164884/328x328/81x0x667x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1621354480-4ZuBUbwSnc4tet481tu4Kixe1goLjOx-KuC_bqwQcVU
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82a27787438fb42a1d78db250abc9f4ca19b78ae63f548626d0bfc65bc641a04

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: c75bde23-7c68-49e4-aedf-70bf6d742d70
age: 2200535
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17434
cf-request-id: 0a21db2512000032aa8bbc0000000001
last-modified: Mon, 08 Feb 2021 10:20:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614e888a32aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: d239c78c-0bf7-4830-8b81-76b2533a78b5
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164884/328x328/81x0x667x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1621354480-4ZuBUbwSnc4tet481tu4Kixe1goLjOx-KuC_bqwQcVU
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516614df8d9ee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db24be0000ee4c730f0000000001
server: cloudflare

GET
H3-29 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp
s-img.adskeeper.co.uk/g/8164884/492x328/0x0x1001x667/ 21 KB
21 KB 154ms
34ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164884/492x328/0x0x1001x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1621354480-I8jxETC_OhhOk3uV-BFNERD6QSNZJq1F9s_jmBUJEiA
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 416ad5ca4d012266fa88ed4a3941d48cb2638e931a9634b4de9434abf2e7572e

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: dac7b9fb-e564-4fda-ba73-4ec058184b17
age: 2200775
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21184
cf-request-id: 0a21db2399000032aa57aee000000001
last-modified: Mon, 08 Feb 2021 10:20:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614c2b2232aa-CDG

GET
H3-29 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp
s-img.adskeeper.co.uk/g/8164835/492x328/0x91x1080x720/ 15 KB
16 KB 153ms
32ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164835/492x328/0x91x1080x720/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTAtMDYvMTAxOTI0LzFmNGE0NmMwN2E1ZTliOTk5NTFhMjVmY2Y2YjhiY2Y3LmpwZWc_dD0xNTM4ODQ3ODI3MzQ2.webp?v=1621354480-n670mMM4x5pBaXA7YFfAGr9h3p4G3HYNfPv-1GJki_I
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d047f42c5906039f405b16f31972cc00b9e08cf5a8e2f5ab21eff54422155fe1

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: f359d7a2-0daa-4d5f-b932-0bb3e5fa45af
age: 2200747
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15574
cf-request-id: 0a21db2399000032aa5108e000000001
last-modified: Fri, 16 Apr 2021 17:18:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614c2b1c32aa-CDG

GET
H3-29 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp
s-img.adskeeper.co.uk/g/8193506/492x328/0x0x582x388/ 14 KB
14 KB 137ms
29ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8193506/492x328/0x0x582x388/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDktMTQvMTAxOTI0LzY2MTg4NzY0MDYxZTNlNGMwZDM0YWIxYzQ3YTRjMDBlLnBuZz90PTE1MzY5NDAyMjYyNjc.webp?v=1621354480-25III2l_JNDVOb2OPeVTBDEYolUdI4qbxeW3rQug05Y
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d8abefde33d47e14e059ef4173465c9a852847346e075ea45bee91036add797

Request headers

Referer: https://dualsale1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:42 GMT
cf-cache-status: HIT
x-mg-request-uuid: f6afa287-f872-409f-8121-e11a5b7de8e0
age: 2200784
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14260
cf-request-id: 0a21db238d000032aa85039000000001
last-modified: Wed, 10 Feb 2021 07:16:02 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516614c1af732aa-CDG

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 46ms
5ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://dualsale1.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 15:35:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 434353
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Fri, 13 May 2022 15:35:29 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 47ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://dualsale1.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 01:43:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 484270
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Fri, 13 May 2022 01:43:32 GMT

GET
H2 200 event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_2000
dualsale1.xyz/ 118 B
211 B 158ms
157ms Script
application/javascript 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_2000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTVlZWJkNTMxNjA0NzIyZWQwZGFiMGZmMWYzMjRjOWM1LTcxNy0wLjAwMDQyNyUyMiUyQyUyMjUzNC1lMjE3NWVhNWRiNGI3NGFmNmYwMzg4NTliYzRlZmI5Zi03MDAtMC4wMDA0NDclMjIlMkMlMjI1MzQtM2YzZTNjMDgxMDM2NjRlOWZiZjQ0MWJhYmEyZmQ0ZmYtNjUxLTAuMDA2ODQ2JTIyJTVEJTdE&t=1621354481928&rnd=759368425&js=1&io=0&if=0
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash

Request headers

:path: /event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_2000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTVlZWJkNTMxNjA0NzIyZWQwZGFiMGZmMWYzMjRjOWM1LTcxNy0wLjAwMDQyNyUyMiUyQyUyMjUzNC1lMjE3NWVhNWRiNGI3NGFmNmYwMzg4NTliYzRlZmI5Zi03MDAtMC4wMDA0NDclMjIlMkMlMjI1MzQtM2YzZTNjMDgxMDM2NjRlOWZiZjQ0MWJhYmEyZmQ0ZmYtNjUxLTAuMDA2ODQ2JTIyJTVEJTdE&t=1621354481928&rnd=759368425&js=1&io=0&if=0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: dualsale1.xyz
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:44 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript

