URL: https://bill1k.fun/
Submission: On June 07 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 20 IPs in 5 countries across 19 domains to perform 35 HTTP transactions. The main IP is 172.67.139.164, located in United States and belongs to CLOUDFLARENET, US. The main domain is bill1k.fun.
TLS certificate: Issued by WE1 on June 7th 2024. Valid for: 3 months.
This is the only time bill1k.fun was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 172.67.139.164 13335 (CLOUDFLAR...)
1 104.17.25.14 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 104.18.10.207 13335 (CLOUDFLAR...)
2 104.18.11.207 13335 (CLOUDFLAR...)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
2 188.114.97.3 13335 (CLOUDFLAR...)
3 199.232.192.193 54113 (FASTLY)
5 2400:52e0:1e0... 200325 (BUNNYCDN)
1 2400:52e0:1e0... 200325 (BUNNYCDN)
1 103.27.236.152 131386 (LVSS-AS-V...)
1 172.67.190.76 13335 (CLOUDFLAR...)
1 103.42.57.53 45899 (VNPT-AS-V...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 104.18.29.243 13335 (CLOUDFLAR...)
35 20
Apex Domain
Subdomains
Transfer
5 haitrieu.com
cdn.haitrieu.com
144 KB
4 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3330
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1268
130 KB
3 imgur.com
i.imgur.com — Cisco Umbrella Rank: 7256
433 KB
3 bill1k.fun
bill1k.fun
26 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 354 Failed
8 KB
2 datatables.net
cdn.datatables.net — Cisco Umbrella Rank: 5477
105 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 70
1 KB
1 iconscout.com
cdn.iconscout.com — Cisco Umbrella Rank: 153286
4 KB
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2406
251 B
1 gstatic.com
fonts.gstatic.com
11 KB
1 thoitranghaianh.com
thoitranghaianh.com
127 KB
1 inkythuatso.com
inkythuatso.com
24 KB
1 seeklogo.com
seeklogo.com — Cisco Umbrella Rank: 97506
9 KB
1 ngoisaoso.vn
www.ngoisaoso.vn
37 KB
1 tripi.vn
gcs.tripi.vn — Cisco Umbrella Rank: 375250
104 KB
1 lmhmod.me
lmhmod.me
204 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 78
103 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 824
30 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 260
6 KB
35 19
Domain Requested by
5 cdn.haitrieu.com bill1k.fun
3 i.imgur.com bill1k.fun
3 bill1k.fun bill1k.fun
2 cdn.jsdelivr.net bill1k.fun
2 cdn.datatables.net bill1k.fun
2 maxcdn.bootstrapcdn.com bill1k.fun
maxcdn.bootstrapcdn.com
2 stackpath.bootstrapcdn.com bill1k.fun
2 fonts.googleapis.com bill1k.fun
1 cdn.iconscout.com
1 region1.google-analytics.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 thoitranghaianh.com bill1k.fun
1 inkythuatso.com bill1k.fun
1 seeklogo.com bill1k.fun
1 www.ngoisaoso.vn bill1k.fun
1 gcs.tripi.vn bill1k.fun
1 lmhmod.me bill1k.fun
1 www.googletagmanager.com bill1k.fun
1 code.jquery.com bill1k.fun
1 cdnjs.cloudflare.com bill1k.fun
35 20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
Subject Issuer Validity Valid
bill1k.fun
WE1
2024-06-07 -
2024-09-05
3 months crt.sh
cdnjs.cloudflare.com
E1
2024-06-02 -
2024-08-31
3 months crt.sh
upload.video.google.com
WR2
2024-05-21 -
2024-08-13
3 months crt.sh
bootstrapcdn.com
GTS CA 1P5
2024-05-25 -
2024-08-23
3 months crt.sh
datatables.net
GTS CA 1P5
2024-05-25 -
2024-08-23
3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA
2024-05-04 -
2025-05-04
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2023-07-11 -
2024-07-14
a year crt.sh
*.google-analytics.com
WR2
2024-05-21 -
2024-08-13
3 months crt.sh
lmhmod.me
GTS CA 1P5
2024-04-13 -
2024-07-12
3 months crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA
2024-02-15 -
2025-02-14
a year crt.sh
cdn.haitrieu.com
R3
2024-05-25 -
2024-08-23
3 months crt.sh
gcs.tripi.vn
R3
2024-05-23 -
2024-08-21
3 months crt.sh
ngoisaoso.vn
R3
2024-05-12 -
2024-08-10
3 months crt.sh
seeklogo.com
E1
2024-05-29 -
2024-08-27
3 months crt.sh
cdn.inkythuatso.com
R3
2024-05-29 -
2024-08-27
3 months crt.sh
thoitranghaianh.com
GTS CA 1P5
2024-05-12 -
2024-08-10
3 months crt.sh
*.gstatic.com
WR2
2024-05-21 -
2024-08-13
3 months crt.sh
iconscout.com
GTS CA 1P5
2024-05-14 -
2024-08-12
3 months crt.sh

