urlscan.io logo urlscan.io
SecurityTrails logo

towerstate3.xyz Open in urlscan Pro
173.214.240.15  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzx...
Effective URL: https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMS...
Submission: On February 12 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 1 countries across 17 domains to perform 19 HTTP transactions. The main IP is 173.214.240.15, located in United States and belongs to SERVEREL-AS, US. The main domain is towerstate3.xyz.
TLS certificate: Issued by R3 on January 21st 2024. Valid for: 3 months.
This is the only time towerstate3.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 17 173.214.240.15 15317 (SERVEREL-AS)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2 199.182.164.180 15317 (SERVEREL-AS)
2 2 2606:4700:1::... 13335 (CLOUDFLAR...)
4 4 173.239.53.24 27257 (WEBAIR-IN...)
2 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2607:f8b0:400... 15169 (GOOGLE)
19 8
17    173.214.240.15 (United States)

ASN15317 (SERVEREL-AS, US)
PTR: 173.214.240.15.serverel.net
shoesauto4.xyz
freetrckr.com
fre-book3.xyz
towerstate3.xyz
1    2607:f8b0:4006:817::200a (United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    199.182.164.180 (United States)

ASN15317 (SERVEREL-AS, US)
PTR: 180.164.182.199.serverel.net
xml.ppctraffic.co
xml.cpcmart.com
2    2606:4700:1::6813:824c (United States)

ASN13335 (CLOUDFLARENET, US)
c.mgid.com
4    173.239.53.24 (United States)

ASN27257 (WEBAIR-INTERNET, US)
click.pclk.name
2    2606:4700:3037::6815:56a9 (United States)

ASN13335 (CLOUDFLARENET, US)
push1000.com
1    2606:4700:3031::ac43:b3fa (United States)

ASN13335 (CLOUDFLARENET, US)
n3yjn.top
1    2606:4700:3032::6815:5df1 (United States)

ASN13335 (CLOUDFLARENET, US)
upplo.top
1    2606:4700:3037::ac43:c427 (United States)

ASN13335 (CLOUDFLARENET, US)
jwia0.top
1    2606:4700:3034::6815:100c (United States)

ASN13335 (CLOUDFLARENET, US)
sssjg.top
2    2607:f8b0:4006:81c::2003 (United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
11 freetrckr.com
freetrckr.com — Cisco Umbrella Rank: 811687
3 KB
4 pclk.name
click.pclk.name — Cisco Umbrella Rank: 32296
2 KB
3 fre-book3.xyz
fre-book3.xyz
2 KB
2 gstatic.com
fonts.gstatic.com
31 KB
2 push1000.com
push1000.com — Cisco Umbrella Rank: 52778
766 B
2 mgid.com
c.mgid.com — Cisco Umbrella Rank: 7229
740 B
2 shoesauto4.xyz
shoesauto4.xyz
607 B
1 towerstate3.xyz
towerstate3.xyz
1 sssjg.top
sssjg.top — Cisco Umbrella Rank: 808905
9 KB
1 jwia0.top
jwia0.top — Cisco Umbrella Rank: 721918
6 KB
1 cpcmart.com
xml.cpcmart.com — Cisco Umbrella Rank: 744346
540 B
1 upplo.top
upplo.top
16 KB
1 n3yjn.top
n3yjn.top — Cisco Umbrella Rank: 714549
3 KB
1 ppctraffic.co
xml.ppctraffic.co — Cisco Umbrella Rank: 831027
541 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
0 cdn4image.com Failed
cdn4image.com Failed
0 pushking.net Failed
xml.pushking.net Failed
19 17
Domain Requested by
11 freetrckr.com 11 redirects
4 click.pclk.name 4 redirects towerstate3.xyz
3 fre-book3.xyz 1 redirects fre-book3.xyz
2 fonts.gstatic.com fonts.googleapis.com
2 push1000.com 2 redirects
2 c.mgid.com 2 redirects
2 shoesauto4.xyz 2 redirects
1 towerstate3.xyz fre-book3.xyz
towerstate3.xyz
1 sssjg.top fre-book3.xyz
1 jwia0.top fre-book3.xyz
1 xml.cpcmart.com 1 redirects
1 upplo.top fre-book3.xyz
1 n3yjn.top fre-book3.xyz
1 xml.ppctraffic.co 1 redirects towerstate3.xyz
1 fonts.googleapis.com fre-book3.xyz
towerstate3.xyz
0 cdn4image.com Failed towerstate3.xyz
0 xml.pushking.net Failed towerstate3.xyz
19 17

This site contains no links.

