1wqrwr.top Open in urlscan Pro
190.115.24.78 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://refpaxbzqm.top/
Effective URL:
https://1wqrwr.top/?open=register&sub2=14360
Submission: On April 30 via api (April 30th 2023, 9:55:22 pm UTC) from US — Scanned from NL

Summary HTTP 60 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 4 countries across 11 domains to perform 60 HTTP transactions. The main IP is 190.115.24.78, located in Belize City, Belize and belongs to DDOS-GUARD CORP., BZ. The main domain is 1wqrwr.top.
TLS certificate: Issued by R3 on April 14th 2023. Valid for: 3 months.

This is the only time 1wqrwr.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3030::ac43:a66e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	190.115.24.78 190.115.24.78	262254 (DDOS-GUAR...) (DDOS-GUARD CORP.)
33	2606:4700:20:... 2606:4700:20::681a:40b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.130.132 151.101.130.132	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
4	52.88.81.160 52.88.81.160	16509 (AMAZON-02) (AMAZON-02)
2 4	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
1	18.66.97.37 18.66.97.37	16509 (AMAZON-02) (AMAZON-02)
1 4	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
1	13.32.27.107 13.32.27.107	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
60	13

1 2606:4700:3030::ac43:a66e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

refpaxbzqm.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 190.115.24.78 (Belize City, Belize)

ASN262254 (DDOS-GUARD CORP., BZ)
PTR: ddos-guard.net

1wqrwr.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2606:4700:20::681a:40b (United States)

ASN13335 (CLOUDFLARENET, US)

1win-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.132 (United States)

ASN54113 (FASTLY, US)

api.lab.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.88.81.160 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-81-160.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.70 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

12688802.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
12572451.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-37.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-107.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	1win-cdn.com 1win-cdn.com — Cisco Umbrella Rank: 382519	683 KB
7	1wqrwr.top 1wqrwr.top	102 KB
6	amplitude.com api.lab.amplitude.com — Cisco Umbrella Rank: 7780 api.amplitude.com — Cisco Umbrella Rank: 2061	561 B
4	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 2437	75 KB
4	doubleclick.net 2 redirects 12688802.fls.doubleclick.net — Cisco Umbrella Rank: 546365 12572451.fls.doubleclick.net — Cisco Umbrella Rank: 553388	2 KB
2	google.nl adservice.google.nl — Cisco Umbrella Rank: 11490	665 B
2	google.com adservice.google.com — Cisco Umbrella Rank: 130	1 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 899 script.hotjar.com — Cisco Umbrella Rank: 1171	72 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	135 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 1718	251 B
1	refpaxbzqm.top 1 redirects refpaxbzqm.top	506 B
60	11

	Domain	Requested by
33	1win-cdn.com	1wqrwr.top 1win-cdn.com
7	1wqrwr.top	1win-cdn.com 1wqrwr.top
4	mc.yandex.ru	1 redirects 1wqrwr.top
4	api.amplitude.com	1win-cdn.com
2	adservice.google.nl	adservice.google.com
2	adservice.google.com	12572451.fls.doubleclick.net 12688802.fls.doubleclick.net
2	12572451.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	12688802.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.googletagmanager.com	1wqrwr.top www.googletagmanager.com
2	api.lab.amplitude.com	1win-cdn.com
1	region1.google-analytics.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	static.hotjar.com	1wqrwr.top
1	refpaxbzqm.top	1 redirects
60	14

This site contains no links.

Subject Issuer	Validity	Valid
1wqrwr.top R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
*.1win-cdn.com GTS CA 1P5	`2023-04-10` - `2023-07-09`	3 months	crt.sh
*.lab.amplitude.com GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-25` - `2024-03-28`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2023-01-23` - `2024-02-14`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-03-17` - `2023-08-27`	5 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://1wqrwr.top/?open=register&sub2=14360
Frame ID: B1FAC5D3C1D5B968AF6A67CC5559A143
Requests: 52 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister
Frame ID: FB0B4DDED5F29F51D76C5972D8A662AD
Requests: 1 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273
Frame ID: 06F86B7A1DE3F4FCCE517DD1506AC349
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273;~oref=https://1wqrwr.top/
Frame ID: E2C23292E8D776320C5EEE8D9EF86CA0
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister
Frame ID: BB0EFE1A5372B2A18A6ABD552E326FE3
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.nl/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273;~oref=https://1wqrwr.top/
Frame ID: D0ED8A92F82FF4DB875506D6547D44AB
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.nl/ddm/fls/i/dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister
Frame ID: 47FC6D23C0CD540FCC159309AE26C315
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1win

Page URL History Show full URLs

https://refpaxbzqm.top/ HTTP 303
https://1wqrwr.top/?open=register&sub2=14360 Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

60
Requests

98 %
HTTPS

54 %
IPv6

11
Domains

14
Subdomains

13
IPs

4
Countries

1070 kB
Transfer

3443 kB
Size

26
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://refpaxbzqm.top/ HTTP 303
https://1wqrwr.top/?open=register&sub2=14360 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister HTTP 302
https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister

Request Chain 46

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273 HTTP 302
https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273

Request Chain 55

https://mc.yandex.ru/watch/92006234?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3A798%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1012%3Acn%3A1%3Adp%3A0%3Als%3A423331071206%3Ahid%3A590984201%3Az%3A0%3Ai%3A20230430215518%3Aet%3A1682891718%3Ac%3A1%3Arn%3A90920301%3Arqn%3A1%3Au%3A1682891718919946866%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A132%2C122%2C146%2C59%2C251%2C0%2C%2C29%2C0%2C1524%2C1524%2C0%2C962%3Aco%3A0%3Acpf%3A1%3Ans%3A1682891716347%3Arqnl%3A1%3Ast%3A1682891718%3At%3A1win&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
https://mc.yandex.ru/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3A798%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1012%3Acn%3A1%3Adp%3A0%3Als%3A423331071206%3Ahid%3A590984201%3Az%3A0%3Ai%3A20230430215518%3Aet%3A1682891718%3Ac%3A1%3Arn%3A90920301%3Arqn%3A1%3Au%3A1682891718919946866%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A132%2C122%2C146%2C59%2C251%2C0%2C%2C29%2C0%2C1524%2C1524%2C0%2C962%3Aco%3A0%3Acpf%3A1%3Ans%3A1682891716347%3Arqnl%3A1%3Ast%3A1682891718%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

60 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
1wqrwr.top/
Redirect Chain

https://refpaxbzqm.top/
https://1wqrwr.top/?open=register&sub2=14360

261 KB
82 KB

400ms
146ms

Document
text/html

190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

34ba7177ccc63d63700d2583f93043f52e96bde9c07e47fda36d4e836174e114

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 30 Apr 2023 21:55:16 GMT
server: openresty/1.19.9.1
x-frame-options: DENY
x-request-id: 3kEn0dV9DOd5lJO8

