hwyh7ago.dreamwp.com Open in urlscan Pro
2a00:fd80:a222:bbbb:bba5:2:ffff:ffff Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Submission: On June 06 via automatic, source openphish (June 6th 2022, 1:04:37 am UTC) — Scanned from DE

Summary HTTP 29 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 7 domains to perform 29 HTTP transactions. The main IP is 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff, located in United Arab Emirates and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is hwyh7ago.dreamwp.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 24th 2021. Valid for: a year.

This is the only time hwyh7ago.dreamwp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Posten Norge (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
23	2a00:fd80:a22... 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff	38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited)
1	176.221.90.98 176.221.90.98	31264 (STIM-COMP...) (STIM-COMPUTING-AS Peering: peering@visolit.no)
1	2606:4700:310... 2606:4700:3108::ac42:285e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	18.158.135.185 18.158.135.185	16509 (AMAZON-02) (AMAZON-02)
29	6

23 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff (United Arab Emirates)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)

hwyh7ago.dreamwp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.221.90.98 (Moss, Norway)

ASN31264 (STIM-COMPUTING-AS Peering: peering@visolit.no, NO)

www.nesodden.kommune.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:285e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.iconfinder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

iconape.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.135.185 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-135-185.eu-central-1.compute.amazonaws.com

6015663.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	dreamwp.com hwyh7ago.dreamwp.com	66 KB
1	siteimproveanalytics.io 6015663.global.siteimproveanalytics.io	620 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	46 KB
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3282	13 KB
1	iconape.com iconape.com — Cisco Umbrella Rank: 148372	3 KB
1	iconfinder.com cdn2.iconfinder.com — Cisco Umbrella Rank: 70566	10 KB
1	nesodden.kommune.no www.nesodden.kommune.no	23 KB
29	7

	Domain	Requested by
23	hwyh7ago.dreamwp.com	hwyh7ago.dreamwp.com
1	6015663.global.siteimproveanalytics.io	hwyh7ago.dreamwp.com
1	www.googletagmanager.com	hwyh7ago.dreamwp.com
1	siteimproveanalytics.com	hwyh7ago.dreamwp.com
1	iconape.com	hwyh7ago.dreamwp.com
1	cdn2.iconfinder.com	hwyh7ago.dreamwp.com
1	www.nesodden.kommune.no	hwyh7ago.dreamwp.com
29	7

This site contains links to these domains. Also see Links.

Domain
www.posten.no
id.posten.no
adressesok.posten.no
www.postennorge.no

Subject Issuer	Validity	Valid
*.dreamwp.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-24` - `2023-01-24`	a year	crt.sh
www.nesodden.kommune.no Buypass Class 2 CA 2	`2022-03-18` - `2023-03-18`	a year	crt.sh
*.iconfinder.com E1	`2022-04-17` - `2022-07-16`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-25` - `2023-03-25`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon	`2022-04-27` - `2023-05-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Frame ID: C301CF36F4340066AC9B569A3180D8C9
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DigipostSøkMin sideNOT_TRANSLATEDLukke meny

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

Page Statistics

29
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

160 kB
Transfer

545 kB
Size

2
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://www.posten.no/

Search URL Search Domain Scan URL

URL: https://id.posten.no/minside
Title: Min sideMin side

Search URL Search Domain Scan URL

URL: https://adressesok.posten.no/
Title: Søk etter adresser, postnummer og personer

Search URL Search Domain Scan URL

URL: https://www.posten.no/kart
Title: Åpningstider og røde postkasser

Search URL Search Domain Scan URL

URL: https://www.posten.no/frimerker-til-samling
Title: Frimerker til samling

Search URL Search Domain Scan URL

URL: https://www.posten.no/nettbutikker
Title: Kjøp skilt og postkasse i nettbutikken

Search URL Search Domain Scan URL

URL: https://www.posten.no/sende
Title: Sende brev og pakker i Norge

Search URL Search Domain Scan URL

URL: https://www.posten.no/sende/pakke/utland
Title: Sende brev og pakker til utlandet

Search URL Search Domain Scan URL

URL: https://www.posten.no/sende/retur
Title: Retur

Search URL Search Domain Scan URL

URL: https://www.posten.no/sende/klargjoring
Title: Adressering og innpakking

Search URL Search Domain Scan URL

URL: https://www.posten.no/sende/brev/frimerker-og-porto
Title: Frimerker og porto

Search URL Search Domain Scan URL

URL: https://www.posten.no/fortolling/sende-til-utlandet
Title: Fortolling når du sender

Search URL Search Domain Scan URL

URL: https://www.posten.no/motta/hente-selv
Title: Hente selv

Search URL Search Domain Scan URL

URL: https://www.posten.no/motta/hente-selv/pakkeboks
Title: Pakkeboks

Search URL Search Domain Scan URL

URL: https://www.posten.no/motta/hente-selv/postboks
Title: Leie postboks

Search URL Search Domain Scan URL

URL: https://www.posten.no/motta/hjemlevering
Title: Hjemlevering

Search URL Search Domain Scan URL

URL: https://www.posten.no/motta/hjemlevering/postkasse
Title: Alt om postkasser

Search URL Search Domain Scan URL

URL: https://www.posten.no/levering-av-post-2020
Title: Hvilke dager kommer posten min?