This page contains 1 frames:

Primary Page: https://bill1k.fun/
Frame ID: 3DFA8B2C67A13F893F96F28F2F8C64FF
Requests: 35 HTTP requests in this frame

Screenshot

Page Title

Fake bill chuyển khoản ngân hàng

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • dataTables.*\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /npm/sweetalert2@([\d.]+)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

35
Requests

94 %
HTTPS

47 %
IPv6

19
Domains

20
Subdomains

20
IPs

5
Countries

1508 kB
Transfer

2641 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

35 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
bill1k.fun/
51 KB
10 KB
Document
General
Full URL
https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.164 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b039a2854234d3e317bae314899190b7e54ad8403ab696fc29dc6779a2533594

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
88fdb0d28d842bf6-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 07 Jun 2024 03:52:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IrMwStPUpnv%2F7vI7Ch1fiM5dPIQauwIu%2BLGgnHU0Y9yYWRaCJytfcft07niFbr0gW1I5YK6shvnmTpXnXSJ2vvIzktS1otNMn3oBwFrYiT4QT4l2YzOZ5Lkid4rC"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
x-turbo-charged-by
LiteSpeed
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/
34 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/font-awesome.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b977f453450222a069d89dd2e776f6f21f9fa42f6e15c03c7fe6ff34d9a2c159
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
620528
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5557
last-modified
Sat, 06 Jan 2024 12:46:35 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"65993d9b-15b5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CYK4RtVLHqNeE1owmNDmS3MXl%2FLL6LsZ%2FYxeVh%2FFxdxgiJwQIuTh1f%2B3uB1k4tyfECT3DcCFmS9AfF91XiAKUKICkzlvPx0%2B46ZLwBh8CoBunpD5bA1Z%2BLnnY80oSA%2BLBXUpEf0f"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88fdb0d44fb89177-FRA
expires
Wed, 28 May 2025 03:52:40 GMT
1.css
bill1k.fun/
0
0
Stylesheet
General
Full URL
https://bill1k.fun/1.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.164 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E10tu2qOAzOAp24IjYrpFueFFreqsUQSvksdH0%2BgMHkUtCcXrpFP5c3fOKY6s8OBAZtoBpAWba%2FreftBtVHa47XJpixjREZpipJNEZAT%2FdQPPsho49uuBDftqvpp"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
max-age=14400
x-turbo-charged-by
LiteSpeed
cf-ray
88fdb0d43e572bf6-FRA
alt-svc
h3=":443"; ma=86400
1.css
bill1k.fun/css/
178 KB
17 KB
Stylesheet
General
Full URL
https://bill1k.fun/css/1.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.164 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa5886df1f38d8aee7e109a89a4ef76f02548096c20e815f6d8a044ddbed64e4