GET
H2

200

sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js Show response
screenauto.xyz/
Redirect Chain

https://feed.rexadvert.xyz/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet
https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js

8 KB
4 KB

568ms
164ms

Document
text/html

173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Requested by: Host: dualsale1.xyz
URL: https://dualsale1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_2000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTVlZWJkNTMxNjA0NzIyZWQwZGFiMGZmMWYzMjRjOWM1LTcxNy0wLjAwMDQyNyUyMiUyQyUyMjUzNC1lMjE3NWVhNWRiNGI3NGFmNmYwMzg4NTliYzRlZmI5Zi03MDAtMC4wMDA0NDclMjIlMkMlMjI1MzQtM2YzZTNjMDgxMDM2NjRlOWZiZjQ0MWJhYmEyZmQ0ZmYtNjUxLTAuMDA2ODQ2JTIyJTVEJTdE&t=1621354481928&rnd=759368425&js=1&io=0&if=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: 1a1a620c1eed9a45667ecab1553c9dc628f61a2dd968876240edd995ecd3eb04

Request headers

:method: GET
:authority: screenauto.xyz
:scheme: https
:path: /sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://dualsale1.xyz/sw_93b43e18-4509-1db7-8e9b-a130d9b8e9a7_101_0_2000.js#pc151445

Response headers

server: nginx
date: Tue, 18 May 2021 16:14:46 GMT
content-type: text/html
content-encoding: gzip

Redirect headers

server: nginx
date: Tue, 18 May 2021 16:14:45 GMT
location: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js

GET
H2 200 css
fonts.googleapis.com/ 6 KB
803 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Requested by

Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a717ffda5397cefca88d5c009df837db88d5be739693c6e7d350bfdb2726e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 18 May 2021 14:25:32 GMT
server: ESF
date: Tue, 18 May 2021 16:14:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 18 May 2021 16:14:47 GMT

GET
H2

200

CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2...
fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/
Redirect Chain

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_651_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNENDM4OGYyODgzMmU0Y2QzZDljMTQ1YjY1NDkzN2JhZGUlMj...
https://xml.planetpush.net/icon?sid=4388f28832e4cd3d9c145b654937bade&rnd=938820327
https://ngp4.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoIU1ounBdJvbtN06bsjfCZ0b1aSe-wgCb5V5wVHqST9Hapt5AeAKBV5NZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMo...

3 KB
3 KB

99ms
98ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:47 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==
access-control-allow-methods: POST

GET
H3-29

200

6217-0de96f36
b70.info/img/
Redirect Chain

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_959_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNENmQ4MjAxZWMwZWY4YTY2MjJiNGQwYzZhY2FiNTFkNjAlMj...
https://xml.planetpush.net/icon?sid=6d8201ec0ef8a6622b4d0c6acab51d60&rnd=938820327
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=4094&f=/img/6217-0de96f36&ft=1&geo=FR&r=69285-2560
https://b70.info/img/6217-0de96f36

18 KB
19 KB

14ms
11ms

Image
image/png

2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217-0de96f36
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7327e3c5fb6bd317798360df415b74870a7062841f7ed1c8bd2912916a3c6fa8

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185364
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18410
cf-request-id: 0a21db367e00004e3da3a93000000001
last-modified: Sun, 16 May 2021 12:18:01 GMT
server: cloudflare
etag: "60a10d79-47ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EhIjNJjGCUzbWvF%2FjnttiWqbeyhrW5XCe%2B6EVUVOZC%2BjnTJ7QXTk3uqhFdMfL9hr0z4qOvtQPJq6yNABY8drl7%2Fg9B9A16GNXI9Fomw0PJiiJVt5Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6516616a6a5d4e3d-FRA

Redirect headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4ZyafNnHSEaIa39JddCFwfG1I9ZuVORHJljgozjNEDh90ua2Ito6sm363aBQdj3WyrJtE1qrt6BtiuccszGwvo13pqw%2FFTrzfrXRDyYDk2ZZLKXBxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: , /img/6217-0de96f36
cf-ray: 6516616a3d954e13-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db366000004e133d1d7000000001

GET
H2

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp
s-img.adskeeper.co.uk/g/8164828/328x328/0x37x767x767/
Redirect Chain

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_700_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNEZTJjODI3NzE0ZDBhYWE3NTk5ZjA4MDgxZGM0N2M3NTIlMj...
https://xml.planetpush.net/icon?sid=e2c827714d0aaa7599f08081dc47c752&rnd=938820327
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|ZwjuW_OnsvU4QJTx-6ozMi26-ZpDrp4fRStLUwErRHEUYP3t2cNCkvuFcfGq4CPX&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=28dfc477-b7f4-11eb-820b-...
https://s-img.adskeeper.co.uk/g/8164828/328x328/0x37x767x767/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp?v=1...

