urlscan.io logo urlscan.io
SecurityTrails logo

www.buyingnewsoul.com Open in urlscan Pro
2606:4700:30::681b:a7bc  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://link.watergunfight.com/ga/click/2-42650734-4450-63548-87152-25145-0631819ee1-ac94008322
Effective URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159...
Submission: On May 27 via manual from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 37 HTTP transactions. The main IP is 2606:4700:30::681b:a7bc, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.buyingnewsoul.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 19th 2018. Valid for: a year.
This is the only time www.buyingnewsoul.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 193.24.232.33 202998 (GONET)
3 2606:4700:30:... 13335 (CLOUDFLAR...)
1 5 2606:4700:30:... 13335 (CLOUDFLAR...)
1 1 2606:4700:30:... 13335 (CLOUDFLAR...)
18 2606:4700:30:... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 52.219.74.48 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
37 7
1    193.24.232.33 (Lithuania)

ASN202998 (GONET, LT)
PTR: ma.watergunfight.com
link.watergunfight.com
3    2606:4700:30::6818:7af2 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.kettlesandmittens.com
5    2606:4700:30::6818:7bf2 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.kettlesandmittens.com
1    2606:4700:30::681c:1c3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.luckyluke500.com
18    2606:4700:30::681b:a7bc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.buyingnewsoul.com
3    2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
4    2606:4700::6810:cca5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.onesignal.com
onesignal.com
2    52.219.74.48 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3.eu-central-1.amazonaws.com
s3-eu-central-1.amazonaws.com
3    2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
Domain Requested by
18 www.buyingnewsoul.com www.kettlesandmittens.com
www.buyingnewsoul.com
8 www.kettlesandmittens.com 1 redirects www.kettlesandmittens.com
3 fonts.gstatic.com www.buyingnewsoul.com
3 fonts.googleapis.com www.buyingnewsoul.com
2 onesignal.com cdn.onesignal.com
2 s3-eu-central-1.amazonaws.com www.buyingnewsoul.com
2 cdn.onesignal.com www.buyingnewsoul.com
cdn.onesignal.com
1 www.luckyluke500.com 1 redirects
1 link.watergunfight.com 1 redirects
37 9

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2018-12-19 -
2019-12-19		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-05-07 -
2019-07-30		 3 months crt.sh
ssl473492.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-01-22 -
2019-07-31		 6 months crt.sh
*.s3.eu-central-1.amazonaws.com
DigiCert Baltimore CA-2 G2		 2018-11-08 -
2019-11-06		 a year crt.sh
*.google.com
Google Internet Authority G3		 2019-05-07 -
2019-07-30		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Frame ID: AB5467472DF4F5028AAF65AAED4EA54E
Requests: 36 HTTP requests in this frame

Frame: https://onesignal.com/webPushAnalytics
Frame ID: 0D8194C57FC9FF062DFF51EB0662C0A7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://link.watergunfight.com/ga/click/2-42650734-4450-63548-87152-25145-0631819ee1-ac94008322 HTTP 302
    http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&... Page URL
  2. http://www.kettlesandmittens.com/urlshort_test/uid_long=12807&tracking_id=29754279&token=QzWh6bZqPyVt9m5kUfyJ... HTTP 302
    https://www.luckyluke500.com/tracking/5a8c392631fc7238b2661361?src=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&... HTTP 302
    https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=5... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