Subject Issuer Validity Valid
fre-boom3.xyz
R3		 2023-12-23 -
2024-03-22		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
globetower3.xyz
R3		 2024-01-21 -
2024-04-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Frame ID: 6AC0EDC14D41EEF98BE4173FE8B2E6B2
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymi... HTTP 301
    https://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymi... HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJT... Page URL
  2. https://freetrckr.com/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJT... Page URL

Page Statistics

19
Requests

32 %
HTTPS

73 %
IPv6

17
Domains

17
Subdomains

8
IPs

1
Countries

69 kB
Transfer

80 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3zjywm2vhndmtmzgxos0wljawmtg2msuymiuyqyuymjg4ni0xnjy4ndzkodvhzwuwzgvlm2uwmwfmytllz...~311~...tem9lx2fsbf9pdcuymiu3ra==&if=1 HTTP 301
    https://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3zjywm2vhndmtmzgxos0wljawmtg2msuymiuyqyuymjg4ni0xnjy4ndzkodvhzwuwzgvlm2uwmwfmytllz...~311~...tem9lx2fsbf9pdcuymiu3ra==&if=1 HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D Page URL
  2. https://freetrckr.com/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3zjywm2vhndmtmzgxos0wljawmtg2msuymiuyqyuymjg4ni0xnjy4ndzkodvhzwuwzgvlm2uwmwfmytllz...~311~...tem9lx2fsbf9pdcuymiu3ra==&if=1 HTTP 301
  • https://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3zjywm2vhndmtmzgxos0wljawmtg2msuymiuyqyuymjg4ni0xnjy4ndzkodvhzwuwzgvlm2uwmwfmytllz...~311~...tem9lx2fsbf9pdcuymiu3ra==&if=1 HTTP 302
  • https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Request Chain 2
  • https://fre-book3.xyz/event_55d04cdd-47f2-183f-5ea5-45f86820261f_6_3143_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHBjdHJhZmZpYy5jbyUyRmljb24lM0ZzaWQlM0Q3ODIwYzlkOGU3MmIzNDEyNjBmMGRmMTcyNTFmNTgzNSUyNnJuZCUzRDQ3NDc0MjI5MA%3D%3D&t=1707778168741&rnd=129852026&i=1 HTTP 302
  • https://xml.ppctraffic.co/icon?sid=7820c9d8e72b341260f0df17251f5835&rnd=474742290 HTTP 302
  • https://c.mgid.com/c?pv=2&v=0|0|0|BkmvYT0OD5SImOAE3eRdePLeOTWwzgy0a34SJvHTPZbNYkag31I79Uimxj71SIzBvC6kRpQoUZkDTxn6Jf731A**&cid=1394193&f=1&h2=xwIziUS4wo_UT2mUEzXCZgMmSWzQc8CaIpshOkDPxS87Rp7AmuYYxQqqtpDedZHl&rid=fa0d74eb-c9f8-11ee-adb7-c84bd68370c0&psid=925527&turl=https%3A%2F%2Fservicer.mgid.com%2Fpixel%3Fh%3Da5UAaoikOiPgmgVGsoYjJ0yp12keBRJ3Wni9ZEuV7BgGEpSxz0Nr9fgyvyoxLnnD2WorxeWbhqflF7PWJsXXQMOYp3RlNiuU9yz-yZhd8LjXq6eV9PPOFQ%26r%3Dfa0d74eb-c9f8-11ee-adb7-c84bd68370c0%26l%3D%26c%3D%26ps%3D925527%26tt%3DDirect%26ts%3D%26iv%3D0%26prid%3D0&iub=aHR0cDovL2NsaWNrLnBjbGsubmFtZS90aHVtYm5haWw_aT1YUHVwVUEtdzRJUV8wJmltZ3Q9aWNvbg== HTTP 301
  • https://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0&imgt=icon HTTP 302