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 07 Feb 2024 04:22:38 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2c7e2-65c3058e-d3ba4505496528a6;br"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DmM1Lr3Rd4oJvOI6z2k%2BKAnVoS5MV3EmnbF4WDGAyx0to3QiRJW4iIztLjWFrghc6IomZQmOikGxEzavnAFNt6OIRgDZaZOHy1CZe%2BeXGyuJ1tVfQdlQWd1GKS5i"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
88fdb0d43e592bf6-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 14 Jun 2024 03:51:54 GMT
css
fonts.googleapis.com/
405 B
723 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Merienda+One
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6fdd458c1cc7da896923768468f2ad08d41d92d8cfb5e4bfe7970213e339bde7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 07 Jun 2024 03:06:12 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 07 Jun 2024 03:52:40 GMT
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/
157 KB
29 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
865
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7388379
cdn-cachedat
10/31/2023 18:50:52
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:10 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"3afe15e976734d9daac26310110c4594"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
d5984a916a5f0bcc448a8c9f79acf6af
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
88fdb0d44ebf3a44-FRA
cdn-requestpullsuccess
True
icon
fonts.googleapis.com/
569 B
439 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/icon?family=Material+Icons
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
36b2057eb5eef261a2cbb8c149dcf3a11edaa15ccd8e3d462eb34999f5ff8f2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 07 Jun 2024 03:52:40 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 07 Jun 2024 03:52:40 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/
30 KB
8 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
1078
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
2865097
cdn-cachedat
03/18/2024 12:28:12
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"269550530cc127b6aa5a35925a7de6ce"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
7a1c9dbc32c16186eedda7c8c11c4540
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
88fdb0d44dab9195-FRA
cdn-requestpullsuccess
True
jquery.dataTables.css
cdn.datatables.net/1.13.4/css/
22 KB
3 KB
Stylesheet
General
Full URL
https://cdn.datatables.net/1.13.4/css/jquery.dataTables.css
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:87b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bc6e9e976f1b0bfef0189b31a0d77d4fc97bce1d96ce5b721984b30e5a4ea23
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3935923
last-modified
Fri, 19 Apr 2024 08:45:39 GMT
server
cloudflare
etag
W/"66222f33-571d"
vary
Accept-Encoding
access-control-allow-methods
OPTIONS, GET
content-type
text/css; charset=utf-8
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8qpAKISvIP4pieG%2BD2ejjMEeOJ9Np4vI7OXD5s7OLuPPbtYnIgss8by5RpQczqnqaFlgjlp1CoVRWaObbmhg9N985OYIpgtg2ZK1i1uQTCD0Iih%2BhnFxUWD7EIELm5AwfGjPGCoqAWFidgLbVIIEw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
x-frame-options
SAMEORIGIN
cf-ray
88fdb0d45cad8f39-FRA
access-control-allow-headers
origin, x-requested-with, content-type
expires
Thu, 31 Dec 2037 23:55:55 GMT
sweetalert2@10
cdn.jsdelivr.net/npm/
0
0

sweetalert2@10
cdn.jsdelivr.net/npm/
71 KB
0
Script
General
Full URL
https://cdn.jsdelivr.net/npm/sweetalert2@10
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d5fa531e30ac3debad673003128f1ca9ad3c964ef17b547377e7ed09bd4504f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
8633
x-jsd-version
10.16.11
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
19321
x-served-by
cache-fra-etou8220022-FRA, cache-lga21923-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"11dc8-k2jefS6LDTNa26qxcRQ+MH7V+1Q"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MwVlWb2MUCxnsX2f0ub47rq5zDPQ%2FFgcLQSm2StSCh087O3%2BGM3ahvB9b4%2B14FqHl3qEHx9X95%2BMI39Ksg4cCHEH3LLidlWtDa55810keex7Art1VqQJiZ91ptZEiF9%2B2Dwp0KeBGMXWYbZtQq4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88fdb0d45e1690e2-FRA
jquery.dataTables.js
cdn.datatables.net/1.13.4/js/
446 KB
101 KB
Script
General
Full URL
https://cdn.datatables.net/1.13.4/js/jquery.dataTables.js
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:87b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d826d1d841f78418e3f8abf2977329dedac4e7d2b8fd3f0ff966db0106367d6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3935833
last-modified
Fri, 19 Apr 2024 08:45:39 GMT
server
cloudflare
etag
W/"66222f33-6f6f1"
vary
Accept-Encoding
access-control-allow-methods
OPTIONS, GET
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wa09KGDPzOdo0k8ibm5mrztJRghAkwMp8kYFNolNxjS4CkD%2BF%2F87yHDwKmW%2FaRV49ToggRVBkiWWCDYPEd1U%2FW7PV%2BktJlsihBPgotsVm3B2%2F083a7Pf%2FVU8M3Hz7COLpCZN3atDphbves7OFc7I1A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
x-frame-options
SAMEORIGIN
cf-ray
88fdb0d46caf8f39-FRA
access-control-allow-headers
origin, x-requested-with, content-type
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-3.5.1.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
2413149
x-cache
HIT, HIT
content-length
30879
x-served-by
cache-lga21981-LGA, cache-fra-etou8220045-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1717732360.377255,VS0,VE0
etag
W/"28feccc0-15d84"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
9, 50464
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/
21 KB
8 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2908038
x-jsd-version
1.16.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
7510
x-served-by
cache-fra-eddf8230104-FRA, cache-lga21938-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LJkIBaZG5zZuRBpnY8DqLfZ8Px30qM6Oyrb6sR%2BLRkzCLWEHSEHaf6izCbwEAaLWm4XUqGS9i2irYCxFbDiGk5Z7jk01C6HDJ%2BYmjan92YYFgihKylpHvoSg9EcdRfoAic42Be%2FRpG%2FN04C%2FgOU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88fdb0d45e1890e2-FRA
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/
59 KB
18 KB
Script
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 718, 718
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7379554
cdn-cachedat
2021-08-03 11:18:10
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:10 GMT
server
cloudflare
cdn-requestpullcode
200
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
b390e598751bb8ef0fbad6c818f3ae72
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
88fdb0d44ebe3a44-FRA
cdn-requestpullsuccess
True
js
www.googletagmanager.com/gtag/
308 KB
103 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4BM81NPTGW
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
40d021bb735672992976d1db551b5d40a26f50be9cca29800a45702c8bed0df6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
104716
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 07 Jun 2024 03:52:40 GMT
MB-Bank-logo.png
lmhmod.me/wp-content/uploads/2022/05/
203 KB
204 KB
Image
General
Full URL
https://lmhmod.me/wp-content/uploads/2022/05/MB-Bank-logo.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c33eb28c2bb89efa170516e260482bd3250b67cdce53e2af503305680c36676a
Security Headers
Name Value
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always
X-Content-Type-Options "nosniff" always
X-Xss-Protection "1; mode=block" always