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c03072c5ddcb88b-AMS
content-type: text/html; charset=UTF-8
date: Sun, 30 Apr 2023 21:55:16 GMT
location: https://1wqrwr.top/?open=register&sub2=14360#79i6
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B6cQ3eqbOEpPT9xjqfyX2Qi6hsqvAGVbOaCYM9sh6gJPBIN0rv%2BaoUmO0dyTegoU8JSPhoZ%2FJpYJzRKuHlcCFyMD7LHJL9HO5VYA%2FiZsgle8smrX%2BDx3Nha53UH4hN7BdKwobV9vLDKEBMGmjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 SFNSDisplay-latin.50a4eaff3.woff2
1win-cdn.com/font/ 32 KB
33 KB 142ms
56ms Font
application/octet-stream 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/font/SFNSDisplay-latin.50a4eaff3.woff2
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68

Request headers

Referer: https://1wqrwr.top/
Origin: https://1wqrwr.top
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1493250
content-length: 33064
last-modified: Thu, 13 Apr 2023 12:16:32 GMT
server: cloudflare
etag: "6437f2a0-8128"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SqGk%2BmowewVyVDnp3OdcKkowzxx5A55dyD9ooWS61vhKk3XtLOxIxZ3DLcMMND9g5xCzHw%2FyUsOxbkga3uqYwokRp%2BQ4jVSCXfU5fAAhUs9IahS4SZjS7lh6WKgD1jUVR%2BfYpKP8sHd61Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7c0307306949b740-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 SFNSText-latin.f09aa5229.woff2
1win-cdn.com/font/ 42 KB
43 KB 117ms
31ms Font
application/octet-stream 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/font/SFNSText-latin.f09aa5229.woff2
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6

Request headers

Referer: https://1wqrwr.top/
Origin: https://1wqrwr.top
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1493250
content-length: 43512
last-modified: Thu, 13 Apr 2023 12:16:32 GMT
server: cloudflare
etag: "6437f2a0-a9f8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DQ51ia7K6NOT7CHIoOIAOyf9Fo9OKBSnsaEipCe4wrRsJPAEwF4U5nnuSdyoj%2FQHawK7QNlXRZKl%2FLb6qymUGke7mvuI7poRnx2kQHhWWrYM0Z5zdkcaZRgX%2BRs7sm66fAhRV4UMdDwM9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7c030730694ab740-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 desktop.b3ddd9957.js Show response
1win-cdn.com/js/ 120 KB
31 KB 119ms
37ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/desktop.b3ddd9957.js
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77677fb9c9db0db0dc1a1746a7b916c31850e21d5647e91c093b830a9c8e3da8

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203754
cf-polished: origSize=123212
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: cloudflare
etag: W/"644bc6bd-1e14c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VRXcqvw%2FBptpiWu5R7bzrrg8nQvNfrcWOJAdYJIR444vR2EP8yMKdzlyOZB6F09Due1GuPH2mb5OPhbofXHn5UI3T2L4BFSF215M1F32zhfP2RjpRrfp%2BHeHw%2BzVwT1BxDTFzROLscYhLg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307306fdb0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 desktop.c03b8db26.css
1win-cdn.com/css/ 94 KB
16 KB 116ms
34ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/desktop.c03b8db26.css
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b9d04d042e1b1686dc3bfeec791df24e7bd650e462dbe94052591837be4bcc3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 893973
cf-polished: origSize=96137
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:21:58 GMT
server: cloudflare
etag: W/"64413c76-17789"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w0uJpu9mN6V8qGzXcKKOdqOTrL9X7iuTPwpAIjhxyQUDvCMpy5mlIdsLrKcb6UiguOCRYYqgi4%2FtCZKbLIP9SVbKvZ%2BYGo1FRlgb6G47hecVDZwHhLXcKZXMhz0gU0FPhKNfBLYCfwGIUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307306fda0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 chunk-vendors.8e07d0bc9.js Show response
1win-cdn.com/js/ 417 KB
130 KB 139ms
58ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 690407e69dc25a754e67e780c311e274ce02b5dbd08d26e9bb8e5c700c36ca50

Request headers

Referer: https://1wqrwr.top/
Origin: https://1wqrwr.top
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203722
cf-polished: origSize=427606
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: cloudflare
etag: W/"644bc6bd-68656"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qt1BTSP8Jvo%2FThdyUsAwhqyeqCUOYUuWbVI859H5tx0klyHuh4Q9BEeL6Pqff0ls%2F7lo6QNE8lImkK02vDJl4dBh6XQnJVCbssBpAbxjTwaIebdgIH3Mfj4%2Bb5bwXwYhYzPoS79HFiN4gA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030730694bb740-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 chunk-common.5ce1e96c5.js Show response
1win-cdn.com/js/ 23 KB
7 KB 138ms
58ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/chunk-common.5ce1e96c5.js
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75b79a010371d7bff58838a9cde724d4695750dcbebc3e90a3ab9541d8f97304

Request headers

Referer: https://1wqrwr.top/
Origin: https://1wqrwr.top
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203722
cf-polished: origSize=23739
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: cloudflare
etag: W/"644bc6bd-5cbb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BWGxHA7vOrp0lf3jz%2FNewhz8t5tUmpqYTvHgi08NqxD4J8Cd899iARkdESe9lRuEfLxB3kFhE%2BEwEu91WBILs9CiP0gr%2FSZeTLGcGLhI0Qo5xOBxMlpa3%2F6q58G2%2Bxjy0hJnl5EK1koY9g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030730694cb740-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.cd7cdac87.js Show response
1win-cdn.com/js/ 78 KB
30 KB 137ms
57ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/index.cd7cdac87.js
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7fb944a4cf45c9baf9edf920cdb000791b973153c3eb0ea7babe1eb8a90bd9a

Request headers

Referer: https://1wqrwr.top/
Origin: https://1wqrwr.top
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203722
cf-polished: origSize=80205
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: cloudflare
etag: W/"644bc6bd-1394d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dpH1au3YxgSuF6TR%2Bkz30sZ9twgL7YLZSJNrWxNWxucCx6BW%2FAip8OfF4kkyjY%2BlrIUOTgvPFchqbLEf1fSAjGcdN0aIp2NMdhIVY%2BzcvP37ugVa0jLX0FaeTW59qUuSewi7mFeHYz0ljg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030730694db740-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 affiliate:link_visit Show response
1wqrwr.top/ 15 B
426 B 64ms
64ms Fetch
application/json 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/affiliate:link_visit?partner_key=79i6&sub_ids=sub2%3D14360

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 / Express

Resource Hash

a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/?open=register&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
server: openresty/1.19.9.1
etag: W/"f-VaSQ4oDUiZblZNAEkkN+sX+q3Sg"
x-powered-by: Express
access-control-max-age: 7200
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: undefined
access-control-expose-headers: Authorization
x-frame-options: DENY
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Authorization
content-length: 15

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 icons-common.2d0de9f5c.js Show response
1win-cdn.com/js/ 210 KB
54 KB 36ms
36ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/icons-common.2d0de9f5c.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 081cc0024405334dfb80cb3bdd05f45c35ec771ca840c583b24b05d97406024b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1069104
cf-polished: origSize=214813
cf-bgj: minify
last-modified: Tue, 18 Apr 2023 12:48:38 GMT
server: cloudflare
etag: W/"643e91a6-3471d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CknPRkMhhRxZw7l9Hr12sEzgJQjN147C%2FlxmCsZ5FBlFYuI6%2BqWcSOFCWRfV%2F7Meq6uUndvcrI2rign82rlHlaYk2GT7ZUtlSwjL0rBVztbdUVJacEszQMHvrOnVbPJgAHsgFD98DKRQBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030731495e0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 21705.b48d53948.js Show response
1win-cdn.com/js/ 29 KB
10 KB 31ms
31ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/21705.b48d53948.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1076880a1b1e3c9e8896163ee62ab7c7f2de4be14b4c160b907938ba06e4d367