17 KB
17 KB

48ms
47ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164828/328x328/0x37x767x767/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp?v=1621354485-U4O6A4nY9cYDBJEgt0ujsYLXFiCzy5lf-yg3wmt6CTo
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d134f8476916cfd9a9a83b3d7520c6ef553f09c2006a76a79c42082b4d755cf4

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
x-mg-request-uuid: e6f0d5aa-ac61-41b4-a8ef-adf8b5d47d5a
age: 2200542
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17648
cf-request-id: 0a21db36df0000ee4c9c364000000001
last-modified: Mon, 08 Feb 2021 10:22:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516616afc37ee4c-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: d09ab773-c854-4890-b106-d0277e335425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164828/328x328/0x37x767x767/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp?v=1621354485-U4O6A4nY9cYDBJEgt0ujsYLXFiCzy5lf-yg3wmt6CTo
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516616a5af7ee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db367a0000ee4ceaa21000000001
server: cloudflare

GET
H2

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp
s-img.adskeeper.co.uk/g/8164847/328x328/128x0x333x333/
Redirect Chain

https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_717_3001?payload=aHR0cHMlM0ElMkYlMkZ4bWwucGxhbmV0cHVzaC5uZXQlMkZpY29uJTNGc2lkJTNEZDhkOTNkMmM1NzFjMWE1MDc0ZTRkODFmNWY5ZDQ0MTElMj...
https://xml.planetpush.net/icon?sid=d8d93d2c571c1a5074e4d81f5f9d4411&rnd=938820327
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|FcVHk3zu8NetxhO3XlH9cdOTUbgjjzEvpaJN-WJpTsHJpP50Oc7aK4-YPgE7yM-V&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=28e0844f-b7f4-11eb-bbd5-...
https://s-img.adskeeper.co.uk/g/8164847/328x328/128x0x333x333/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp?v=1621354485-7FBTkvb9QTgubCwRvv...

12 KB
12 KB

28ms
26ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164847/328x328/128x0x333x333/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp?v=1621354485-7FBTkvb9QTgubCwRvvOkq_yutUE9UeK71gH-CnfW54s
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c589b9ae836a997a18e39f18814aa3815265ba4de691fc2c4d4135f2ee5ddb2

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
x-mg-request-uuid: 0ab6f82f-230a-44d4-bba9-b64e0eac0965
age: 2200644
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12448
cf-request-id: 0a21db36da0000ee4cbb059000000001
last-modified: Mon, 08 Feb 2021 10:21:33 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6516616afc2aee4c-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: d3cf5f4f-4d06-426d-81cd-cbc76c4829ce
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164847/328x328/128x0x333x333/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp?v=1621354485-7FBTkvb9QTgubCwRvvOkq_yutUE9UeK71gH-CnfW54s
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516616a5afcee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db367b0000ee4c96081000000001
server: cloudflare

GET
H2

200

https://ngp4.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoIU1ounBdJvbtN06bsjfCZ0b1aSe-wgCb5V5wVHqST9Hapt5AeAKBV5NZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMo...

3 KB
3 KB

98ms
97ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:47 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/28e1c505-b7f4-11eb-a196-0ac2900b0bb9/2/8da89260-c0c7-11e8-b146-0ae8b840b174/CRnqT933wdntdKRgA8VIZ6_pQ4Wd7f0RRQjIzr5vfHRC043ul6Ow0Hgt5oVaTNFltbIQwg0dN7MXjOJaXBoLyakcClbvhMoA1Z19EcpzKk7AnKRk7XduAH0UzFqbmh-T8OK2_botR8wxd0PZLoZ1nsXzY_GLF-iCH8wIm0_K2fliFYvfJMcWPf5ENLpBQojPzo4y2YPa80S0QNe82YXiYdO6GnkYBUGcH7457MfofE0jU50Rnupo6JOEjVXuN5MUHnLKcJKHpNmPbmnXw25oO3695RXfUnFYJp0wQA9n4SGgLHOfQUQJFtaj9qCrRmeBZjKjl_S0m5JyH_iEQ_bKNRZ9WUl58bfonl93XIAbSpO4ZnSekI5hSADzh7ti9bc9L0g_TuHALj4hIayT3BaFeAV0RlxETr5ghEQqrNWf9hc8sVqHVB8dSVzIvg1i_mm3UyPFvK1rfsaUxyzSIyz4GTmMar2Uebf2e__H7BnhmfRxdo9-mDRFILmDO5ffTOTCn3UZRKVmSCBkJhj9od7eAq8ZQ53Y5tNKKaaPP_mO_UsbrlPulLfHoyvH7Qtzr27Zh9mvNkf2hsveuBE3pDgCaAkwefdHoFbRpZODiwg8CXLI6O1FEv3LFMoY-9ITDsXwSoY-tYWj-RwSgiQdJaMJDMiCNFPY-CUu6m27eCXoZ6uWPoxPAu3PJP3uEOLJYVQqlLayIW-VOsCXQ-THFtThl4fBoqi25X7OryRqbefXGjiCOAO5Hd1adw==.ycIM0pf0XqZIMhGgEE-q_Q==
access-control-allow-methods: POST

GET
H2 200 6217_64ca0074
b70.info/img/ 50 KB
51 KB 14ms
12ms Image
image/jpeg 2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217_64ca0074
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a62b37d39aecb605aaadcd802af573faec6534c89679556ed46462ed72295b1

