urlscan.io logo urlscan.io
SecurityTrails logo

heavytunas.com Open in urlscan Pro
116.203.124.201  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hehgisewffxhti.com/
Effective URL: https://heavytunas.com/uk/
Submission: On May 31 via manual from IT — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 4 countries across 10 domains to perform 16 HTTP transactions. The main IP is 116.203.124.201, located in Germany and belongs to HETZNER-AS, DE. The main domain is heavytunas.com. The Cisco Umbrella rank of the primary domain is 527040.
TLS certificate: Issued by R3 on April 19th 2022. Valid for: 3 months.
This is the only time heavytunas.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 139.45.197.151 9002 (RETN-AS)
1 139.45.197.236 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
8 116.203.124.201 24940 (HETZNER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 161.35.78.172 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2 217.147.127.42 201071 (VISL-IE)
1 2 143.204.98.29 16509 (AMAZON-02)
1 2 143.204.98.59 16509 (AMAZON-02)
16 9
1    139.45.197.151 (United Kingdom)

ASN9002 (RETN-AS, GB)
hehgisewffxhti.com
1    139.45.197.236 (United Kingdom)

ASN9002 (RETN-AS, GB)
yonxatuor.com
1    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
8    116.203.124.201 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.201.124.203.116.clients.your-server.de
heavytunas.com
1    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    161.35.78.172 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: securely-send.com-fra1
www.securely-send.com
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    217.147.127.42 (Gibraltar)

ASN201071 (VISL-IE, GI)
PTR: www.aff-handler.com
ic.aff-handler.com
2    143.204.98.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-29.fra50.r.cloudfront.net
www.888casino.com
2    143.204.98.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-59.fra50.r.cloudfront.net
play-www.777.com
Apex Domain
Subdomains		 Transfer
8 heavytunas.com
heavytunas.com — Cisco Umbrella Rank: 527040
631 KB
2 777.com
play-www.777.com — Cisco Umbrella Rank: 591019
871 B
2 888casino.com
www.888casino.com — Cisco Umbrella Rank: 145645
868 B
2 aff-handler.com
ic.aff-handler.com — Cisco Umbrella Rank: 202897
1 KB
1 gstatic.com
fonts.gstatic.com
31 KB
1 securely-send.com
www.securely-send.com — Cisco Umbrella Rank: 433259
20 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42
1 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 11060
505 B
1 yonxatuor.com
yonxatuor.com — Cisco Umbrella Rank: 477898
2 KB
1 hehgisewffxhti.com
hehgisewffxhti.com
2 KB
16 10
Domain Requested by
8 heavytunas.com yonxatuor.com
heavytunas.com
2 play-www.777.com 1 redirects hehgisewffxhti.com
2 www.888casino.com 1 redirects hehgisewffxhti.com
2 ic.aff-handler.com 2 redirects
1 fonts.gstatic.com fonts.googleapis.com
1 www.securely-send.com heavytunas.com
1 fonts.googleapis.com heavytunas.com
1 my.rtmark.net yonxatuor.com
1 yonxatuor.com hehgisewffxhti.com
1 hehgisewffxhti.com
16 10

This site contains links to these domains. Also see Links.

Domain
www.begambleaware.org
www.gamblingtherapy.org
Subject Issuer Validity Valid
*.rtmark.net
Sectigo RSA Domain Validation Secure Server CA		 2021-11-20 -
2022-11-26		 a year crt.sh
heavytunas.com
R3		 2022-04-19 -
2022-07-18		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
securely-send.com
R3		 2022-04-08 -
2022-07-07		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
*.888casino.com
Amazon		 2021-11-02 -
2022-12-01		 a year crt.sh

This page contains 3 frames:

Primary Page: https://heavytunas.com/uk/
Frame ID: 6981CB48BEF772009C36DEE695CF53DF
Requests: 14 HTTP requests in this frame

Frame: https://www.888casino.com/exclusive-mob/double-offer.htm?utm_campaign=100138643_1856981_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
Frame ID: 54826EF26930BC29F089A09380D1BBFA
Requests: 1 HTTP requests in this frame

