1win.com Open in urlscan Pro
190.115.24.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://theinnocent.in/situs-togel-toto12/
Effective URL:
https://1win.com/
Submission Tags: @phish_report
Submission: On September 18 via api (September 18th 2024, 10:38:29 am UTC) from FI — Scanned from FI

Summary HTTP 72 Redirects Behaviour Indicators

Summary

This website contacted 19 IPs in 7 countries across 14 domains to perform 72 HTTP transactions. The main IP is 190.115.24.78, located in Belize and belongs to IQWEB, AE. The main domain is 1win.com.
TLS certificate: Issued by R11 on September 18th 2024. Valid for: 3 months.

This is the only time 1win.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 5	172.67.155.76 172.67.155.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	190.115.24.78 190.115.24.78	59692 (IQWEB) (IQWEB)
31	154.197.121.128 154.197.121.128	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	151.101.130.132 151.101.130.132	54113 (FASTLY) (FASTLY)
4	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	18.66.102.106 18.66.102.106	16509 (AMAZON-02) (AMAZON-02)
3 8	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1d::9d	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.185.131 142.250.185.131	15169 (GOOGLE) (GOOGLE)
1	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2	100.21.47.81 100.21.47.81	16509 (AMAZON-02) (AMAZON-02)
1	216.58.206.70 216.58.206.70	15169 (GOOGLE) (GOOGLE)
1	13.32.27.21 13.32.27.21	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.228 142.250.185.228	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
72	19

5 172.67.155.76 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

theinnocent.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

rejodadi.co.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

naturewildlife.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 190.115.24.78 (Belize)

ASN59692 (IQWEB, AE)
PTR: ddos-guard.net

1win.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 154.197.121.128 (Seychelles)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

v1.bundlecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

api.lab.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-106.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

12572451.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
12688802.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1d::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net

www.google.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 100.21.47.81 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-21-47-81.us-west-2.compute.amazonaws.com

api2.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.70 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.228 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	bundlecdn.com v1.bundlecdn.com — Cisco Umbrella Rank: 309916	715 KB
8	doubleclick.net 12572451.fls.doubleclick.net — Cisco Umbrella Rank: 410574 stats.g.doubleclick.net — Cisco Umbrella Rank: 130 td.doubleclick.net — Cisco Umbrella Rank: 189 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 12688802.fls.doubleclick.net — Cisco Umbrella Rank: 429755 ad.doubleclick.net — Cisco Umbrella Rank: 153	3 KB
6	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 8922	4 KB
6	1win.com 1win.com Failed	214 KB
5	theinnocent.in 2 redirects theinnocent.in	8 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	373 KB
4	amplitude.com api.lab.amplitude.com — Cisco Umbrella Rank: 4269 api2.amplitude.com — Cisco Umbrella Rank: 1195	961 B
2	google.com analytics.google.com — Cisco Umbrella Rank: 140 www.google.com — Cisco Umbrella Rank: 3	64 B
2	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 4140	71 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 816 script.hotjar.com — Cisco Umbrella Rank: 1029	61 KB
1	google.fi www.google.fi — Cisco Umbrella Rank: 38754	455 B
1	google.ru www.google.ru — Cisco Umbrella Rank: 15049	63 B
1	naturewildlife.id 1 redirects naturewildlife.id	496 B
1	rejodadi.co.id rejodadi.co.id Failed	500 B
72	14

	Domain	Requested by
31	v1.bundlecdn.com	1win.com v1.bundlecdn.com
6	mc.yandex.com	2 redirects mc.yandex.ru
6	1win.com	1win.com v1.bundlecdn.com
5	theinnocent.in	2 redirects theinnocent.in
4	www.googletagmanager.com	theinnocent.in www.googletagmanager.com
3	td.doubleclick.net	www.googletagmanager.com
2	api2.amplitude.com	v1.bundlecdn.com
2	mc.yandex.ru	1 redirects theinnocent.in
2	api.lab.amplitude.com	v1.bundlecdn.com
1	www.google.fi
1	www.google.com
1	script.hotjar.com	static.hotjar.com
1	ad.doubleclick.net
1	12688802.fls.doubleclick.net	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	www.google.ru
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	12572451.fls.doubleclick.net	www.googletagmanager.com
1	static.hotjar.com	theinnocent.in
1	naturewildlife.id	1 redirects
1	rejodadi.co.id	theinnocent.in
72	22

This site contains no links.

Subject Issuer	Validity	Valid
theinnocent.in WE1	`2024-09-11` - `2024-12-10`	3 months	crt.sh
1win.com R11	`2024-09-18` - `2024-12-17`	3 months	crt.sh
v1.bundlecdn.com WE1	`2024-07-24` - `2024-10-22`	3 months	crt.sh
*.lab.amplitude.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-11-29` - `2024-12-30`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.com.ru WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2024-01-31` - `2025-03-02`	a year	crt.sh
*.google.fi WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://1win.com/
Frame ID: 66266C81E03F3F4063369ABB4D6A1509
Requests: 65 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8883518999762.549
Frame ID: 16E51BC4FB7A187DE7549B316F82C2DF
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=1312232886.1726655905&gtm=45je4990v894728184z89182494087za200zb9182494087&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=817375529
Frame ID: DE29C7BCD55C08C03F56D0B04B129FBC
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/16482547739?random=1726655904916&cv=11&fst=1726655904916&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Ftheinnocent.in%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=1605545537.1726655905&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: CFD68228A02CDBBFDC133A4ACE05D85C
Requests: 1 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F
Frame ID: 858874B35FC89513D65A7C5E2C5E48ED
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F
Frame ID: 24E5175CEAF5094783FDA041C3B1241A
Requests: 1 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: 2BD14F1B27C58CD80C67D7DF18F301A6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1win

Page URL History Show full URLs

https://theinnocent.in/situs-togel-toto12/ Page URL
https://theinnocent.in/cdn-cgi/phish-bypass?atok=anS2ssmoIN0nJTPrDL_S3UZl889ei89C9Z.29Ey52.4-172665... HTTP 301
https://theinnocent.in/situs-togel-toto12/ HTTP 301
https://rejodadi.co.id/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

72
Requests

90 %
HTTPS

30 %
IPv6

14
Domains

22
Subdomains

19
IPs

7
Countries

1447 kB
Transfer

4516 kB
Size

31
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://theinnocent.in/situs-togel-toto12/ Page URL
https://theinnocent.in/cdn-cgi/phish-bypass?atok=anS2ssmoIN0nJTPrDL_S3UZl889ei89C9Z.29Ey52.4-1726655898-0.0.1.1-%2Fsitus-togel-toto12%2F HTTP 301
https://theinnocent.in/situs-togel-toto12/ HTTP 301
https://rejodadi.co.id/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://theinnocent.in/cdn-cgi/speculation HTTP 301
https://rejodadi.co.id/

Request Chain 4

https://theinnocent.in/favicon.ico HTTP 301
https://rejodadi.co.id/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/