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:42 GMT
strict-transport-security
"max-age=31536000; includeSubDomains; preload" always
x-content-type-options
"nosniff" always
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-rocket-nginx-serving-static
No
alt-svc
h3=":443"; ma=86400
content-length
207763
x-xss-protection
"1; mode=block" always
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 07 Dec 2022 11:19:36 GMT
server
cloudflare
etag
"639076c8-32b93"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6IT5iZw%2FWEi0nYJIaqE5Ez41F16KtGsL%2FmRosTsU9tUFUczvSwYte8ETrRFbO9kiJUvEXtKCN0a2f8mcFj9QHw2nN0UTRQvbb6latlcN864ylGs2cHVCMPhQEHI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
88fdb0d66ce9049b-FRA
expires
Sun, 07 Jul 2024 00:56:54 GMT
2163Hdp.png
i.imgur.com/
14 KB
14 KB
Image
General
Full URL
https://i.imgur.com/2163Hdp.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.192.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
09063de8aa4d273e11ac447357039b5c59e4f5b250ef6bc22bc1c41afc196367
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
1319664
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
14613
x-served-by
cache-iad-kiad7000146-IAD, cache-fra-etou8220100-FRA
last-modified
Tue, 23 Apr 2024 03:36:29 GMT
server
cat factory 1.0
x-timer
S1717732361.731099,VS0,VE1
etag
"20f18b8f43dca01b8711de1ceea18413"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
7kZzWyMYVy-UtUN2uvIHuzmRMkDR4erAl8OfQjx83Cal4B9NnhuMKw==
x-cache-hits
5, 0
Logo-VietinBank-CTG-Ori.png
cdn.haitrieu.com/wp-content/uploads/2022/01/
5 KB
5 KB
Image
General
Full URL
https://cdn.haitrieu.com/wp-content/uploads/2022/01/Logo-VietinBank-CTG-Ori.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
87f7ef4c84e6eaa58cb8bef6cad1193601b93d430d731866e1c66fa46cbc2302

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1081
perma-cache
HIT
cdn-storageserver
DE-168
cdn-cachedat
02/01/2024 06:41:14
cdn-pullzone
760988
content-length
4828
last-modified
Tue, 08 Aug 2023 20:06:44 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
646
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"64d2a054-12dc"
content-type
image/webp
cdn-cache
HIT
cdn-uid
8c2a9a68-1117-4d6a-92be-5527354be508
cache-control
public, max-age=31919000
cdn-requestid
d95f3bb9a137c462300fc57a04020bb6
accept-ranges
bytes
cdn-requestcountrycode
DE
link
<https://haitrieu.com/wp-content/uploads/2022/01/Logo-VietinBank-CTG-Ori.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
mau-logo-techcombank-dep_045648494.png
gcs.tripi.vn/public-tripi/tripi-feed/img/474066ubq/
104 KB
104 KB
Image
General
Full URL
https://gcs.tripi.vn/public-tripi/tripi-feed/img/474066ubq/mau-logo-techcombank-dep_045648494.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1054:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1054 /
Resource Hash
7d850e525a01c4397199826c77e8fbc02dd3316dfe9bc1312ac1018fb51230ef