Frame: https://play-www.777.com/exclusive-mob/double-offer-new.htm?utm_campaign=100138643_1853319_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
Frame ID: 76D7F85B6B1973E56AC474AA71BB2ECE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

The History of Casino

Page URL History Show full URLs

  1. http://hehgisewffxhti.com/ Page URL
  2. http://yonxatuor.com/4/2627325 Page URL
  3. https://heavytunas.com/uk/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

16
Requests

88 %
HTTPS

20 %
IPv6

10
Domains

10
Subdomains

9
IPs

4
Countries

687 kB
Transfer

696 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hehgisewffxhti.com/ Page URL
  2. http://yonxatuor.com/4/2627325 Page URL
  3. https://heavytunas.com/uk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://ic.aff-handler.com/C/43258?sr=1856981 HTTP 302
  • https://www.888casino.com/exclusive-mob/double-offer.htm?sr=1856981&mm_id=43258&utm_source=aff&utm_medium=casap&utm_content=100138643&utm_campaign=100138643_1856981_nodescription HTTP 301
  • https://www.888casino.com/exclusive-mob/double-offer.htm?utm_campaign=100138643_1856981_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
Request Chain 14
  • https://ic.aff-handler.com/C/40667?sr=1853319 HTTP 302
  • https://play-www.777.com/exclusive-mob/double-offer-new.htm?sr=1853319&mm_id=40667&utm_source=aff&utm_medium=casap&utm_content=100138643&utm_campaign=100138643_1853319_nodescription HTTP 301
  • https://play-www.777.com/exclusive-mob/double-offer-new.htm?utm_campaign=100138643_1853319_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
hehgisewffxhti.com/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://hehgisewffxhti.com/
Protocol
HTTP/1.1
Server
139.45.197.151 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4ec4ada6c5eab89cfd518732165d91816917cb16c8565e800ed8437ad6ac6800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 31 May 2022 06:55:43 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
2627325
yonxatuor.com/4/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://yonxatuor.com/4/2627325
Requested by
Host: hehgisewffxhti.com
URL: http://hehgisewffxhti.com/
Protocol
HTTP/1.1
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://hehgisewffxhti.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Accept, Content-Type, Content-Length, Accept-Encoding Accept, Content-Type, Content-Length, Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Origin
* *
Access-Control-Max-Age
86400
Cache-Control
no-transform, no-store, no-cache, must-revalidate, max-age=0 no-store, no-cache, must-revalidate, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf8
Date
Tue, 31 May 2022 06:55:44 GMT
Expires
Tue, 11 Jan 1994 10:00:00 GMT Mon, 26 Jul 1997 05:00:00 GMT
Link
<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://heavytunas.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
Pragma
no-cache no-cache
Server
nginx
Timing-Allow-Origin
*
Transfer-Encoding
chunked
X-Trace-Id
21b90f15de96b2ac7b9ced1a2500f5c3
img.gif
my.rtmark.net/ 		43 B
505 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=13d5500e1ff14dcfbdee191097e4f248
Requested by
Host: yonxatuor.com
URL: http://yonxatuor.com/4/2627325
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
x-content-type-options
nosniff
server
nginx
strict-transport-security
max-age=1
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
http://yonxatuor.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
Primary Request /
heavytunas.com/uk/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://heavytunas.com/uk/
Requested by
Host: yonxatuor.com
URL: http://yonxatuor.com/4/2627325
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
c60ed9b7c0822bacb6cdf674bea6c2e967449ad5bec654476dd1ef87deacd87f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Tue, 31 May 2022 06:55:44 GMT
etag
W/"62611959-eae"
last-modified
Thu, 21 Apr 2022 08:44:09 GMT
server
nginx
css2
fonts.googleapis.com/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:wght@300;400;500;600&display=swap
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
713140fdfacd94b57b4a32e0b3958cf9b085e2a459306cd434d3a5cc633b0600
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 31 May 2022 06:18:57 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 31 May 2022 06:55:44 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 31 May 2022 06:55:44 GMT
style.css
heavytunas.com/uk/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heavytunas.com/uk/style.css
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
6d5043e610fa88e765c2409ecaccd6e76c49e2a34495cbcad92db1491d293263

