urlscan.io logo urlscan.io
SecurityTrails logo

1d6cd6411f5.winsites.net Open in urlscan Pro
94.237.93.242  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://gtbks2.cn/burl/index.php?type=web&_f=Kaufland-M2022&_p=Pop
Effective URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIs...
Submission: On August 05 via manual from PL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 6 countries across 11 domains to perform 18 HTTP transactions. The main IP is 94.237.93.242, located in Finland and belongs to UPCLOUD, FI. The main domain is 1d6cd6411f5.winsites.net.
TLS certificate: Issued by R3 on June 10th 2022. Valid for: 3 months.
This is the only time 1d6cd6411f5.winsites.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 185.66.201.42 201702 (SKHOSTING-EU)
1 185.66.201.8 201702 (SKHOSTING-EU)
3 65.60.9.236 32475 (SINGLEHOP...)
2 3 51.68.85.158 16276 (OVH)
1 1 34.91.142.64 396982 (GOOGLE-CL...)
1 1 34.91.27.112 396982 (GOOGLE-CL...)
1 1 34.147.1.177 396982 (GOOGLE-CL...)
1 94.237.99.118 202053 (UPCLOUD)
9 94.237.93.242 202053 (UPCLOUD)
1 178.63.30.222 24940 (HETZNER-AS)
18 8
1    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
gtbks2.cn
1    185.66.201.42 (Nitra, Slovakia)

ASN201702 (SKHOSTING-EU, SK)
PTR: affilist.com
qoaaa.com
1    185.66.201.8 (Nitra, Slovakia)

ASN201702 (SKHOSTING-EU, SK)
PTR: 185.66.201.8.skhosting.eu
qlaa.net
3    65.60.9.236 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi
us.r-q.media
3    51.68.85.158 (France)

ASN16276 (OVH, FR)
www.wewillserv.com
1    34.91.142.64 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 64.142.91.34.bc.googleusercontent.com
harrenmedia.g2afse.com
1    34.91.27.112 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 112.27.91.34.bc.googleusercontent.com
offers.quisaque.com
1    34.147.1.177 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 177.1.147.34.bc.googleusercontent.com
admoustache.go2affise.com
1    94.237.99.118 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-99-118.de-fra1.upcloud.host
1d69312e36e.trff9links.com
9    94.237.93.242 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-93-242.de-fra1.upcloud.host
1d6cd6411f5.winsites.net
1    178.63.30.222 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.222.30.63.178.clients.your-server.de
register.push.dog
Apex Domain
Subdomains		 Transfer
9 winsites.net
1d6cd6411f5.winsites.net
143 KB
3 wewillserv.com
www.wewillserv.com
6 KB
3 r-q.media
us.r-q.media — Cisco Umbrella Rank: 344324
7 KB
1 push.dog
register.push.dog — Cisco Umbrella Rank: 209290
8 KB
1 trff9links.com
1d69312e36e.trff9links.com
2 KB
1 go2affise.com
admoustache.go2affise.com — Cisco Umbrella Rank: 125142
221 B
1 quisaque.com
offers.quisaque.com
200 B
1 g2afse.com
harrenmedia.g2afse.com — Cisco Umbrella Rank: 165970
248 B
1 qlaa.net
qlaa.net
303 B
1 qoaaa.com
qoaaa.com — Cisco Umbrella Rank: 258151
744 B
1 gtbks2.cn
gtbks2.cn
663 B
18 11
Domain Requested by
9 1d6cd6411f5.winsites.net 1d6cd6411f5.winsites.net
3 www.wewillserv.com 2 redirects us.r-q.media
3 us.r-q.media qlaa.net
us.r-q.media
1 register.push.dog 1d6cd6411f5.winsites.net
1 1d69312e36e.trff9links.com www.wewillserv.com
1 admoustache.go2affise.com 1 redirects
1 offers.quisaque.com 1 redirects
1 harrenmedia.g2afse.com 1 redirects
1 qlaa.net qoaaa.com
1 qoaaa.com gtbks2.cn
1 gtbks2.cn
18 11

This site contains no links.