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185364
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51539
cf-request-id: 0a21db351b00004e1330028000000001
last-modified: Sun, 16 May 2021 12:26:28 GMT
server: cloudflare
etag: "60a10f74-c953"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=94Y4N5b5lhP%2FaS7z0fsgXn05hXbSjJ8OE5xG5spi20vaUiknTNkaez8AHH82GKgFkEcpR0QbLiLcbDZUgji8PAWUF2u3lb4DWrH1GCf5krLmqlHSKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6516616828b14e13-FRA

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp
s-img.adskeeper.co.uk/g/8164828/492x328/0x138x825x550/ 24 KB
24 KB 37ms
34ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164828/492x328/0x138x825x550/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMDMtMjkvMTAxOTI0L2FjODNlN2IyMjcwNzFjZGY1ZGNhZjY2ZGU3Yjc5YjBhLnBuZz90PTE1MjIzMjc3NTk3NDQ.webp?v=1621354485-ingJaLv752SfxIu8wVVYkNma54oRAOH9BLyeGystwlw
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80c1142086c7469cc696b84c3b97c48e496279a06d12e258014d296481f55d31

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
x-mg-request-uuid: a1b676b7-3785-4c85-9230-c5dbdec37122
age: 2200785
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24348
cf-request-id: 0a21db35210000ee4c70a28000000001
last-modified: Mon, 08 Feb 2021 10:20:46 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661683e7aee4c-CDG

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp
s-img.adskeeper.co.uk/g/8164847/492x328/0x2x504x336/ 19 KB
19 KB 33ms
31ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164847/492x328/0x2x504x336/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzVmMDM5ZDViMDc0NzY4ZDk0MTk2MzJiYzcxMjBiMTJhLmpwZw.webp?v=1621354485-rIsJ0FyNPjZ5CNKP1qWvlZBHFq6RnBGvEzFk6U0Pgok
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d13770d5c8d7662e9a7c6b3a43ee682d2acb422bc7d69f0f0366d7f2cefdb802

Request headers

Referer: https://screenauto.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:47 GMT
cf-cache-status: HIT
x-mg-request-uuid: b1b0edfd-9b90-4bc6-b189-683b39e27146
age: 2200739
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19460
cf-request-id: 0a21db35210000ee4cb43b3000000001
last-modified: Mon, 08 Feb 2021 10:21:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661683e7bee4c-CDG

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 31ms
0ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://screenauto.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 15:35:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 434358
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Fri, 13 May 2022 15:35:29 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 28ms
0ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://screenauto.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 01:43:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 484275
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Fri, 13 May 2022 01:43:32 GMT

GET
H2 200 event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_0_3001
screenauto.xyz/ 118 B
211 B 157ms
157ms Script
application/javascript 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_0_3001?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wbGFuZXRwdXNoLm5ldCUyMiUyQyUyMnUlMjIlM0ElNUIlMjI4ODYtNDM4OGYyODgzMmU0Y2QzZDljMTQ1YjY1NDkzN2JhZGUtNjUxLTAuMDA0NDY0JTIyJTJDJTIyODg2LTZkODIwMWVjMGVmOGE2NjIyYjRkMGM2YWNhYjUxZDYwLTk1OS0wLjAwMDcwNCUyMiUyQyUyMjg4Ni1lMmM4Mjc3MTRkMGFhYTc1OTlmMDgwODFkYzQ3Yzc1Mi03MDAtMC4wMDA0NDclMjIlMkMlMjI4ODYtZDhkOTNkMmM1NzFjMWE1MDc0ZTRkODFmNWY5ZDQ0MTEtNzE3LTAuMDAwNDI3JTIyJTVEJTdE&t=1621354486331&rnd=174099188&js=1&io=0&if=0
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash

Request headers

:path: /event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_0_3001?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wbGFuZXRwdXNoLm5ldCUyMiUyQyUyMnUlMjIlM0ElNUIlMjI4ODYtNDM4OGYyODgzMmU0Y2QzZDljMTQ1YjY1NDkzN2JhZGUtNjUxLTAuMDA0NDY0JTIyJTJDJTIyODg2LTZkODIwMWVjMGVmOGE2NjIyYjRkMGM2YWNhYjUxZDYwLTk1OS0wLjAwMDcwNCUyMiUyQyUyMjg4Ni1lMmM4Mjc3MTRkMGFhYTc1OTlmMDgwODFkYzQ3Yzc1Mi03MDAtMC4wMDA0NDclMjIlMkMlMjI4ODYtZDhkOTNkMmM1NzFjMWE1MDc0ZTRkODFmNWY5ZDQ0MTEtNzE3LTAuMDAwNDI3JTIyJTVEJTdE&t=1621354486331&rnd=174099188&js=1&io=0&if=0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: screenauto.xyz
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:49 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript

GET
H2

200

Primary Request sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js Show response
shopdictionary1.xyz/
Redirect Chain

https://feed.rexadvert.xyz/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=tb_planet
https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js