37
Requests

81 %
HTTPS

78 %
IPv6

8
Domains

9
Subdomains

7
IPs

3
Countries

906 kB
Transfer

1743 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://link.watergunfight.com/ga/click/2-42650734-4450-63548-87152-25145-0631819ee1-ac94008322 HTTP 302
    http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd Page URL
  2. http://www.kettlesandmittens.com/urlshort_test/uid_long=12807&tracking_id=29754279&token=QzWh6bZqPyVt9m5kUfyJOpW079nMlCkrvHMWeW2h&preview=0&subid_json=eyJzdWJpZDEiOiJlOnVSMDg0Z3hKcG9uNzBVU0ZGWHN1VzJkSG1zTDRicFBSR2ZQbnRUc1VFU1kiLCJzdWJpZCI6ImU6dVIwODRneEpwb243MFVTRkZYc3VXMmRIbXNMNGJwUFJHZlBudFRzVUVTWSIsInN1YmlkMiI6IndhdGVyZ3VuZmlnaHQuY29tIiwic3ViaWQzIjoiOTIxOSJ9 HTTP 302
    https://www.luckyluke500.com/tracking/5a8c392631fc7238b2661361?src=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&k=5bee8d04ff538b49160250f5 HTTP 302
    https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]] Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://link.watergunfight.com/ga/click/2-42650734-4450-63548-87152-25145-0631819ee1-ac94008322 HTTP 302
  • http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd

37 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set nrp=g5gf7yh1z3p5vcipw2ugno1jd
www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/
Redirect Chain
  • http://link.watergunfight.com/ga/click/2-42650734-4450-63548-87152-25145-0631819ee1-ac94008322
  • http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7af2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
e47bc43a3209613d5acabe59704dce0f1f026476642d50e7d9829f8299318a48

Request headers

Host
www.kettlesandmittens.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=df970d1e45a97cb6c2c5c2301c017f86e1558956785; expires=Tue, 26-May-20 11:33:05 GMT; path=/; domain=.kettlesandmittens.com; HttpOnly laravel_session=eyJpdiI6ImVFOGRxRGNIMjE0cUdjdHZOKzh0N1E9PSIsInZhbHVlIjoiN0FWNVNseEc4RHp3QTZuTVRZR1wvdU9xa2syWGdcLzh2RnBPR1wvTkk1dWRDMnQrYnhvUG9EUTlNeXBSQ3F0UzllVjVua241OWpadXhaamRpb1IwYTlaSkE9PSIsIm1hYyI6ImM2YWMzMWVjMjM0NmVlMzc5ZThlZjU3NmNkOThjZDc1NTZkZmZlMjNhOGExYWVkOTUxZmM3ZGIyMzQyMGFjMDcifQ%3D%3D; expires=Mon, 03-Jun-2019 10:12:05 GMT; Max-Age=599940; path=/; httponly
Vary
Accept-Encoding
X-Powered-By
PHP/5.6.40
Cache-Control
no-cache
Server
cloudflare
CF-RAY
4dd7ac026878c29f-FRA
Content-Encoding
gzip

Redirect headers

Server
nginx/1.14.0 (Ubuntu)
Date
Mon, 27 May 2019 11:33:04 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Frame-Options
SAMEORIGIN
Location
http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
jquery.js
www.kettlesandmittens.com/js/ 		278 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/js/jquery.js
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7af2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Wed, 19 Oct 2016 13:11:54 GMT
Server
cloudflare
ETag
W/"5807711a-456ea"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac02fa76c29f-FRA
Expires
Mon, 27 May 2019 15:33:05 GMT
bootstrap.js
www.kettlesandmittens.com/js/ 		67 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/js/bootstrap.js
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7bf2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Wed, 19 Oct 2016 13:11:56 GMT
Server
cloudflare
ETag
W/"5807711c-10d1a"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac02faa8c281-FRA
Expires
Mon, 27 May 2019 15:33:05 GMT
jquery.cookie.js
www.kettlesandmittens.com/js/plugins/jqueryCookie/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/js/plugins/jqueryCookie/jquery.cookie.js
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7bf2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Wed, 19 Oct 2016 13:14:52 GMT
Server
cloudflare
ETag
W/"580771cc-c31"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac02fdc5beb0-FRA
Expires
Mon, 27 May 2019 15:33:05 GMT
survey
www.kettlesandmittens.com/survey/ 		16 B
793 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/survey/survey
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/js/jquery.js
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7bf2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
377034300d692835b36c8a10e163fd64fb748ec150e0d1c880172de423dce811