  • https://push1000.com/d?bidId=push_20240212224927_7faabd65_3cb1_4138_b162_744dc1f7749f&offerId=557557&feedId=3665&data=55b3RvQHdudG50bjBtdXFLPz5BRUdMO4h8jlZKSUxRRJSBXm.Sno6Sk4lYX1lcTVaGmZ.WoquoVoWMWWtram15X5eqsHl4gGa-fn1za429vru1qLe1n2l1MTg3PDQ6PikyVlRhW1s8MX58f3o2Xn18hYpFPWGHkpCPiFNWWFhWWVhhXWNlXWFnYlOHlpyYqqJpcG90bHJ2Z6uzgXd2fXZ-gHmFg3yCgXe.tMJnPih2c3p4am1GPzxBQkFBNnp2UISKiX93S0pNUE1QUFJTVFddV12GX4.LjI6RZGSPZJWVZZRqaGtxmZ1tc3Ced3V2p6d2rH5-fYOxcsKvto2BeLa9ZD40Nzs8Pj5AL3B0cEpBRUZGOIJ9eVNMTVBPUFNDh4JdUIuQhYyLmleMi5icjpeWnqRhlqaal6uhr6OvtWpwc3d4dXN9cnd9gYCBfXyAhoiHhYaGgnBvaSlzdXp0RXd5eXEzcnV5dU85hnp8fIp.jFhCkJOBk4SUjIaKmIaRjWdcX19eYmRka2dr&ip=206.66.96.31&ds=1 HTTP 302
  • https://n3yjn.top/images/campaigns/creativity-2477309-16977203897443.png
Request Chain 3
  • https://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0 HTTP 302
  • https://upplo.top/images/campaigns/creativity-image-2477309-16977203897443.png
Request Chain 4
  • https://xml.cpcmart.com/icon?sid=78400ca747e7b98c832500d86c3c4f9b&rnd=35811137 HTTP 302
  • https://c.mgid.com/c?pv=2&v=0|0|0|BkmvYT0OD5SImOAE3eRdeOmVCpKP6vp17HA8V12SXszNYkag31I79Uimxj71SIzBeSS54mCuj7eBhyf_COWZlQ**&cid=1394193&f=1&h2=xwIziUS4wo_UT2mUEzXCZgMmSWzQc8CaIpshOkDPxS87Rp7AmuYYxQqqtpDedZHl&rid=fa0d9244-c9f8-11ee-98b7-c84bd6826564&psid=925522&turl=https%3A%2F%2Fservicer.mgid.com%2Fpixel%3Fh%3Da5UAaoikOiPgmgVGsoYjJ0yp12keBRJ3Wni9ZEuV7BgGEpSxz0Nr9fgyvyoxLnnD2WorxeWbhqflF7PWJsXXQMOYp3RlNiuU9yz-yZhd8LjXq6eV9PPOFQ%26r%3Dfa0d9244-c9f8-11ee-98b7-c84bd6826564%26l%3D%26c%3D%26ps%3D925522%26tt%3DDirect%26ts%3D%26iv%3D0%26prid%3D0&iub=aHR0cDovL2NsaWNrLnBjbGsubmFtZS90aHVtYm5haWw_aT1QelBtKk1UZVFZTV8wJmltZ3Q9aWNvbg== HTTP 301
  • https://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0&imgt=icon HTTP 302
  • https://push1000.com/d?bidId=push_20240212224928_3c4af6c3_9666_4dbb_87ef_7116931a9868&offerId=557557&feedId=3665&data=41b3RvQHdudG50bjBtdXFLPz5BRUdMO4h8jlZKSUxRRJSBXm.Sno6Sk4lYX1lcTVaGmZ.WoquoVoWMWWtram15X5dpbzg3PyV.PTwyKkx8fXp0Z3Z0Xn2JRUxLUEhOUj1Gamh1b29QRZKQk45KcpGQmZ5ZUXWbpqSjnGdqbGxqbWx1cTY4MDQ6NSZaaW9rfXU8Q0JHP0VJOn6GVEpJUElSU0xYVk9VVEqRh5WPZlCem6KgkpVuZ2RpamlpXqKeeKyysaefMjE0NzQ3Nzk6Oz5EPkVtQnNFc3lKeEl2UU9QUXtRgoGCgFpaiYuFXllaYGRfXo9oaGdqWamWnXRoX52koHpwc3g0MTg1Kmtva0U8QEFBM314dE5HSEtKS04.gn1YS4aLgIeGlVKHhpOXiZKRmZ9ckaGVkqacqp6qsGVrbnNwbXRxbTE3Ozw4Oj03PUJCQz5BPH9.eDiChImDVIaIiIBCgYSIhF5IlYmLi5mNm2dRn6KQopOjm5WZp5WgnHZrbm5tcXNzOTU5&ip=206.66.96.31&ds=1 HTTP 302
  • https://jwia0.top/images/campaigns/creativity-2484062-16994570598824.png
Request Chain 5
  • https://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0 HTTP 302
  • https://sssjg.top/images/campaigns/creativity-image-2484062-16994570598824.png