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1075
perma-cache
HIT
cdn-storageserver
SG-515
cdn-cachedat
05/20/2024 02:55:40
cdn-pullzone
1519349
content-length
106332
last-modified
Wed, 14 Feb 2024 15:41:42 GMT
server
BunnyCDN-DE1-1054
cdn-fileserver
779
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"65ccdf36-19f5c"
content-type
image/png
cdn-cache
HIT
cdn-uid
997b7c59-5e69-404c-907e-2b883550ed60
cache-control
public, max-age=31919000
cdn-requestid
de1181630627e7efb32acbb95c5d41bc
accept-ranges
bytes
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
130513-logo-vietcombank.png
www.ngoisaoso.vn/uploads/news/2013_07/01/
37 KB
37 KB
Image
General
Full URL
https://www.ngoisaoso.vn/uploads/news/2013_07/01/130513-logo-vietcombank.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.27.236.152 , Viet Nam, ASN131386 (LVSS-AS-VN Long Van System Solution JSC, VN),
Reverse DNS
Software
Apache/2 /
Resource Hash
c5c8c705732feae73cb74810c9f2e17c44a9f7e71544d646e03205c02c350191

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:41 GMT
last-modified
Fri, 10 Apr 2020 00:00:08 GMT
server
Apache/2
etag
"94bd-5a2e46a95d200"
content-type
image/png
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
38077
zWOrdk5.png
i.imgur.com/
404 KB
405 KB
Image
General
Full URL
https://i.imgur.com/zWOrdk5.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.192.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
a2ca206ebcbdc6caca841902892f2ee1ff4a3f5db4289441ceec32857c9b7548
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
612425
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
414098
x-served-by
cache-iad-kcgs7200134-IAD, cache-fra-etou8220100-FRA
last-modified
Fri, 31 May 2024 01:44:01 GMT
server
cat factory 1.0
x-timer
S1717732361.731077,VS0,VE1
etag
"372673eed5a02c56f2d7556e2476ac0f"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
37mCXQfEPJQmxx4ZVPYG203PYYe6h8oQsWRTZtrbfQxZLnkhcfel-A==
x-cache-hits
9, 0
Icon-MSB.png
cdn.haitrieu.com/wp-content/uploads/2022/02/
97 KB
98 KB
Image
General
Full URL
https://cdn.haitrieu.com/wp-content/uploads/2022/02/Icon-MSB.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
3816dc22630d90a30bd8dead608bd0d90801b6031f3ba25b428f58093170f71f

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1080
perma-cache
HIT
cdn-storageserver
DE-51
cdn-cachedat
03/23/2024 02:37:20
cdn-pullzone
760988
content-length
99467
last-modified
Tue, 08 Aug 2023 19:44:42 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
570
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"64d29b2a-1848b"
content-type
image/png
cdn-cache
HIT
cdn-uid
8c2a9a68-1117-4d6a-92be-5527354be508
cache-control
public, max-age=31919000
cdn-requestid
1a1b10f786a76ea331ba35f7147f36ab
accept-ranges
bytes
cdn-requestcountrycode
DE
link
<https://haitrieu.com/wp-content/uploads/2022/02/Icon-MSB.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
Icon-OCB.png
cdn.haitrieu.com/wp-content/uploads/2022/02/
11 KB
11 KB
Image
General
Full URL
https://cdn.haitrieu.com/wp-content/uploads/2022/02/Icon-OCB.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
e5108bdb90d88e0707e65421e2d8a6d456752a4ec238ae5be1a75f7feaea112c