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:14 GMT
server
nginx
etag
"6214d71a-91c"
content-type
text/css
cache-control
max-age=604800
accept-ranges
bytes
content-length
2332
expires
Tue, 07 Jun 2022 06:55:44 GMT
pu_cd_uk_pa_cs_vold.js
www.securely-send.com/storage/ 		20 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securely-send.com/storage/pu_cd_uk_pa_cs_vold.js
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
161.35.78.172 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
securely-send.com-fra1
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
a19348c064caef1ba011a48fa3c56006031fab760634083530576f67b92e428d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 May 2022 11:51:22 GMT
server
nginx/1.18.0 (Ubuntu)
etag
"62823aba-4f46"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
accept-ranges
bytes
content-length
20294
x-xss-protection
1; mode=block
logo.png
heavytunas.com/uk/ 		947 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/logo.png
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
b7abb33953367ca8cbd7992cfac8d74385407227e3de75105ee9cfbf38070a41

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:14 GMT
server
nginx
etag
"6214d71a-3b3"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
947
expires
Thu, 30 Jun 2022 06:55:44 GMT
begambleaware.jpg
heavytunas.com/uk/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/begambleaware.jpg
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
0e154a70318b723da442bd7eba4d4f955e17a72cfe430a6e55455f4e7be5978c

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:13 GMT
server
nginx
etag
"6214d719-6e3"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1763
expires
Thu, 30 Jun 2022 06:55:44 GMT
gambling-therapy.jpg
heavytunas.com/uk/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/gambling-therapy.jpg
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
8bbf132b1eafb66efa9a77b4899646ef9669e02e1bf6f318438f6ba0bcde3eac

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:14 GMT
server
nginx
etag
"6214d71a-cb0"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3248
expires
Thu, 30 Jun 2022 06:55:44 GMT
20.png
heavytunas.com/uk/ 		548 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/20.png
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
content-encoding
gzip
server
nginx
content-type
text/html
bg.jpg
heavytunas.com/uk/ 		443 KB
443 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/bg.jpg
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
feb61a3ba4977daab982264b4373739a85f5da55bdad0dd6226cfd8b5eeb1ef5

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:14 GMT
server
nginx
etag
"6214d71a-6eb2d"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
453421
expires
Thu, 30 Jun 2022 06:55:44 GMT
hero-bg.jpg
heavytunas.com/uk/ 		176 KB
176 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavytunas.com/uk/hero-bg.jpg
Requested by
Host: heavytunas.com
URL: https://heavytunas.com/uk/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.124.201 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.201.124.203.116.clients.your-server.de
Software
nginx /
Resource Hash
c02f6746d153b518672232c92ee0ff26977a2a3f793b3f4c9462420d701f5b51

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://heavytunas.com/uk/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 06:55:44 GMT
last-modified
Tue, 22 Feb 2022 12:29:14 GMT
server
nginx
etag
"6214d71a-2c018"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
180248
expires
Thu, 30 Jun 2022 06:55:44 GMT
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v24/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v24/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@300;400;500;600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://heavytunas.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 24 May 2022 17:07:05 GMT
x-content-type-options
nosniff
age
568119
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30876
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 14:37:35 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 May 2023 17:07:05 GMT
double-offer.htm
www.888casino.com/exclusive-mob/ Frame 5482
Redirect Chain
  • https://ic.aff-handler.com/C/43258?sr=1856981
  • https://www.888casino.com/exclusive-mob/double-offer.htm?sr=1856981&mm_id=43258&utm_source=aff&utm_medium=casap&utm_content=100138643&utm_campaign=100138643_1856981_nodescription
  • https://www.888casino.com/exclusive-mob/double-offer.htm?utm_campaign=100138643_1856981_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.888casino.com/exclusive-mob/double-offer.htm?utm_campaign=100138643_1856981_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
Requested by
Host: hehgisewffxhti.com
URL: http://hehgisewffxhti.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-29.fra50.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

apigw-requestid
S-pNyj0eDoEEMuw=
content-encoding
br
content-security-policy
frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com
content-type
text/html; charset=utf-8
date
Tue, 31 May 2022 06:55:46 GMT
p3p
CP="Read our privacy policy at http://www.888.com/security-and-privacy/privacy-policy.htm"
srv
44302334
vary
Accept-Encoding,User-Agent
via
1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-id
YqZpBHaON-UV4CGOUwO7uZTyB6ibBbS21tCCTMGVXEXyJ7sdpAjMCQ==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
x-wcs-correlation-id
YqZpBHaON-UV4CGOUwO7uZTyB6ibBbS21tCCTMGVXEXyJ7sdpAjMCQ==