Request Chain 65

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10496.taH8uZ6A6XvNv5L7r5h6VGlIO7L5hzUvlmXmiN9bRs6aPTNFajIm5cdRW5eChZzN.QybDgFfALgK2GhkM1lEmODAfjag%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10496.N4CYpZi7dpD6_v1J4sLGEu0lZZjn5wkHvaodtmYzmX8rnvkbOTJU8DoKPUzwUcVEE5urlzzQj-KDeZLEH2FlumZKCxs4g9vad2JxoBqMT7pb7jbIHD8F4QWH99tu01gUksl5-nzbfZJAylI_HCmDqSA7p_VA_pgVm4wVc0Cl-TeOh2O1sGgCSZ3SeTlSYmXV18L549XC5atqROdViEtv4k2B9w7ZmuVpBU8QfIqIUcE%2C.Sz3-oeFDfbsBfYI3jEXWOGoryJ4%2C

Request Chain 70

https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A353059999133%3Ahid%3A122391057%3Az%3A180%3Ai%3A20240918133825%3Aet%3A1726655905%3Ac%3A1%3Arn%3A516129705%3Arqn%3A1%3Au%3A1726655905300364852%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1158%3Awv%3A2%3Ads%3A1%2C84%2C346%2C39%2C452%2C0%2C%2C214%2C0%2C1685%2C1685%2C0%2C1418%3Aco%3A0%3Acpf%3A1%3Ans%3A1726655902297%3Agi%3AR0ExLjEuMTMxMjIzMjg4Ni4xNzI2NjU1OTA1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726655905%3At%3A1win&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)eco(21037568)ti(1) HTTP 302
https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A353059999133%3Ahid%3A122391057%3Az%3A180%3Ai%3A20240918133825%3Aet%3A1726655905%3Ac%3A1%3Arn%3A516129705%3Arqn%3A1%3Au%3A1726655905300364852%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1158%3Awv%3A2%3Ads%3A1%2C84%2C346%2C39%2C452%2C0%2C%2C214%2C0%2C1685%2C1685%2C0%2C1418%3Aco%3A0%3Acpf%3A1%3Ans%3A1726655902297%3Agi%3AR0ExLjEuMTMxMjIzMjg4Ni4xNzI2NjU1OTA1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726655905%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29

72 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
theinnocent.in/situs-togel-toto12/ 4 KB
2 KB 149ms
73ms Document
text/html 172.67.155.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://theinnocent.in/situs-togel-toto12/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.155.76 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

368124e112c44824d4d6d58013c7687e50586debfffa4e395aa9a9a6c52ef750

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

cf-ray: 8c50b4a58b6b5b13-VIE
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 18 Sep 2024 10:38:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tOD5XP1bGHuR81CghNl0M50VhMrpttNjIpQUr1dGUGuSIp6GbE12Hl5TSbQaGjweYivZ8PDRytLz10uO3MUxcE4xCbG5BMs3MYWifQZGpLe5cKeFhnwuO0mHgE90YvGTnw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET

/
rejodadi.co.id/
Redirect Chain

https://theinnocent.in/cdn-cgi/speculation
https://rejodadi.co.id/

0
0

GET
H3 200 cf.errors.css
theinnocent.in/cdn-cgi/styles/ 23 KB
5 KB 69ms
69ms Stylesheet
text/css 172.67.155.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://theinnocent.in/cdn-cgi/styles/cf.errors.css

Requested by

Host: theinnocent.in
URL: https://theinnocent.in/situs-togel-toto12/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.155.76 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://theinnocent.in/situs-togel-toto12/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"66e7fafc-5df3"
x-content-type-options: nosniff
cf-ray: 8c50b4a60bff5b13-VIE
expires: Wed, 18 Sep 2024 12:38:18 GMT
date: Wed, 18 Sep 2024 10:38:18 GMT
content-type: text/css
last-modified: Mon, 16 Sep 2024 09:31:40 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
theinnocent.in/cdn-cgi/images/ 452 B
634 B 70ms
69ms Image
image/png 172.67.155.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://theinnocent.in/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: theinnocent.in
URL: https://theinnocent.in/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.155.76 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://theinnocent.in/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "66e7fafc-1c4"
x-content-type-options: nosniff
cf-ray: 8c50b4a67cab5b13-VIE
expires: Wed, 18 Sep 2024 12:38:18 GMT
accept-ranges: bytes
content-length: 452
date: Wed, 18 Sep 2024 10:38:18 GMT
content-type: image/png
last-modified: Mon, 16 Sep 2024 09:31:40 GMT
server: cloudflare
x-frame-options: DENY

GET

/
1win.com/
Redirect Chain

https://theinnocent.in/favicon.ico
https://rejodadi.co.id/
https://naturewildlife.id/
https://1win.com/

0
0

GET
H2

200

Primary Request / Show response
1win.com/
Redirect Chain

https://theinnocent.in/cdn-cgi/phish-bypass?atok=anS2ssmoIN0nJTPrDL_S3UZl889ei89C9Z.29Ey52.4-1726655898-0.0.1.1-%2Fsitus-togel-toto12%2F
https://theinnocent.in/situs-togel-toto12/
https://rejodadi.co.id/
https://naturewildlife.id/
https://1win.com/

64 KB
26 KB

432ms
348ms

Document
text/html

190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

6fadb170818ee2cb77815a1e183b6a3f8de9a74f52b2282681c14a72d1a52119

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://theinnocent.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

access-control-allow-origin: *
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 18 Sep 2024 10:38:23 GMT
server: ddos-guard
vary: Origin
x-app-version: v2.115.0
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
x-match-domain: 1win.com
x-request-id: U82jELiR1SWc6lZm

Redirect headers

cache-control: max-age=3600
cf-ray: 8c50b4bff8795aef-VIE
content-length: 167
content-type: text/html
date: Wed, 18 Sep 2024 10:38:22 GMT
expires: Wed, 18 Sep 2024 11:38:22 GMT
location: https://1win.com/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2hjbY3fhkeJZ9u089xmkUZs9bY2uUBgeMiFX3jnEAKZviQe4E0jZoxId0MHd4vOK53aznzcNmh47hQpl%2Fh6VtWhuTFjw8tOWeziZyvdWhZ1qRa8Qg2Nd4NVtRUG5IQmR5s6OwA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

GET
H2 200 SFNSDisplay-latin.50a4eaff3.woff2
v1.bundlecdn.com/font/ 32 KB
32 KB 145ms
51ms Font
application/octet-stream 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/font/SFNSDisplay-latin.50a4eaff3.woff2
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Origin: https://1win.com
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
cf-cache-status: HIT
etag: "66a3a611-8128"
age: 4654684
cf-ray: 8c50b4c3cc3d82b9-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33064
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/octet-stream
last-modified: Fri, 26 Jul 2024 13:35:13 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 SFNSText-latin.f09aa5229.woff2
v1.bundlecdn.com/font/ 42 KB
43 KB 140ms
48ms Font
application/octet-stream 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/font/SFNSText-latin.f09aa5229.woff2
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Origin: https://1win.com
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
cf-cache-status: HIT
etag: "66a3a611-a9f8"
age: 4654684
cf-ray: 8c50b4c3cc4082b9-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43512
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/octet-stream
last-modified: Fri, 26 Jul 2024 13:35:13 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 minified.js Show response
1win.com/core-js/3.33.3/ 238 KB
73 KB 49ms
49ms Script
application/javascript 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/core-js/3.33.3/minified.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

ce68e1614ab493deaecfa6eb9711736de0348248e1d559b5f6dfb5dc4c29b459

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

vary: Accept-Encoding
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-encoding: br
etag: W/"661e70bd-3b989"
age: 13381446
expires: Thu, 31 Dec 2037 23:55:55 GMT
content-length: 74396
date: Tue, 16 Apr 2024 13:34:17 GMT
content-type: application/javascript
last-modified: Tue, 16 Apr 2024 12:36:13 GMT
server: ddos-guard
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