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js
fre-book3.xyz/
Redirect Chain
  • http://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3z...
  • https://shoesauto4.xyz/event_70b522fb-669a-9772-158c-e80cc61933a9_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytowyyotlkmmuwmde4njaxowq1otvmy2q3...
  • https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash
906b3029673abdb4a830d1a46d7d9d63355c81344c4099e238a78ea96cb018ff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Mon, 12 Feb 2024 22:49:28 GMT
server
nginx

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-WoW64, Sec-CH-UA-Bitness, Sec-CH-UA-Model
date
Mon, 12 Feb 2024 22:49:28 GMT
location
https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
server
nginx
css
fonts.googleapis.com/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://fre-book3.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 12 Feb 2024 22:49:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 12 Feb 2024 22:22:32 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 12 Feb 2024 22:49:29 GMT
creativity-2477309-16977203897443.png
n3yjn.top/images/campaigns/
Redirect Chain
  • https://fre-book3.xyz/event_55d04cdd-47f2-183f-5ea5-45f86820261f_6_3143_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHBjdHJhZmZpYy5jbyUyRmljb24lM0ZzaWQlM0Q3ODIwYzlkOGU3MmIzNDEyNjBmMGRmMTcyNTFmNTgzNSUyNnJu...
  • https://xml.ppctraffic.co/icon?sid=7820c9d8e72b341260f0df17251f5835&rnd=474742290
  • https://c.mgid.com/c?pv=2&v=0|0|0|BkmvYT0OD5SImOAE3eRdePLeOTWwzgy0a34SJvHTPZbNYkag31I79Uimxj71SIzBvC6kRpQoUZkDTxn6Jf731A**&cid=1394193&f=1&h2=xwIziUS4wo_UT2mUEzXCZgMmSWzQc8CaIpshOkDPxS87Rp7AmuYYxQq...
  • https://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0&imgt=icon
  • https://push1000.com/d?bidId=push_20240212224927_7faabd65_3cb1_4138_b162_744dc1f7749f&offerId=557557&feedId=3665&data=55b3RvQHdudG50bjBtdXFLPz5BRUdMO4h8jlZKSUxRRJSBXm.Sno6Sk4lYX1lcTVaGmZ.WoquoVoWMW...
  • https://n3yjn.top/images/campaigns/creativity-2477309-16977203897443.png
2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://n3yjn.top/images/campaigns/creativity-2477309-16977203897443.png
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Server
2606:4700:3031::ac43:b3fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34e2167a27050c80e21c783b27a4ec377d68084b401774c0f70b4bd3e0029534

Request headers

accept-language
en-US,en;q=0.9
Referer
https://fre-book3.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 22:49:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid
718
age
2106695
cdn-cachedat
11/01/2023 23:00:22
cdn-pullzone
283898
alt-svc
h3=":443"; ma=86400
content-length
2312
last-modified
Thu, 19 Oct 2023 12:59:49 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
"65312845-908"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQwgfHA9x4X4Bk47Zy%2Fhq8Hq6EMMtUYArqjTtHQ%2Fry6fgpwgcjREctFVo2%2Fikcd7AO3onLVmNw5cvErGsbVADlFgUZIV5d%2BJKm9tBaR%2BMJTczGipYIWAt4fqY5AIxpFMxNnjZD5ZS0A%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cdn-cache
HIT
cdn-uid
10270df6-3a78-4ee3-9e7e-62f57a8521e8
cache-control
public, max-age=31919000
cdn-requestid
eeb4996d2a3ac2d844f3032f3b192e19
accept-ranges
bytes
cf-ray
854862a0a8aa7c8d-EWR
cdn-requestcountrycode
US
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

