1win-va.xyz Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.1win-kontora-bonus.site/
Effective URL:
https://1win-va.xyz/
Submission: On January 04 via automatic, source certstream-suspicious (January 4th 2023, 9:34:34 pm UTC) — Scanned from DE

Summary HTTP 28 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 7 domains to perform 28 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is 1win-va.xyz.
TLS certificate: Issued by GTS CA 1P5 on November 19th 2022. Valid for: 3 months.

This is the only time 1win-va.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3031::6815:3632	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3030::6815:5525	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
5 12	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
28	5

1 2606:4700:3031::6815:3632 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.1win-kontora-bonus.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

1win-va.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:5525 (United States)

ASN13335 (CLOUDFLARENET, US)

1win-bk-site.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:6b8::1:119 (Moscow, Russian Federation) 5 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	1win-va.xyz 1win-va.xyz	758 KB
9	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 7498	3 KB
4	gstatic.com fonts.gstatic.com	51 KB
3	yandex.ru 2 redirects mc.yandex.ru — Cisco Umbrella Rank: 1851	73 KB
1	1win-bk-site.com 1win-bk-site.com	4 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 127	2 KB
1	1win-kontora-bonus.site 1 redirects www.1win-kontora-bonus.site	514 B
28	7

	Domain	Requested by
15	1win-va.xyz	1win-va.xyz
9	mc.yandex.com	3 redirects 1win-va.xyz mc.yandex.ru
4	fonts.gstatic.com	fonts.googleapis.com
3	mc.yandex.ru	2 redirects 1win-va.xyz
1	1win-bk-site.com	1win-va.xyz
1	fonts.googleapis.com	1win-va.xyz
1	www.1win-kontora-bonus.site	1 redirects
28	7

This site contains no links.

Subject Issuer	Validity	Valid
*.1win-va.xyz GTS CA 1P5	`2022-11-19` - `2023-02-17`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.1win-bk-site.com GTS CA 1P5	`2022-11-12` - `2023-02-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2022-10-18` - `2023-03-30`	5 months	crt.sh

This page contains 1 frames:

Primary Page: https://1win-va.xyz/
Frame ID: 5C8DEB664DFABAE41AA8981B00E715B8
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1WIN официальный сайт букмекерской конторы 1ВИН

Page URL History Show full URLs

https://www.1win-kontora-bonus.site/ HTTP 301
https://1win-va.xyz/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Lightbox (JavaScript Libraries) Expand

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

28
Requests

89 %
HTTPS

100 %
IPv6

7
Domains

7
Subdomains

5
IPs

3
Countries

888 kB
Transfer

1352 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.1win-kontora-bonus.site/ HTTP 301
https://1win-va.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9873.CMKzdGogGZsUvTLGBbEMgjo2J1WgT2O_TgShnREU3P2g2vthfVQ1spyDJy77FCSd.04Pr2HmOkoPOWL1XKHDun-xgNOE%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9873.wg3wbOxpLQDoFgzurFuBzKrIluc2nKbrdR9_3uJrG5cM9IvkCRp7HEzTMHeMypWKjz1rYexElJR-EPaO_y0-U1hWSKbxE537Y852Cwrato0%2C.OpWeCh6EyqzKoayyUyOIVZfgYsg%2C

