www.windowfivegold.com Open in urlscan Pro
20.120.136.37  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Page URL
2. https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	4989EG9106JT11981T302KA69791653XQ392081297 Show response www.dosurveys.rest/l/lt3J10535N4C/	2 KB 1 KB	306ms 287ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.4 Resource Hash 1f686af3796b337e3ac5d9107a05330c58a862a446f10b99364b4b75a42ed448 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 77072fa34959920d-FRA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Sun, 27 Nov 2022 01:45:44 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MfYWx%2BgRWlS1RNGDFYvVf3pDKVCnmrfEmEV8J2rU0dkl%2FQ3yIfa8lPHxZVPEPczLoDxoKKhje7Ao%2BivLoRhlpm8D67O8HGsiW1NVWw4oJMdCqkQRF0%2Bm%2BqNNtTL%2FDWf%2FVbwb1Y5Jp%2F%2Fjyc2%2BtR6MBxs%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked X-Powered-By PHP/5.3.4 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.9.1/	90 KB 33 KB	100ms 30ms	Script text/javascript	2a00:1450:4001:806::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Requested by Host: www.dosurveys.rest URL: http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer http://www.dosurveys.rest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Fri, 25 Nov 2022 13:12:27 GMT content-encoding gzip x-content-type-options nosniff age 131597 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33018 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 25 Nov 2023 13:12:27 GMT
GET H/1.1	200 OK	/ Show response www.dosurveys.rest/ajax/get_js/main/	3 KB 1 KB	153ms 153ms	Script text/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.dosurveys.rest/ajax/get_js/main/ Requested by Host: www.dosurveys.rest URL: http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.4 Resource Hash 6e81862e7adb1609c3c0d873ecfeff71413ea02e219669d27cd8e6ecd1f774c9 Request headers accept-language nl-NL,nl;q=0.9 Referer http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers Date Sun, 27 Nov 2022 01:45:44 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare X-Powered-By PHP/5.3.4 Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W7Hurpe%2BEfdB6ZasRS34YMSENJWCF3FIxhzjNiwwDFf2jKl0Aq9Yw%2FssrqpqsmQ%2BpsIbjgz%2BZP35Cr9ksWHh8bOHZ%2B3XWSKRxDtVycz%2F4OPiQPnIj7pJnQqKJ500DFAOFkdpyeXvn3RoI%2BJiacaVxis%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/javascript Connection keep-alive CF-RAY 77072fa52ad4920d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	/ www.dosurveys.rest/ajax/get_imgl/loading.gif/	8 KB 9 KB	304ms 284ms	Image image/gif	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www.dosurveys.rest/ajax/get_imgl/loading.gif/ Requested by Host: www.dosurveys.rest URL: http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.4 Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers Date Sun, 27 Nov 2022 01:45:44 GMT CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare X-Powered-By PHP/5.3.4 Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wc6XVP2TGWngVbh73Gn5BezznHuqs0C7LJrOzpiGsskzALNlp4g1F2tIazRpZDIDNJw7XCNtB1R1yEqfVoZXav%2FTxZwEtUGvbGpA5CFDbnjzWGId6w1EzsxRsc8rmASBjqYtvTNMHY6Bj0i%2F6QEqkKQ%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/gif Connection keep-alive CF-RAY 77072fa5fecc9bee-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	/ www.dosurveys.rest/ajax_m/get_main_page/10535/3/302/69791653/10535-69791653-11981-9106/4/4989/	74 B 767 B	157ms 157ms	XHR text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www.dosurveys.rest/ajax_m/get_main_page/10535/3/302/69791653/10535-69791653-11981-9106/4/4989/ Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.4 Resource Hash Request headers Accept */* Referer http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 X-Requested-With XMLHttpRequest accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers Date Sun, 27 Nov 2022 01:45:44 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare X-Powered-By PHP/5.3.4 Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pge4XZKI47IF6AUcDLukV72QsaS0y2Stvrd1xAxrso%2FkyAmRqZYK0TG4iv4AlPqZvNFMhjjHq07GOeO8kxrJeBj0dGHX7TL7OKBjtCPmE%2Fu8VCMtS9hsUxKv1wzgP%2FULpSPgZ2gT0CXFDz1AD6r1JWU%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/html Connection keep-alive CF-RAY 