date
Mon, 12 Feb 2024 22:49:30 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xbk1eU35vcqFji1RKI2xuiyKANxAI9n8IjLPavzdBcpoeBQoa3zqTMgGyc53khpieLSrnxAQVFE60QrBUn3C6YCZuWoAFdq6e%2FfeP5IVdZHvvB%2BfcvB4l4D%2FLUrXhUsTIl0EGaaS%2BZtnT%2F4%3D"}],"group":"cf-nel","max_age":604800}
location
https://n3yjn.top/images/campaigns/creativity-2477309-16977203897443.png
cf-ray
8548629d0b55c472-EWR
alt-svc
h3=":443"; ma=86400
content-length
0
creativity-image-2477309-16977203897443.png
upplo.top/images/campaigns/
Redirect Chain
  • https://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0
  • https://upplo.top/images/campaigns/creativity-image-2477309-16977203897443.png
15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upplo.top/images/campaigns/creativity-image-2477309-16977203897443.png
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Server
2606:4700:3032::6815:5df1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbff664799f924f5673e798203d431f0fef8434f0c50dd34b2ceff017898c25c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://fre-book3.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 22:49:29 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid
871
age
2115581
cdn-cachedat
01/09/2024 11:20:13
cdn-pullzone
283898
alt-svc
h3=":443"; ma=86400
content-length
15831
last-modified
Thu, 19 Oct 2023 12:59:49 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
"65312845-3dd7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2BzBYoDD91ogbUKtOXRNTxdBzndvlN7HG9y4PfPKs%2FIY8%2BlCDVEv%2Ba4cpsdp%2FUBZ2vcga%2FRjTNZw4yi0RpI5jNPnDPb%2BZuiCsD%2F90IyhfSA%2FiYxTNzYqJmzg5X7tTt7NpMkwJ61gSBY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cdn-cache
HIT
cdn-uid
10270df6-3a78-4ee3-9e7e-62f57a8521e8
cache-control
public, max-age=31919000
cdn-requestid
9bb3c99a4642ae76f583e649e44892c7
accept-ranges
bytes
cf-ray
854862980c3742ee-EWR
cdn-requestcountrycode
US
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

Location
https://upplo.top/images/campaigns/creativity-image-2477309-16977203897443.png
Date
Mon, 12 Feb 2024 22:49:29 GMT
Cache-Control
no-store
Server
nginx
Connection
keep-alive
Content-Length
0
creativity-2484062-16994570598824.png
jwia0.top/images/campaigns/
Redirect Chain
  • https://xml.cpcmart.com/icon?sid=78400ca747e7b98c832500d86c3c4f9b&rnd=35811137
  • https://c.mgid.com/c?pv=2&v=0|0|0|BkmvYT0OD5SImOAE3eRdeOmVCpKP6vp17HA8V12SXszNYkag31I79Uimxj71SIzBeSS54mCuj7eBhyf_COWZlQ**&cid=1394193&f=1&h2=xwIziUS4wo_UT2mUEzXCZgMmSWzQc8CaIpshOkDPxS87Rp7AmuYYxQq...
  • https://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0&imgt=icon
  • https://push1000.com/d?bidId=push_20240212224928_3c4af6c3_9666_4dbb_87ef_7116931a9868&offerId=557557&feedId=3665&data=41b3RvQHdudG50bjBtdXFLPz5BRUdMO4h8jlZKSUxRRJSBXm.Sno6Sk4lYX1lcTVaGmZ.WoquoVoWMW...
  • https://jwia0.top/images/campaigns/creativity-2484062-16994570598824.png
5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jwia0.top/images/campaigns/creativity-2484062-16994570598824.png
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Server
2606:4700:3037::ac43:c427 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cee50f3c1ada51aa6c24ac23847bbb417e0c31e1f634883bf40dc87dd79ea848