Request Chain 23

https://mc.yandex.com/watch/91277716?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A943%3Acn%3A1%3Adp%3A0%3Als%3A539578617305%3Ahid%3A675474878%3Az%3A0%3Ai%3A20230104213429%3Aet%3A1672868070%3Ac%3A1%3Arn%3A506607174%3Arqn%3A1%3Au%3A1672868070284889549%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A14%2C45%2C111%2C3%2C105%2C0%2C%2C210%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1672868068867%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1672868070%3At%3A1WIN%20%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%81%D0%B0%D0%B9%D1%82%20%D0%B1%D1%83%D0%BA%D0%BC%D0%B5%D0%BA%D0%B5%D1%80%D1%81%D0%BA%D0%BE%D0%B9%20%D0%BA%D0%BE%D0%BD%D1%82%D0%BE%D1%80%D1%8B%201%D0%92%D0%98%D0%9D&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/91277716/1?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A943%3Acn%3A1%3Adp%3A0%3Als%3A539578617305%3Ahid%3A675474878%3Az%3A0%3Ai%3A20230104213429%3Aet%3A1672868070%3Ac%3A1%3Arn%3A506607174%3Arqn%3A1%3Au%3A1672868070284889549%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A14%2C45%2C111%2C3%2C105%2C0%2C%2C210%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1672868068867%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1672868070%3At%3A1WIN%20%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%81%D0%B0%D0%B9%D1%82%20%D0%B1%D1%83%D0%BA%D0%BC%D0%B5%D0%BA%D0%B5%D1%80%D1%81%D0%BA%D0%BE%D0%B9%20%D0%BA%D0%BE%D0%BD%D1%82%D0%BE%D1%80%D1%8B%201%D0%92%D0%98%D0%9D&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Request Chain 24

https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=9873.iNumBpBqUi9KFBOO25LUyKoqY-hPMucb08P3Z2cdBUnO7Tc6pACPfLFZtjrp_4cB.h_KarCwsKv_zjPYwl3RwYv-O5iE%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9873.AGcE6nUR--rtaqi8nO5QEEovICjfnsWAzOaVrhUzdbWM5qxuqFRfb59GXV5949DlCeKOaB3z4IkAybbgqY0h2C9jTt3wXppvk-m-Z-P7b0c%2C.nu3XMaCpaWNDQOpooZBetMDjFSc%2C

28 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
1win-va.xyz/
Redirect Chain

https://www.1win-kontora-bonus.site/
https://1win-va.xyz/

60 KB
15 KB

171ms
111ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.34
Resource Hash: ce604ca7e46c125add93b87be6edfea4f98881641c86bf235a5123ab45ba628a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 784719377cb99ba7-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 04 Jan 2023 21:34:29 GMT
link: <https://1win-va.xyz/wp-json/>; rel="https://api.w.org/", <https://1win-va.xyz/wp-json/wp/v2/pages/20>; rel="alternate"; type="application/json", <https://1win-va.xyz/>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HIaFyivoozS%2BDqinNpFrlr7xtfh24K92aST4jdI%2BxxHCJumWqe0Zy1i6zH%2FpBtFz0cRYB3V08OAOX2I1zvuRHoB7XJmiyT%2BzKtVUTOYO80OJcITEzQw8s9ZS8WtDL%2FC4zClCGaWyUHEL3A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.2.34

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 78471936bafb9bc4-FRA
content-type: text/html; charset=UTF-8
date: Wed, 04 Jan 2023 21:34:28 GMT
location: https://1win-va.xyz/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TrJyfJPMBTRc%2F%2BToStxj%2BLGGcwNFK7ZkTkL76vnHtgB7U7D76gfOOrTxP955A%2BL65QC5x2gfGYL1W1ByBPNysA2HSUpiRgk7vaUYEMpdXvQOqsuCs2uDclxgL2BdXXk1m6cXaNWlXtaV%2BmSsxEbwP52EZ1CSh8hcHMw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.2.34
x-redirect-by: WordPress

GET
H2 200 style.min.css
1win-va.xyz/wp-includes/css/dist/block-library/ 87 KB
12 KB 76ms
73ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-includes/css/dist/block-library/style.min.css?ver=c68924c3307553842bc963d12a98fda2
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-15b64"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M8%2FYNuuJjq2IaEU2An%2BHvj0JV6czaiSfeeS6EbrT4aTC0%2B4syQcRPI3tYJtWSegVwPsA7qcQHKRvzauNmlbjOj8%2FbCF08%2BG6t5%2F1813e4wUWUnzNMLRsR%2FKzKeaVnTyXEqzgVvaQKxZFNg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 784719383de99ba7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H2 200 css
fonts.googleapis.com/ 14 KB
2 KB 135ms
49ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700%7COpen+Sans%3A400%2C400i%2C700&subset=cyrillic&ver=c68924c3307553842bc963d12a98fda2