77072fa63bc8920d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	/ www.dosurveys.rest/ajax/get_imgl/loading.gif/ Frame 0F20	8 KB 9 KB	309ms 289ms	Image image/gif	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www.dosurveys.rest/ajax/get_imgl/loading.gif/ Requested by Host: www.dosurveys.rest URL: http://www.dosurveys.rest/l/lt3J10535N4C/4989EG9106JT11981T302KA69791653XQ392081297 Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.4 Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers Date Sun, 27 Nov 2022 01:45:44 GMT CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare X-Powered-By PHP/5.3.4 Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f7kEQvjNSgO4GYvGcSwBsFbmpy7UF8LPOQTretdfODYI3aResPO5Izbt3X9%2FdcTetY18Aar4b96%2F%2BHJHDoy1w5OTPeGnujAFhsEF5ez0%2BugRESv1XagAzHreILN0nk6nwXCpVrw1YENJhiBOyd4%2FtuI%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/gif Connection keep-alive CF-RAY 77072fa6585dbb62-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	Primary Request o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Show response www.windowfivegold.com/	805 B 1 KB	761ms 221ms	Document text/html	20.120.136.37 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Requested by Host: www.dosurveys.rest URL: http://www.dosurveys.rest/ajax/get_js/main/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.120.136.37 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e51d98f26aea0f5fd01aacb9a1cfbc91ffd790e9b56a2aad3f114b4ac47b2a12 Request headers Referer http://www.dosurveys.rest/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Accept-Ranges bytes Age 72468 Connection keep-alive Content-Length 805 Content-Type text/html Date Sun, 27 Nov 2022 01:45:45 GMT ETag "df4f67d430bdad90e0f9f0bc64ce6542" Last-Modified Fri, 25 Nov 2022 05:37:48 GMT Vary Accept-Encoding Via 1.1 e9c8cd6cad69627cb7c9d88123e6e2cc.cloudfront.net (CloudFront) X-Amz-Cf-Id 5Zi-X4sJA6GCVztSzovyUbeedAnGqPcfGei3Cwydwu_-Tl0WFHRfcg== X-Amz-Cf-Pop HIO50-C2 X-Cache Error from cloudfront X-Proxy-Cache EXPIRED domain-integrity-check true
GET H2	200	css fonts.googleapis.com/	6 KB 1 KB	103ms 33ms	Stylesheet text/css	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300,400,500 Requested by Host: www.windowfivegold.com URL: https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.windowfivegold.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Sun, 27 Nov 2022 01:45:45 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 27 Nov 2022 01:05:33 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 27 Nov 2022 01:45:45 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	109 KB 43 KB	79ms 32ms	Script application/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-9000201-8 Requested by Host: www.windowfivegold.com URL: https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 6b210de2fd99faab578a1888bd78ef7f4ad18a153e166741d30fcf9693415c7b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.windowfivegold.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Sun, 27 Nov 2022 01:45:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43677 x-xss-protection 0 last-modified Sun, 27 Nov 2022 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sun, 27 Nov 2022 01:45:45 GMT
GET H2	200	main.34656e74.js Show response ds2r9mr2r4h38.cloudfront.net/static/js/	1 MB 311 KB	22ms 20ms	Script application/javascript	2600:9000:2057:7400:7:5868:a100:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ds2r9mr2r4h38.cloudfront.net/static/js/main.34656e74.js Requested by Host: www.windowfivegold.com URL: https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7400:7:5868:a100:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 005dcbcfe4d073a86c0aee158bcbcd4521005e87fe47abdc426744c1b5ed8cbe Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.windowfivegold.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Fri, 25 Nov 2022 05:38:00 GMT content-encoding gzip via 1.1 25c6baf0a31a5ef699c1e219b25ce7b8.cloudfront.net (CloudFront) last-modified Fri, 25 Nov 2022 05:37:51 GMT server AmazonS3 x-amz-cf-pop FRA6-C1 age 158866 etag W/"440f4b28c134cbd474af6dbf5e523ffa" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript domain-integrity-check true cache-control max-age=604800 x-amz-cf-id V6mdG3saMIaasnttLQMqbnkgKtQDYXi9BlhTbvvTt9M_YIq8M3NCsw==