Request headers

Accept
text/html, */*; q=0.01
Origin
http://www.kettlesandmittens.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
Server
cloudflare
X-Powered-By
PHP/5.6.40
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
http://www.kettlesandmittens.com
Cache-Control
no-cache
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac038ea8beb0-FRA
survey
www.kettlesandmittens.com/survey/ 		14 B
791 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/survey/survey
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/js/jquery.js
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7af2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
930bd3dca9f0581f01df5c4d8e9e14e555eb55a9e1e4344f95927becf7e5b158

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Origin
http://www.kettlesandmittens.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
Server
cloudflare
X-Powered-By
PHP/5.6.40
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
http://www.kettlesandmittens.com
Cache-Control
no-cache
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac038cb4c29f-FRA
survey
www.kettlesandmittens.com/survey/ 		18 B
792 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.kettlesandmittens.com/survey/survey
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/js/jquery.js
Protocol
HTTP/1.1
Server
2606:4700:30::6818:7bf2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Origin
http://www.kettlesandmittens.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 27 May 2019 11:33:05 GMT
Content-Encoding
gzip
Server
cloudflare
X-Powered-By
PHP/5.6.40
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
http://www.kettlesandmittens.com
Cache-Control
no-cache
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
4dd7ac038c80c281-FRA
Primary Request subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/
Redirect Chain
  • http://www.kettlesandmittens.com/urlshort_test/uid_long=12807&tracking_id=29754279&token=QzWh6bZqPyVt9m5kUfyJOpW079nMlCkrvHMWeW2h&preview=0&subid_json=eyJzdWJpZDEiOiJlOnVSMDg0Z3hKcG9uNzBVU0ZGWHN1Vz...
  • https://www.luckyluke500.com/tracking/5a8c392631fc7238b2661361?src=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&k=5bee8d04ff538b49160250f5
  • https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&...
47 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Requested by
Host: www.kettlesandmittens.com
URL: http://www.kettlesandmittens.com/survey/koop/source=9219/subid=e:uR084gxJpon70USFFXsuW2dHmsL4bpPRGfPntTsUESY&subid2=watergunfight.com&subid3=9219/nrp=g5gf7yh1z3p5vcipw2ugno1jd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
78c9eec35babb53b0f9f4312ab06392af8da070b8e7d4f47d450c23671227f0a

Request headers

:method
GET
:authority
www.buyingnewsoul.com
:scheme
https
:path
/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 27 May 2019 11:33:06 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=ddd318fd3995f1ab2187a9916c5d560f91558956786; expires=Tue, 26-May-20 11:33:06 GMT; path=/; domain=.buyingnewsoul.com; HttpOnly laravel_session=eyJpdiI6ImxoaEpvbnJxTlRYS1lMWnMrbTg5ZWc9PSIsInZhbHVlIjoiWVwvZTdTUFljTnpoVGRaSDFwOVRrRmR3NTlhc3Vqb2hPeHNOMkt2NlNleGFhMTNWbHV4Qm5lOERRaGo3bm5PWVpoVHF2aXlqdXBBNzZRQVFmektjYVhRPT0iLCJtYWMiOiJjYWJmZDZkZGZjZTBmZWM1ZTI5YjI5ZjczNmEwZmE3ODlhYzVkM2M4ZjI3OGY2NDY1NmYyZTBlNDNjOTFmMjlkIn0%3D; expires=Mon, 03-Jun-2019 10:12:06 GMT; Max-Age=599940; path=/; httponly
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
cache-control
no-cache
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4dd7ac09c8e4645b-FRA
content-encoding
br

Redirect headers

status
302
date
Mon, 27 May 2019 11:33:06 GMT
set-cookie
__cfduid=d8664fe5346abf0edfc0195cdf21eb0521558956785; expires=Tue, 26-May-20 11:33:05 GMT; path=/; domain=.luckyluke500.com; HttpOnly c2lub3M=5cebcaf27ce7f91a6040bd70; Max-Age=595999; Path=/; Expires=Mon, 03 Jun 2019 09:06:25 GMT connect.sid=s%3AkmKH_5x_pFXq0j1pCK4bf3ZzUddIdxMA.vUkO1sMv4Wke9d64StOMObxi4ubmm5fYoH8llrhxq5I; Path=/; HttpOnly
x-powered-by
Express
access-control-allow-origin
*
location
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4dd7ac078a2ec277-FRA
backend.css
www.buyingnewsoul.com/css/ 		2 KB
744 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/css/backend.css
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b24eb9638260837328cb57cc88a42c7472eebcef0d23ad953073901d3bf41c6d