Requested by

Host: 1win-va.xyz
URL: https://1win-va.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3cb4e46831acc0129456625a8da846cfb8ae14fb9e8c669bdfc2cf6d9d0f4aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 04 Jan 2023 21:34:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 04 Jan 2023 21:34:29 GMT

GET
H2 200 style.min.css
1win-va.xyz/wp-content/themes/root/css/ 147 KB
29 KB 82ms
81ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-content/themes/root/css/style.min.css?ver=2.4.1
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d562f64de28b3c975ada07a8ec399ba128df2ebb971289dea81a91b0ad17fb5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-24cc6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYHPB418%2BA059iXVKNZ3vmukdO8EMHrB4XdC4eFoT9Y4uFW5c7bUkDVUvXhJwJGvbdXcIfXcGuYEZX0D6DTXYf9i7cyOcXysJp%2FgEqrryv4cONSkxHWVz8liAeUeeKwPaj9ianQGaEtoZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 784719383deb9ba7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H2 200 jquery.min.js Show response
1win-va.xyz/wp-includes/js/jquery/ 87 KB
32 KB 78ms
76ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-15db1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bWY6GdUB7a6FaIJufH50DX0jHo5dLRxEp9wTazD3cg9iHEbgrFNKyclIg3te91Wb2gi1E%2FFqURdFp93OiJMFmgsLx1jS0Q8DkibnIRRI%2B2ZyEH9YKb9t2zMf5bRWCdFrcEKa78%2B84eKHUg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 784719383def9ba7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H2 200 jquery-migrate.min.js Show response
1win-va.xyz/wp-includes/js/jquery/ 11 KB
5 KB 61ms
60ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-2bd8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sa%2FxYCDDImACGlJMYI%2BkxKeybd6xumWy2stITm8vSBSfN27oVKAM43WAnNLOkcxf9%2FRGdWK4HrVk5cGYN4Zv4yHgcS7BRwt64ZafqI9%2F5L4eYu1cIA%2FrNhApETj4dr2aYYsePhYeEHyvEw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 784719383df09ba7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 1win-header.png
1win-va.xyz/wp-content/uploads/2022/07/ 36 KB
36 KB 70ms
70ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2022/07/1win-header.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d07f60e24e4361a59fb6467c72d0993c4bf1cf58261043fa2fe5ff85ff311383