Subject Issuer Validity Valid
*.gtbks2.cn
E1		 2022-07-17 -
2022-10-15		 3 months crt.sh
qoaaa.com
R3		 2022-06-06 -
2022-09-04		 3 months crt.sh
qlaa.net
R3		 2022-07-28 -
2022-10-26		 3 months crt.sh
us.r-q.media
R3		 2022-06-30 -
2022-09-28		 3 months crt.sh
www.wewillserv.com
R3		 2022-06-11 -
2022-09-09		 3 months crt.sh
*.trff9links.com
R3		 2022-07-29 -
2022-10-27		 3 months crt.sh
*.winsites.net
R3		 2022-06-10 -
2022-09-08		 3 months crt.sh
*.push.dog
R3		 2022-08-05 -
2022-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Frame ID: 55A7270CDD3B842C6EF113BBA602C931
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bevestig dat je geen robot bent.

Page URL History Show full URLs

  1. https://gtbks2.cn/burl/index.php?type=web&_f=Kaufland-M2022&_p=Pop Page URL
  2. https://qoaaa.com/e8ff0088ab/1c337ce436/?placementName=mPop Page URL
  3. https://qlaa.net/go.php?go=https%3A%2F%2Fus.r-q.media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e0... Page URL
  4. https://us.r-q.media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&c... Page URL
  5. https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949... Page URL
  6. https://us.r-q.media/proc.php?342c71ee4c3bdd009289f2a7dfb2da9d66034be1 Page URL
  7. https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website... Page URL
  8. https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website... HTTP 302
    https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website... HTTP 302
    https://harrenmedia.g2afse.com/sl?id=5db1a4743bf47917e8f252cf&pid=228&sub2=132435&sub1=230008c83825d84350fa... HTTP 302
    https://offers.quisaque.com/click?pid=150&offer_id=5790&sub1=62ed3c33aa42c50001c8122d&sub2=228 HTTP 302
    https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=49&sub1=62ed3c33aa42c50001c8122d&sub2=228... HTTP 302
    https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad Page URL
  9. https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRR... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
  • <link[^>]+recaptcha