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:21:51 GMT
server
cloudflare
etag
W/"5807736f-8ab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af0645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
bootstrap.css
www.buyingnewsoul.com/css/ 		144 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/css/bootstrap.css
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef9c554bca3ce5b9f978b626ff8c3a441c0468af2599bdb4e9b6b32f6743f058

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:22:02 GMT
server
cloudflare
etag
W/"5807737a-23fe6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af2645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
jquery.js
www.buyingnewsoul.com/js/ 		278 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/js/jquery.js
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:54 GMT
server
cloudflare
etag
W/"5807711a-456ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af8645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
bootstrap.js
www.buyingnewsoul.com/js/ 		67 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/js/bootstrap.js
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:56 GMT
server
cloudflare
etag
W/"5807711c-10d1a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af9645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
jquery.cookie.js
www.buyingnewsoul.com/js/plugins/jqueryCookie/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/js/plugins/jqueryCookie/jquery.cookie.js
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:14:52 GMT
server
cloudflare
etag
W/"580771cc-c31"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2afa645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
simple_green4.css
www.buyingnewsoul.com/css/tpl_css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/css/tpl_css/simple_green4.css
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b336ee919770f24464a0092df7f6abc78383d7c7054174713908b4b079cdae2e

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 13 Mar 2018 09:55:45 GMT
server
cloudflare
etag
W/"5aa7a021-1e64"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af5645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
currency_cnd2.js
www.buyingnewsoul.com/custom_js/ 		1 KB
510 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/custom_js/currency_cnd2.js
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7793635b3a67ad46bb0f738f17326d1d4de4ef3e9a2a2ee4ac4e318a77dabd0

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Mar 2017 09:41:42 GMT
server
cloudflare
etag
W/"58d39856-5f4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2afb645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
css
fonts.googleapis.com/ 		3 KB
540 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Signika+Negative:400,600,700&subset=latin-ext
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
bcd5566fa10f5136b8696011aeead1304594441e672de88838ac761256d9a99b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 27 May 2019 11:33:06 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 27 May 2019 11:33:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Mon, 27 May 2019 11:33:06 GMT
blue_notys3.css
www.buyingnewsoul.com/css/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/css/blue_notys3.css
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae88db06df66fada6bd19661950611c6a69796df07f7a97991ec8db92c124af7

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Nov 2017 11:25:47 GMT
server
cloudflare
etag
W/"5a0c243b-2381"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4dd7ac0b2af6645b-FRA
expires
Mon, 27 May 2019 15:33:06 GMT
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cca5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
etag
W/"a5067802576549b3e0627521f03ee508"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=43200
cf-ray
4dd7ac0bb93b97ba-FRA
expires
Mon, 27 May 2019 23:33:06 GMT
prof_pic.png
www.buyingnewsoul.com/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/img/prof_pic.png
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de8025dffc57069d02c00a3640796dec23114f51af54c209b8fee272d8d0ecd6

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:34:34 GMT
server
cloudflare
etag
"5807766a-b0c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0b2afe645b-FRA
content-length
2828
expires
Thu, 24 May 2029 11:33:06 GMT
public.png
www.buyingnewsoul.com/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/img/public.png
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2897f490eaee6fd3c20a755839a30d051c2b4423a9cbc1af2a6d8a05c15e9154

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:32:44 GMT
server
cloudflare
etag
"580775fc-517"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0b6b2b645b-FRA
content-length
1303
expires
Thu, 24 May 2029 11:33:06 GMT
multifunnel_coop_logo_brand.png
s3-eu-central-1.amazonaws.com/igamingcloudstr/images/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3-eu-central-1.amazonaws.com/igamingcloudstr/images/multifunnel_coop_logo_brand.png
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.74.48 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e16dbda717a971b05cab85f3ad29058f6f318cf05e4b675fbd7ac0a3c304d208