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-8eb8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HIpnAYpgaPF6D3Ld4P26hESkk1SKr75bFXNx4Nas5mo722PNBbtrqzYshQ6jcb7ajpJiqTYXXHwr%2FyiAMFyIXqG%2BIs46IeM7nVSIuMrEtprlYZAVcT0jnH2tLpEbB3q%2BWiu1c1Y3nrmAuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719394c0690b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36536
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 freespin-deposit.png
1win-va.xyz/wp-content/uploads/2022/07/ 117 KB
118 KB 94ms
94ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2022/07/freespin-deposit.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc4b36e5ce0c6a40bb316e63f0614ca9195f655381f16033a7ec10124a787afc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-1d4ff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mXHJdyPUIMbcELQ%2BAGGL64Lw5gEbSmlOmhLTweQOqLKgEI6%2FahvHkIB3eAJlt2rlpqq79LqdfoafeCnJrZC4a5MiJwrQwY9Fu1YnDgHybGM1aewHXeE2Uq4PNyeGJI5r1JLXCFQjrTsuFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719394c0890b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 120063
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 lightbox.js Show response
1win-va.xyz/wp-content/themes/root/js/ 3 KB
1 KB 60ms
60ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-content/themes/root/js/lightbox.js?ver=2.4.1
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6689da9de439659c81141876190f91117e80885025c04d63ff41915efda4a6f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-a9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c81ol70fqpIhZ8KdUcCWeVWnnbJsqhcrO9LrpEHOBEmP%2FXx%2Fa6I0VYvqYCuo%2FbTDKQhdwXsc8%2B3J37G3flfZjW34IAGa%2BkGdlrbnGN5ndLz0f7YhgfqgIJHPIojHirsvqXnS0Kjw7yzPNw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 78471938cb9090b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 scripts.min.js Show response
1win-va.xyz/wp-content/themes/root/js/ 7 KB
3 KB 62ms
61ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-content/themes/root/js/scripts.min.js?ver=2.4.1
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8fef484ac8a107d5c1d4592fc8dbcdd63232b32794b86d33ed9a646ba8b0abf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-1d19"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9TsFzD3UXW5UeQEYnmMw0sGdXG4NDz8rVgqqF0olxwaY92RErD88IK9iF2NS6ANlmoeXWlUD5pF74ph8TJAKPuO0ARgtlwpa4o%2FL4OXSHXN7djOtT9i69rgd6OeuThHzS6ptNOfnfx%2FYpw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 784719391bd990b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 wp-emoji-release.min.js Show response
1win-va.xyz/wp-includes/js/ 18 KB
5 KB 63ms
63ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-va.xyz/wp-includes/js/wp-emoji-release.min.js?ver=c68924c3307553842bc963d12a98fda2
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637942f2-48b9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SdPCPzAXR6DCJavsdIygNWRWn2ex2LqNuG19rTeiD4l7sIcyUYLCG5e53sgTmUI1u40UqAxfDaDequP2JQSI%2Blf10BZkG5kmu2O9G7BLBsS9zYJ2E7WC5h%2BVk2AZaUevRnkL%2BEoNjcrIQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 784719394c0990b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H2 200 bggg.png
1win-bk-site.com/wp-content/uploads/2022/07/ 4 KB
4 KB 83ms
25ms Image
image/png 2606:4700:3030::6815:5525
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-bk-site.com/wp-content/uploads/2022/07/bggg.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:5525 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eac0d40d1bb25272ca52ef80b777b01675942d002c1cacfa5c7eeca0cab39a6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44752
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4029
last-modified: Thu, 28 Jul 2022 10:04:39 GMT
server: cloudflare
etag: "62e25f37-fbd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nvfx7uh%2F%2FCdYKyzRYZQBE1HL7HnXKBBkWsQGjzJO%2F055u7CHWJje%2BDsOjx2vXmIxoQLgGqBeJcAJqLOqHKuTRpGGMHET%2B%2FV76tlexxsYMAvnz3CqClHLx%2FWihA7%2Bp6MqnA2n3bT1qZQUFIutdgzF"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 78471939bd749b37-FRA
expires: Thu, 05 Jan 2023 09:08:37 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 9 KB
9 KB 168ms
81ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700%7COpen+Sans%3A400%2C400i%2C700&subset=cyrillic&ver=c68924c3307553842bc963d12a98fda2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://1win-va.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:01:13 GMT
x-content-type-options: nosniff
age: 552796
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9628
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 12:01:13 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 135ms
48ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700%7COpen+Sans%3A400%2C400i%2C700&subset=cyrillic&ver=c68924c3307553842bc963d12a98fda2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://1win-va.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 16:44:52 GMT
x-content-type-options: nosniff
age: 190177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Jan 2024 16:44:52 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 9 KB
10 KB 171ms
90ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700%7COpen+Sans%3A400%2C400i%2C700&subset=cyrillic&ver=c68924c3307553842bc963d12a98fda2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://1win-va.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 19:36:30 GMT
x-content-type-options: nosniff
age: 179879
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9644
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Jan 2024 19:36:30 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 120ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700%7COpen+Sans%3A400%2C400i%2C700&subset=cyrillic&ver=c68924c3307553842bc963d12a98fda2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://1win-va.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 19:42:15 GMT
x-content-type-options: nosniff
age: 525134
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 19:42:15 GMT