GET
H2 200 chunk-vendors.b5eb4d992.js Show response
v1.bundlecdn.com/js/ 247 KB
83 KB 50ms
49ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/chunk-vendors.b5eb4d992.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f007c721f3891c6fbc6555f58faf308a9187968bfca7439dd601ae93b621649b

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66d85f0c-3dbdd"
age: 1199245
cf-ray: 8c50b4c469e798ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 04 Sep 2024 13:22:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk-common.626cde0fe.js Show response
v1.bundlecdn.com/js/ 385 KB
115 KB 49ms
49ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e07ecaa23cfa51908d6adaa3a1b9b6927ce4e7ba92acfa182fee9c3d1a3ef34

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca5-602c9"
age: 175113
cf-ray: 8c50b4c469e998ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 16 Sep 2024 09:38:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 index.6ca3a4953.js Show response
v1.bundlecdn.com/js/ 385 KB
126 KB 81ms
80ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcc1c58cf13b65fa067a2e96ed5f0c6adf13363dc05e9e031e729909a972e61c

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66eaa50a-604de"
age: 1897
cf-ray: 8c50b4c479f798ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 18 Sep 2024 10:01:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 index.aedf85995.css
v1.bundlecdn.com/css/ 6 KB
1 KB 129ms
48ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/index.aedf85995.css
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9be12e59a210d45411e025096615d4308c44a0cffeb791dd452e443c675e8481

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66a38386-185b"
age: 4663496
cf-ray: 8c50b4c4098a98ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Fri, 26 Jul 2024 11:07:50 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 1win-normal.svg
1win.com/img/logo/main/ 5 KB
2 KB 44ms
42ms Image
image/svg+xml 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win.com/img/logo/main/1win-normal.svg
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS: ddos-guard.net
Software: ddos-guard /
Resource Hash: a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-encoding: br
etag: W/"66bb644e-1221"
age: 3091249
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
content-length: 1474
date: Tue, 13 Aug 2024 15:57:34 GMT
content-type: image/svg+xml
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
vary: Accept-Encoding

GET
H2 200 mobile.ffd295876.js Show response
v1.bundlecdn.com/js/ 159 KB
44 KB 83ms
83ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/mobile.ffd295876.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2ff54d440d6890a5ddc0b25fe41dd295e564beedea3410567b018d3d0c72384

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66eaa50a-27d81"
age: 1905
cf-ray: 8c50b4c479f198ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 18 Sep 2024 10:01:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 mobile.4c06acce9.css
v1.bundlecdn.com/css/ 74 KB
14 KB 80ms
79ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/mobile.4c06acce9.css
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bbf99d77dbb7cd1388b574b97975c551735598fc5c9821c0f9f957cce26cad4

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca4-127a0"
age: 175112
cf-ray: 8c50b4c479f298ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Mon, 16 Sep 2024 09:38:44 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 affiliate:link_visit
1win.com/ 37 B
387 B 185ms
183ms Ping
application/json 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/affiliate:link_visit

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard / Express

Resource Hash

9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Content-Type: application/json
Referer: https://1win.com/

Response headers

x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
vary: Accept-Encoding
access-control-max-age: 7200
access-control-expose-headers: Authorization
content-encoding: gzip
etag: W/"25-Zj67mG54TfZ031q1ea2QwFUXWX4"
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://1win.com
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
server: ddos-guard
access-control-allow-headers: Content-Type, Authorization, X-Origin

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
H2 200 61255.4f034e44e.css
v1.bundlecdn.com/css/ 0
88 B 50ms
50ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/61255.4f034e44e.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
cf-cache-status: HIT
etag: "66a38e34-0"
age: 4657226
cf-ray: 8c50b4c64be498ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Fri, 26 Jul 2024 11:53:24 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 68618.d62065178.js Show response
v1.bundlecdn.com/js/ 10 KB
4 KB 54ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/68618.d62065178.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13b15f93eb2d98d4f7e9d58c481b6e04e54a0caed2b0b19a51cfb2a61adc8449

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66cd9f73-272d"
age: 1903286
cf-ray: 8c50b4c64bee98ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 27 Aug 2024 09:42:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60385.06f32d4d1.js Show response
v1.bundlecdn.com/js/ 9 KB
3 KB 53ms
52ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/60385.06f32d4d1.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7cc97d5681d6d3e5921465551231c25df6ea5dec92aeb116e7dd146daef4565

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66c735be-241d"
age: 2324131
cf-ray: 8c50b4c64bef98ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 22 Aug 2024 12:57:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 60215.d56258a30.js Show response
v1.bundlecdn.com/js/ 76 KB
18 KB 54ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/60215.d56258a30.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 464315c4b50d1c2fc205a9922c85615b83279ca54d05b48f77c1e4577778f131

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca5-12f45"
age: 175111
cf-ray: 8c50b4c64bf098ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 16 Sep 2024 09:38:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 6353.46910464c.js Show response
v1.bundlecdn.com/js/ 10 KB
3 KB 49ms
48ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/6353.46910464c.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fb4f5c65b076cddbd9e294b583bc0222e1a2a47c8b890496940a54df2eeccfe

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca5-27f6"
age: 175111
cf-ray: 8c50b4c65bf198ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 16 Sep 2024 09:38:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 47904.b8027b5a4.css
v1.bundlecdn.com/css/ 53 KB
10 KB 52ms
51ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/47904.b8027b5a4.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 394daf2ca11c67f7a6188bc8e31f5dd7e2985db4de06dbc67ab4db2c0886cb7c

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e2c8af-d4aa"
age: 517051
cf-ray: 8c50b4c65bf298ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Thu, 12 Sep 2024 10:55:43 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 47904.ad3dd66fc.js Show response
v1.bundlecdn.com/js/ 372 KB
111 KB 52ms
52ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/47904.ad3dd66fc.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e81c3c172e351d6dfea962f40de23aac1ef75252c5192563765b0502a7ff1726

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66eaa50a-5d1ac"
age: 1895
cf-ray: 8c50b4c65bf398ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 18 Sep 2024 10:01:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 89159.dc4aa9ad0.js Show response
v1.bundlecdn.com/js/ 10 KB
3 KB 53ms
53ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/89159.dc4aa9ad0.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb6da1eb7a6fcbdc88067d666bc358ac24e8e1c23bb5c00f8a49917f41a3331f

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66d5920a-286b"
age: 139453
cf-ray: 8c50b4c65bf498ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 02 Sep 2024 10:23:06 GMT
vary: Accept-Encoding
server: cloudflare

OPTIONS
H2 200 vardata
api.lab.amplitude.com/sdk/v2/ Frame 0
0 181ms
55ms Preflight 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/v2/vardata?v=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-amp-exp-user
Access-Control-Request-Method: GET
Origin: https://1win.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-amp-exp-user
access-control-allow-methods: GET,POST,HEAD
access-control-allow-origin: https://1win.com
access-control-max-age: 1800
age: 2380
cache-control: no-store
content-length: 0
date: Wed, 18 Sep 2024 10:38:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amzn-trace-id: Root=1-66eaa453-1bc2127f77772f9852a5aa8b
x-cache: HIT
x-cache-hits: 193
x-content-type-options: nosniff
x-served-by: cache-fra-etou8220043-FRA
x-timer: S1726655904.092092,VS0,VE0