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 893991
cf-polished: origSize=29338
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:26:09 GMT
server: cloudflare
etag: W/"64413d71-729a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RbSozh2BwiytJ5dP76tkP%2BanZY21rYrC7u%2FmnjhwT37cO6FifVUUCaYUgJrL%2FyABynqrSnhhnHK3S9%2FuQx3aj6KiT9mhMfnIOR4LGI%2FvL77so36FGj%2BZ60G9%2FVGlhB2J9V2q%2BKNJEBMeLA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030731495f0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 49439.4e2f3a6a4.js Show response
1win-cdn.com/js/ 19 KB
6 KB 32ms
32ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/49439.4e2f3a6a4.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa9f843d3e35f7c78c49deed39d49a93e2a436e650f05571be1138667e43475d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 284559
cf-polished: origSize=19193
cf-bgj: minify
last-modified: Thu, 27 Apr 2023 14:45:13 GMT
server: cloudflare
etag: W/"644a8a79-4af9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iso8uX0k%2F%2FesrHaLhvOdEpb%2BQlf4HIJWvbwdSckhKMKjh6n4M%2BlQ6xukfFSkHHd6SxerQGlVGbMRojObaNVaWcu6zgErkxI2kMRamPfzf%2F81raKibD4CbA4wAJjiWQLK5ax8v4odL5pt8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c03073149600eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 42523.db3879442.css
1win-cdn.com/css/ 21 KB
4 KB 45ms
45ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/42523.db3879442.css
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff500ce68bc0a2adf9b08fc0c16a6ea1fdf9f2d2c8fe351f15ac5b3a1b357749

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 812902
cf-polished: origSize=21034
cf-bgj: minify
last-modified: Fri, 21 Apr 2023 11:55:45 GMT
server: cloudflare
etag: W/"644279c1-522a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EKd0MRHCPhdTPHbkhldN94YCHkZxzBVmwB%2B6JhT1Pg%2BOFuDQ0NK2HqmFmykO1KiMP6A5kP9PzYJLL0YtP1%2BczMccI76W23Il8JRKTdiiLqJAMGWHQPr64Romer716SnFYKUybNZjXer9mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c03073149630eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 42523.55a83cf90.js Show response
1win-cdn.com/js/ 648 KB
175 KB 46ms
46ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/42523.55a83cf90.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44a9f042cf5b8d1fe335977147738416946564ef110f15650544d5aa681f9c6e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203766
cf-polished: origSize=663282
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: cloudflare
etag: W/"644bc6bd-a1ef2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6fLARQm83s%2FU3%2BgL64bUvyxUr5apHpmCo35ihAuOH25x7XjZ%2FWbwTCwiMoUxsT2h%2BhDgP17f9FGR3k1FG4EASVhpq5%2FxxwrFvjsbbrWAmWB7iRuEdONlmuNCoaI6DrGEy%2Br1VLVNOy1Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c03073149650eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

OPTIONS
H2 200 vardata
api.lab.amplitude.com/sdk/ Frame 0
0 406ms
179ms Preflight 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/vardata

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-amp-exp-user
Access-Control-Request-Method: GET
Origin: https://1wqrwr.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-amp-exp-user
access-control-allow-methods: GET,POST,HEAD
access-control-allow-origin: https://1wqrwr.top
access-control-max-age: 1800
date: Sun, 30 Apr 2023 21:55:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
x-amzn-trace-id: Root=1-644ee3c5-1e9ffce50bbaa99e1b2eb14c
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-served-by: cache-ewr18156-EWR
x-timer: S1682891718.787875,VS0,VE84

GET
H2 200 vardata Show response
api.lab.amplitude.com/sdk/ 2 B
152 B 216ms
215ms Fetch
application/json 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/vardata

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/42523.55a83cf90.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://1wqrwr.top/
accept-language: nl-NL,nl;q=0.9
Authorization: Api-Key client-Ss5BFx7UDrTj948TJHfc5ZUoTW67EjvZ
X-Amp-Exp-User: eyJsaWJyYXJ5IjoiZXhwZXJpbWVudC1qcy1jbGllbnQvMS43LjEiLCJkZXZpY2VfaWQiOiJCTTA0cmNEXzdIaDhaT2d0TE5GbUtMIiwidXNlcl9wcm9wZXJ0aWVzIjp7fX0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-ewr18156-EWR
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 0
x-timer: S1682891718.969812,VS0,VE119
x-amzn-trace-id: Root=1-644ee3c6-23989d533987934419f8c466
vary: Origin, Origin
x-cache: MISS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://1wqrwr.top
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 2
x-cache-hits: 0

GET
H2 200 get-authorization Show response
1wqrwr.top/ 19 B
187 B 126ms
126ms XHR
application/json 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/get-authorization?random=1682891717520-0.4015298348928802

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

759315d5ae8c31136d2a7bc803e591554894987559325cdf7e0b5965bec0eaca

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://1wqrwr.top/?open=register&
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-origin: https://1wqrwr.top
date: Sun, 30 Apr 2023 21:55:17 GMT
access-control-allow-credentials: true
server: openresty/1.19.9.1
content-length: 19
x-frame-options: DENY
content-type: application/json; charset=utf-8

GET
H2 200 firebase-app.js Show response
1wqrwr.top/firebase/8.1.1/ 19 KB
7 KB 61ms
60ms Script
application/javascript 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/firebase/8.1.1/firebase-app.js

Requested by

Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/?open=register&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: gzip
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: openresty/1.19.9.1
etag: W/"644bc6bd-4ded"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 178 KB
61 KB 194ms
69ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Requested by

Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

965693d1344a3fc125a718d67bad8b24ae2efb8ca779a213524a1802d5c42bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62458
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 30 Apr 2023 21:55:17 GMT

GET
H2 200 firebase-messaging.js Show response
1wqrwr.top/firebase/8.1.1/ 40 KB
12 KB 67ms
67ms Script
application/javascript 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/firebase/8.1.1/firebase-messaging.js

Requested by

Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/?open=register&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: gzip
last-modified: Fri, 28 Apr 2023 13:14:37 GMT
server: openresty/1.19.9.1
etag: W/"644bc6bd-9f25"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 35616.7f5925bbb.css
1win-cdn.com/css/ 20 KB
3 KB 32ms
32ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/35616.7f5925bbb.css
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3632ad0ef20284bb996a0c5e354ba7751e36835e124fc972521f3cec75aec3d7