8 KB
4 KB

673ms
162ms

Document
text/html

173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Requested by: Host: screenauto.xyz
URL: https://screenauto.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_102_0_3001?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wbGFuZXRwdXNoLm5ldCUyMiUyQyUyMnUlMjIlM0ElNUIlMjI4ODYtNDM4OGYyODgzMmU0Y2QzZDljMTQ1YjY1NDkzN2JhZGUtNjUxLTAuMDA0NDY0JTIyJTJDJTIyODg2LTZkODIwMWVjMGVmOGE2NjIyYjRkMGM2YWNhYjUxZDYwLTk1OS0wLjAwMDcwNCUyMiUyQyUyMjg4Ni1lMmM4Mjc3MTRkMGFhYTc1OTlmMDgwODFkYzQ3Yzc1Mi03MDAtMC4wMDA0NDclMjIlMkMlMjI4ODYtZDhkOTNkMmM1NzFjMWE1MDc0ZTRkODFmNWY5ZDQ0MTEtNzE3LTAuMDAwNDI3JTIyJTVEJTdE&t=1621354486331&rnd=174099188&js=1&io=0&if=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: 9da79a8afbdc66970e777a38e73bc741d5357aecb82be0fcad6c64752561a8f0

Request headers

:method: GET
:authority: shopdictionary1.xyz
:scheme: https
:path: /sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://screenauto.xyz/sw_d2d563a0-60e4-9f1f-8a8a-eb75f757f6d9_102_0_3001.js

Response headers

server: nginx
date: Tue, 18 May 2021 16:14:50 GMT
content-type: text/html
content-encoding: gzip

Redirect headers

server: nginx
date: Tue, 18 May 2021 16:14:49 GMT
location: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js

GET
H3-29 200 css
fonts.googleapis.com/ 6 KB
694 B 76ms
24ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Requested by

Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a717ffda5397cefca88d5c009df837db88d5be739693c6e7d350bfdb2726e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 18 May 2021 14:19:18 GMT
server: ESF
date: Tue, 18 May 2021 16:14:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 18 May 2021 16:14:50 GMT

GET
H2

200

mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0...
fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/
Redirect Chain

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_651_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDAyNWZhMTRhNjJmNTRlMjU1MDAyOTVlZTBjZDI2NmYwJ...
https://xml.pushking.net/icon?sid=025fa14a62f54e25500295ee0cd266f0&rnd=11236015
https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoJ6awBqyP-HetN06bsjfCZ3QBJ6FlRx31aRkPb3ZKFFVRXaOwXa7MgVNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRx...

3 KB
3 KB

135ms
110ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:51 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==
access-control-allow-methods: POST

GET
H3-29

200

6217-0de96f36
b70.info/img/
Redirect Chain

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_511_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDI0NWE3MjZlNWQ0MDAyYTQ0ODc1MTNhNDkwNTQzYWQ3J...
https://xml.pushking.net/icon?sid=245a726e5d4002a4487513a490543ad7&rnd=11236015
https://b70.info/iae?c_id=203117&u_id_p=6217&u_id=4094&f=/img/6217-0de96f36&ft=1&geo=FR&r=69289-829
https://b70.info/img/6217-0de96f36

18 KB
19 KB

40ms
15ms

Image
image/png

2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217-0de96f36
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7327e3c5fb6bd317798360df415b74870a7062841f7ed1c8bd2912916a3c6fa8

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185368
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18410
cf-request-id: 0a21db467e00004e3dee874000000001
last-modified: Sun, 16 May 2021 12:18:01 GMT
server: cloudflare
etag: "60a10d79-47ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KnvQ40pMVz2KsTlpRwKZM7m3FH5fPkoRXk28SEgdEldsiJN05uZ43Q%2Fm12OtqP0iXjW8P2ZJc7WRafO69Ic4pyHwZOH1l%2BULsLnflOrWR652yTBUBg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 65166183faa84e3d-FRA

Redirect headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hGPrEDbf0qWBshfh4XPzTIweA8CJvDjseqo6qL59tVgxlaDs86sYEItwPDnVrKaQP0aSauj4AxdtkTFC0I4rhmgBOp5XvS1nWfwxYrt3%2BUM2Nn%2FdHA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: , /img/6217-0de96f36
cf-ray: 6516618358fd4e3d-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db461a00004e3da3826000000001

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp
s-img.adskeeper.co.uk/g/8164872/328x328/492x0x328x328/
Redirect Chain

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_717_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDBiNmQ4MTAwNzlkYmFhNWY4YTdiNWZiOWY0MDAxNmQ3J...
https://xml.pushking.net/icon?sid=0b6d810079dbaa5f8a7b5fb9f40016d7&rnd=11236015
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|ci9agS5PuoT-imxJOKGMWaPe-Qldr2erQnD0N6-2NXEDkQfI7lXv4RAAXihySq46&cid=864927&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=2b6fcf7b-b7f4-11eb-81ac-...
https://s-img.adskeeper.co.uk/g/8164872/328x328/492x0x328x328/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp?v=1621354489-FG1ybWqnJag0guCMFK...