GET
H2 200 20948.309322c35.css
v1.bundlecdn.com/css/ 22 KB
3 KB 50ms
50ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/20948.309322c35.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 789ae704b2217f0e501c2f67d21786d21b6fd766d3c3699c3a00625809579152

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e164aa-599a"
age: 607878
cf-ray: 8c50b4c72ce098ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Wed, 11 Sep 2024 09:36:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 18860.1f1e193d8.js Show response
v1.bundlecdn.com/js/ 28 KB
10 KB 56ms
56ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/18860.1f1e193d8.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f6e3e5c53c730a88de6f874ab17cb1283f0ed8580bb22b57578f4f0d601f700

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66c735be-6ea0"
age: 2324131
cf-ray: 8c50b4c73ce198ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 22 Aug 2024 12:57:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 81377.bff8d2d1b.js Show response
v1.bundlecdn.com/js/ 16 KB
6 KB 49ms
48ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/81377.bff8d2d1b.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5550c4b4441530d7f809f252c439ce1dc918bfe70d85c9eb7688bbc053341d20

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca5-4064"
age: 175109
cf-ray: 8c50b4c73ce398ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 16 Sep 2024 09:38:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 44733.7c4db5660.js Show response
v1.bundlecdn.com/js/ 14 KB
5 KB 51ms
51ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/44733.7c4db5660.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37d09bb9dec51b98e773e55e75b2508d6eb9ff6db77b172a614642a06f2c3ff2

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e19ea0-3719"
age: 592774
cf-ray: 8c50b4c73ce598ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 11 Sep 2024 13:44:00 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 72908.a759287aa.js Show response
v1.bundlecdn.com/js/ 42 KB
17 KB 62ms
62ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/72908.a759287aa.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c8f261e94c058930ea2fca6c28e8a10458fc6d53b392348a0a1745f600afaa2

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e7fca5-a805"
age: 175109
cf-ray: 8c50b4c73ce698ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 16 Sep 2024 09:38:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 51602.779b83497.css
v1.bundlecdn.com/css/ 38 KB
8 KB 54ms
53ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/51602.779b83497.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 463863dcb9403bdaea042fc745a70e8aa2d25e887ad6891dfc88fd920a90c6be

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e2c8ae-9929"
age: 517065
cf-ray: 8c50b4c73ce798ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: text/css
last-modified: Thu, 12 Sep 2024 10:55:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 51602.138e57e51.js Show response
v1.bundlecdn.com/js/ 54 KB
16 KB 54ms
53ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/51602.138e57e51.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44eea7173f8bc302277e161c6895c2575141300e19df2594c58a6981395917ac

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e2c8ae-d711"
age: 517050
cf-ray: 8c50b4c73ce998ea-ARN
expires: Sat, 16 Sep 2034 10:38:23 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 12 Sep 2024 10:55:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 en Show response
1win.com/fss/translations/ 377 KB
112 KB 114ms
114ms XHR
application/json 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/fss/translations/en?domain=1win.com&appName=web

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

3e293409afa8dc3494ebda65e578a24bd3a3be1d0e3f5b1313a37dd474cbd729

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

X-Origin: 1win.com
Referer: https://1win.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Accept: application/json, text/plain, */*

Response headers

x-request-id: xv0ToCi9h4tmPQZk
content-encoding: gzip
etag: W/"a0b76-tUvXFWBcc5NPu4Z/+CizE4F8X/I"
x-match-domain: 1win.com
access-control-allow-origin: *
x-app-version: v2.115.0
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: ddos-guard
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

GET
H2 200 allv4 Show response
v1.bundlecdn.com/common/banners/ 21 KB
6 KB 198ms
197ms XHR
application/json 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://v1.bundlecdn.com/common/banners/allv4?localeId=14&lang=en&tzOffset=180

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1eabc2018d9bf590adaabe705bc040d8f3f2e623be180f5f5efd10e6324b686

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://1win.com/

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"6f33-SBf3A1kZ4CMikjJ2pt9ue3XTkUE"
cf-ray: 8c50b4c7a98182b9-ARN
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 vardata Show response
api.lab.amplitude.com/sdk/v2/ 2 KB
742 B 374ms
373ms Fetch
application/json 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/v2/vardata?v=0

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0d42740827f657ed3df4f67d0704bb86f9e943b044e18b98030b09c645d90d00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Authorization: Api-Key client-Ss5BFx7UDrTj948TJHfc5ZUoTW67EjvZ
Referer: https://1win.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
X-Amp-Exp-User: eyJsaWJyYXJ5IjoiZXhwZXJpbWVudC1qcy1jbGllbnQvMS4xMC4wIiwibGFuZ3VhZ2UiOiJlbi1VUyIsInBsYXRmb3JtIjoiV2ViIiwib3MiOiJDaHJvbWUgOTIiLCJkZXZpY2VfbW9kZWwiOiJBbmRyb2lkIiwiZGV2aWNlX2lkIjoiMWM2NjZkMmMtMDFkYS00ODU5LTk4YTEtMjk2NjA5YTY5M2U1IiwidXNlcl9wcm9wZXJ0aWVzIjp7ImRldmljZV90eXBlIjoibW9iaWxlIiwicGxhdGZvcm0iOiJ3ZWIiLCJvcyI6ImFuZHJvaWQiLCJwbGF0Zm9ybV9sYW5ndWFnZSI6ImVuIiwiZG9tYWluIjoiMXdpbi5jb20iLCJ0aW1lX3pvbmUiOiJFdXJvcGUvSGVsc2lua2kiLCJyZWZlcnJpbmdfZG9tYWluIjoidGhlaW5ub2NlbnQuaW4ifX0

Response headers

content-encoding: gzip
age: 0
cache-tag: client-Ss5BFx7UDrTj948TJHfc5ZUoTW67EjvZ
x-content-type-options: nosniff
x-cache: MISS
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/json;charset=utf-8
x-served-by: cache-fra-etou8220043-FRA
x-cache-hits: 0
vary: Origin, Origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store
x-timer: S1726655904.147673,VS0,VE318
x-amzn-trace-id: Root=1-66eaada0-003d2b633013cc5864f3d220
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-origin: https://1win.com
content-length: 553

GET
H2 200 favicon-32x32.png
1win.com/img/icons/ 536 B
630 B 41ms
41ms Other
image/png 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/img/icons/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

82dcbd3db370fd49d3a130886970cfd48796750ab3767c8b6985a2bf825b250b

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
etag: "66bb644e-218"
age: 3090553
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
content-length: 536
date: Tue, 13 Aug 2024 16:09:11 GMT
content-type: image/png
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

GET
H2 200 1279.2ddf52e8a.js Show response
v1.bundlecdn.com/js/ 911 B
717 B 57ms
57ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/1279.2ddf52e8a.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b563de728f7ad9022ef94968360931749d32898f02f524b66a73c2630126f4a3

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66c735bd-38f"
age: 2324117
cf-ray: 8c50b4c9afa998ea-ARN
expires: Sat, 16 Sep 2034 10:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 22 Aug 2024 12:57:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 firebase-app.js Show response
1win.com/firebase/8.1.1/ 19 KB
0 106ms
106ms Script
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/firebase/8.1.1/firebase-app.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-encoding: br
etag: W/"66bb644e-4ded"
age: 3095357
expires: Thu, 31 Dec 2037 23:55:55 GMT
content-length: 6578
date: Tue, 13 Aug 2024 14:49:06 GMT
content-type: application/javascript
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
vary: Accept-Encoding