Search URL Search Domain Scan URL

URL: https://www.posten.no/fortolling/motta-fra-utlandet
Title: Fortolling når du mottar

Search URL Search Domain Scan URL

URL: https://www.posten.no/adressetjenester/adresseendring
Title: Flytte og endre adresse

Search URL Search Domain Scan URL

URL: https://www.posten.no/adressetjenester/midlertidig-ettersending
Title: Ettersende post midlertidig

Search URL Search Domain Scan URL

URL: https://www.posten.no/adressetjenester/oppbevaring-av-post
Title: Oppbevaring av post

Search URL Search Domain Scan URL

URL: https://www.posten.no/kundeservice
Title: Kundeservice

Search URL Search Domain Scan URL

URL: https://www.posten.no/kundeservice/klager-og-reklamasjon
Title: Klager og reklamasjon

Search URL Search Domain Scan URL

URL: https://www.posten.no/kundeservice/postens-chatbot
Title: Chat med oss

Search URL Search Domain Scan URL

URL: https://www.posten.no/sporing-kundeservice
Title: Sporingshjelp

Search URL Search Domain Scan URL

URL: https://www.posten.no/fortolling
Title: Toll

Search URL Search Domain Scan URL

URL: https://www.posten.no/enklere-hverdag/slik-far-du-pakkene-dine-enkelt-levert
Title: Sende og motta hjemmefra

Search URL Search Domain Scan URL

URL: https://www.posten.no/kundeservice/nettsvindel
Title: Nettsvindel og falske SMS

Search URL Search Domain Scan URL

URL: https://www.posten.no/vilkar/norgespakke
Title: Vilkår for Norgespakke™

Search URL Search Domain Scan URL

URL: https://www.posten.no/personvern-sikkerhet
Title: Personvern og sikkerhet

Search URL Search Domain Scan URL

URL: https://www.posten.no/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.postennorge.no/
Title: Om Posten Norge

Search URL Search Domain Scan URL

URL: https://www.postennorge.no/jobb/ledige-stillinger
Title: Jobb i Posten

Search URL Search Domain Scan URL

URL: https://www.posten.no/priser
Title: Priser

Search URL Search Domain Scan URL

URL: https://www.posten.no/vilkar
Title: Våre vilkår

Search URL Search Domain Scan URL

URL: https://www.posten.no/enklere-hverdag
Title: Nettmagasin: Enklere hverdag

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/ 124 KB
37 KB 633ms
558ms Document
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash: 01f8c49e64852eb05faaa56681bdeeb0161ec51495d5d76df3f6afbdfeabc01f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/7.3.33

GET
H2 200 posten.css
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 210 KB
28 KB 29ms
28ms Stylesheet
text/css 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/posten.css
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash: 5f7d64b4430cb94ebc646350c38b1be5693c6396f9083f4fee50d06ce1ae8345

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
content-encoding: gzip
last-modified: Wed, 06 Apr 2022 04:59:48 GMT
server: nginx
etag: W/"624d1e44-349ec"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
expires: Wed, 06 Jul 2022 01:04:32 GMT

GET
H2 200 fonts.css
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 2 KB
725 B 39ms
39ms Stylesheet
text/css 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash: 304a57945a1b44c2f502ddb3d2b2f315f7baa57c4c3f1f47c00f499f71ef38c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
content-encoding: gzip
last-modified: Thu, 10 Mar 2022 14:58:48 GMT
server: nginx
etag: W/"622a1228-855"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
expires: Wed, 06 Jul 2022 01:04:32 GMT

GET
H2 404 linkid.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 993ms
992ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/linkid.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 analytics.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 1188ms
1186ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/analytics.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 gtm.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 1353ms
1352ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/gtm.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 siteanalyze_6015663.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 1580ms
1579ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/siteanalyze_6015663.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK digipost_2.jpg
www.nesodden.kommune.no/handlers/bv.ashx/i05354904-f1cd-445b-bcaf-0656a00f52ca/w1200/ka8174c743253/ 22 KB
23 KB 420ms
49ms Image
image/jpeg 176.221.90.98
STIM-COMPUTING-AS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nesodden.kommune.no/handlers/bv.ashx/i05354904-f1cd-445b-bcaf-0656a00f52ca/w1200/ka8174c743253/digipost_2.jpg