GET
H3 200 5.png
1win-va.xyz/wp-content/uploads/2022/11/ 103 KB
103 KB 118ms
117ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2022/11/5.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95c830ae8bece8a46d68259c0f70e6d4acaddcef77e6f38dba66620dcc6a1c65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-19a19"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ebkoGLaoTUqx6sWl9hRsiZwpCJoOQyBDx%2FoQdJpZYECBNEoArfJvqy4i4OTLzxJZVFJYSPLHv5DcGjRd0pEPn5aDEEv%2FDSH6YmjXWdUWOMV1XHrNUu9c2025HPuL4oqjyI6dJMryCvZb3g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719397c2990b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 104985
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 reg1win-768x566.png
1win-va.xyz/wp-content/uploads/2021/07/ 121 KB
122 KB 121ms
120ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2021/07/reg1win-768x566.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d1f4ecf23496a1000f0c03552670ceeb23c6431f0239939282b78b9296ed130

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-1e54b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IDJJGLrEcIx8QzGa6inCfMgFqJOifqo1VL9VO1U0%2FTGU1oZ4KuYY6ft%2BfAOewDNRgYvwXY4EQtI%2B0Yp0VGuteVNADDxZr8eXD4O3jdFNGFIQtQCNnUkVkDL12vfsQ0oZa9nzBH6hQJCW5A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719397c2a90b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 124235
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 8.png
1win-va.xyz/wp-content/uploads/2022/11/ 102 KB
102 KB 94ms
93ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2022/11/8.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7c27f21de71224c90aeec5c55c824b8102009d43c38041a257505d687139c44

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-197e1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ihq4xRttWRbQP0HD%2BbQmnOpfXeIOrxpz0Bi8BicvbJ5YObl6X8qDnRL047z%2BlFXOzbPgubYeYZK3DXfKdaiZ43yN0ZFg67fKypHR008y8m9arWHk24S8G6eJnmNOCG8d35pBjHVrTMlcRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719397c2b90b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 104417
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 1win2.jpg
1win-va.xyz/wp-content/uploads/2021/02/ 132 KB
133 KB 98ms
97ms Image
image/jpeg 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2021/02/1win2.jpg
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a8e3941cd10d7f17618dcbb3d20a675765fd4d0cb101e6ff16521d59557eb83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-210d4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B65AYGJ5tptDOyWaX5RKDupupGpoGdbIEIDCeCbgihmk9HW0VEok0kDEHUzGMFM3zQ5YH7NCN%2BJZPgTxCy7Nq8badtBtX0NhJCzvZczh5MOood3SKP%2BFGX7DS2J1IK61xpTELvPOnsh2WA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719397c2c90b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 135380
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H3 200 1win-line.png
1win-va.xyz/wp-content/uploads/2022/07/ 42 KB
42 KB 118ms
118ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-va.xyz/wp-content/uploads/2022/07/1win-line.png
Requested by: Host: 1win-va.xyz
URL: https://1win-va.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e6109d7aeb869271f55f5eeed17096b63f21e04e0b3cc61a7549ff1ae1caf46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
cf-cache-status: MISS
last-modified: Sat, 19 Nov 2022 20:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "637942f2-a73b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=euE%2FFsibb8EKIaqWF4CACeoUilEsiQybLMPfmCQITrUpGWC4pPN0RwzlJH3O8IxOADpWsDGPJEQ9H%2Fzd7Cfv%2Bw1hMFaTMMBpRGlvF%2F01wI5t5ZUbQg6OI0sTst5HUtGZF0P8wut6mn%2BuHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 784719397c2d90b5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 42811
expires: Thu, 05 Jan 2023 21:34:29 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 211 KB
72 KB 217ms
102ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: 1win-va.xyz
URL: https://1win-va.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