Page Statistics

18
Requests

100 %
HTTPS

9 %
IPv6

11
Domains

11
Subdomains

8
IPs

6
Countries

167 kB
Transfer

407 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://gtbks2.cn/burl/index.php?type=web&_f=Kaufland-M2022&_p=Pop Page URL
  2. https://qoaaa.com/e8ff0088ab/1c337ce436/?placementName=mPop Page URL
  3. https://qlaa.net/go.php?go=https%3A%2F%2Fus.r-q.media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5%26utm_campaign%3DMS-SL-NA%26cid%3D90affC1659714610aff7d7be5a830694a092a673%261%3D26233199&do=632fbd8fd86a3ccb33a33f843730f48b Page URL
  4. https://us.r-q.media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1659714610aff7d7be5a830694a092a673&1=26233199 Page URL
  5. https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90 Page URL
  6. https://us.r-q.media/proc.php?342c71ee4c3bdd009289f2a7dfb2da9d66034be1 Page URL
  7. https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90 Page URL
  8. https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=de2674ccee57c9e7cedd85c2d6e53ce5&eyer=0.12370513962054397&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=us.r-q.media HTTP 302
    https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=3&eyer=0.12370513962054397&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=us.r-q.media HTTP 302
    https://harrenmedia.g2afse.com/sl?id=5db1a4743bf47917e8f252cf&pid=228&sub2=132435&sub1=230008c83825d84350fabb4d930826041d74f0805-202208-flb*5467509-4538f*M7128419970660171894*sl_5467509-4538f*e0ef346cece3f2efea1762112a879dfb0bb116d1*21977-0aaa6c88*21977 HTTP 302
    https://offers.quisaque.com/click?pid=150&offer_id=5790&sub1=62ed3c33aa42c50001c8122d&sub2=228 HTTP 302
    https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=49&sub1=62ed3c33aa42c50001c8122d&sub2=228&sub3=&sub4=5790&sub5=150 HTTP 302
    https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad Page URL
  9. https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=de2674ccee57c9e7cedd85c2d6e53ce5&eyer=0.12370513962054397&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=us.r-q.media HTTP 302
  • https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90&eyeg=3&eyer=0.12370513962054397&eyei=0&eyew=1600&eyeh=1200&eyetd=210&eyef=us.r-q.media HTTP 302
  • https://harrenmedia.g2afse.com/sl?id=5db1a4743bf47917e8f252cf&pid=228&sub2=132435&sub1=230008c83825d84350fabb4d930826041d74f0805-202208-flb*5467509-4538f*M7128419970660171894*sl_5467509-4538f*e0ef346cece3f2efea1762112a879dfb0bb116d1*21977-0aaa6c88*21977 HTTP 302
  • https://offers.quisaque.com/click?pid=150&offer_id=5790&sub1=62ed3c33aa42c50001c8122d&sub2=228 HTTP 302
  • https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=49&sub1=62ed3c33aa42c50001c8122d&sub2=228&sub3=&sub4=5790&sub5=150 HTTP 302
  • https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.php
gtbks2.cn/burl/ 		131 B
663 B 		Document
General
Check archive.org
Download Go to
Full URL
https://gtbks2.cn/burl/index.php?type=web&_f=Kaufland-M2022&_p=Pop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7360afd5ab429182-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:09 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6moCwD7nt%2FAOZSpA5qHOVesQvz4Z81ixGMQl87KIajiIG4%2Fktq%2FAmmjrBDsIj%2F7vkJxiVvmQKqOM98xFIAEYbdOqjadD%2BGg5Vp7t0MJUgNJ11NG6JxoC0Dy%2FP%2FpzvbKur6Y3JWErJhY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
/
qoaaa.com/e8ff0088ab/1c337ce436/ 		668 B
744 B 		Document
General
Check archive.org
Download Go to
Full URL
https://qoaaa.com/e8ff0088ab/1c337ce436/?placementName=mPop
Requested by
Host: gtbks2.cn
URL: https://gtbks2.cn/burl/index.php?type=web&_f=Kaufland-M2022&_p=Pop
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.66.201.42 Nitra, Slovakia, ASN201702 (SKHOSTING-EU, SK),
Reverse DNS
affilist.com
Software
nginx /
Resource Hash

Request headers

Referer
https://gtbks2.cn/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:10 GMT
expires
Sun, 01 Jan 2014 00:00:00 GMT
pragma
no-cache
server
nginx
x-robots-tag
noindex,nofollow
go.php
qlaa.net/ 		663 B
303 B 		Document
General
Check archive.org
Download Go to
Full URL
https://qlaa.net/go.php?go=https%3A%2F%2Fus.r-q.media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5%26utm_campaign%3DMS-SL-NA%26cid%3D90affC1659714610aff7d7be5a830694a092a673%261%3D26233199&do=632fbd8fd86a3ccb33a33f843730f48b
Requested by
Host: qoaaa.com
URL: https://qoaaa.com/e8ff0088ab/1c337ce436/?placementName=mPop
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.66.201.8 Nitra, Slovakia, ASN201702 (SKHOSTING-EU, SK),
Reverse DNS
185.66.201.8.skhosting.eu
Software
nginx /
Resource Hash

Request headers

Referer
https://qoaaa.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:10 GMT
server
nginx
/
us.r-q.media/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us.r-q.media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1659714610aff7d7be5a830694a092a673&1=26233199
Requested by
Host: qlaa.net
URL: https://qlaa.net/go.php?go=https%3A%2F%2Fus.r-q.media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5%26utm_campaign%3DMS-SL-NA%26cid%3D90affC1659714610aff7d7be5a830694a092a673%261%3D26233199&do=632fbd8fd86a3ccb33a33f843730f48b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
65.60.9.236 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/8.0.11
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