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4522536
cf-bgj: minify
last-modified: Thu, 09 Mar 2023 11:29:26 GMT
server: cloudflare
etag: W/"6409c316-5166"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QYHMvaKE4EEciL%2FsFZjWZlgPd%2FwYpz8gQutA7YMpe1qi42G2%2Bqn1h5tG7of%2BIrEjP%2Fl9eMqdJWmTesHXqhxlho9hvfBSOW41lLsInMUCqEC8NeHJQalas6JKCuQq14MeE71AgFGoPFkNSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c530eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 3148.d4b4f98f6.js Show response
1win-cdn.com/js/ 13 KB
5 KB 32ms
32ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/3148.d4b4f98f6.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f7fdf24b33c2ffd4503e3c80c9e67c6e3cc8abd159cd3d1c261f0dc6f8e5f91

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2196081
cf-polished: origSize=13348
cf-bgj: minify
last-modified: Wed, 05 Apr 2023 11:36:36 GMT
server: cloudflare
etag: W/"642d5d44-3424"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J1kjumaafA5bd1UCePW43ndJ3QbWEv70ML2ByRwABaakLqhZZwqw7Z3ePvqltQdgp8E%2BhnOeNqm4V%2BYQfTMzYUJ%2Fv6EaOb1C53qRIMRZolFnr7JZxSbHZZs9wxnXSSae4TU%2B7YvNqJ%2BRIg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c570eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 87724.94cdb6912.js Show response
1win-cdn.com/js/ 12 KB
3 KB 30ms
30ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/87724.94cdb6912.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 367b1cc3c4b30dd5c0b2a636977bc6d587ac4796713ae2ac49fd8696dfc0316a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1512492
cf-polished: origSize=12823
cf-bgj: minify
last-modified: Thu, 13 Apr 2023 09:35:16 GMT
server: cloudflare
etag: W/"6437ccd4-3217"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1wMozg%2Fb8twHaKPn55CPBaJYSTMSV28bzQRLw08%2BLldjsKrFoyEB1H5C1Vu7qoj%2FfkP3yXCFJjJraarj7rtXJctUX96ygTfyyN6hprpxrjCCo4knc6U%2BdMdMEqXYR83IVz%2F6G5stNRKGMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c5b0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1665.e3c55f209.js Show response
1win-cdn.com/js/ 91 KB
16 KB 37ms
37ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/1665.e3c55f209.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bc900cd16c85ba32d10e2ebf9e925e67c74da29f2e9830ecd58ee41512b7b8e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 378941
cf-polished: origSize=92934
cf-bgj: minify
last-modified: Wed, 26 Apr 2023 12:30:46 GMT
server: cloudflare
etag: W/"64491976-16b06"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DtkchkJnPbSJBt%2BvOVtrtoa2VSCSiEQwEdkb9K%2F9znuElHtu0wHAhqJWPDoMA9MoFGyG%2FKSMIbdhbjIbKfof86ssaK4y7yWAtjohwUOi5Kc5hp3KVDO8PyP2Wbmz1I314gGH51lzGOi%2B9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c5c0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 82562.60648b098.js Show response
1win-cdn.com/js/ 11 KB
4 KB 33ms
33ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/82562.60648b098.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af60c7e817766bec3a2e6609310f903cea2d678324036a2e1a8317f06aee0aa9

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 894035
cf-polished: origSize=11248
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:26:09 GMT
server: cloudflare
etag: W/"64413d71-2bf0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=woA1RQt7R3QbbKlrJd%2B%2Bp6%2FvbPaFaeCHDcfzL%2BeX%2BsG6Dt%2F2nx2zawgLxpBvq5Rh1yfzxx9FjyRBnlmmk01DfMWAd1zpfoNNFJe8n5xWWDhoOd%2FLtPcW%2BMibOiDMNMC2P1NDHMgk6RyDcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c5d0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 20010.90a88829f.js Show response
1win-cdn.com/js/ 11 KB
4 KB 31ms
31ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/20010.90a88829f.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc960bf4b7ad4abff7e7af70865dbf97a56b1e2a749e16939d8f16e1c5427d1f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 893972
cf-polished: origSize=11331
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:26:09 GMT
server: cloudflare
etag: W/"64413d71-2c43"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2FLr7Nrt9Z36xZ3886bibUGeikM94ALyHWigSlbHJHO6sGxpCcWOOauTC842947mrPd6C1rXgJwsGnrbfh%2Flcz5A8Rku5ThiVOsGl%2F9kJq4seCrnyufAgK4L7wxPL8XIgP3zPF4LzNLGA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c5e0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 3293.43502c037.css
1win-cdn.com/css/ 67 KB
11 KB 34ms
34ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/3293.43502c037.css
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2220769992b6716e4b0ee6544cb51e27047d7fd9207040afaacf41471bfe6e9

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 893972
cf-polished: origSize=68735
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:26:09 GMT
server: cloudflare
etag: W/"64413d71-10c7f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ef5lv7mw7vr3TMU1ChzqBymf6lBTJahxvzNjTqSNLvgq3kZ9srqLV%2FUqvlIpKALzlTcMTl24XyWOXkwpnkAfuN%2FQ0lBnZm2QV9ptPeV8C47%2FxXCD5Vp0tVBVk3wSg%2Bi986x4gHucTskKVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c600eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 3293.dfb1436e3.js Show response
1win-cdn.com/js/ 101 KB
27 KB 37ms
37ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/3293.dfb1436e3.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf7cc6d61ff402d48c066f44dcfe7719556109ad1f39e03f003fa6361d735fa8

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 293841
cf-polished: origSize=103222
cf-bgj: minify
last-modified: Thu, 27 Apr 2023 12:10:32 GMT
server: cloudflare
etag: W/"644a6638-19336"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AesYDYjhGj1gNvcsKN3%2BLF3klcoe%2FZayT3WtZPNh8zxKALd7OjRDzs%2FgVh6zMwFRyDyXhi83LQCmQ3zJ3VB5UtF3FUsBt8w6GPkdOZnhzWtiuQK5Hv0b9x3w92v9Sry9MXWLHM8GbSz0bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c620eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 80794.110b33e19.js Show response
1win-cdn.com/js/ 8 KB
3 KB 34ms
34ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/80794.110b33e19.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd55168e2ec771243678b7b8bce6e26c8460b3b250e8d40d3958a5f638b79b62

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1069101
cf-polished: origSize=7958
cf-bgj: minify
last-modified: Tue, 18 Apr 2023 12:48:38 GMT
server: cloudflare
etag: W/"643e91a6-1f16"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nzgbV%2F48mAMMWFbcJ3jLhm98tx1g66gdM3SPwAHtkPkgQOXm1CvHJp4vJ11HUn3IibZqrXfLB1p%2FcTG25nCylv03y3j42yvHrBoAabRQL4ZNBBUR8rtLbmPItGrpCMHlwUbuLMrduSxuNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c630eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1561.389f25540.js Show response
1win-cdn.com/js/ 17 KB
5 KB 32ms
32ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/1561.389f25540.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 891653281f62b1f2b6346c644fb4a0c7510fb07d857df9a8b4d5b98b57376159