a84c7cc39305302875b9bbc7a62ebe486241cce1e3a3ee3b9e4521e6acf90ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 30 Dec 2022 07:53:53 GMT
etag: "63ae6ee1-12019"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 73753
expires: Wed, 04 Jan 2023 22:34:29 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9873.CMKzdGogGZsUvTLGBbEMgjo2J1WgT2O_TgShnREU3P2g2vthfVQ1spyDJy77FCSd.04Pr2HmOkoPOWL1XKHDun-xgNOE%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9873.wg3wbOxpLQDoFgzurFuBzKrIluc2nKbrdR9_3uJrG5cM9IvkCRp7HEzTMHeMypWKjz1rYexElJR-EPaO_y0-U1hWSKbxE537Y852Cwrato0%2C.OpWeCh6EyqzKoayyUyOIVZfgYsg%2C

75 B
75 B

52ms
52ms

Image
text/html

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9873.wg3wbOxpLQDoFgzurFuBzKrIluc2nKbrdR9_3uJrG5cM9IvkCRp7HEzTMHeMypWKjz1rYexElJR-EPaO_y0-U1hWSKbxE537Y852Cwrato0%2C.OpWeCh6EyqzKoayyUyOIVZfgYsg%2C

Requested by

Host: 1win-va.xyz
URL: https://1win-va.xyz/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9873.wg3wbOxpLQDoFgzurFuBzKrIluc2nKbrdR9_3uJrG5cM9IvkCRp7HEzTMHeMypWKjz1rYexElJR-EPaO_y0-U1hWSKbxE537Y852Cwrato0%2C.OpWeCh6EyqzKoayyUyOIVZfgYsg%2C
date: Wed, 04 Jan 2023 21:34:29 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
111 B 58ms
52ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: 1win-va.xyz
URL: https://1win-va.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:29 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 30 Dec 2022 07:53:53 GMT
etag: "63ae6ee1-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Wed, 04 Jan 2023 22:34:29 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/91277716/
Redirect Chain

https://mc.yandex.com/watch/91277716?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3...
https://mc.yandex.com/watch/91277716/1?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av...

435 B
517 B

56ms
55ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/91277716/1?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A943%3Acn%3A1%3Adp%3A0%3Als%3A539578617305%3Ahid%3A675474878%3Az%3A0%3Ai%3A20230104213429%3Aet%3A1672868070%3Ac%3A1%3Arn%3A506607174%3Arqn%3A1%3Au%3A1672868070284889549%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A14%2C45%2C111%2C3%2C105%2C0%2C%2C210%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1672868068867%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1672868070%3At%3A1WIN%20%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%81%D0%B0%D0%B9%D1%82%20%D0%B1%D1%83%D0%BA%D0%BC%D0%B5%D0%BA%D0%B5%D1%80%D1%81%D0%BA%D0%BE%D0%B9%20%D0%BA%D0%BE%D0%BD%D1%82%D0%BE%D1%80%D1%8B%201%D0%92%D0%98%D0%9D&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

752228bffb787a5b4c545e089a97661b05d6a402b483dab89c2c9edd8e374af1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 04 Jan 2023 21:34:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Wed, 04-Jan-2023 21:34:29 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1win-va.xyz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 435
x-xss-protection: 1; mode=block
expires: Wed, 04-Jan-2023 21:34:29 GMT

Redirect headers

pragma: no-cache
date: Wed, 04 Jan 2023 21:34:29 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 04-Jan-2023 21:34:29 GMT
location: /watch/91277716/1?wmode=7&page-url=https%3A%2F%2F1win-va.xyz%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Awzrng0ylweo7u6lqi2r53%3Afp%3A481%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A943%3Acn%3A1%3Adp%3A0%3Als%3A539578617305%3Ahid%3A675474878%3Az%3A0%3Ai%3A20230104213429%3Aet%3A1672868070%3Ac%3A1%3Arn%3A506607174%3Arqn%3A1%3Au%3A1672868070284889549%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A14%2C45%2C111%2C3%2C105%2C0%2C%2C210%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1672868068867%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1672868070%3At%3A1WIN%20%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%81%D0%B0%D0%B9%D1%82%20%D0%B1%D1%83%D0%BA%D0%BC%D0%B5%D0%BA%D0%B5%D1%80%D1%81%D0%BA%D0%BE%D0%B9%20%D0%BA%D0%BE%D0%BD%D1%82%D0%BE%D1%80%D1%8B%201%D0%92%D0%98%D0%9D&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
access-control-allow-origin: https://1win-va.xyz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Wed, 04-Jan-2023 21:34:29 GMT