Referer
https://qlaa.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:10 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubdomains;
vary
Accept-Encoding
x-powered-by
PHP/8.0.11
/
us.r-q.media/ 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Requested by
Host: us.r-q.media
URL: https://us.r-q.media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1659714610aff7d7be5a830694a092a673&1=26233199
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
65.60.9.236 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/8.0.11
Resource Hash
5015b8463f000f812baff35ec4ce634e1d4cf260c7254555c3eb613a11d497b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

Referer
https://us.r-q.media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1659714610aff7d7be5a830694a092a673&1=26233199
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 05 Aug 2022 15:50:10 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubdomains;
vary
Accept-Encoding
x-powered-by
PHP/8.0.11
proc.php
us.r-q.media/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us.r-q.media/proc.php?342c71ee4c3bdd009289f2a7dfb2da9d66034be1
Requested by
Host: us.r-q.media
URL: https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
65.60.9.236 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/8.0.11
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains;

Request headers

Referer
https://us.r-q.media/?utm_term=7128419970660171894&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:11 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubdomains;
vary
Accept-Encoding
x-powered-by
PHP/8.0.11
/
www.wewillserv.com/ 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Requested by
Host: us.r-q.media
URL: https://us.r-q.media/proc.php?342c71ee4c3bdd009289f2a7dfb2da9d66034be1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.68.85.158 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://us.r-q.media/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Cache-Control
no-transform
Connection
keep-alive
Content-Type
text/html
Date
Fri, 05 Aug 2022 15:50:11 GMT
Transfer-Encoding
chunked
/
1d69312e36e.trff9links.com/
Redirect Chain
  • https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83...
  • https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83...
  • https://harrenmedia.g2afse.com/sl?id=5db1a4743bf47917e8f252cf&pid=228&sub2=132435&sub1=230008c83825d84350fabb4d930826041d74f0805-202208-flb*5467509-4538f*M7128419970660171894*sl_5467509-4538f*e0ef3...
  • https://offers.quisaque.com/click?pid=150&offer_id=5790&sub1=62ed3c33aa42c50001c8122d&sub2=228
  • https://admoustache.go2affise.com/sl?id=59a8401d13943b96038b456a&pid=49&sub1=62ed3c33aa42c50001c8122d&sub2=228&sub3=&sub4=5790&sub5=150
  • https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad
Requested by
Host: www.wewillserv.com
URL: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.99.118 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-99-118.de-fra1.upcloud.host
Software
/
Resource Hash
1e8e6994efb5174ad48d883441a047cc9ce75d0a450a857654b294be102cd943

Request headers

Referer
https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7128419970660171894&website=21977-0aaa6c88&placement=21977&utm_content=fdc2c69a9cafac9c949390a197959495ba88b8ccbecabcbd83858081b6868685ba8bb889be8f8cbc828380ede7e9e0f6f9fae8fcb3efeef4fff2e2e896a694d285848f858bcfa58381cde0d3d2e7d6d1fafbf88d8c8a99fdf2c2f0c0c0c7c4f5fbf9f8f9cecfcccdc2fbf0f1f1fff4fde8efe9edecefe5ebea90
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:12 GMT
expires
Fri, 5 Aug 2022 15:50:12 GMT
last-modified
Fri, 5 Aug 2022 15:50:12 GMT
pragma
no-cache
vary
Accept-Encoding
x-robots-tag
noindex, nofollow

Redirect headers

access-control-allow-origin
*
content-length
0
date
Fri, 05 Aug 2022 15:50:12 GMT
location
https://1d69312e36e.trff9links.com/?p=6597&media_type=mainstream&click_id=62ed3c34af91a700018ee6ad
server
nginx
Primary Request push-recaptcha
1d6cd6411f5.winsites.net/ 		3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
a2f51922e3ca766b39929a64419d70ad8ac9ad323189d30506c3dab19b085308