Request headers

accept-language
en-US,en;q=0.9
Referer
https://fre-book3.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 22:49:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid
940
age
2109667
cdn-cachedat
01/18/2024 11:41:14
cdn-pullzone
283898
alt-svc
h3=":443"; ma=86400
content-length
5484
last-modified
Wed, 08 Nov 2023 15:24:19 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
"654ba823-156c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JFSbSLORD2kAsztuL9jRana7kFir%2FNaV2AIpOfbFzUauSD5LKO%2BWTZwOJLdREwJ3Fh8%2BU%2FdQXwmJJbm1u4ielB4%2FzA85DwNNkfPAs0mJ4Vu9vkfswlorFvtO8kJnaxYyshuoGGik0ps%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cdn-cache
HIT
cdn-uid
10270df6-3a78-4ee3-9e7e-62f57a8521e8
cache-control
public, max-age=31919000
cdn-requestid
5ef29372783d0bc71bae58bc48e7cbfb
accept-ranges
bytes
cf-ray
854862a0af10420b-EWR
cdn-requestcountrycode
US
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

date
Mon, 12 Feb 2024 22:49:30 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzh00FQUbTjKE0mvDnspaxvQh9BU4Lt%2FpB6tdUm16idT7VkpOhxgV2uSeRjo0lGrtlga%2Fa5rnoji0x9praj4%2FhIhM387RdMvD4Mr0jzgQDhY6PpMcQE%2FNDRQnTPiZoyNW0kIa4C1Jz%2FL0HY%3D"}],"group":"cf-nel","max_age":604800}
location
https://jwia0.top/images/campaigns/creativity-2484062-16994570598824.png
cf-ray
8548629d0b58c472-EWR
alt-svc
h3=":443"; ma=86400
content-length
0
creativity-image-2484062-16994570598824.png
sssjg.top/images/campaigns/
Redirect Chain
  • https://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0
  • https://sssjg.top/images/campaigns/creativity-image-2484062-16994570598824.png
8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sssjg.top/images/campaigns/creativity-image-2484062-16994570598824.png
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Server
2606:4700:3034::6815:100c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a97c8209d6f7b39acef71ee3da2a790cfc24c78324ad5b8d99bf53d0ebc2b62

Request headers

accept-language
en-US,en;q=0.9
Referer
https://fre-book3.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 22:49:29 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid
1069
age
813819
cdn-cachedat
01/28/2024 12:00:28
cdn-pullzone
283898
alt-svc
h3=":443"; ma=86400
content-length
8460
last-modified
Wed, 08 Nov 2023 15:24:19 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
"654ba823-210c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JReFDJap%2BExm6yq6mjWqe45Jc8yflcX2%2B9O%2BGN3W6%2Ffz%2FI%2BmxAUEhwOuLVJ3pdKVOAtcZ1CH7ekD0b8Ch8U6DLIATEsYC1rM8bWQ4zzhuFA3q1%2BaLMNp%2B9juhS12lou33q4%2F91eArv4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cdn-cache
HIT
cdn-uid
10270df6-3a78-4ee3-9e7e-62f57a8521e8
cache-control
public, max-age=31919000
cdn-requestid
91c567d502fce798f03083785e8984b9
accept-ranges
bytes
cf-ray
854862989ba34363-EWR
cdn-requestcountrycode
US
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

Location
https://sssjg.top/images/campaigns/creativity-image-2484062-16994570598824.png
Date
Mon, 12 Feb 2024 22:49:29 GMT
Cache-Control
no-store
Server
nginx
Connection
keep-alive
Content-Length
0
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://fre-book3.xyz
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Fri, 09 Feb 2024 00:02:57 GMT
x-content-type-options
nosniff
age
341192
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 08 Feb 2025 00:02:57 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://fre-book3.xyz
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Fri, 09 Feb 2024 00:07:14 GMT
x-content-type-options
nosniff
age
340935
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 08 Feb 2025 00:07:14 GMT
event_55d04cdd-47f2-183f-5ea5-45f86820261f_6_0_2000
fre-book3.xyz/ 		114 B
206 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fre-book3.xyz/event_55d04cdd-47f2-183f-5ea5-45f86820261f_6_0_2000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wcGN0cmFmZmljLmNvJTIyJTJDJTIydSUyMiUzQSU1QiUyMjMzOC03ODIwYzlkOGU3MmIzNDEyNjBmMGRmMTcyNTFmNTgzNS0zMTQzLTAuMDEyNDYlMjIlNUQlN0Q%3D&t=1707778168741&rnd=919034913&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 22:49:32 GMT
content-encoding
gzip
server
nginx
content-type
application/javascript
Primary Request sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js
towerstate3.xyz/
Redirect Chain
  • https://freetrckr.com/bid?id=3001&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=2998&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3006&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=2000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
6 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Requested by
Host: fre-book3.xyz
URL: https://fre-book3.xyz/event_55d04cdd-47f2-183f-5ea5-45f86820261f_6_0_2000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wcGN0cmFmZmljLmNvJTIyJTJDJTIydSUyMiUzQSU1QiUyMjMzOC03ODIwYzlkOGU3MmIzNDEyNjBmMGRmMTcyNTFmNTgzNS0zMTQzLTAuMDEyNDYlMjIlNUQlN0Q%3D&t=1707778168741&rnd=919034913&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Mon, 12 Feb 2024 22:49:35 GMT
server
nginx