GET
H2

200

sync_cookie_image_decide_secondary
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check_secondary
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=9873.iNumBpBqUi9KFBOO25LUyKoqY-hPMucb08P3Z2cdBUnO7Tc6pACPfLFZtjrp_4cB.h_KarCwsKv_zjPYwl3RwYv-O5iE%2C
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9873.AGcE6nUR--rtaqi8nO5QEEovICjfnsWAzOaVrhUzdbWM5qxuqFRfb59GXV5949DlCeKOaB3z4IkAybbgqY0h2C9jTt3wXppvk-m-Z-P7b0c%2C.nu3XMaCpaWNDQOpooZ...

43 B
70 B

52ms
52ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9873.AGcE6nUR--rtaqi8nO5QEEovICjfnsWAzOaVrhUzdbWM5qxuqFRfb59GXV5949DlCeKOaB3z4IkAybbgqY0h2C9jTt3wXppvk-m-Z-P7b0c%2C.nu3XMaCpaWNDQOpooZBetMDjFSc%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1win-va.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 04 Jan 2023 21:34:30 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9873.AGcE6nUR--rtaqi8nO5QEEovICjfnsWAzOaVrhUzdbWM5qxuqFRfb59GXV5949DlCeKOaB3z4IkAybbgqY0h2C9jTt3wXppvk-m-Z-P7b0c%2C.nu3XMaCpaWNDQOpooZBetMDjFSc%2C
date: Wed, 04 Jan 2023 21:34:30 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

POST
H2 200 91277716 Show response
mc.yandex.com/webvisor/ 43 B
154 B 202ms
99ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/91277716?wmode=0&wv-part=1&wv-hit=675474878&page-url=https%3A%2F%2F1win-va.xyz%2F&rn=902905023&wv-type=3&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1672868073%3Aw%3A1600x1200%3Av%3A943%3Az%3A0%3Ai%3A20230104213432%3Au%3A1672868070284889549%3Avf%3Awzrng0ylweo7u6lqi2r53%3Ast%3A1672868073&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1win-va.xyz/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 04 Jan 2023 21:34:32 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 04-Jan-2023 21:34:32 GMT
content-type: image/gif
access-control-allow-origin: https://1win-va.xyz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 04-Jan-2023 21:34:32 GMT

POST
H2 200 91277716 Show response
mc.yandex.com/webvisor/ 43 B
145 B 55ms
54ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/91277716?wmode=0&wv-part=1&wv-hit=675474878&page-url=https%3A%2F%2F1win-va.xyz%2F&rn=995332340&wv-type=3&browser-info=we%3A1%3Aet%3A1672868073%3Aw%3A1600x1200%3Av%3A943%3Az%3A0%3Ai%3A20230104213433%3Au%3A1672868070284889549%3Avf%3Awzrng0ylweo7u6lqi2r53%3Ast%3A1672868073&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1win-va.xyz/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 04 Jan 2023 21:34:33 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 04-Jan-2023 21:34:33 GMT
content-type: image/gif
access-control-allow-origin: https://1win-va.xyz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 04-Jan-2023 21:34:33 GMT