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 378941
cf-polished: origSize=17048
cf-bgj: minify
last-modified: Wed, 26 Apr 2023 12:30:46 GMT
server: cloudflare
etag: W/"64491976-4298"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2cVU%2BCeLlGn5bKi3Pxj5nJaT0Vbl%2FxcQF%2FHBmwgD4xpCpnI2%2B%2FOo8yuOgfOfT3DbGDRurKy0xPjIoMNhK043XNM016Yj5Nf%2BFAcJ3CFAOukgH%2FFiYgU6CGJG76xsLNnK7fQgyxA2k%2FeXXw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307337c640eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 53211.94e86b54d.css
1win-cdn.com/css/ 11 KB
3 KB 59ms
58ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/53211.94e86b54d.css
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef3428fbfdbf673435898684c2ceb8c453f659065e3a90b4c4f3734c5990c4e3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 893972
cf-bgj: minify
last-modified: Thu, 20 Apr 2023 13:21:58 GMT
server: cloudflare
etag: W/"64413c76-2a64"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rokg5FkNAXsgOYAJGWDmKJ%2BTm%2Fq%2Fw%2FrKbgnezleAhQ0yNQs%2FPaSEICEWaQjAcr9PwoA5TSwflyOArxyH4ySWv7pVfHR%2FByi1ipxpQZ1yEZCWDTvGkWIB6Av%2F0vfMGnTBYDEgom4DZCjaQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733acad0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 title Show response
1wqrwr.top/common/ 16 B
132 B 70ms
70ms XHR
application/json 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/common/title?path=bets&lang=en

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://1wqrwr.top/?open=register&
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
server: openresty/1.19.9.1
content-length: 16
vary: Origin
x-frame-options: DENY
content-type: application/json; charset=utf-8

GET
H2 200 51840.b25c35372.js Show response
1win-cdn.com/js/ 766 B
801 B 56ms
55ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/51840.b25c35372.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2511c31016a689e8f193b6d5df168a94e1bebd56d1fe00d8dc27a7214b70a58

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 284235
cf-polished: origSize=810
cf-bgj: minify
last-modified: Thu, 27 Apr 2023 14:45:13 GMT
server: cloudflare
etag: W/"644a8a79-32a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ltS%2FmRKZ3c%2FJ%2FHtNt5P3VF4%2FK2hJGth%2FQZ2CiTWRvWURMZk0DP8tAU7N8SBm6VN97Q%2FH4gRfN1fw0w3Q%2BBA4kOljwWFF5tR%2BaP%2BsC20d9HQePgeCSgyYcxobhyZmM0M3hvWuM9w9NfEOPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733acae0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 54801.d2015519d.js Show response
1win-cdn.com/js/ 25 KB
9 KB 38ms
35ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/54801.d2015519d.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb7d41244c86e6cd3a95f5f5cd68e0803001f5647bcc21fbd6e85c1cc7d1b603

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4192334
cf-polished: origSize=25558
cf-bgj: minify
last-modified: Fri, 10 Mar 2023 11:28:45 GMT
server: cloudflare
etag: W/"640b146d-63d6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w0NpYu%2BEFF0jVzD9kKabEgcceCYOyIaIq6Jg4U0OcjcHYqqq4Vtv9HtZlfY0%2FJ9PbJN45WPWg66pazRORjr39KAI6CD5C4uUZjnxpCaKkIUdEJSyAN24%2BvfROFsFaKahOEth9vB5CKcFaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733fd170eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 76328.b21c93d25.js Show response
1win-cdn.com/js/ 31 KB
10 KB 36ms
34ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/76328.b21c93d25.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef33c57048b702d0c68665a43955429ae2491bff20037b3a36c6b9b817f6b8dd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 209635
cf-polished: origSize=31632
cf-bgj: minify
last-modified: Fri, 28 Apr 2023 11:31:22 GMT
server: cloudflare
etag: W/"644bae8a-7b90"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Md%2BCLZ17wXpRU2fBFU8l1cQVROOvIV6D8HTM0liy9Z3C1AIaHgeBnMH1WRw7rFEmQuUF3OVjYfnrA8kqgmZcMKAZO22wYxB5OdxwF3x%2FFSLZZl3Mmv8Ic4%2BCF0AWJo8Ww39TuUYQWDKCMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733fd1a0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 13392.e7adff534.css
1win-cdn.com/css/ 32 KB
6 KB 34ms
32ms Stylesheet
text/css 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/css/13392.e7adff534.css
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28cd730ff2aed4621bbc27132a62855143c01624555a5dae2d9413d7340d64d3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 806849
cf-polished: origSize=32951
cf-bgj: minify
last-modified: Fri, 21 Apr 2023 13:20:32 GMT
server: cloudflare
etag: W/"64428da0-80b7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VJFb0WjAQPN8NRVLfvlqMJS0J6%2FClHMKmyEP%2FLMiuEg4bvWAtLTo9OypbKgtkPb%2BneNV%2BSQsX%2B1ZdjcfuyQxb35RuiwwAbOVjU5C%2B1wHZiXZqjFSSMUFIBXIfjIkK7tjiTA7NptF1wG7WA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733fd150eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 13392.8e2a6deb5.js Show response
1win-cdn.com/js/ 47 KB
13 KB 39ms
36ms Script
application/javascript 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1win-cdn.com/js/13392.8e2a6deb5.js
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/index.cd7cdac87.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e1d631f408cecc1225c2a9d8bbfc8a74f449f931fd2c18f59661ba5f8ba1569

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 378600
cf-polished: origSize=48575
cf-bgj: minify
last-modified: Wed, 26 Apr 2023 12:30:46 GMT
server: cloudflare
etag: W/"64491976-bdbf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rDPMMth67gew1ZENawqzOfZYTNeOhaLkLodNhrEi8Bwmr4vzUE4gzcm6TWOLaE00wQveQcIBBkwkF3xfSa%2FbwXCSTGBPaNGFn14RexodzTI65V3DmVqKb6%2BLfxIQurxIG10TSHl%2BzKEkxg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030733fd1b0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 nl.svg
1win-cdn.com/img/flags/ 245 B
496 B 32ms
31ms Image
image/svg+xml 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-cdn.com/img/flags/nl.svg
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/bets/home?open=register
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 317b23c0c68de40a09f524be5874131d6d06fb49bb45037a15575448dbd94852

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2023 09:47:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 8338037
etag: W/"63cfa92c-f5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HQ7LBQXpSRHAYRxXEom8LxRO1Nl9uR7gEk0RXXZcu07NHaJVdip9i3NrLGmmoAIleA5RNrjeMB8sLxsH9Wm%2BwDjfdYOLhrrXu5sVY%2B6K%2F8GX%2BKveP%2BPVxJktEWf4AnKDZyWnJtB5s%2BEm%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307341d660eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 store-authorization Show response
1wqrwr.top/ 31 B
259 B 158ms
157ms XHR
application/json 190.115.24.78
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://1wqrwr.top/store-authorization?token=

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

190.115.24.78 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

openresty/1.19.9.1 /

Resource Hash

0f5076a35ed631c902095c1b4e778e9399c78f553b7a3c137fe7549e126411ee

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://1wqrwr.top/bets/home?open=register
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-origin: https://1wqrwr.top
date: Sun, 30 Apr 2023 21:55:17 GMT
access-control-allow-credentials: true
server: openresty/1.19.9.1
content-length: 31
x-frame-options: DENY
content-type: application/json; charset=utf-8