Request headers

Referer
https://1d69312e36e.trff9links.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 15:50:12 GMT
vary
Accept-Encoding
app.css
1d6cd6411f5.winsites.net/css/ 		69 B
329 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/css/app.css?id=2fbe2d9a9a40ca9b2489
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
94d8599586a5ee9c62dc15b45ca083b69d060d0c12bf2be3673b19a9820216ea

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-45"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
app.css
1d6cd6411f5.winsites.net/css/landers/push-recaptcha/ 		1 KB
838 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
fd2168c89baf8cf41bbcc257be275ed2ded4c05e026dce680379d9c47e9316a3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-4db"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
pub.min.js
register.push.dog/js/ 		17 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://register.push.dog/js/pub.min.js
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.63.30.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.222.30.63.178.clients.your-server.de
Software
/
Resource Hash
94b76a730bcacf0fbb4c2d05205808375b12fc640417a3161f8ef731c84b7f39

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:50:12 GMT
cache-control
no-cache, private
content-encoding
gzip
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
app.js
1d6cd6411f5.winsites.net/js/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/js/app.js?id=d75b4cfe9b4f0f2f3a56
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
0a9b16afee4ee7fa81b369cfe3d69c3a6d4ff580726b9d9c10f398deb2fc3c22

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-4891"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
private.js
1d6cd6411f5.winsites.net/js/ 		187 KB
62 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/js/private.js?id=283bbb9239a516ffb8f5
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
69993bddaa120d79d2dd15ffe476c21c88f93cf13319a2ea925695e3da73fad7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-2ec57"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
app.js
1d6cd6411f5.winsites.net/js/landers/push-recaptcha/ 		134 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd6411f5.winsites.net/js/landers/push-recaptcha/app.js?id=67bf27b1cad5ae49729a
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
45f1d2720d19fe2bb39c826d7281b9dda2c28be1275b450b16fb1258ce1a9868

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/push-recaptcha?ctrack=1659714612.4154268783&traffic=eyJpdiI6IkpRdkFzUG5FQTRRcFMyUkxCNWR1a3c9PSIsInZhbHVlIjoiV3ZnWWNnTjlKQ0ZnVUpnbnhoQkxMOTZnT0diVXdsWU5sdTVrcm1tQ1pIQkc4aHFuQ2d1dnRjallFWHE2SzhxVyIsIm1hYyI6IjFkNjZlMjdjY2E0OTRlYzhkMDg4MTczNmFiYjIxMTM4MWIzMDMxYjZkMjNlZTE5ZmIyMzUwZjI4MTNlNDZkNGIifQ%3D%3D&out=eyJpdiI6IkpLRnpoTTZ2OFVlR2NkSXNwSjJ4d0E9PSIsInZhbHVlIjoiVE5PMlNqTVN2YitlNEMzdmpCUlFwV1ltNGRsbnhvUWxmcVA5b1pZbkhJWnlKOFJuY0dxUXdMdldtNGtsbDhEaVFHXC9BMGJnblwvbmYzNkFDOVwvT3ByMFg3K1JVYzFzTUxQaG9HaWdCZlFxUTZ3U3BLaG14bVAzZDRxVE1vaGhaZ0IiLCJtYWMiOiJhZTYyNzc4NGIwZDE2NjZlZTY4OGMwNmQyYzVhNGRkNWFmYmRkYzJhYTkyZTkzYmJhNTUwZjdhNjhhMDFkNDkyIn0%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-217cb"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
background.jpg
1d6cd6411f5.winsites.net/img/landers/push-recaptcha/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1d6cd6411f5.winsites.net/img/landers/push-recaptcha/background.jpg
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
a427da1bb64f30fe80524ca519c40ae58282c772f3e620db9e08c9ad51bc51f5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
"62df980e-44f0"
content-type
image/jpeg
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
17648
expires
Sat, 05 Aug 2023 15:50:12 GMT
left.svg
1d6cd6411f5.winsites.net/img/landers/push-recaptcha/browser/ 		874 B
655 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1d6cd6411f5.winsites.net/img/landers/push-recaptcha/browser/left.svg
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
fa24be6dd8a646de0a6b7cd0db935dd586fb8191f8f50918badec921ba55c3ad