8 KB
8 KB

25ms
24ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164872/328x328/492x0x328x328/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp?v=1621354489-FG1ybWqnJag0guCMFKJdJOJ6Kw0zw89r9mkXA6KAmXc
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 745f5aa57ee3529f6328de0f564a6d047e8c6c30ffb2e26effc7d39d526e6a77

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
x-mg-request-uuid: 619f1e96-92a6-4561-8f61-e85904dcc610
age: 2199526
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7878
cf-request-id: 0a21db4683000032aa422a6000000001
last-modified: Mon, 08 Feb 2021 10:21:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661840b1f32aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: ad8f203e-34ea-417a-a6e7-04d69d05cd33
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8164872/328x328/492x0x328x328/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp?v=1621354489-FG1ybWqnJag0guCMFKJdJOJ6Kw0zw89r9mkXA6KAmXc
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516618369a7ee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db46260000ee4c94203000000001
server: cloudflare

GET
H3-29

200

aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp
s-img.adskeeper.co.uk/g/8193535/328x328/9x0x994x994/
Redirect Chain

https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_700_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGQzODMzZjE1ZmQzZmVkNTBlYTRjMzUyOTQ3ZDgxNWIxJ...
https://xml.pushking.net/icon?sid=d3833f15fd3fed50ea4c352947d815b1&rnd=11236015
https://c.adskeeper.co.uk/c?pv=2&v=0|0|0|pZAIluf_2JSZaXUuBwNT3fEMHA3UISBYVhSPglZqmbFjcR4WktuPxK1Oj7KE6gsm&cid=864925&f=1&h2=osGc9IG8QbaWdv591HpRpcB5_07rwZ0vLxcYTalSpKk*&rid=2b6f4061-b7f4-11eb-820b-...
https://s-img.adskeeper.co.uk/g/8193535/328x328/9x0x994x994/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp?v=16...

10 KB
10 KB

31ms
30ms

Image
image/webp

104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8193535/328x328/9x0x994x994/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp?v=1621354489-QQJl696vwWrw8_G0G_6oYmauuyf7Qj2EL--wbkx1mvk
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37dd209fedaab811fa1494d953f9cad45071a6c01b217e87050761969c873012

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
x-mg-request-uuid: 510de34f-be5f-4169-835b-6c51ca2b7f3f
age: 2200739
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9968
cf-request-id: 0a21db4683000032aaa680e000000001
last-modified: Wed, 10 Feb 2021 07:16:05 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661840b2332aa-CDG

Redirect headers

pragma: no-cache
date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 4c36bd5a-cce9-4b77-bcb2-93d736258424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://s-img.adskeeper.co.uk/g/8193535/328x328/9x0x994x994/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp?v=1621354489-QQJl696vwWrw8_G0G_6oYmauuyf7Qj2EL--wbkx1mvk
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6516618369aaee4c-CDG
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a21db46270000ee4c9fbd6000000001
server: cloudflare

GET
H2

200

https://ngp1.intnotif.club/adServe/wpnFeed/getImage?ai=g2RvEwrk2eqQ6BMJcmqdpES0NJXK9s8q5mAx1A-_vxAm_Vd7T9gGoJ6awBqyP-HetN06bsjfCZ3QBJ6FlRx31aRkPb3ZKFFVRXaOwXa7MgVNZYjGCW6Acydoo3gzXRzjroaOrs_jBWK6xC...
https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRx...

3 KB
3 KB

100ms
99ms

Image
image/webp

2600:1f18:40f7:9700:3671:48a5:dea9:ae90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:40f7:9700:3671:48a5:dea9:ae90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
content-disposition: inline;filename=f.txt
content-length: 2908
content-type: image/webp

Redirect headers

access-control-allow-origin: *
date: Tue, 18 May 2021 16:14:51 GMT
server: nginx
content-length: 0
location: https://fikri-ayo.com/imp/2b6f26a9-b7f4-11eb-acda-12f21ac8ce2b/2/8da89260-c0c7-11e8-b146-0ae8b840b174/mMSy1AQ73sMRSBFQx4VyI3RA8NUVpM0cNeIdKXZWLXpUtd0ve1s0aqiwCQCFUK5xZpiQL-jomb0rnSESKbb0E7uPRzWJjRxqqSXQmX7yJEkjCIYuNBu1Ac98bQ-rB3n7UdK3VonoWKj7RXazHB60S7RDyC9nRpCBA-hljCeDFPHXBPwzeIgDQWZKD_rJpTjC2Mt_0ol7r4Kacl4DGiRrRr5qJSSAbTq2ITOXhTYnVVkXxUguDojmVZ6qmo337PWirjFIDz5FtePtCuW9pfUFBSXajmU_bR2yl3fSUYpNLvKyp0Dqe0c0YnsawW5VxiLrHpqIx14X1ItkxlVqZzXLO0dWC7Zo_h44s9UuD-dL6d0hhCdA_bja4Tl5D3QJiOc65Y09ba_Ys2oLvfdJqCN99fTZqBVA9OXEp-vfe0zOzEtWrXJ6IdBZsWOI3lO-vLl7ml1sP_ip_l09R2KTtwVOHhXNqo2CbLe5pNqPiOof2hSsPKGA5nTbm07kGTAKTHJuvQwXN84rmLZ7rbZ8OYV3fYXoZ0YzGgipFcdtPAZt2SvLBynf0BU26IpNnfPqIGI4QB8mEQeamQvS5Lb4vgt4is9lWNUtgVwsJUklAZ32w_MMJgtmY2GKYMTyrFI5GnCtzu_uxpIKeL-nW-7WQB9Vn5yfxCOiAyvBkBmakbNXQqYCSbtQV6G2maVgJeGVLIj8--ikoCiIzB57LQmo_O_M4EAHrx8qH31ok5AzPUhb6ognQuBRWavkmA==.q7Bvw2EkyUGQ6-N5Qc900w==
access-control-allow-methods: POST