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:07 GMT
Last-Modified
Tue, 20 Feb 2018 09:01:35 GMT
Server
AmazonS3
x-amz-request-id
23041A04953CFB70
ETag
"81dd2218e4d4b5da38d5d408f29d4dc6"
Content-Type
image/jpg
Accept-Ranges
bytes
Content-Length
21455
x-amz-id-2
g5SW3ev9zoCThaFmtZm58w4VCwnX0g3F8u2ga+ya+rhODCf4AmTyIvSevyS5ffKMo5d5yC4O9pE=
20180907144327_346346ipx.jpg
www.buyingnewsoul.com/uploads/products/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/products/20180907144327_346346ipx.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
103d1a1e940c735ada941334ed00d2098b4c8e5dc9c0696f75b0981a00f87439

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Fri, 07 Sep 2018 12:43:27 GMT
server
cloudflare
etag
"5b92726f-73c1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb98645b-FRA
content-length
29633
expires
Thu, 24 May 2029 11:33:06 GMT
20180907144642_34657_s9.jpg
www.buyingnewsoul.com/uploads/products/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/products/20180907144642_34657_s9.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
078a4cadc938a676dabb7d9d8d7497e0c381d9f01e7a01d881733e79b783962d

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Fri, 07 Sep 2018 12:46:42 GMT
server
cloudflare
etag
"5b927332-8c4e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb99645b-FRA
content-length
35918
expires
Thu, 24 May 2029 11:33:06 GMT
20180907144936_346346stv.jpg
www.buyingnewsoul.com/uploads/products/ 		52 KB
52 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/products/20180907144936_346346stv.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
403ce884e04f1d406a917fe0a22ebc4fc915d7412e09637a83eab99b98343656

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Fri, 07 Sep 2018 12:49:36 GMT
server
cloudflare
etag
"5b9273e0-cf22"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb9a645b-FRA
content-length
53026
expires
Thu, 24 May 2029 11:33:06 GMT
20180625144829_20180615124806_ikea.jpg
www.buyingnewsoul.com/uploads/products/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/products/20180625144829_20180615124806_ikea.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcfb389f9d65a58fa7346d671952fc24e7657d5b297d75c3d89114c352991f53

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jun 2018 12:48:29 GMT
server
cloudflare
etag
"5b30e49d-5e3f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb9b645b-FRA
content-length
24127
expires
Thu, 24 May 2029 11:33:06 GMT
20180625145357_se_20180615124806_shell.jpg
www.buyingnewsoul.com/uploads/products/ 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/products/20180625145357_se_20180615124806_shell.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2427ba49c6c344ee446b335e22613f03362650326afa9797dc04ea3577dd4a28

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jun 2018 12:53:57 GMT
server
cloudflare
etag
"5b30e5e5-5dc4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb9d645b-FRA
content-length
24004
expires
Thu, 24 May 2029 11:33:06 GMT
20170517113334_check.png
www.buyingnewsoul.com/uploads/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.buyingnewsoul.com/uploads/20170517113334_check.png
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
54685db07aca72f8729aafc7d545ad6cd2804361d9d1960a48c20a5bc02967f9

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
cf-cache-status
HIT
last-modified
Wed, 17 May 2017 09:33:34 GMT
server
cloudflare
etag
"591c18ee-5c5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4dd7ac0bdb9f645b-FRA
content-length
1477
expires
Thu, 24 May 2029 11:33:06 GMT
css
fonts.googleapis.com/ 		763 B
386 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:700
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
53f9e45881fbce7aaa137ed2b508c8605a51752b9045ad3e9fcf1425cc00531f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 27 May 2019 11:33:06 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 27 May 2019 11:33:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Mon, 27 May 2019 11:33:06 GMT
css
fonts.googleapis.com/ 		7 KB
700 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
8ee054df7771d01363eff93589b01ed200eb2350e27e0f619114cfded4e4f0d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 27 May 2019 11:33:06 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 27 May 2019 11:33:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Mon, 27 May 2019 11:33:06 GMT
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ 		212 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cca5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
etag
W/"c855e8eb5fbdafddfa15bc848b662c44"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=259200
cf-ray
4dd7ac0be99297ba-FRA
expires
Thu, 30 May 2019 11:33:06 GMT
CoopBG-min1.jpg
s3-eu-central-1.amazonaws.com/igamingcloudstr/images/ 		361 KB
362 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3-eu-central-1.amazonaws.com/igamingcloudstr/images/CoopBG-min1.jpg
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/js/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.74.48 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
ddfc2c606836767e32e7ceb26172fed85a966b2d5aea16b8f23209e8024ac917