Requested by

Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

176.221.90.98 Moss, Norway, ASN31264 (STIM-COMPUTING-AS Peering: peering@visolit.no, NO),

Reverse DNS

Software

Resource Hash

3244c18f87a989b59e5fa180317b0c3ea24814c6b4cd8397a8f770e3469dd165

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000, max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Mon, 06 Jun 2022 01:04:32 GMT
Last-Modified: Thu, 02 Jun 2022 13:20:59 GMT
Strict-Transport-Security: max-age=157680000, max-age=157680000
Content-Type: image/jpeg
Cache-Control: private, must-revalidate, max-age=31536000
content-disposition: inline; filename="digipost_2.jpg"
Content-Length: 22836
Expires: Tue, 06 Jun 2023 01:04:32 GMT

GET
H2 200 receive_parcel-supplie-stock-4-512.png
cdn2.iconfinder.com/data/icons/delivery-and-logistic/64/ 9 KB
10 KB 55ms
26ms Image
image/webp 2606:4700:3108::ac42:285e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn2.iconfinder.com/data/icons/delivery-and-logistic/64/receive_parcel-supplie-stock-4-512.png

Requested by

Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:285e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fec366807efc6847f5c6327a2729cd33197ee2735dea4c3ca602b17883080dad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
age: 406013
cf-polished: origFmt=png, origSize=27529
content-disposition: inline; filename="receive_parcel-supplie-stock-4-512.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9210
x-request-id: 7ab99dec-539f-4e3a-821e-11fbaca4db70
expires: Tue, 06 Jun 2023 01:04:32 GMT
last-modified: Wed, 01 Jun 2022 06:30:05 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
vary: Accept
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 716d3c0a1e1b9c01-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 299202.svg
iconape.com/wp-content/files/dv/299202/svg/ 8 KB
3 KB 40ms
13ms Image
image/svg+xml 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://iconape.com/wp-content/files/dv/299202/svg/299202.svg
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ae3bdab8863e868a1a73a07c4b06b4dcd8412385477453d52482ee719ba938c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 139835
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
pragma: public
last-modified: Mon, 30 Mar 2020 11:18:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wrUmNDc9UmDyiA7GTCnzdaEQ%2B9MdkNZSOfxE4TEEI7jUoq6AksZ30qSf3XNZpskN4IGkGvxHJwBkQZMJhc9Db0DZULP7EaBO4MQKU2hkLYORcWEmrld%2B1C9hjewlzpzUf4w2mXZJHEM70g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=5184000
cf-ray: 716d3c0a196f9972-FRA
expires: Wed, 03 Aug 2022 10:13:55 GMT

GET
H2 404 main.46ce0189.chunk.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 772ms
771ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.46ce0189.chunk.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 2.59df707e.chunk.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 762ms
762ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/2.59df707e.chunk.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 runtime-main.4ac6edaa.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 761ms
759ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/runtime-main.4ac6edaa.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 main.ab622f28.chunk.css
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 761ms
759ms Stylesheet
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.ab622f28.chunk.css
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 icons.min.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 833ms
831ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/icons.min.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 main.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 1805ms
1805ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:34 GMT
content-encoding: gzip
server: nginx
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://hwyh7ago.dreamwp.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 503 bundle.js.t%C3%A9l%C3%A9chargement
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/ 0
0 37ms
36ms Script
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/bundle.js.t%C3%A9l%C3%A9chargement
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Regular.woff2
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 21ms
20ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.woff2
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Medium.woff2
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.woff2
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Bold.woff2
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.woff2
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Regular.woff
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.woff
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Medium.woff
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.woff
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Bold.woff
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.woff
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Regular.ttf
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.ttf
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Medium.ttf
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 19ms
19ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.ttf
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 503 PostenSans-Bold.ttf
hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/ 0
0 20ms
20ms Font
text/html 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.ttf
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff , United Arab Emirates, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts.css
Origin: https://hwyh7ago.dreamwp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:32 GMT
server: nginx
content-length: 592
content-type: text/html