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 375 KB
111 KB 217ms
88ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Requested by

Host: theinnocent.in
URL: https://theinnocent.in/situs-togel-toto12/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2a2ab3b6931fb3e38d74277ffef5a529bb660910f813ba221ee776dd570d2361

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-encoding: br
expires: Wed, 18 Sep 2024 10:38:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 112918
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 1win-normal.34748aac6.svg
v1.bundlecdn.com/img/ 5 KB
2 KB 49ms
48ms Image
image/svg+xml 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/1win-normal.34748aac6.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e9a122-1221"
age: 3610
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c50b4c9bfba98ea-ARN
expires: Wed, 18 Sep 2024 14:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: image/svg+xml
last-modified: Tue, 17 Sep 2024 15:32:50 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 fi.svg
v1.bundlecdn.com/img/flags/ 207 B
268 B 54ms
54ms Image
image/svg+xml 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/flags/fi.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86a11ca8f8761ee42f5ad8f3ec57fed81d52d3b809ce86d9209305dc5c0fb0be

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e9a123-cf"
age: 2108
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c50b4c9bfbb98ea-ARN
expires: Wed, 18 Sep 2024 14:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: image/svg+xml
last-modified: Tue, 17 Sep 2024 15:32:51 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 bear.7b736fe37-290.webp
v1.bundlecdn.com/img/ 15 KB
15 KB 54ms
54ms Image
image/webp 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/bear.7b736fe37-290.webp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66c4135905d8889570877f8bf74d092dbcda1ec84d16791a9eab736415fd396c

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=14400
cf-cache-status: HIT
etag: "66e9a122-3adc"
age: 2713
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c50b4c9cfce98ea-ARN
expires: Wed, 18 Sep 2024 14:38:24 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15068
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: image/webp
last-modified: Tue, 17 Sep 2024 15:32:50 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 756.cfe432ea5.js Show response
v1.bundlecdn.com/js/ 9 KB
3 KB 52ms
51ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/756.cfe432ea5.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9123cebe41c1fc2c79b22d627451ea38662dc1933286f0bd7ff7a03721821bf1

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66dafd74-23e1"
age: 1027619
cf-ray: 8c50b4c9cfd898ea-ARN
expires: Sat, 16 Sep 2034 10:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 06 Sep 2024 13:02:44 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footer.a3b7a6009.css
v1.bundlecdn.com/css/ 11 KB
3 KB 53ms
52ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/footer.a3b7a6009.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a64e74582e4c1bef5283a8d36009e03530aec86589afe144237fdb246e5f0fcf

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e96bc0-2b07"
age: 82131
cf-ray: 8c50b4c9cfd698ea-ARN
expires: Sat, 16 Sep 2034 10:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: text/css
last-modified: Tue, 17 Sep 2024 11:45:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footer.971448c11.js Show response
v1.bundlecdn.com/js/ 25 KB
8 KB 52ms
51ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/footer.971448c11.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.6ca3a4953.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecfc620b0ba1cb0947679ff2077e3ece437e2f30f7cf0ff44695a14bc92e3f5f

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: public, max-age=315360000
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66eaa50a-63ce"
age: 1894
cf-ray: 8c50b4c9cfdb98ea-ARN
expires: Sat, 16 Sep 2034 10:38:24 GMT
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 18 Sep 2024 10:01:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 title Show response
1win.com/common/ 29 B
0 103ms
103ms XHR
application/json

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/common/title?path=bets&lang=en

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

c07b2c0a515caf1306fb4d9366fab5758253eeadcf8c0414cb44ccd48f82e59a

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://1win.com/

Response headers

cache-control: public, max-age=3600, stale-while-revalidate=300
content-encoding: gzip
etag: W/"25-bM/5z02X/xOkKbh8eZCiJpcKcd0"
access-control-allow-origin: *
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: ddos-guard
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

GET
H2 200 firebase-messaging.js Show response
1win.com/firebase/8.1.1/ 40 KB
0 2ms
2ms Script
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/firebase/8.1.1/firebase-messaging.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-encoding: br
etag: W/"66bb644e-9f25"
age: 3093408
expires: Thu, 31 Dec 2037 23:55:55 GMT
content-length: 10915
date: Tue, 13 Aug 2024 15:21:35 GMT
content-type: application/javascript
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
93 KB 70ms
69ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98aac6b65bfa12026ca183b718c6bf01d5d6a552d79ea09547831c5afa2050ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Wed, 18 Sep 2024 10:38:24 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95090
date: Wed, 18 Sep 2024 10:38:24 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
93 KB 90ms
87ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98a120f53a51e99fa0ad07f146b968026f5cd470b156de9ba1d224dfc2529c3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-encoding: br
expires: Wed, 18 Sep 2024 10:38:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 94701
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 132ms
130ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cdc91556133cb30a0d3e5df729f641b1cfcf985043924131e0a98f0976a1aabd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-encoding: br
expires: Wed, 18 Sep 2024 10:38:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 18 Sep 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 78951
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 hotjar-2606090.js Show response
static.hotjar.com/c/ 13 KB
6 KB 184ms
61ms Script
application/javascript 18.66.102.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Requested by

Host: theinnocent.in
URL: https://theinnocent.in/situs-togel-toto12/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-106.fra56.r.cloudfront.net

Software

Resource Hash

9458dbf0b5b7d5dae83c8b606592d026cfa46c5d448a26e6c9926c05e25773e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-encoding: br
etag: W/274d3c6ad279fe12f77f6697070f185a
age: 46
x-content-type-options: nosniff
x-cache-hit: 1
x-cache: Hit from cloudfront
x-amz-cf-id: AHrHmMAB7wb8sVQttTTPo96XIJqkGzauFiiKcR1mvNGJkXyWr9a-sw==
date: Wed, 18 Sep 2024 10:37:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
via: 1.1 c387974a86541bbcc6c5141a85eeaf36.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P2

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 202 KB
70 KB 170ms
59ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: theinnocent.in
URL: https://theinnocent.in/situs-togel-toto12/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

6071fb99e587aa37f08c8f14a5718a3bda75cae32fd1d4ccd0718733a362ab64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=3600
timing-allow-origin: *
content-encoding: br
etag: "66e303a5-115c6"
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Wed, 18 Sep 2024 11:38:24 GMT
access-control-allow-origin: *
content-length: 71110
date: Wed, 18 Sep 2024 10:38:24 GMT
last-modified: Thu, 12 Sep 2024 15:07:17 GMT
content-type: application/javascript

GET
H2 200 activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8883518999762.549
12572451.fls.doubleclick.net/ Frame 16E5 0
0 212ms
75ms Document
text/html 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8883518999762.549?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 233
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 10:38:24 GMT
expires: Wed, 18 Sep 2024 10:38:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 207ms
69ms Fetch
text/plain 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je4990v894728184z89182494087za200zb9182494087&_p=1726655904251&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=1312232886.1726655905&ul=fi-fi&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dp=%2F&sid=1726655904&sct=1&seg=0&dl=https%3A%2F%2F1win.com%2F&dr=https%3A%2F%2Ftheinnocent.in%2F&dt=1win&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_url=https%3A%2F%2F1win.com%2F&up.UserID=&up.platform_language=en&up.device_type=mobile&up.platform=web&up.os=android&tfd=2522
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://1win.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 18 Sep 2024 10:38:24 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
240 B 220ms
70ms Ping
text/plain 2a00:1450:400c:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-548949LWLW&cid=1312232886.1726655905&gtm=45je4990v894728184z89182494087za200zb9182494087&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://1win.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 18 Sep 2024 10:38:25 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame DE29 0
0 219ms
85ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=1312232886.1726655905&gtm=45je4990v894728184z89182494087za200zb9182494087&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=817375529