GET
H2 200 6217_64ca0074
b70.info/img/ 50 KB
51 KB 135ms
0ms Image
image/jpeg 2606:4700:3036::ac43:d89f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b70.info/img/6217_64ca0074
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:d89f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a62b37d39aecb605aaadcd802af573faec6534c89679556ed46462ed72295b1

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 185368
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51539
cf-request-id: 0a21db44b600004e133f313000000001
last-modified: Sun, 16 May 2021 12:26:28 GMT
server: cloudflare
etag: "60a10f74-c953"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LL4749lXali3lG55R79EiMN6u3Mbt0f7JxfUEtSnFGtHJLpRL13MwrlRkugPNdgNrFNJ5MwBYCtxAK%2FM50Sz32A2%2FVr%2BrP2XNz2fb4cgkG%2B0MOdPvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 651661812a3b4e13-FRA

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp
s-img.adskeeper.co.uk/g/8164872/492x328/0x0x492x328/ 9 KB
9 KB 201ms
22ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8164872/492x328/0x0x492x328/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMDcvMTAxOTI0LzQ1YjFhNTc5YzA1MjgzZTMzYTIxODk2ODliN2E0NjFiLmpwZw.webp?v=1621354489-p0bEmfrye-GN85VywqEy-1rvaeRmth4X_SzsF3vDMsM
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61cd794e2ad27693666bdc56ffe379d53486497200ca2d06dc8bcd4ce379aa4c

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
x-mg-request-uuid: 914d62ab-33a2-4783-acb4-b9dbd9a36b2f
age: 2200771
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9462
cf-request-id: 0a21db44f10000ee4ceab88000000001
last-modified: Mon, 08 Feb 2021 10:20:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661818dcfee4c-CDG

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp
s-img.adskeeper.co.uk/g/8193535/492x328/0x43x1003x668/ 11 KB
12 KB 198ms
20ms Image
image/webp 104.19.134.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.co.uk/g/8193535/492x328/0x43x1003x668/aHR0cDovL2ltZ2hvc3RzLmNvbS90ZW1wLzIwMTgtMTItMTUvMTAxOTI0LzBhMjAzZTJkY2RhYjY4MTJhZGFjNjU0MTUyNjUzZjFhLmpwZz90PTE1NDQ5Mzc4OTE5NjE.webp?v=1621354489-N4pZibIZbZMJgeSj3wMJzIZvRJZV9evcVQOeDFIWPzo
Requested by: Host: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/sw_d21709d7-b86c-beb4-ff37-218873429e6f_101_0_3000.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.134.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5e5f8d32022c3946a1d9b047f843d4329e61a8c50ab0791bb18f5be78e37139

Request headers

Referer: https://shopdictionary1.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 16:14:51 GMT
cf-cache-status: HIT
x-mg-request-uuid: f5e2658f-306d-4a3c-a6f0-f07618775cae
age: 2200772
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11604
cf-request-id: 0a21db44f10000ee4cb51a5000000001
last-modified: Wed, 10 Feb 2021 07:15:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 651661818dd1ee4c-CDG

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 96ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://shopdictionary1.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 15:35:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 434362
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Fri, 13 May 2022 15:35:29 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 105ms
15ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://shopdictionary1.xyz
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 May 2021 01:43:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 484279
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Fri, 13 May 2022 01:43:32 GMT

GET event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_3000
shopdictionary1.xyz/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: shopdictionary1.xyz
URL: https://shopdictionary1.xyz/event_2e6c4834-4dd8-3116-3a39-d26690b12451_101_0_3000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTAyNWZhMTRhNjJmNTRlMjU1MDAyOTVlZTBjZDI2NmYwLTY1MS0wLjAwNTUzOCUyMiUyQyUyMjUzNC0yNDVhNzI2ZTVkNDAwMmE0NDg3NTEzYTQ5MDU0M2FkNy01MTEtMC4wMDA3MDQlMjIlMkMlMjI1MzQtMGI2ZDgxMDA3OWRiYWE1ZjhhN2I1ZmI5ZjQwMDE2ZDctNzE3LTAuMDAwNDI3JTIyJTJDJTIyNTM0LWQzODMzZjE1ZmQzZmVkNTBlYTRjMzUyOTQ3ZDgxNWIxLTcwMC0wLjAwMDQ0NyUyMiU1RCU3RA%3D%3D&t=1621354490670&rnd=954951236&js=1&io=0&if=0