GET
H2 200 siteanalyze_6015663.js Show response
siteimproveanalytics.com/js/ 42 KB
13 KB 41ms
14ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6015663.js
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d5c8afe612685aaf7198ab468e508f8ab65abf8c05cccf3309ab6b02ddf796f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5412
cf-ray: 716d3c0eeab190fe-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12230
x-amz-id-2: iZZ1oPOIiOYCDi8Rtp3mL776MFMh+QI8BERjIJS/oQPnlcdHvAeNqQG3TR1OS8Cfh2jVp+m/Pc8=
last-modified: Tue, 31 May 2022 12:44:18 GMT
server: cloudflare
etag: "49931024bd4c093cfb7666aaca3656b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BEABGobdYm3oKNKMaH4fk0JC%2F9DyvP2x9fE9a0NSOGOvZdvgJ8RkZwxGJkhos5Zg0H0scaLy8OvaIIPvmLCxKu5JRdYSD9R8D1x6TcgGCnsc69ejENZKJ4dxi7wgAcRnBW8J03U%2BPr0mY3wugZX01CvqfhYRdZM%3D"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: 6GRQ5NCRBZMHNYA3
cache-control: max-age=86400, no-transform
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 127 KB
46 KB 77ms
29ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T89LQD

Requested by

Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fceb77c2434d887cf49b17e627d4dd5c5b36c300a99284fd53c3c5a54549bbb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 01:04:33 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46268
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Jun 2022 01:04:33 GMT

GET
H/1.1 200
OK image.aspx
6015663.global.siteimproveanalytics.io/ 34 B
620 B 60ms
7ms Image
image/gif 18.158.135.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6015663.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fhwyh7ago.dreamwp.com%2Fwp-admin%2FNO%25202%2FNO%2Fbetale%2F&title=Digipost&res=1600x1200&accountid=6015663&rt=1541&prev=6c89983b-b2d4-cf52-5cee-eb1ae2cf1518&luid=67b11991-b73b-55e1-a09d-2f4ea78183f6&rnd=95530
Requested by: Host: hwyh7ago.dreamwp.com
URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.135.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-135-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hwyh7ago.dreamwp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Mon, 06 Jun 2022 01:04:33 GMT
Cache-Control: max-age=0, no-cache="set-cookie"
Expires: Mon, 06 Jun 2022 01:04:33 UTC
Connection: keep-alive
Content-Length: 34
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Posten Norge (Transportation)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dreamwp.com/	1970-01-21 03:34:37	Name: nmstat Value: 6c89983b-b2d4-cf52-5cee-eb1ae2cf1518
			6015663.global.siteimproveanalytics.io/	1969-12-31 23:59:59	Name: AWSELBCORS Value: 1BF185CB12C799AC7E8F30E4356ECAB670474BBE588D8C794434013018C6F025CF05C90678F60F8BC4542034736A388120A7C60680E5CEA23BDF794F89C7883D26F01C0A24

20 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/bundle.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.woff2 Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.woff2 Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.woff2 Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.woff Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.woff Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.woff Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Regular.ttf Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Medium.ttf Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/fonts/PostenSans-Bold.ttf Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/runtime-main.4ac6edaa.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.ab622f28.chunk.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/2.59df707e.chunk.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.46ce0189.chunk.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/icons.min.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/linkid.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/analytics.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/gtm.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/siteanalyze_6015663.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://hwyh7ago.dreamwp.com/wp-admin/NO%202/NO/betale/Postenid_files/main.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6015663.global.siteimproveanalytics.io
cdn2.iconfinder.com
hwyh7ago.dreamwp.com
iconape.com
siteimproveanalytics.com
www.googletagmanager.com
www.nesodden.kommune.no
176.221.90.98
18.158.135.185
2606:4700:3108::ac42:285e
2a00:1450:4001:82f::2008
2a00:fd80:a222:bbbb:bba5:2:ffff:ffff
2a06:98c1:3121::3
01f8c49e64852eb05faaa56681bdeeb0161ec51495d5d76df3f6afbdfeabc01f
0ae3bdab8863e868a1a73a07c4b06b4dcd8412385477453d52482ee719ba938c
1d5c8afe612685aaf7198ab468e508f8ab65abf8c05cccf3309ab6b02ddf796f
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
304a57945a1b44c2f502ddb3d2b2f315f7baa57c4c3f1f47c00f499f71ef38c2
3244c18f87a989b59e5fa180317b0c3ea24814c6b4cd8397a8f770e3469dd165
5f7d64b4430cb94ebc646350c38b1be5693c6396f9083f4fee50d06ce1ae8345
fceb77c2434d887cf49b17e627d4dd5c5b36c300a99284fd53c3c5a54549bbb0
fec366807efc6847f5c6327a2729cd33197ee2735dea4c3ca602b17883080dad

hwyh7ago.dreamwp.com Open in urlscan Pro 2a00:fd80:a222:bbbb:bba5:2:ffff:ffff Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

29 Requests

100 %HTTPS

67 %IPv6

7 Domains

7 Subdomains

6 IPs

4 Countries

160 kBTransfer

545 kBSize

2 Cookies

37 Outgoing links

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

hwyh7ago.dreamwp.com Open in urlscan Pro
2a00:fd80:a222:bbbb:bba5:2:ffff:ffff Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

160 kB
Transfer

545 kB
Size

2
Cookies

29 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!