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 10:38:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ru/ads/ 42 B
63 B 168ms
93ms Image
image/gif 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ru/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-548949LWLW&cid=1312232886.1726655905&gtm=45je4990v894728184z89182494087za200zb9182494087&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0&tag_exp=0&z=1785643359

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 18 Sep 2024 10:38:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/ 5 KB
2 KB 201ms
81ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/?random=1726655904916&cv=11&fst=1726655904916&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Ftheinnocent.in%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=1605545537.1726655905&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

b3fbb7a6cd6c95bbdabae8db7ab2d48885f8f6dae2d33d1cc15c5d391c02e3e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2331
date: Wed, 18 Sep 2024 10:38:25 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 16482547739
td.doubleclick.net/td/rul/ Frame CFD6 0
0 101ms
100ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/16482547739?random=1726655904916&cv=11&fst=1726655904916&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Ftheinnocent.in%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=1605545537.1726655905&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 10:38:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 httpapi
api2.amplitude.com/2/ Frame 0
0 626ms
199ms Preflight 100.21.47.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.amplitude.com/2/httpapi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.21.47.81 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-100-21-47-81.us-west-2.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://1win.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET, POST
access-control-allow-origin: *
access-control-max-age: 86400
content-length: 0
date: Wed, 18 Sep 2024 10:38:25 GMT
strict-transport-security: max-age=15768000

POST
H2 200 httpapi Show response
api2.amplitude.com/2/ 95 B
219 B 212ms
207ms Fetch
application/json 100.21.47.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.amplitude.com/2/httpapi

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.626cde0fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

100.21.47.81 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-100-21-47-81.us-west-2.compute.amazonaws.com

Software

Resource Hash

1d036466f5780b3537086b15a0363d2c56b66135166e30520e419a25877ff2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Accept: */*
Content-Type: application/json

Response headers

strict-transport-security: max-age=15768000
access-control-allow-origin: *
content-length: 95
date: Wed, 18 Sep 2024 10:38:25 GMT
content-type: application/json

GET
H2 200 activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe...
12688802.fls.doubleclick.net/ Frame 8588 0
0 78ms
75ms Document
text/html 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 306
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 10:38:25 GMT
expires: Wed, 18 Sep 2024 10:38:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0...
td.doubleclick.net/td/fls/rul/ Frame 24E5 0
0 189ms
187ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 10:38:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl...
ad.doubleclick.net/ 0
24 B 226ms
98ms Image
image/png 216.58.206.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=4312446300220;npa=0;auiddc=1605545537.1726655905;ps=1;pcor=181205333;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 18 Sep 2024 10:38:25 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"5593791723075334687"}],"aggregatable_trigger_data":[{"filters":{"14":["13647302"]},"key_piece":"0x7b9d7974ced394c7","source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","638603056","638603057","638603058","638603059"]},{"key_piece":"0x88ce7124aba630ed","not_filters":{"14":["13647302"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","638603056","638603057","638603058","638603059"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"20557008":36,"20557009":36,"20557010":36,"20557011":3530,"21":6356,"638603056":32,"638603057":32,"638603058":32,"638603059":3177},"debug_key":"13018204237946901304","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"5593791723075334687","filters":{"14":["13647302"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"5593791723075334687","filters":{"14":["13647302"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"5593791723075334687","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"5593791723075334687","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12688802"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10496.taH8uZ6A6XvNv5L7r5h6VGlIO7L5hzUvlmXmiN9bRs6aPTNFajIm5cdRW5eChZzN.QybDgFfALgK2GhkM1lEmODAfjag%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10496.N4CYpZi7dpD6_v1J4sLGEu0lZZjn5wkHvaodtmYzmX8rnvkbOTJU8DoKPUzwUcVEE5urlzzQj-KDeZLEH2FlumZKCxs4g9vad2JxoBqMT7pb7jbIHD8F4QWH99tu01gUksl5-nzbfZ...

43 B
482 B

56ms
55ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10496.N4CYpZi7dpD6_v1J4sLGEu0lZZjn5wkHvaodtmYzmX8rnvkbOTJU8DoKPUzwUcVEE5urlzzQj-KDeZLEH2FlumZKCxs4g9vad2JxoBqMT7pb7jbIHD8F4QWH99tu01gUksl5-nzbfZJAylI_HCmDqSA7p_VA_pgVm4wVc0Cl-TeOh2O1sGgCSZ3SeTlSYmXV18L549XC5atqROdViEtv4k2B9w7ZmuVpBU8QfIqIUcE%2C.Sz3-oeFDfbsBfYI3jEXWOGoryJ4%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
date: Wed, 18 Sep 2024 10:38:25 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://mc.yandex.com/sync_cookie_image_decide?token=10496.N4CYpZi7dpD6_v1J4sLGEu0lZZjn5wkHvaodtmYzmX8rnvkbOTJU8DoKPUzwUcVEE5urlzzQj-KDeZLEH2FlumZKCxs4g9vad2JxoBqMT7pb7jbIHD8F4QWH99tu01gUksl5-nzbfZJAylI_HCmDqSA7p_VA_pgVm4wVc0Cl-TeOh2O1sGgCSZ3SeTlSYmXV18L549XC5atqROdViEtv4k2B9w7ZmuVpBU8QfIqIUcE%2C.Sz3-oeFDfbsBfYI3jEXWOGoryJ4%2C
x-xss-protection: 1; mode=block
date: Wed, 18 Sep 2024 10:38:25 GMT

GET
H2 200 modules.6e8cbd39caed17f0d1c0.js Show response
script.hotjar.com/ 223 KB
56 KB 187ms
61ms Script
application/javascript 13.32.27.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.6e8cbd39caed17f0d1c0.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-21.fra56.r.cloudfront.net

Software

Resource Hash

448797aade8c774bb0d8bf418eb7469865095c4e9016fc13095204ba2b6dc3e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

x-robots-tag: none
content-encoding: br
etag: "92b2dc3a86a608117dd7c4d6660c942b"
age: 590239
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: 0A9-YHU-qMd9XHr7tY4ovFE_v5jcbTXccYDuYkB1dxlznkujjzPbrw==
date: Wed, 11 Sep 2024 14:41:06 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 11 Sep 2024 14:40:34 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 3d58896f901dbeed449603f5d2b4d9f0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56449
x-amz-cf-pop: FRA56-C2

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
600 B 153ms
153ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=3600
timing-allow-origin: *
etag: "66e303a5-2b"
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Wed, 18 Sep 2024 11:38:25 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Wed, 18 Sep 2024 10:38:25 GMT
content-type: image/gif
last-modified: Thu, 12 Sep 2024 15:07:17 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/16482547739/ 42 B
64 B 201ms
75ms Image
image/gif 142.250.185.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/16482547739/?random=1726655904916&cv=11&fst=1726653600000&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Ftheinnocent.in%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=1605545537.1726655905&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfpFukx9HNVy2Yz9Bgt935FsBkgucdEtjsIUnut82YypFPSiup&random=2861783218&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 18 Sep 2024 10:38:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 /
www.google.fi/pagead/1p-user-list/16482547739/ 42 B
455 B 206ms
71ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.fi/pagead/1p-user-list/16482547739/?random=1726655904916&cv=11&fst=1726653600000&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Ftheinnocent.in%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=1605545537.1726655905&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfpFukx9HNVy2Yz9Bgt935FsBkgucdEtjsIUnut82YypFPSiup&random=2861783218&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 18 Sep 2024 10:38:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

1 Show response
mc.yandex.com/watch/92006234/
Redirect Chain

https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw...
https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetx...