GET
H2 200 emoji-soccer.1a6d4ecac-160.png
1win-cdn.com/img/ 8 KB
8 KB 32ms
31ms Image
image/png 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-cdn.com/img/emoji-soccer.1a6d4ecac-160.png
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/bets/home?open=register
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 575412b54e344b5f40a21bb5b799f0430919cfb4ba807f9832c040e13711dc8e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4524573
content-length: 7896
last-modified: Thu, 09 Mar 2023 11:29:26 GMT
server: cloudflare
etag: "6409c316-1ed8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j7tLUB%2F53jHzOlUz3eLFqEnet6lKDJG27P9VvOpVVr%2FHMLEmYcnFIPYfWpwl0%2FHBV99xjlI2z%2FEB2GDx%2FT28Rajnbidll4sYW2K5QUpXpby1F63sQa%2B%2B2RvJjFJZXXOk4a6Rkxy1X%2FVc5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7c0307348e2d0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 emoji-slots.1c6e965b9-160.png
1win-cdn.com/img/ 9 KB
9 KB 33ms
32ms Image
image/png 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-cdn.com/img/emoji-slots.1c6e965b9-160.png
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/bets/home?open=register
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2fc8f2712717b32157f7741b1c723d6fe1d430c41652cfafd39c68980db20bd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4522530
content-length: 8977
last-modified: Thu, 09 Mar 2023 11:29:26 GMT
server: cloudflare
etag: "6409c316-2311"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DEfF2A9urSqPVzOUNMrCxP8NsT6YgNsk%2Bpx92WqqAg7FLrdJxMkIVSD8cE87y6CxIcDVWwRK0FvJhQDF4N%2FDZ5XuXAYjT7A%2FEq5k9NzTg8fMtMGpFvrv04ruaom4zfWYVbVx97qCVZ9rdg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7c0307348e2e0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cashback.12a565952.svg
1win-cdn.com/img/ 2 KB
1 KB 34ms
33ms Image
image/svg+xml 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-cdn.com/img/cashback.12a565952.svg
Requested by: Host: 1wqrwr.top
URL: https://1wqrwr.top/bets/home?open=register
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8492b63b2d1147503ddb11a27f119e5287c5ae6f02f37e51ad6ae769af970658

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 17 Apr 2023 13:36:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1149248
etag: W/"643d4b4c-851"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uqS4xrOdo0LC3EIwJ96fENilrMHKKEgO%2FE4t80HIuTf9YaYGbqY%2B6lQGu%2BcwQtZyT6KAq0AD9sQ%2BrOGigLRnXlfZAmbjOho8zccee1cGNAS0QFXXyH3pzMU4qr6o3ydohXvLWffxk4BEOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c0307348e2f0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 nl.svg
1win-cdn.com/img/flags/ 245 B
549 B 36ms
36ms Image
image/svg+xml 2606:4700:20::681a:40b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win-cdn.com/img/flags/nl.svg
Requested by: Host: 1win-cdn.com
URL: https://1win-cdn.com/js/chunk-vendors.8e07d0bc9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 317b23c0c68de40a09f524be5874131d6d06fb49bb45037a15575448dbd94852

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2023 09:47:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 8338037
etag: W/"63cfa92c-f5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iT5YgME6z5%2F5YVDLWC4UcBLjvq7VAuiWPY7hWZ28PbS7G4VwGJRNUd%2BSJPapuS22uXv2qOiCSZTo9npp9MwpOBDktgxnEY52fQB8fO8PlTtvvB6jcVCYMxecPe1YjMuiqDyEWSjAYfcmrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7c030734feeb0eae-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

OPTIONS
H2 200 /
api.amplitude.com/ Frame 0
0 539ms
176ms Preflight 52.88.81.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.81.160 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-81-160.us-west-2.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Access-Control-Request-Headers: cross-origin-resource-policy
Access-Control-Request-Method: POST
Origin: https://1wqrwr.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: cross-origin-resource-policy
access-control-allow-methods: GET, POST
access-control-allow-origin: *
content-length: 0
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=15768000

POST
H2 200 / Show response
api.amplitude.com/ 7 B
205 B 182ms
181ms XHR
text/html 52.88.81.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/42523.55a83cf90.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.81.160 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-81-160.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://1wqrwr.top/
Cross-Origin-Resource-Policy: cross-origin
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-644ee3c6-31e3b7387c0f64f15d28c5ef
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

GET
H2

200

activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3D... Show response
12688802.fls.doubleclick.net/ Frame FB0B
Redirect Chain

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen...
https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F...

510 B
459 B

71ms
70ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

0156362355a79e8627b025583b2d9e565d449da621f39937467a40e4f1ee6792

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wqrwr.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 283
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;o... Show response
12572451.fls.doubleclick.net/ Frame 06F8
Redirect Chain

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...

554 B
481 B

70ms
69ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

702164170416a4ff65874a4c6a6ced6024d12764a29ce90aa0f9c99db625390f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wqrwr.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 305
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 hotjar-2606090.js Show response
static.hotjar.com/c/ 9 KB
4 KB 98ms
32ms Script
application/javascript 18.66.97.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Requested by

Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.37 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-37.fra56.r.cloudfront.net

Software

Resource Hash

d049608012c1a2319b30083b4e6c4f207253ca612e37704074ac68b3483acd6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Sun, 30 Apr 2023 21:54:28 GMT
via: 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 52
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/6bd51f400ab6852eddb9ebe5faa7a544
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: 9IJPBP64Ae1HyUzTjMPQ0R1OIYGiyWlY_L9UPKaxgNLgSLPaFOVnXA==

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 212 KB
73 KB 266ms
132ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: 1wqrwr.top
URL: https://1wqrwr.top/?open=register&sub2=14360

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

27b16e47b8a7c9a504f1eabe45a5f5b24e9157f56dde3118ba78b262edf51d8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 28 Apr 2023 15:09:05 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "644bb761-12299"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 74393
expires: Sun, 30 Apr 2023 22:55:18 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 207 KB
73 KB 68ms
67ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ab5ca340cca50cab5ba3ef2f1569fa3e26b762f518df225aa80da8e8c14cd4af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 75018
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 30 Apr 2023 21:55:18 GMT

GET
H2 200 modules.50a80ed62b384955a8b2.js Show response
script.hotjar.com/ 263 KB
68 KB 102ms
36ms Script
application/javascript 13.32.27.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.50a80ed62b384955a8b2.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-107.fra56.r.cloudfront.net

Software

Resource Hash

e60eac0f2636af6308d91526e82dff118e961332236bbe87a134f7e5d0d5037e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 11:06:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 211751
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 69259
last-modified: Fri, 28 Apr 2023 11:05:08 GMT
etag: "64d5841f997872b89ef043f224290bdf"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: HqthiJrFqzDzo6Te43VTQSw7On80VGF0fqA7WpirqJ7nbLkVklT-DQ==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
251 B 87ms
28ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je34q0&_p=42444164&cid=1873809105.1682891718&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1682891718&sct=1&seg=0&dl=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&dt=1win&en=page_view&_fv=1&_nsi=1&_ss=1&up.platform_language=en&up.device_type=desktop&up.platform=web&up.os=windows
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 21:55:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://1wqrwr.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
adservice.google.com/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7B... Frame E2C2 553 B
681 B 210ms
95ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273;~oref=https://1wqrwr.top/