GET H2	200	main.3ec05bac.css ds2r9mr2r4h38.cloudfront.net/static/css/	237 KB 52 KB	87ms 20ms	Stylesheet text/css	2600:9000:2057:7400:7:5868:a100:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ds2r9mr2r4h38.cloudfront.net/static/css/main.3ec05bac.css Requested by Host: www.windowfivegold.com URL: https://www.windowfivegold.com/o-plml-k04-ae6feb2948c68cdeeb68abfa24640124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:7400:7:5868:a100:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash c6c5d84c4980ae0521194cb78fee2650a276eb6c647afa22f5811a864f2beb54 Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.windowfivegold.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Fri, 25 Nov 2022 05:38:00 GMT content-encoding gzip via 1.1 25c6baf0a31a5ef699c1e219b25ce7b8.cloudfront.net (CloudFront) last-modified Fri, 25 Nov 2022 05:37:50 GMT server AmazonS3 x-amz-cf-pop FRA6-C1 age 158866 etag W/"94fec3c6987c4a59b2f719672a6eaaf6" vary Accept-Encoding x-cache Hit from cloudfront content-type text/css domain-integrity-check true cache-control max-age=604800 x-amz-cf-id v-01PYSUW08Bg6pLKunWo5zQkTCHXGJGc7ZR2C88yTnELqmPjzrbqw==
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	207ms 19ms	Script text/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-9000201-8 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.windowfivegold.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sun, 27 Nov 2022 01:15:54 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 1791 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Sun, 27 Nov 2022 03:15:54 GMT
POST H/1.1	200 OK	/ Show response sentry.io/api/1314267/envelope/	2 B 412 B	516ms 127ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1314267/envelope/?sentry_key=6c20ba397902400f9d47007cf6200a24&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.13.0 Requested by Host: ds2r9mr2r4h38.cloudfront.net URL: https://ds2r9mr2r4h38.cloudfront.net/static/js/main.34656e74.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.windowfivegold.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Sun, 27 Nov 2022 01:45:46 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary Origin Content-Type application/json access-control-allow-origin https://www.windowfivegold.com access-control-expose-headers x-sentry-error, retry-after, x-sentry-rate-limits x-envoy-upstream-service-time 0 Connection keep-alive Content-Length 2
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	78ms 19ms	Font font/woff2	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.windowfivegold.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Thu, 24 Nov 2022 19:42:15 GMT x-content-type-options nosniff age 194610 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Nov 2023 19:42:15 GMT
POST H2	200	optout-key Show response api.optoutsystem.com/auth/legacy/	421 B 692 B	519ms 187ms	XHR application/json	54.200.42.35 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.optoutsystem.com/auth/legacy/optout-key Requested by Host: ds2r9mr2r4h38.cloudfront.net URL: https://ds2r9mr2r4h38.cloudfront.net/static/js/main.34656e74.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.200.42.35 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-200-42-35.us-west-2.compute.amazonaws.com Software / Resource Hash 82d45bf934eecbe7c6bd292843fe6276b92a441b1b35601dbcbbb00f1cbd0454 Request headers Accept application/json, text/plain, */* Referer https://www.windowfivegold.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Content-Type application/json Response headers pragma no-cache date Sun, 27 Nov 2022 01:45:46 GMT vary Origin x-ratelimit-remaining 1499 content-type application/json; charset=utf-8 access-control-allow-origin https://www.windowfivegold.com cache-control no-cache access-control-allow-credentials true x-ratelimit-reset 1669513606 x-ratelimit-limit 1500 content-length 421 expires -1
OPTIONS H2	204	optout-key api.optoutsystem.com/auth/legacy/ Frame	0 0	514ms 164ms	Preflight	54.200.42.35 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.optoutsystem.com/auth/legacy/optout-key Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.200.42.35 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-200-42-35.us-west-2.compute.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.windowfivegold.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type access-control-allow-methods GET,HEAD,PUT,POST,DELETE,PATCH access-control-allow-origin https://www.windowfivegold.com access-control-max-age 86400 date Sun, 27 Nov 2022 01:45:46 GMT vary Origin