593 B
813 B

54ms
52ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A353059999133%3Ahid%3A122391057%3Az%3A180%3Ai%3A20240918133825%3Aet%3A1726655905%3Ac%3A1%3Arn%3A516129705%3Arqn%3A1%3Au%3A1726655905300364852%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1158%3Awv%3A2%3Ads%3A1%2C84%2C346%2C39%2C452%2C0%2C%2C214%2C0%2C1685%2C1685%2C0%2C1418%3Aco%3A0%3Acpf%3A1%3Ans%3A1726655902297%3Agi%3AR0ExLjEuMTMxMjIzMjg4Ni4xNzI2NjU1OTA1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726655905%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

9e610560b5801bb443e0a126836ec08bed007927201510447a0d2a3e9a21fdbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Referer: https://1win.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Wed, 18-Sep-2024 10:38:25 GMT
access-control-allow-origin: https://1win.com
content-length: 593
x-xss-protection: 1; mode=block
date: Wed, 18 Sep 2024 10:38:25 GMT
content-type: application/json; charset=utf-8
last-modified: Wed, 18-Sep-2024 10:38:25 GMT

Redirect headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
location: /watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Ftheinnocent.in%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A353059999133%3Ahid%3A122391057%3Az%3A180%3Ai%3A20240918133825%3Aet%3A1726655905%3Ac%3A1%3Arn%3A516129705%3Arqn%3A1%3Au%3A1726655905300364852%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1158%3Awv%3A2%3Ads%3A1%2C84%2C346%2C39%2C452%2C0%2C%2C214%2C0%2C1685%2C1685%2C0%2C1418%3Aco%3A0%3Acpf%3A1%3Ans%3A1726655902297%3Agi%3AR0ExLjEuMTMxMjIzMjg4Ni4xNzI2NjU1OTA1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726655905%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29
pragma: no-cache
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-credentials: true
expires: Wed, 18-Sep-2024 10:38:25 GMT
access-control-allow-origin: https://1win.com
date: Wed, 18 Sep 2024 10:38:25 GMT
x-xss-protection: 1; mode=block
last-modified: Wed, 18-Sep-2024 10:38:25 GMT

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame 2BD1 0
0 218ms
114ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1046
content-type: text/html
date: Wed, 18 Sep 2024 10:38:25 GMT
etag: "66e303a5-416"
expires: Wed, 18 Sep 2024 11:38:25 GMT
last-modified: Thu, 12 Sep 2024 15:07:17 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: rejodadi.co.id
URL: https://rejodadi.co.id/

Domain: 1win.com
URL: https://1win.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.theinnocent.in/	1970-01-20 23:39:02	Name: __cf_mw_byp Value: anS2ssmoIN0nJTPrDL_S3UZl889ei89C9Z.29Ey52.4-1726655898-0.0.1.1-/situs-togel-toto12/
.1win.com/	1970-01-21 08:23:11	Name: __ddg1_ Value: ymxIx90fmpAyHH51ytch
1win.com/	1970-01-21 00:22:14	Name: visit_domain Value: 1win.com
1win.com/	1969-12-31 23:59:59	Name: core-sticky Value: http://10.233.108.55:80
1win.com/	1970-01-21 08:23:11	Name: 1w_lang Value: en
1win.com/	1969-12-31 23:59:59	Name: 1w_locale Value: 14
.1win.com/	1970-01-21 01:47:11	Name: _gcl_au Value: 1.1.1605545537.1726655905
.1win.com/	1970-01-21 08:23:11	Name: AMP_494cccfe21 Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjIxYzY2NmQyYy0wMWRhLTQ4NTktOThhMS0yOTY2MDlhNjkzZTUlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzI2NjU1OTAzOTM1JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTcyNjY1NTkwNDcxMCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMTAlMkMlMjJwYWdlQ291bnRlciUyMiUzQTAlN0Q=
.1win.com/	1970-01-21 09:13:35	Name: _ga Value: GA1.1.1312232886.1726655905
.yandex.ru/	1970-01-21 09:13:35	Name: i Value: NXVh6l4+ZonQ9OLxthVwMzZscdCbOZNUqiDn+y/smeu2JM56mI6ZhUKrUY2NWSZHEDNciNTp1Ob5dsZaRBCyzGER7LM=
.yandex.ru/	1970-01-21 09:13:35	Name: yandexuid Value: 7714262571726655904
.yandex.ru/	1970-01-21 08:23:11	Name: yashr Value: 9764914691726655904
.1win.com/	1970-01-21 09:13:35	Name: _ga_548949LWLW Value: GS1.1.1726655904.1.0.1726655904.60.0.0
.1win.com/	1970-01-21 08:23:11	Name: _ym_uid Value: 1726655905300364852
.1win.com/	1970-01-21 08:23:11	Name: _ym_d Value: 1726655905
.mc.yandex.com/	1970-01-20 23:37:36	Name: sync_cookie_csrf Value: 3515682959fake
.mc.yandex.ru/	1970-01-20 23:37:36	Name: sync_cookie_csrf Value: 3722285809fake
.doubleclick.net/	1970-01-21 00:20:47	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 08:59:11	Name: IDE Value: AHWqTUnn1kYmZ3D_bCo0qWRZLhqPhsGtelk1G8ZejHHSTV3PfxKc6vo7-5AfYVhz
.yandex.com/	1970-01-21 08:23:11	Name: yashr Value: 3816919691726655905
.yandex.com/	1970-01-21 08:23:11	Name: yandexuid Value: 7714262571726655904
.yandex.com/	1970-01-21 08:23:11	Name: yuidss Value: 7714262571726655904
.yandex.com/	1970-01-21 09:13:35	Name: i Value: NXVh6l4+ZonQ9OLxthVwMzZscdCbOZNUqiDn+y/smeu2JM56mI6ZhUKrUY2NWSZHEDNciNTp1Ob5dsZaRBCyzGER7LM=
.mc.yandex.com/	1970-01-20 23:39:02	Name: sync_cookie_ok Value: synced
.1win.com/	1970-01-20 23:38:47	Name: _ym_isad Value: 2
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1188335001726655905
.yandex.com/	1970-01-21 08:23:11	Name: ymex Value: 1758191905.yrts.1726655905
.yandex.com/	1970-01-21 09:13:35	Name: bh Value: KgI/MGCh26q3Bg==
.1win.com/	1970-01-21 08:23:11	Name: _hjSessionUser_2606090 Value: eyJpZCI6ImQ5Nzk1ZWQ4LWE5N2ItNWJhZi1hMzlhLTYxMTM3YWNiYTBiOSIsImNyZWF0ZWQiOjE3MjY2NTU5MDU0NDEsImV4aXN0aW5nIjpmYWxzZX0=
.1win.com/	1970-01-20 23:37:37	Name: _hjSession_2606090 Value: eyJpZCI6Ijc5MjYwNThiLTI4MmUtNDZiZC1iNmVjLWZiNjEzOTBmMjQ3ZSIsImMiOjE3MjY2NTU5MDU0NDMsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
1win.com/	1969-12-31 23:59:59	Name: _hjHasCachedUserAttributes Value: true