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-WoW64, Sec-CH-UA-Bitness, Sec-CH-UA-Model
date
Mon, 12 Feb 2024 22:49:34 GMT
location
https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
server
nginx
css
fonts.googleapis.com/ 		0
0
event_55d04cdd-47f2-183f-5ea5-45f86820261f_5_3140_2000
towerstate3.xyz/ 		0
0
thumbnail
click.pclk.name/ 		0
0
icon
xml.pushking.net/ 		0
0
360_0_1707414911327.png
cdn4image.com/creatives/647/983/ 		0
0
icon
xml.ppctraffic.co/ 		0
0
thumbnail
click.pclk.name/ 		0
0
icon
xml.pushking.net/ 		0
0
360_0_1707756322692.webp
cdn4image.com/creatives/649/795/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Domain
towerstate3.xyz
URL
https://towerstate3.xyz/event_55d04cdd-47f2-183f-5ea5-45f86820261f_5_3140_2000?payload=aHR0cHMlM0ElMkYlMkZ4bWwuY3BjbWFydC5jb20lMkZpY29uJTNGc2lkJTNEZDhhM2FhYzNlNDUwNTIzZjEzNjc5YjY3M2MzYzA2Y2YlMjZybmQlM0Q5NzE2ODIw&t=1707778175521&rnd=412810814&i=1
Domain
click.pclk.name
URL
https://click.pclk.name/thumbnail?i=v-HPDHBELW0_0
Domain
xml.pushking.net
URL
https://xml.pushking.net/icon?sid=8d8deeee9b1b1df3627ac999959735d3&rnd=21915035
Domain
cdn4image.com
URL
https://cdn4image.com/creatives/647/983/360_0_1707414911327.png
Domain
xml.ppctraffic.co
URL
https://xml.ppctraffic.co/icon?sid=8714f763dbdc3146f2aea860ec93c913&rnd=655713043
Domain
click.pclk.name
URL
https://click.pclk.name/thumbnail?i=fntyKVa20r4_0
Domain
xml.pushking.net
URL
https://xml.pushking.net/icon?sid=cf8fd17e665e41d8b7318fefd2b2bc6c&rnd=21915035
Domain
cdn4image.com
URL
https://cdn4image.com/creatives/649/795/360_0_1707756322692.webp

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
.mgid.com/ Name: __cf_bm
Value: JebLlAuB811JhgTuuEVG_LP1ljXtUf0IBGSrdP_JzmQ-1707778170-1-AZoKWGqmHRTfvgDTVGFV27djGnIbC/vUw6gTOHWa8KfFhXr0SvOQ6FnbaEzp7CzPyd+JbfeF4/udV+rVM0tm3hM=

8 Console Messages

Source Level URL
Text
security warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=XPupUA-w4IQ_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=PzPm*MTeQYM_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
other warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://fre-book3.xyz/sw_ff691cde-8761-01f2-307a-9b290935362d_6_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
security warning URL: https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=v-HPDHBELW0_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Message:
Mixed Content: The page at 'https://towerstate3.xyz/sw_19fe3e65-c45c-af76-1f56-f888f2cc74df_5_0_2000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D' was loaded over HTTPS, but requested an insecure element 'http://click.pclk.name/thumbnail?i=fntyKVa20r4_0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html