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b70.info
c.adskeeper.co.uk
cdnjs.cloudflare.com
cpasbien.me
dualsale1.xyz
eep.io
feed.rexadvert.xyz
fergas-fri.com
fikri-ayo.com
fonts.googleapis.com
fonts.gstatic.com
ibwood1.xyz
mc.us20.list-manage.com
ngp1.intnotif.club
ngp4.intnotif.club
popcash.net
ps.popcash.net
resources.blogblog.com
s-img.adskeeper.co.uk
screenauto.xyz
shopdictionary1.xyz
towerfriend1.xyz
www.blogger.com
www.cpasbien.me
xml.cpcmart.com
xml.planetpush.net
xml.ppctraffic.co
xml.pushking.net
shopdictionary1.xyz
104.19.134.80
108.168.193.183
162.255.119.60
173.192.101.24
173.214.240.15
184.30.16.149
199.182.164.180
23.79.149.111
2600:1f18:40f7:9700:3671:48a5:dea9:ae90
2606:4700:21::681b:ce5c
2606:4700:3036::ac43:d89f
2606:4700::6810:135e
2a00:1450:4001:801::200a
2a00:1450:4001:802::2003
2a00:1450:4001:809::2009
2a00:1450:4001:82f::200a
2a00:1450:4001:831::2013
34.204.217.156
52.72.29.7
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
08174b3d13ab074e28edde32bceddeca919ea330ee3740d62185af9af11a75b9
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126
1a1a620c1eed9a45667ecab1553c9dc628f61a2dd968876240edd995ecd3eb04
221815c51fde0eb187cdcee6d505f8c37bce4a4879df22bd0cdc39becdba8df1
2d8abefde33d47e14e059ef4173465c9a852847346e075ea45bee91036add797
33c87525169a7284c9966c919fa3a68fc2d8051200a53ce84c6ec3a83f67d1ec
37dd209fedaab811fa1494d953f9cad45071a6c01b217e87050761969c873012
3a717ffda5397cefca88d5c009df837db88d5be739693c6e7d350bfdb2726e30
416ad5ca4d012266fa88ed4a3941d48cb2638e931a9634b4de9434abf2e7572e
4ab0afd73797c23b9621ca47eb651f12bd043bed9acfd524731b5d2ff99fa997
4c589b9ae836a997a18e39f18814aa3815265ba4de691fc2c4d4135f2ee5ddb2
56a28f2d9efbcc5908c310f42bf9fc6cdbb5aadd42f79365a60e5b226af2e62c
618665c855f4c22e31426142bf580d63586f7fa483043fa1967614a8f8418e9c
61cd794e2ad27693666bdc56ffe379d53486497200ca2d06dc8bcd4ce379aa4c
6b1a462e8a583814bbdcaedc645b15bdac617e0a44b087c2cfdadccee0ad0f55
6d59d021664d5ed1b12affa7a3b96d567b4a42c8f325e9233fdb5d26d1298a67
71867ca10f1cd0c8ff620addb9fc27494f1681f0359a9e3fc8a0e26b7f93a102
7327e3c5fb6bd317798360df415b74870a7062841f7ed1c8bd2912916a3c6fa8
745f5aa57ee3529f6328de0f564a6d047e8c6c30ffb2e26effc7d39d526e6a77
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79a55cb67645da5f76d990ad52d179d986e1658149d6d67cf63394417eb10b2f
7f3d3c8458599c1a2156ff679d6300402d42a93410d795609e7cb9087c735046
80c1142086c7469cc696b84c3b97c48e496279a06d12e258014d296481f55d31
82a27787438fb42a1d78db250abc9f4ca19b78ae63f548626d0bfc65bc641a04
8470e2a8007f8a6d05931efbc084f93b1bc3129b57a8bdf65b1dc1a45be41fbb
8c733c892b5b0c222708477ba428d1838215af99ef8b04c5934c8a32d07fe82f
9147e56702cac804cff4b646db96efe455be370caeba029965acd0f375d00da1
9890b523125c63685ab6e157e022072740363afb75a023b694cec0b986a25481
9a62b37d39aecb605aaadcd802af573faec6534c89679556ed46462ed72295b1
9da79a8afbdc66970e777a38e73bc741d5357aecb82be0fcad6c64752561a8f0
c09e28b2ca8f4af46d7eed363b2f98e0109f10a938c45438c1cb5d55107abe60
c7f0b231a0f8c3dbb14d125b46e8d3b0759ff2f20f60dd370b60228490709867
ca5b07bfc5efde012c887bc6d600039d9368a9aa5221ea7cdfba4f1a253212e6
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d047f42c5906039f405b16f31972cc00b9e08cf5a8e2f5ab21eff54422155fe1
d134f8476916cfd9a9a83b3d7520c6ef553f09c2006a76a79c42082b4d755cf4
d13770d5c8d7662e9a7c6b3a43ee682d2acb422bc7d69f0f0366d7f2cefdb802
d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b
d5e5f8d32022c3946a1d9b047f843d4329e61a8c50ab0791bb18f5be78e37139
e1ce1c229f1bd3bd438802ae9ddf1702687f459f742549e8984d27a2ff8bb9e8
f59e7ae8d406307c55571fc0f090138ed57825217bc4e5f83898a325bbed9301
fbfabc91b64aa11c14ed6cfe66d6a9d04973d0b2172bb9f0fa08b13c4728f994

shopdictionary1.xyz Open in urlscan Pro 173.214.240.15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

94 %HTTPS

47 %IPv6

24 Domains

28 Subdomains

14 IPs

2 Countries

1065 kBTransfer

1252 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

shopdictionary1.xyz Open in urlscan Pro
173.214.240.15 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

94 %
HTTPS

47 %
IPv6

24
Domains

28
Subdomains

14
IPs

2
Countries

1065 kB
Transfer

1252 kB
Size

0
Cookies

65 HTTP transactions
0 data transactions