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://theinnocent.in/situs-togel-toto12/ Message: Access to speculationrule at 'https://rejodadi.co.id/' (redirected from 'https://theinnocent.in/cdn-cgi/speculation') from origin 'https://theinnocent.in' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rejodadi.co.id/ Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://theinnocent.in/situs-togel-toto12/ Message: Load failed or canceled (net::ERR_FAILED) for rule set requested from "https://theinnocent.in/cdn-cgi/speculation" found in Speculation-Rules header.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12572451.fls.doubleclick.net
12688802.fls.doubleclick.net
1win.com
ad.doubleclick.net
analytics.google.com
api.lab.amplitude.com
api2.amplitude.com
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
naturewildlife.id
rejodadi.co.id
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
td.doubleclick.net
theinnocent.in
v1.bundlecdn.com
www.google.com
www.google.fi
www.google.ru
www.googletagmanager.com
1win.com
rejodadi.co.id
100.21.47.81
13.32.27.21
142.250.181.230
142.250.185.131
142.250.185.228
142.250.186.130
151.101.130.132
154.197.121.128
172.67.155.76
18.66.102.106
188.114.96.3
188.114.97.3
190.115.24.78
216.58.206.70
2a00:1450:4001:80e::2002
2a00:1450:4001:81c::200e
2a00:1450:4001:828::2003
2a00:1450:4001:828::2008
2a00:1450:400c:c1d::9d
2a02:6b8::1:119
01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce
06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6
0d42740827f657ed3df4f67d0704bb86f9e943b044e18b98030b09c645d90d00
0f6e3e5c53c730a88de6f874ab17cb1283f0ed8580bb22b57578f4f0d601f700
13b15f93eb2d98d4f7e9d58c481b6e04e54a0caed2b0b19a51cfb2a61adc8449
1bbf99d77dbb7cd1388b574b97975c551735598fc5c9821c0f9f957cce26cad4
1d036466f5780b3537086b15a0363d2c56b66135166e30520e419a25877ff2ab
2a2ab3b6931fb3e38d74277ffef5a529bb660910f813ba221ee776dd570d2361
368124e112c44824d4d6d58013c7687e50586debfffa4e395aa9a9a6c52ef750
37d09bb9dec51b98e773e55e75b2508d6eb9ff6db77b172a614642a06f2c3ff2
394daf2ca11c67f7a6188bc8e31f5dd7e2985db4de06dbc67ab4db2c0886cb7c
3e293409afa8dc3494ebda65e578a24bd3a3be1d0e3f5b1313a37dd474cbd729
448797aade8c774bb0d8bf418eb7469865095c4e9016fc13095204ba2b6dc3e3
44eea7173f8bc302277e161c6895c2575141300e19df2594c58a6981395917ac
463863dcb9403bdaea042fc745a70e8aa2d25e887ad6891dfc88fd920a90c6be
464315c4b50d1c2fc205a9922c85615b83279ca54d05b48f77c1e4577778f131
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5550c4b4441530d7f809f252c439ce1dc918bfe70d85c9eb7688bbc053341d20
58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f
6071fb99e587aa37f08c8f14a5718a3bda75cae32fd1d4ccd0718733a362ab64
66c4135905d8889570877f8bf74d092dbcda1ec84d16791a9eab736415fd396c
6fadb170818ee2cb77815a1e183b6a3f8de9a74f52b2282681c14a72d1a52119
789ae704b2217f0e501c2f67d21786d21b6fd766d3c3699c3a00625809579152
7c8f261e94c058930ea2fca6c28e8a10458fc6d53b392348a0a1745f600afaa2
7e07ecaa23cfa51908d6adaa3a1b9b6927ce4e7ba92acfa182fee9c3d1a3ef34
82dcbd3db370fd49d3a130886970cfd48796750ab3767c8b6985a2bf825b250b
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
86a11ca8f8761ee42f5ad8f3ec57fed81d52d3b809ce86d9209305dc5c0fb0be
9123cebe41c1fc2c79b22d627451ea38662dc1933286f0bd7ff7a03721821bf1
9458dbf0b5b7d5dae83c8b606592d026cfa46c5d448a26e6c9926c05e25773e9
98a120f53a51e99fa0ad07f146b968026f5cd470b156de9ba1d224dfc2529c3b
98aac6b65bfa12026ca183b718c6bf01d5d6a552d79ea09547831c5afa2050ba
9be12e59a210d45411e025096615d4308c44a0cffeb791dd452e443c675e8481
9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f
9e610560b5801bb443e0a126836ec08bed007927201510447a0d2a3e9a21fdbe
9fb4f5c65b076cddbd9e294b583bc0222e1a2a47c8b890496940a54df2eeccfe
a1eabc2018d9bf590adaabe705bc040d8f3f2e623be180f5f5efd10e6324b686
a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb
a64e74582e4c1bef5283a8d36009e03530aec86589afe144237fdb246e5f0fcf
a7cc97d5681d6d3e5921465551231c25df6ea5dec92aeb116e7dd146daef4565
b2ff54d440d6890a5ddc0b25fe41dd295e564beedea3410567b018d3d0c72384
b3fbb7a6cd6c95bbdabae8db7ab2d48885f8f6dae2d33d1cc15c5d391c02e3e6
b563de728f7ad9022ef94968360931749d32898f02f524b66a73c2630126f4a3
bb6da1eb7a6fcbdc88067d666bc358ac24e8e1c23bb5c00f8a49917f41a3331f
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
c07b2c0a515caf1306fb4d9366fab5758253eeadcf8c0414cb44ccd48f82e59a
cdc91556133cb30a0d3e5df729f641b1cfcf985043924131e0a98f0976a1aabd
ce68e1614ab493deaecfa6eb9711736de0348248e1d559b5f6dfb5dc4c29b459
dcc1c58cf13b65fa067a2e96ed5f0c6adf13363dc05e9e031e729909a972e61c
df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e81c3c172e351d6dfea962f40de23aac1ef75252c5192563765b0502a7ff1726
ecfc620b0ba1cb0947679ff2077e3ece437e2f30f7cf0ff44695a14bc92e3f5f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f007c721f3891c6fbc6555f58faf308a9187968bfca7439dd601ae93b621649b
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

1win.com Open in urlscan Pro 190.115.24.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

72 Requests

90 %HTTPS

30 %IPv6

14 Domains

22 Subdomains

19 IPs

7 Countries

1447 kBTransfer

4516 kBSize

31 Cookies

0 Outgoing links

Page URL History

Redirected requests

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

1win.com Open in urlscan Pro
190.115.24.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

72
Requests

90 %
HTTPS

30 %
IPv6

14
Domains

22
Subdomains

19
IPs

7
Countries

1447 kB
Transfer

4516 kB
Size

31
Cookies

72 HTTP transactions
1 data transactions