GET H2	200	optout-page Show response api.optoutsystem.com/campaigns/215759/	216 B 486 B	169ms 168ms	XHR application/json	54.200.42.35 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.optoutsystem.com/campaigns/215759/optout-page Requested by Host: ds2r9mr2r4h38.cloudfront.net URL: https://ds2r9mr2r4h38.cloudfront.net/static/js/main.34656e74.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.200.42.35 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-200-42-35.us-west-2.compute.amazonaws.com Software / Resource Hash 174ea411ff84f44d42de685ddff61ca2b450bc460398198a11075d0aae005415 Request headers Accept application/json, text/plain, */* Referer https://www.windowfivegold.com/ accept-language nl-NL,nl;q=0.9 Authorization Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoib3B0b3V0IiwiY2FtcGFpZ25faWQiOjIxNTc1OSwibWFpbGVyX2lkIjoxMjIxNzgsImNtYV9pZCI6NDQxMTQzMzIsImlhdCI6MTY2OTUxMzU0NiwiZXhwIjoxNjcxMzI3OTQ2fQ.ycQ0o3S3zi07OMxdnQpWiBPdYT7zLrK0pkaMEJmjuyA User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers pragma no-cache date Sun, 27 Nov 2022 01:45:47 GMT vary Origin x-ratelimit-remaining 1498 content-type application/json; charset=utf-8 access-control-allow-origin https://www.windowfivegold.com cache-control no-cache access-control-allow-credentials true x-ratelimit-reset 1669513606 x-ratelimit-limit 1500 content-length 216 expires -1
OPTIONS H2	204	optout-page api.optoutsystem.com/campaigns/215759/ Frame	0 0	167ms 161ms	Preflight	54.200.42.35 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.optoutsystem.com/campaigns/215759/optout-page Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.200.42.35 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-200-42-35.us-west-2.compute.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://www.windowfivegold.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods GET,HEAD,PUT,POST,DELETE,PATCH access-control-allow-origin https://www.windowfivegold.com access-control-max-age 86400 date Sun, 27 Nov 2022 01:45:47 GMT vary Origin
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	20ms 20ms	Font font/woff2	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.windowfivegold.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Thu, 24 Nov 2022 11:59:40 GMT x-content-type-options nosniff age 222367 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Nov 2023 11:59:40 GMT

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| __SENTRY__ object| classValidatorMetadataStorage object| FontAwesomeConfig object| ___FONT_AWESOME___ object| gaplugins object| gaGlobal object| gaData

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.windowfivegold.com/	1970-01-20 17:21:13	Name: _ga Value: GA1.2.1199421820.1669513546
			.windowfivegold.com/	1970-01-20 07:46:39	Name: _gid Value: GA1.2.995499643.1669513546

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.optoutsystem.com
ds2r9mr2r4h38.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
sentry.io
www.dosurveys.rest
www.google-analytics.com
www.googletagmanager.com
www.windowfivegold.com
20.120.136.37
2600:9000:2057:7400:7:5868:a100:21
2a00:1450:4001:803::200a
2a00:1450:4001:806::200a
2a00:1450:4001:80b::200e
2a00:1450:4001:828::2003
2a00:1450:4001:829::2008
2a06:98c1:3121::3
35.188.42.15
54.200.42.35
005dcbcfe4d073a86c0aee158bcbcd4521005e87fe47abdc426744c1b5ed8cbe
174ea411ff84f44d42de685ddff61ca2b450bc460398198a11075d0aae005415
1f686af3796b337e3ac5d9107a05330c58a862a446f10b99364b4b75a42ed448
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836
6b210de2fd99faab578a1888bd78ef7f4ad18a153e166741d30fcf9693415c7b
6e81862e7adb1609c3c0d873ecfeff71413ea02e219669d27cd8e6ecd1f774c9
82d45bf934eecbe7c6bd292843fe6276b92a441b1b35601dbcbbb00f1cbd0454
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c6c5d84c4980ae0521194cb78fee2650a276eb6c647afa22f5811a864f2beb54
e51d98f26aea0f5fd01aacb9a1cfbc91ffd790e9b56a2aad3f114b4ac47b2a12
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615