Requested by

Host: 12572451.fls.doubleclick.net
URL: https://12572451.fls.doubleclick.net/activityi;dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9f3e2dd3fed0eb2361faa372cf85baa84cc228caa71440b963c40ecb771e603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://12572451.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 306
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister Show response
adservice.google.com/ddm/fls/i/ Frame BB0E 509 B
353 B 203ms
96ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister

Requested by

Host: 12688802.fls.doubleclick.net
URL: https://12688802.fls.doubleclick.net/activityi;dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9aecb48d8dcddf5c2ba658d49c9ddb7d82fd3ba7bc4dadd5e12c9b5f2c821a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://12688802.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 283
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 advert.gif
mc.yandex.ru/metrika/ 43 B
113 B 70ms
70ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 28 Apr 2023 15:09:05 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "644bb761-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 30 Apr 2023 22:55:18 GMT

GET
H2

200

1 Show response
mc.yandex.ru/watch/92006234/
Redirect Chain

https://mc.yandex.ru/watch/92006234?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3A7...
https://mc.yandex.ru/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3...

435 B
518 B

74ms
73ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3A798%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1012%3Acn%3A1%3Adp%3A0%3Als%3A423331071206%3Ahid%3A590984201%3Az%3A0%3Ai%3A20230430215518%3Aet%3A1682891718%3Ac%3A1%3Arn%3A90920301%3Arqn%3A1%3Au%3A1682891718919946866%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A132%2C122%2C146%2C59%2C251%2C0%2C%2C29%2C0%2C1524%2C1524%2C0%2C962%3Aco%3A0%3Acpf%3A1%3Ans%3A1682891716347%3Arqnl%3A1%3Ast%3A1682891718%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

fca7b27e79b913a838d3eb1ffd16963ee0981b05dd3dcac84bf8d0cf4b778c8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://1wqrwr.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Sun, 30-Apr-2023 21:55:18 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1wqrwr.top
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 435
x-xss-protection: 1; mode=block
expires: Sun, 30-Apr-2023 21:55:18 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 30-Apr-2023 21:55:18 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aihb4q796484i93absudza7%3Afp%3A798%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1012%3Acn%3A1%3Adp%3A0%3Als%3A423331071206%3Ahid%3A590984201%3Az%3A0%3Ai%3A20230430215518%3Aet%3A1682891718%3Ac%3A1%3Arn%3A90920301%3Arqn%3A1%3Au%3A1682891718919946866%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A132%2C122%2C146%2C59%2C251%2C0%2C%2C29%2C0%2C1524%2C1524%2C0%2C962%3Aco%3A0%3Acpf%3A1%3Ans%3A1682891716347%3Arqnl%3A1%3Ast%3A1682891718%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
access-control-allow-origin: https://1wqrwr.top
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 30-Apr-2023 21:55:18 GMT

GET
H2 200 / Show response
adservice.google.nl/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BG... Frame D0ED 194 B
150 B 184ms
70ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273;~oref=https://1wqrwr.top/

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CJvmtZjM0v4CFZXYmgod2ygP6w;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=6985997377366.273;~oref=https://1wqrwr.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Sun, 30 Apr 2023 21:55:18 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister Show response
adservice.google.nl/ddm/fls/i/ Frame 47FC 194 B
515 B 181ms
69ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/ddm/fls/i/dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CKqbtpjM0v4CFY7POwIdK3UAJQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=381067286222;gtm=45He34q0;auiddc=31652188.1682891718;~oref=https%3A%2F%2F1wqrwr.top%2Fbets%2Fhome%3Fopen%3Dregister

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 21:55:18 GMT
expires: Sun, 30 Apr 2023 21:55:18 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 /
api.amplitude.com/ Frame 0
0 176ms
176ms Preflight 52.88.81.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.81.160 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-81-160.us-west-2.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Access-Control-Request-Headers: cross-origin-resource-policy
Access-Control-Request-Method: POST
Origin: https://1wqrwr.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: cross-origin-resource-policy
access-control-allow-methods: GET, POST
access-control-allow-origin: *
content-length: 0
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=15768000