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-36a"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT
recaptcha.svg
1d6cd6411f5.winsites.net/img/landers/push-recaptcha/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1d6cd6411f5.winsites.net/img/landers/push-recaptcha/recaptcha.svg
Requested by
Host: 1d6cd6411f5.winsites.net
URL: https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
3448fc7bea6a6b970de4ff8595094351a041920eca2678493910267744316adc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://1d6cd6411f5.winsites.net/css/landers/push-recaptcha/app.css?id=9e0a76690344ec6d544d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Aug 2022 15:50:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-13c1"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=31536000, public
expires
Sat, 05 Aug 2023 15:50:12 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| view object| pd_options object| __SENTRY__ object| DeviceAtlas object| subscriber

10 Cookies

Domain/Path Name / Value
us.r-q.media/ Name: u
Value: 7c9ea7f0f4f65f9f4670efc72a6b8ea0
harrenmedia.g2afse.com/ Name: afclick
Value: 62ed3c33aa42c50001c8122d
admoustache.go2affise.com/ Name: afclick
Value: 62ed3c34af91a700018ee6ad
.1d69312e36e.trff9links.com/ Name: rts-trck
Value: 1
.trff9links.com/ Name: t-uuid
Value: 5vsmg9y1k5ipqbp3whdgcok0k
.trff9links.com/ Name: traffic-visited-offers
Value: %7C%7C162754%7Cunspecified
.trff9links.com/ Name: traffic-back
Value: ok
1d6cd6411f5.winsites.net/ Name: XSRF-TOKEN
Value: eyJpdiI6Ik93SHA1Z1lCSjBsOXhUMUhnQjNnUWc9PSIsInZhbHVlIjoiaGwrT1hMZ09wdHBQZ1owQjlmSk01ZXc2ZjdFSzFMK1NHb3p0SGZvMUhERi9iVklEaU1haDYzcTJmS0tHRHBzM3BvblFkbWROMDNibGpVTWpacDQySElWSFZ1MGl4NiticnBmckt6M081NmFjZnZXQk95WWp0eTIwa3c2RDBMQUEiLCJtYWMiOiIxYmRjZDVhNmI0MDBkMWM4ZDNkOTlhMGFhMTgxYTgxZTAxODI1NGVmMjdjNDAxYTM4OGNjMGQ4MjBhMjMwODFiIiwidGFnIjoiIn0%3D
1d6cd6411f5.winsites.net/ Name: traffic_prelanders_session