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 27 May 2019 11:33:07 GMT
Last-Modified
Tue, 18 Sep 2018 13:45:24 GMT
Server
AmazonS3
x-amz-request-id
C0DE745414905BFF
ETag
"5ab4fcf52d5ff1fc8e882444fe80a272"
Content-Type
image/jpg
Accept-Ranges
bytes
Content-Length
370153
x-amz-id-2
pY+/PBR0bP624Rebbb2ITWADXMH9qfZU7S+lx19tAHdlUAvyOMs5S1Bxl/HGKIxEpERkvBQY20g=
E218_cfngu7HiRpPX3ZpNE4kY5zKYvWhr7vr5zc.woff2
fonts.gstatic.com/s/signikanegative/v9/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/signikanegative/v9/E218_cfngu7HiRpPX3ZpNE4kY5zKYvWhr7vr5zc.woff2
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/js/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
740c2953cfae463962da14bacc385c870c1579c70f5325053822cb916e642503
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Signika+Negative:400,600,700&subset=latin-ext
Origin
https://www.buyingnewsoul.com

Response headers

date
Fri, 08 Mar 2019 22:04:23 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Jan 2019 19:42:12 GMT
server
sffe
age
6874123
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12060
x-xss-protection
1; mode=block
expires
Sat, 07 Mar 2020 22:04:23 GMT
survey
www.buyingnewsoul.com/survey/ 		1 KB
994 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.buyingnewsoul.com/survey/survey
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/js/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a7bc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.40
Resource Hash
16fa339c4a38ed5bbf7f0b0a3cb47c9c5bc86a5751fbadb5343870d3e6c40d20

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Origin
https://www.buyingnewsoul.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 27 May 2019 11:33:06 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.40
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.buyingnewsoul.com
cache-control
no-cache
cf-ray
4dd7ac0c5c79645b-FRA
E217_cfngu7HiRpPX3ZpNE4kY5zKak6EupbJ6h3hTAo.woff2
fonts.gstatic.com/s/signikanegative/v9/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/signikanegative/v9/E217_cfngu7HiRpPX3ZpNE4kY5zKak6EupbJ6h3hTAo.woff2
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/js/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a78c46e973c9d649678f9211d3f0bd816dd3ea8ce4fac2cf54a54c9c6bb7df06
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Signika+Negative:400,600,700&subset=latin-ext
Origin
https://www.buyingnewsoul.com

Response headers

date
Fri, 08 Mar 2019 22:58:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Jan 2019 19:42:15 GMT
server
sffe
age
6870880
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12084
x-xss-protection
1; mode=block
expires
Sat, 07 Mar 2020 22:58:26 GMT
E217_cfngu7HiRpPX3ZpNE4kY5zKaiqFupbJ6h3hTAo.woff2
fonts.gstatic.com/s/signikanegative/v9/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/signikanegative/v9/E217_cfngu7HiRpPX3ZpNE4kY5zKaiqFupbJ6h3hTAo.woff2
Requested by
Host: www.buyingnewsoul.com
URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8d6fe4cb3c9d104d6f7cf53e774c8f0bf9e8357edc3869d14e7c92dfffa71b9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Signika+Negative:400,600,700&subset=latin-ext
Origin
https://www.buyingnewsoul.com