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1082
perma-cache
HIT
cdn-storageserver
DE-679
cdn-cachedat
05/27/2024 05:41:05
cdn-pullzone
760988
content-length
10820
last-modified
Wed, 09 Aug 2023 01:57:08 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
656
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"64d2f274-2a44"
content-type
image/webp
cdn-cache
HIT
cdn-uid
8c2a9a68-1117-4d6a-92be-5527354be508
cache-control
public, max-age=31919000
cdn-requestid
148504cb493dcb7460e12938a7d34e09
accept-ranges
bytes
cdn-requestcountrycode
DE
link
<https://haitrieu.com/wp-content/uploads/2022/02/Icon-OCB.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
agribank-logo-1CEEE70C76-seeklogo.com.png
seeklogo.com/images/A/
8 KB
9 KB
Image
General
Full URL
https://seeklogo.com/images/A/agribank-logo-1CEEE70C76-seeklogo.com.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.190.76 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b24ef787803f8b909be6d372821cfaf35194e1a399c9cbb29fff6dfb7529643
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
content-security-policy
upgrade-insecure-requests; frame-ancestors 'self'
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
cf-cache-status
MISS
x-permitted-cross-domain-policies
none
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
8003
x-xss-protection
1; mode=block
last-modified
Sun, 27 Nov 2022 12:19:08 GMT
server
cloudflare
etag
"1d9025a72c59943"
x-download-options
noopen
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2BGjR6%2BeLGcZXrOwydm%2B5%2FAjg9i2Us3FYSOD9esCCYdnFrY8L%2BKcg%2B0NPNoeKzJotfbl4SG88gQMf%2FHqv5BEMjoc9vF2vJv9B091bPCR0YYRNtqjlm1hwpn5RO3KeQs%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=31536000
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
accept-ranges
bytes
cf-ray
88fdb0d6be66046e-FRA
logo-vib-inkythuatso-3-21-13-43-27.jpg
inkythuatso.com/uploads/images/2021/12/
34 KB
24 KB
Image
General
Full URL
https://inkythuatso.com/uploads/images/2021/12/logo-vib-inkythuatso-3-21-13-43-27.jpg
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.42.57.53 , Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN),
Reverse DNS
Software
nginx /
Resource Hash
78efe0c62ae7184c60fd913073c715baae94bacdc6e87d27e13fd4c57e86558e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:23 GMT
strict-transport-security
max-age=604800
content-encoding
gzip
last-modified
Mon, 17 Jan 2022 07:22:38 GMT
server
nginx
etag
W/"61e5193e-87bd"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
Logo-MoMo-Circle.png
cdn.haitrieu.com/wp-content/uploads/2022/10/
13 KB
14 KB
Image
General
Full URL
https://cdn.haitrieu.com/wp-content/uploads/2022/10/Logo-MoMo-Circle.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
372779b1631bcd2322c8fe6e0ca6ca090d095d36321b08ba4151b871abf67bff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1080
perma-cache
HIT
cdn-storageserver
DE-383
cdn-cachedat
05/15/2024 22:46:42
cdn-pullzone
760988
content-length
13322
last-modified
Tue, 08 Aug 2023 19:18:02 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
636
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"64d294ea-340a"
content-type
image/webp
cdn-cache
HIT
cdn-uid
8c2a9a68-1117-4d6a-92be-5527354be508
cache-control
public, max-age=31919000
cdn-requestid
3baeda3cc2e8fa23ef4a947c18bbc8c1
accept-ranges
bytes
cdn-requestcountrycode
DE
link
<https://haitrieu.com/wp-content/uploads/2022/10/Logo-MoMo-Circle.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
esLIOkJ.png
i.imgur.com/
13 KB
13 KB
Image
General
Full URL
https://i.imgur.com/esLIOkJ.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.192.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
1aefa3ee08b52202774929effa17b473436f3da9b4162a02ad428f1a75b5a664
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
1371928
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
13535
x-served-by
cache-iad-kjyo7100127-IAD, cache-fra-etou8220100-FRA
last-modified
Thu, 16 May 2024 02:10:05 GMT
server
cat factory 1.0
x-timer
S1717732361.740952,VS0,VE1
etag
"858bb49a316b93142ff42d870fea779d"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
7LC6zYR2vqKMjEiTLpJ30eQe5--jUjUZYfZPaQhIce_enoCKmg-Tzg==
x-cache-hits
6, 0
MT-1.png
thoitranghaianh.com/wp-content/uploads/2018/01/
127 KB
127 KB
Image
General
Full URL
https://thoitranghaianh.com/wp-content/uploads/2018/01/MT-1.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
573deb775e6b633e20c149c6927f43b70c4e459f709124a0819df0eaa3e1aadc

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:42 GMT
cf-cache-status
MISS
last-modified
Wed, 31 Jan 2018 01:02:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jJnvZigbZQUk3nTNb1ODGHbNfCC3wY%2Fj28QKKC9SZCG5%2FUNuKdi70sqRI0fqREid9IT%2BmuD3hM3IPSfCeik9TcSzYLBabqEO2PG%2BcODv5Q1Owd3RRV5IpLqU7xtER8iEkBz%2Fgysa"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=10368000
accept-ranges
bytes
cf-ray
88fdb0d6fed09960-FRA
alt-svc
h3=":443"; ma=86400
content-length
129986
expires
Sat, 05 Oct 2024 03:53:40 GMT
Icon-TPBank.png
cdn.haitrieu.com/wp-content/uploads/2022/02/
16 KB
16 KB
Image
General
Full URL
https://cdn.haitrieu.com/wp-content/uploads/2022/02/Icon-TPBank.png
Requested by
Host: bill1k.fun
URL: https://bill1k.fun/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
36f3b7c5935eda3993d9d0325a8f93ce4087ee5990ab8ca19628bfbfd880e06c