Value: eyJpdiI6IlVUVXB2NkN5OFNKd1NDb0hvRlIwOWc9PSIsInZhbHVlIjoidUo1YVFWcld6Z09OQTM2Qm5tZnFlTm1nT0V5OFdkNVArSFEvRU9EcHNEd0JvaktkVkhVRDB6NHI2QlpPNStZU3p4QU92ZklpUDVKR3B2clhnYWNkV0xjOW9NRmFjT092RUtOU1QxR1hmNjJDb1laOEhycGhhY3BSUDVtaDdSZWEiLCJtYWMiOiJmOGRjZDdkYTgyZDJjZjY5MWU5OGU0M2NlYzFiYzg0ZTMzMzQ0YWUzZTE0ZmNjYjc0OWU5OTg4ZDlmMzM1MzhhIiwidGFnIjoiIn0%3D
1d6cd6411f5.winsites.net/ Name: XMHWZEfTCqhh89KY82RgORyVmk4aC3ROZ7OFvxH0
Value: eyJpdiI6InAzTUsyclhnQzE5aHNibjdaZmFvUlE9PSIsInZhbHVlIjoiQXJuYVB0Sld5VjExRDZIU3BXWXZjYTJTdk9FQS9ybTBmMnNWRjBMTWpseVZ2VmRkR0tpMEszaUlIa2cwNlVaaFhuNlZwVkdIZ0hOK2phbmpiSVl4VkM0c0gvRE5mOG1xV2tEQzZnTUtKL3QzcCtOalZLcGpMcjN5M2tUd2lTc0JQS1hFWUduNkR3dHNhRmhTbkxiaHhXakFLM2gzU1lzMytTRm9rR3k1azhxV1dGU2dLOTFzOVdJS0JMQm5rMzVaZXY5OFRsT2xIN2lhS1pkQmJ4TUNXYUg5R3oxMG8xOHZrbGQwcE9EREFSVW5qQWZJSEpUL2gwMHN3ZnlIeXBZMjhacjQvU1JXTWZELzc3aVZ3anpzMVMwRGx2bTJYS09TSkd3aTFwT0N2bEZ6ejhTOUpyWE52cG1oT1dmTUtJdkI2dTNDUHRWaFZZSWcxMDFieWs0T0ZuZkthUk85bHE4M01KZ0Z3MkZwRW5KbXNCa3lvQU5uNWZzMzNGeTBENmdlSmhMMmMyeE1ITnBRQnp1M08rSWZDL1dGS3grNW9YWVBuY2FSbURJcCtqVTk3a2dxODlCS0xTKzNxR0p6VE43anZEVU1sZFordUxvcVFlMjErTm9RcVlUenpZOVk2eStIVkJKay8vVkQwRlZvNG1TZlUzSENrU1NnWjREdWNWYTRCUWpaTktQQjlwbWo1QVo4TnB6elNLdnlSKzVBMWRJS3JHek1GWmVhZ05oRytxQi9LSC9yMnVDQVY5UDcydVpSSk51a3pUV3RrTkpzTm1jMnNJTXo4Uy9HN244ZEFzbmYwck9ocDhZRTZLbjNYU1FkMFVjRFZPWWk3RnRrcmNpSU8yUXNHSzFVVEVQdjRZVGVEZ1QrR0RRQXRJZGpmbFBpeWt2dWdrQkxWcG0wVU54SVNTZDRxcnh5bE1vQWR6U1YwRVlHcHFvV1hmVHJqdklOWkVQcVM4ck91azMzclduR2ZBK2FWZjY3SUQ5V011OVRTTHdGNytUenJZU0h4b0RTUzNPekgrenk3Um1EVkZzK0txSkhsY0VXblpXL2FRWEdHZGZOL0RwY1N3ZGJLWXFaUWxUbTRDWnhiaFBFa1BZYTBTSmlEZDZaMkRicSt4YzZ1U1p4VTlscytEWmhiaUlnUWxnYUphNVY4Yk5BazRMRGhUdWIvMHdBcld5RndSVyttNkZZU0t5cmNlOWZHdjZ6VTcrZWVPK3NSQTJOOVBuY2NvdDhqNitwUVNqWlBHYjg3Vmw5S2xCdXdhZTFJZVp0dStTYlhORnFraWV2SkdlMGNqc21BYTJFTENYOGtHc1ZaY2Z4dmZPUWtvZEdmcUIvb25pTEtJNjR0QTJvY3k2Q283MHBPam5tdGVxdWltV2NMRkxzUDdkK1phaXBpZWxPZUtRZE1INEZGKzA1UmlkMHppMkEvS3BkRVJ1K3VlWkZ6cHoxMzVJWk92bFVkTEdlVGNZWHgrMmRmMHN3QjMxczF3d01ZV2lVZjBNNnhEUi94eGRTNlozSmdYTjE3WWFUNEE2UGk3K0diVGYreTNmeFJVNlR0SEhoM0FkdVJ6MkVtOWRXWDk5UVdrb0NuYjVPNzc0RDMxamFwcCsyLzNKR3hwS29iU2k4UzZCU0FBaFFSUHlNUHc9PSIsIm1hYyI6IjZlODdjNWJiNDg3MDVkZjM4Mzg3NzhmY2I0YjBkNDVhN2U3ODZhMGVmMTUzYzAxYTU3ZTU0MmY5M2NkMjA3NTQiLCJ0YWciOiIifQ%3D%3D