Response headers

date
Sun, 10 Mar 2019 02:25:35 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Jan 2019 19:42:29 GMT
server
sffe
age
6772051
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11960
x-xss-protection
1; mode=block
expires
Mon, 09 Mar 2020 02:25:35 GMT
web
onesignal.com/api/v1/sync/1c98c6a6-7598-4fa2-8353-35fc9cd574b5/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/sync/1c98c6a6-7598-4fa2-8353-35fc9cd574b5/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cca5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Phusion Passenger 5.3.4
Resource Hash
29b0015138d46914449aaec7ac73e4a049ee226ddd4f2c4dda9f08fd1ccfd311
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 May 2019 11:33:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Phusion Passenger 5.3.4
status
200, 200 OK
vary
Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
34049589-5474-423f-9401-baf1850f8ea9
x-runtime
0.133444
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=300
cf-ray
4dd7ac0d4bd197ba-FRA
access-control-allow-headers
SDK-Version
expires
Mon, 27 May 2019 11:38:07 GMT
webPushAnalytics
onesignal.com/ Frame 0D81 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/webPushAnalytics
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cca5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
onesignal.com
:scheme
https
:path
/webPushAnalytics
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]]

Response headers

status
200
date
Mon, 27 May 2019 11:33:09 GMT
content-type
text/html
set-cookie
__cfduid=dcee56261f6ef76e79f246e93b413ad9d1558956789; expires=Tue, 26-May-20 11:33:09 GMT; path=/; domain=.onesignal.com; HttpOnly
last-modified
Tue, 21 May 2019 21:42:30 GMT
cf-cache-status
HIT
expires
Mon, 27 May 2019 12:33:09 GMT
cache-control
public, max-age=3600
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
4dd7ac1dcd7097ba-FRA
content-encoding
gzip

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| jQuery1113013071000132472066 function| countdown function| OneSignal number| numRight number| numQuestions object| answerDiv object| questionDiv object| numRightSpan object| numQuestionsSpan function| displayQuestion function| startTimer function| rand function| myRedirectTimer function| stopRedirectTimer function| show_answer_btn number| checkTimer string| survey_id object| btn number| __oneSignalSdkLoadCount function| __jp0 number| interval_unit number| randomStep

4 Cookies

Domain/Path Name / Value
www.buyingnewsoul.com/ Name: laravel_session
Value: eyJpdiI6IjVwSE5GV0FOalpoQzhMbERoQ29FckE9PSIsInZhbHVlIjoiOEpMVEpyMUdGaERhMnJ0UGZrK05KVmFxNGwzNDl1YmNZeUpMVXFcL2dhaDUzRUo3bXpPSFE4S3dsN3Z3N1NVb0sxZXNoRWx6ZkNnWUtqM21mSEVielNnPT0iLCJtYWMiOiI4YmU1MjcxNjZlYmFlN2Q3YTQyZDA3OTAwZjUyODhiNDlmZWNlNjRhN2VjMDQ2NjRiNzllOTI4MzM3MDNiNWQxIn0%3D
.buyingnewsoul.com/ Name: __cfduid
Value: dee1bd3e7b95a1d4a5cbb898d4931787d1558956786
www.buyingnewsoul.com/ Name: survey_id_13007
Value: true
www.buyingnewsoul.com/ Name: b2ZmZXJXYWxs
Value: %7B%22campaign%22%3A%2211183%22%2C%22survey%22%3A%2213007%22%2C%22source%22%3A%22565c4b03c479a2fe76159a1b%22%2C%22subid%22%3A%22subid%3D565c4b03c479a2fe76159a1b%26s1%3D%26s2%3D5juS9%26s3%3D%26s4%3D%26s5%3D%26parent%3D5bee8d04ff538b49160250f5%26creative%3D%26extuid%3D%5B%5Bexternal_uid%5D%5D%22%2C%22firstSession%22%3A%22gyKSBkCbFUkCUoQ0PBVwpFdeFUKB78h5xHpcgO8q_11183%22%7D