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.1win-va.xyz/	1970-01-20 17:26:44	Name: _ym_uid Value: 1672868070284889549
.1win-va.xyz/	1970-01-20 17:26:44	Name: _ym_d Value: 1672868070
.mc.yandex.com/	1970-01-20 08:41:08	Name: sync_cookie_csrf Value: 1718520013fake
.1win-va.xyz/	1970-01-20 08:42:20	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 08:41:08	Name: sync_cookie_csrf Value: 2575203404fake
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 2632220151672868069
.yandex.com/	1970-01-20 18:17:08	Name: i Value: D3LXRpmyqJnXtVUbQLJlTuXlS2jpbsprtS88fKKXeJIU1d95CvhHm60sNBo5yj/a0w14M1RcnrMsfcKRb0N6i5MaMtA=
.yandex.com/	1970-01-20 17:26:44	Name: yandexuid Value: 3026704671672868069
.yandex.com/	1970-01-20 17:26:44	Name: yuidss Value: 3026704671672868069
.yandex.com/	1970-01-20 17:26:44	Name: ymex Value: 1704404069.yc.1672868069#1704404069.yrts.1672868069#1704404069.yrtsi.1672868069
.1win-va.xyz/	1970-01-20 08:41:09	Name: _ym_visorc Value: w

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9873.wg3wbOxpLQDoFgzurFuBzKrIluc2nKbrdR9_3uJrG5cM9IvkCRp7HEzTMHeMypWKjz1rYexElJR-EPaO_y0-U1hWSKbxE537Y852Cwrato0%2C.OpWeCh6EyqzKoayyUyOIVZfgYsg%2C Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1win-bk-site.com
1win-va.xyz
fonts.googleapis.com
fonts.gstatic.com
mc.yandex.com
mc.yandex.ru
www.1win-kontora-bonus.site
2606:4700:3030::6815:5525
2606:4700:3031::6815:3632
2a00:1450:4001:803::2003
2a00:1450:4001:828::200a
2a02:6b8::1:119
2a06:98c1:3120::3
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
1a8e3941cd10d7f17618dcbb3d20a675765fd4d0cb101e6ff16521d59557eb83
3cb4e46831acc0129456625a8da846cfb8ae14fb9e8c669bdfc2cf6d9d0f4aa9
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
6689da9de439659c81141876190f91117e80885025c04d63ff41915efda4a6f2
6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e
6d1f4ecf23496a1000f0c03552670ceeb23c6431f0239939282b78b9296ed130
752228bffb787a5b4c545e089a97661b05d6a402b483dab89c2c9edd8e374af1
7e6109d7aeb869271f55f5eeed17096b63f21e04e0b3cc61a7549ff1ae1caf46
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
95c830ae8bece8a46d68259c0f70e6d4acaddcef77e6f38dba66620dcc6a1c65
a84c7cc39305302875b9bbc7a62ebe486241cce1e3a3ee3b9e4521e6acf90ad7
a8fef484ac8a107d5c1d4592fc8dbcdd63232b32794b86d33ed9a646ba8b0abf
bc4b36e5ce0c6a40bb316e63f0614ca9195f655381f16033a7ec10124a787afc
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
ce604ca7e46c125add93b87be6edfea4f98881641c86bf235a5123ab45ba628a
d07f60e24e4361a59fb6467c72d0993c4bf1cf58261043fa2fe5ff85ff311383
d562f64de28b3c975ada07a8ec399ba128df2ebb971289dea81a91b0ad17fb5b
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
eac0d40d1bb25272ca52ef80b777b01675942d002c1cacfa5c7eeca0cab39a6b
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7c27f21de71224c90aeec5c55c824b8102009d43c38041a257505d687139c44

1win-va.xyz Open in urlscan Pro 2a06:98c1:3120::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

28 Requests

89 %HTTPS

100 %IPv6

7 Domains

7 Subdomains

5 IPs

3 Countries

888 kBTransfer

1352 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

1win-va.xyz Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

89 %
HTTPS

100 %
IPv6

7
Domains

7
Subdomains

5
IPs

3
Countries

888 kB
Transfer

1352 kB
Size

11
Cookies

28 HTTP transactions
0 data transactions