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
cdn-edgestorageid
1079
perma-cache
HIT
cdn-storageserver
DE-661
cdn-cachedat
04/26/2024 04:56:34
cdn-pullzone
760988
content-length
16316
last-modified
Wed, 09 Aug 2023 01:32:40 GMT
server
BunnyCDN-DE1-1080
cdn-fileserver
653
cdn-requestpullcode
200
cdn-proxyver
1.04
etag
"64d2ecb8-3fbc"
content-type
image/webp
cdn-cache
HIT
cdn-uid
8c2a9a68-1117-4d6a-92be-5527354be508
cache-control
public, max-age=31919000
cdn-requestid
657fb426bd635bb0efae2c1b6431eb06
accept-ranges
bytes
cdn-requestcountrycode
DE
link
<https://haitrieu.com/wp-content/uploads/2022/02/Icon-TPBank.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
css
fonts.googleapis.com/
0
0

fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/
75 KB
76 KB
Font
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://bill1k.fun
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
752
cdn-cachedat
10/31/2023 19:08:24
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
"af7ae505a9eed503f8b8e6982036873e"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
5aa63ac8aa130d9655dd34017c5632dc
accept-ranges
bytes
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
88fdb0d6db7c3650-FRA
cdn-requestpullsuccess
True
H4cgBXaMndbflEq6kyZ1ht6ohYaz.woff2
fonts.gstatic.com/s/meriendaone/v17/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/meriendaone/v17/H4cgBXaMndbflEq6kyZ1ht6ohYaz.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merienda+One
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be62e6a92e8dfb591bf56cfd7a23dc759fa3bf63d5183543ffdd17b2903e64fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://fonts.googleapis.com/
Origin
https://bill1k.fun
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 04 Jun 2024 14:25:20 GMT
x-content-type-options
nosniff
age
221240
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11176
x-xss-protection
0
last-modified
Mon, 20 Mar 2023 22:34:51 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 04 Jun 2025 14:25:20 GMT
collect
region1.google-analytics.com/g/
0
251 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4BM81NPTGW&gtm=45je4650v9185473409za200&_p=1717732360721&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&cid=1406997242.1717732361&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.141%7CChromium%3B125.0.6422.141%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1717732360&sct=1&seg=0&dl=https%3A%2F%2Fbill1k.fun%2F&dt=Fake%20bill%20chuy%E1%BB%83n%20kho%E1%BA%A3n%20ng%C3%A2n%20h%C3%A0ng&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=777
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4BM81NPTGW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 07 Jun 2024 03:52:40 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://bill1k.fun
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
free-bank-1417507-1201209.png
cdn.iconscout.com/icon/free/png-256/
4 KB
4 KB
Other
General
Full URL
https://cdn.iconscout.com/icon/free/png-256/free-bank-1417507-1201209.png?f=webp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.29.243 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccea664f6f6234df180a6abfcf1f9f232d44f3443c9abffa4a43d2b63b38ad5c
Security Headers
Name Value
Content-Security-Policy script-src 'none'

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://bill1k.fun/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 07 Jun 2024 03:52:42 GMT
via
1.1 google, 1.1 google
content-security-policy
script-src 'none'
cf-cache-status
HIT
age
511961
content-disposition
inline; filename="1201209.webp"
alt-svc
h3=":443"; ma=86400
content-length
3810
x-request-id
P7T7wmDjmEszXDKj51wcT
last-modified
Sat, 01 Jun 2024 05:40:01 GMT
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
88fdb0e2ee1e1905-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept,X-CSRF-TOKEN,Authorization,Client-ID
expires
Sat, 07 Jun 2025 03:52:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.jsdelivr.net
URL
https://cdn.jsdelivr.net/npm/sweetalert2@10
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato:400,700,400italic

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| $ function| jQuery function| Popper object| bootstrap function| loader function| gtag object| dataLayer function| convertNumberToWords function| convertNumber object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal

3 Cookies

Domain/Path Name / Value
bill1k.fun/ Name: PHPSESSID
Value: a01bafd81a686ab74e7dbda107f947ee
.bill1k.fun/ Name: _ga_4BM81NPTGW
Value: GS1.1.1717732360.1.0.1717732360.0.0.0
.bill1k.fun/ Name: _ga
Value: GA1.1.1406997242.1717732361

3 Console Messages

Source Level URL
Text
security error URL: https://bill1k.fun/
Message:
Refused to apply style from 'https://cdn.jsdelivr.net/npm/sweetalert2@10' because its MIME type ('application/javascript') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://bill1k.fun/1.css
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://bill1k.fun/
Message:
Mixed Content: The page at 'https://bill1k.fun/' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Lato:400,700,400italic'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bill1k.fun
cdn.datatables.net
cdn.haitrieu.com
cdn.iconscout.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
gcs.tripi.vn
i.imgur.com
inkythuatso.com
lmhmod.me
maxcdn.bootstrapcdn.com
region1.google-analytics.com
seeklogo.com
stackpath.bootstrapcdn.com
thoitranghaianh.com
www.googletagmanager.com
www.ngoisaoso.vn
cdn.jsdelivr.net
fonts.googleapis.com
103.27.236.152
103.42.57.53
104.17.25.14
104.18.10.207
104.18.11.207
104.18.29.243
172.67.139.164
172.67.190.76
188.114.97.3
199.232.192.193
2001:4860:4802:34::36
2400:52e0:1e00::1054:1
2400:52e0:1e00::1080:1
2606:4700:20::681a:87b
2606:4700::6812:ba1f
2a00:1450:4001:808::200a
2a00:1450:4001:80b::2003
2a00:1450:4001:80e::2008
2a04:4e42:200::649
09063de8aa4d273e11ac447357039b5c59e4f5b250ef6bc22bc1c41afc196367
1aefa3ee08b52202774929effa17b473436f3da9b4162a02ad428f1a75b5a664
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2d5fa531e30ac3debad673003128f1ca9ad3c964ef17b547377e7ed09bd4504f
36b2057eb5eef261a2cbb8c149dcf3a11edaa15ccd8e3d462eb34999f5ff8f2a
36f3b7c5935eda3993d9d0325a8f93ce4087ee5990ab8ca19628bfbfd880e06c
372779b1631bcd2322c8fe6e0ca6ca090d095d36321b08ba4151b871abf67bff
3816dc22630d90a30bd8dead608bd0d90801b6031f3ba25b428f58093170f71f
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
40d021bb735672992976d1db551b5d40a26f50be9cca29800a45702c8bed0df6
4b24ef787803f8b909be6d372821cfaf35194e1a399c9cbb29fff6dfb7529643
573deb775e6b633e20c149c6927f43b70c4e459f709124a0819df0eaa3e1aadc
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6fdd458c1cc7da896923768468f2ad08d41d92d8cfb5e4bfe7970213e339bde7
78efe0c62ae7184c60fd913073c715baae94bacdc6e87d27e13fd4c57e86558e
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7bc6e9e976f1b0bfef0189b31a0d77d4fc97bce1d96ce5b721984b30e5a4ea23
7d826d1d841f78418e3f8abf2977329dedac4e7d2b8fd3f0ff966db0106367d6
7d850e525a01c4397199826c77e8fbc02dd3316dfe9bc1312ac1018fb51230ef
87f7ef4c84e6eaa58cb8bef6cad1193601b93d430d731866e1c66fa46cbc2302
a2ca206ebcbdc6caca841902892f2ee1ff4a3f5db4289441ceec32857c9b7548
aa5886df1f38d8aee7e109a89a4ef76f02548096c20e815f6d8a044ddbed64e4
b039a2854234d3e317bae314899190b7e54ad8403ab696fc29dc6779a2533594
b977f453450222a069d89dd2e776f6f21f9fa42f6e15c03c7fe6ff34d9a2c159
be62e6a92e8dfb591bf56cfd7a23dc759fa3bf63d5183543ffdd17b2903e64fc
c33eb28c2bb89efa170516e260482bd3250b67cdce53e2af503305680c36676a
c5c8c705732feae73cb74810c9f2e17c44a9f7e71544d646e03205c02c350191
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
ccea664f6f6234df180a6abfcf1f9f232d44f3443c9abffa4a43d2b63b38ad5c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5108bdb90d88e0707e65421e2d8a6d456752a4ec238ae5be1a75f7feaea112c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d