POST
H2 200 / Show response
api.amplitude.com/ 7 B
204 B 184ms
183ms XHR
text/html 52.88.81.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: 1win-cdn.com
URL: https://1win-cdn.com/js/42523.55a83cf90.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.81.160 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-81-160.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://1wqrwr.top/
Cross-Origin-Resource-Policy: cross-origin
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 30 Apr 2023 21:55:18 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-644ee3c6-791921176661956c1e0bf1bf
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
1wqrwr.top/	1970-01-20 12:12:50	Name: sub_ids Value: sub2=14360
1wqrwr.top/	1970-01-20 12:12:50	Name: partner_key Value: 79i6
1wqrwr.top/	1970-01-20 12:12:50	Name: visit_domain Value: 1wqrwr.top
1wqrwr.top/	1969-12-31 23:59:59	Name: core-sticky Value: http://10.233.108.106:80
1wqrwr.top/	1970-01-20 20:13:47	Name: 1w_lang Value: en
1wqrwr.top/	1969-12-31 23:59:59	Name: 1w_locale Value: 9
.1wqrwr.top/	1970-01-20 13:37:47	Name: _gcl_au Value: 1.1.31652188.1682891718
.1wqrwr.top/	1970-01-20 20:13:47	Name: amp_494ccc Value: BM04rcD_7Hh8ZOgtLNFmKL...1gva2jepp.1gva2jfb7.1.4.5
.1wqrwr.top/	1970-01-20 21:04:11	Name: _ga Value: GA1.1.1873809105.1682891718
.1wqrwr.top/	1970-01-20 21:04:11	Name: _ga_548949LWLW Value: GS1.1.1682891718.1.0.1682891718.0.0.0
.doubleclick.net/	1970-01-20 11:28:12	Name: test_cookie Value: CheckForPermission
.1wqrwr.top/	1970-01-20 20:13:47	Name: _hjSessionUser_2606090 Value: eyJpZCI6ImU5Nzc1MTdmLTY0NGUtNTRmNS1iNDhhLWFmZjBkMjRhYjgxYSIsImNyZWF0ZWQiOjE2ODI4OTE3MTgyNDMsImV4aXN0aW5nIjpmYWxzZX0=
.1wqrwr.top/	1970-01-20 11:28:13	Name: _hjFirstSeen Value: 1
.1wqrwr.top/	1970-01-20 11:28:11	Name: _hjIncludedInSessionSample_2606090 Value: 0
.1wqrwr.top/	1970-01-20 11:28:13	Name: _hjSession_2606090 Value: eyJpZCI6IjExMjMzYzg5LTM5MGItNDAxYi1iYzYxLTg1ZTk0ZDNjMmVhMCIsImNyZWF0ZWQiOjE2ODI4OTE3MTgyNTUsImluU2FtcGxlIjpmYWxzZX0=
.1wqrwr.top/	1970-01-20 11:28:13	Name: _hjAbsoluteSessionInProgress Value: 0
1wqrwr.top/	1969-12-31 23:59:59	Name: _hjHasCachedUserAttributes Value: true
.1wqrwr.top/	1970-01-20 20:13:47	Name: _ym_uid Value: 1682891718919946866
.1wqrwr.top/	1970-01-20 20:13:47	Name: _ym_d Value: 1682891718
.1wqrwr.top/	1970-01-20 11:29:23	Name: _ym_isad Value: 2
mc.yandex.ru/	1969-12-31 23:59:59	Name: yabs-sid Value: 1268970591682891718
.yandex.ru/	1970-01-20 21:04:11	Name: i Value: KSCMiSNzUkyvmi5Nk4BBJ/tohJ2VSQIBojAQsEkOSuga0YyCkL5FIEdV9xhX9RtY3mPpsViBuavLrIYrZ/YI2K2/HVI=
.yandex.ru/	1970-01-20 21:04:11	Name: yandexuid Value: 6418296671682891718
.yandex.ru/	1970-01-20 20:13:47	Name: yuidss Value: 6418296671682891718
.yandex.ru/	1970-01-20 20:13:47	Name: ymex Value: 1714427718.yc.1682891718#1714427718.yrts.1682891718#1714427718.yrtsi.1682891718
.yandex.ru/	1970-01-20 20:13:47	Name: bh Value: KgI/MA==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12572451.fls.doubleclick.net
12688802.fls.doubleclick.net
1win-cdn.com
1wqrwr.top
adservice.google.com
adservice.google.nl
api.amplitude.com
api.lab.amplitude.com
mc.yandex.ru
refpaxbzqm.top
region1.google-analytics.com
script.hotjar.com
static.hotjar.com
www.googletagmanager.com
13.32.27.107
142.250.186.70
151.101.130.132
18.66.97.37
190.115.24.78
2001:4860:4802:34::36
2606:4700:20::681a:40b
2606:4700:3030::ac43:a66e
2a00:1450:4001:80e::2002
2a00:1450:4001:828::2008
2a00:1450:4001:831::2002
2a02:6b8::1:119
52.88.81.160
0156362355a79e8627b025583b2d9e565d449da621f39937467a40e4f1ee6792
01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6
081cc0024405334dfb80cb3bdd05f45c35ec771ca840c583b24b05d97406024b
0bc900cd16c85ba32d10e2ebf9e925e67c74da29f2e9830ecd58ee41512b7b8e
0f5076a35ed631c902095c1b4e778e9399c78f553b7a3c137fe7549e126411ee
1076880a1b1e3c9e8896163ee62ab7c7f2de4be14b4c160b907938ba06e4d367
1b9d04d042e1b1686dc3bfeec791df24e7bd650e462dbe94052591837be4bcc3
27b16e47b8a7c9a504f1eabe45a5f5b24e9157f56dde3118ba78b262edf51d8d
28cd730ff2aed4621bbc27132a62855143c01624555a5dae2d9413d7340d64d3
317b23c0c68de40a09f524be5874131d6d06fb49bb45037a15575448dbd94852
34ba7177ccc63d63700d2583f93043f52e96bde9c07e47fda36d4e836174e114
3632ad0ef20284bb996a0c5e354ba7751e36835e124fc972521f3cec75aec3d7
367b1cc3c4b30dd5c0b2a636977bc6d587ac4796713ae2ac49fd8696dfc0316a
3f7fdf24b33c2ffd4503e3c80c9e67c6e3cc8abd159cd3d1c261f0dc6f8e5f91
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44a9f042cf5b8d1fe335977147738416946564ef110f15650544d5aa681f9c6e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
575412b54e344b5f40a21bb5b799f0430919cfb4ba807f9832c040e13711dc8e
58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f
690407e69dc25a754e67e780c311e274ce02b5dbd08d26e9bb8e5c700c36ca50
6e1d631f408cecc1225c2a9d8bbfc8a74f449f931fd2c18f59661ba5f8ba1569
702164170416a4ff65874a4c6a6ced6024d12764a29ce90aa0f9c99db625390f
759315d5ae8c31136d2a7bc803e591554894987559325cdf7e0b5965bec0eaca
75b79a010371d7bff58838a9cde724d4695750dcbebc3e90a3ab9541d8f97304
77677fb9c9db0db0dc1a1746a7b916c31850e21d5647e91c093b830a9c8e3da8
8492b63b2d1147503ddb11a27f119e5287c5ae6f02f37e51ad6ae769af970658
891653281f62b1f2b6346c644fb4a0c7510fb07d857df9a8b4d5b98b57376159
965693d1344a3fc125a718d67bad8b24ae2efb8ca779a213524a1802d5c42bf5
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
aa9f843d3e35f7c78c49deed39d49a93e2a436e650f05571be1138667e43475d
ab5ca340cca50cab5ba3ef2f1569fa3e26b762f518df225aa80da8e8c14cd4af
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af60c7e817766bec3a2e6609310f903cea2d678324036a2e1a8317f06aee0aa9
b9aecb48d8dcddf5c2ba658d49c9ddb7d82fd3ba7bc4dadd5e12c9b5f2c821a1
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
bd55168e2ec771243678b7b8bce6e26c8460b3b250e8d40d3958a5f638b79b62
bf7cc6d61ff402d48c066f44dcfe7719556109ad1f39e03f003fa6361d735fa8
c2220769992b6716e4b0ee6544cb51e27047d7fd9207040afaacf41471bfe6e9
c7fb944a4cf45c9baf9edf920cdb000791b973153c3eb0ea7babe1eb8a90bd9a
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
d049608012c1a2319b30083b4e6c4f207253ca612e37704074ac68b3483acd6f
d2511c31016a689e8f193b6d5df168a94e1bebd56d1fe00d8dc27a7214b70a58
df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e60eac0f2636af6308d91526e82dff118e961332236bbe87a134f7e5d0d5037e
e9f3e2dd3fed0eb2361faa372cf85baa84cc228caa71440b963c40ecb771e603
eb7d41244c86e6cd3a95f5f5cd68e0803001f5647bcc21fbd6e85c1cc7d1b603
ef33c57048b702d0c68665a43955429ae2491bff20037b3a36c6b9b817f6b8dd
ef3428fbfdbf673435898684c2ceb8c453f659065e3a90b4c4f3734c5990c4e3
f2fc8f2712717b32157f7741b1c723d6fe1d430c41652cfafd39c68980db20bd
fc960bf4b7ad4abff7e7af70865dbf97a56b1e2a749e16939d8f16e1c5427d1f
fca7b27e79b913a838d3eb1ffd16963ee0981b05dd3dcac84bf8d0cf4b778c8d
ff500ce68bc0a2adf9b08fc0c16a6ea1fdf9f2d2c8fe351f15ac5b3a1b357749

1wqrwr.top Open in urlscan Pro 190.115.24.78 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

60 Requests

98 %HTTPS

54 %IPv6

11 Domains

14 Subdomains

13 IPs

4 Countries

1070 kBTransfer

3443 kBSize

26 Cookies

0 Outgoing links

Page URL History

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

1wqrwr.top Open in urlscan Pro
190.115.24.78 Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

98 %
HTTPS

54 %
IPv6

11
Domains

14
Subdomains

13
IPs

4
Countries

1070 kB
Transfer

3443 kB
Size

26
Cookies

60 HTTP transactions
1 data transactions