3 Console Messages

Source Level URL
Text
console-api log URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]](Line 656)
Message:
processed: s1- s2-5juS9 s3- s4- s5- parent-5bee8d04ff538b49160250f5 creative- extuid-[[external_uid]]
console-api info URL: https://www.buyingnewsoul.com/survey/svara_3_valfria_vinster_11183/source=565c4b03c479a2fe76159a1b/subid=565c4b03c479a2fe76159a1b&s1=&s2=5juS9&s3=&s4=&s5=&parent=5bee8d04ff538b49160250f5&creative=&extuid=[[external_uid]](Line 656)
Message:
TP init
console-api error URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703(Line 1)
Message:
TypeError: Cannot read property 'permission' of undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.onesignal.com
fonts.googleapis.com
fonts.gstatic.com
link.watergunfight.com
onesignal.com
s3-eu-central-1.amazonaws.com
www.buyingnewsoul.com
www.kettlesandmittens.com
www.luckyluke500.com
193.24.232.33
2606:4700:30::6818:7af2
2606:4700:30::6818:7bf2
2606:4700:30::681b:a7bc
2606:4700:30::681c:1c3
2606:4700::6810:cca5
2a00:1450:4001:808::2003
2a00:1450:4001:819::200a
52.219.74.48
078a4cadc938a676dabb7d9d8d7497e0c381d9f01e7a01d881733e79b783962d
0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b
103d1a1e940c735ada941334ed00d2098b4c8e5dc9c0696f75b0981a00f87439
16fa339c4a38ed5bbf7f0b0a3cb47c9c5bc86a5751fbadb5343870d3e6c40d20
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
2427ba49c6c344ee446b335e22613f03362650326afa9797dc04ea3577dd4a28
2897f490eaee6fd3c20a755839a30d051c2b4423a9cbc1af2a6d8a05c15e9154
29b0015138d46914449aaec7ac73e4a049ee226ddd4f2c4dda9f08fd1ccfd311
377034300d692835b36c8a10e163fd64fb748ec150e0d1c880172de423dce811
403ce884e04f1d406a917fe0a22ebc4fc915d7412e09637a83eab99b98343656
53f9e45881fbce7aaa137ed2b508c8605a51752b9045ad3e9fcf1425cc00531f
54685db07aca72f8729aafc7d545ad6cd2804361d9d1960a48c20a5bc02967f9
63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50
740c2953cfae463962da14bacc385c870c1579c70f5325053822cb916e642503
78c9eec35babb53b0f9f4312ab06392af8da070b8e7d4f47d450c23671227f0a
8d6fe4cb3c9d104d6f7cf53e774c8f0bf9e8357edc3869d14e7c92dfffa71b9e
8ee054df7771d01363eff93589b01ed200eb2350e27e0f619114cfded4e4f0d5
930bd3dca9f0581f01df5c4d8e9e14e555eb55a9e1e4344f95927becf7e5b158
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360
a78c46e973c9d649678f9211d3f0bd816dd3ea8ce4fac2cf54a54c9c6bb7df06
ae88db06df66fada6bd19661950611c6a69796df07f7a97991ec8db92c124af7
b24eb9638260837328cb57cc88a42c7472eebcef0d23ad953073901d3bf41c6d
b336ee919770f24464a0092df7f6abc78383d7c7054174713908b4b079cdae2e
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
bcd5566fa10f5136b8696011aeead1304594441e672de88838ac761256d9a99b
d7793635b3a67ad46bb0f738f17326d1d4de4ef3e9a2a2ee4ac4e318a77dabd0
dcfb389f9d65a58fa7346d671952fc24e7657d5b297d75c3d89114c352991f53
ddfc2c606836767e32e7ceb26172fed85a966b2d5aea16b8f23209e8024ac917
de8025dffc57069d02c00a3640796dec23114f51af54c209b8fee272d8d0ecd6
e16dbda717a971b05cab85f3ad29058f6f318cf05e4b675fbd7ac0a3c304d208
e47bc43a3209613d5acabe59704dce0f1f026476642d50e7d9829f8299318a48
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4
ef9c554bca3ce5b9f978b626ff8c3a441c0468af2599bdb4e9b6b32f6743f058