Redirect headers

apigw-requestid
S-pNwixbDoEEMUw=
content-length
0
date
Tue, 31 May 2022 06:55:45 GMT
location
https://www.888casino.com/exclusive-mob/double-offer.htm?utm_campaign=100138643_1856981_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
via
1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-id
Ml0ZdGJ5ztaNW3-EAoEv8pwd60OdqYC3DkcXlyt1fg1z6m475liREg==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
x-wcs-correlation-id
Ml0ZdGJ5ztaNW3-EAoEv8pwd60OdqYC3DkcXlyt1fg1z6m475liREg==
double-offer-new.htm
play-www.777.com/exclusive-mob/ Frame 76D7
Redirect Chain
  • https://ic.aff-handler.com/C/40667?sr=1853319
  • https://play-www.777.com/exclusive-mob/double-offer-new.htm?sr=1853319&mm_id=40667&utm_source=aff&utm_medium=casap&utm_content=100138643&utm_campaign=100138643_1853319_nodescription
  • https://play-www.777.com/exclusive-mob/double-offer-new.htm?utm_campaign=100138643_1853319_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://play-www.777.com/exclusive-mob/double-offer-new.htm?utm_campaign=100138643_1853319_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
Requested by
Host: hehgisewffxhti.com
URL: http://hehgisewffxhti.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-59.fra50.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

apigw-requestid
S-pNyge7joEEMxA=
content-encoding
br
content-security-policy
frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com
content-type
text/html; charset=utf-8
date
Tue, 31 May 2022 06:55:45 GMT
p3p
CP="Read our privacy policy at http://www.888.com/security-and-privacy/privacy-policy.htm"
srv
44301334
vary
Accept-Encoding,User-Agent
via
1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
x-amz-cf-id
eCyTspJUBLnCkhhuOX8usSjQVGt6_ZKoRnpNqe46aBnHj29PSYB2cA==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
x-wcs-correlation-id
eCyTspJUBLnCkhhuOX8usSjQVGt6_ZKoRnpNqe46aBnHj29PSYB2cA==

Redirect headers

apigw-requestid
S-pNwiLNDoEEJcg=
content-length
0
date
Tue, 31 May 2022 06:55:45 GMT
location
https://play-www.777.com/exclusive-mob/double-offer-new.htm?utm_campaign=100138643_1853319_nodescription&utm_content=100138643&utm_medium=casap&utm_source=aff
via
1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
x-amz-cf-id
7sCOzbXxOhMvugEK5C0gSQ-oG2MH74MxSjO2dSXzGwhPzISgRSLOqA==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
x-wcs-correlation-id
7sCOzbXxOhMvugEK5C0gSQ-oG2MH74MxSjO2dSXzGwhPzISgRSLOqA==

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| _0xc36e function| _0xe71c

7 Cookies

Domain/Path Name / Value
yonxatuor.com/ Name: OAID
Value: 13d5500e1ff14dcfbdee191097e4f248
yonxatuor.com/ Name: oaidts
Value: 1653980144
my.rtmark.net/ Name: ID
Value: 13d5500e1ff14dcfbdee191097e4f248
ic.aff-handler.com/ Name: uffiliate_click_43258_1856981_
Value: uffiliate_click_43258_1856981_
ic.aff-handler.com/ Name: uffiliate_click_40667_1853319_
Value: uffiliate_click_40667_1853319_
.777.com/ Name: 888Cookie
Value: isftd%3Dfalse%26isreal%3Dfalse%26lang%3Den%26OSR%3D1853319%26RefType%3DNoReferrer%26TestData%3D%7B%22country%22%3A%22gbr%22%2C%22mm_id%22%3A%2240667%22%2C%22orig-lp%22%3A%22https%3A%2F%2Fplay-www.777.com%2Fexclusive-mob%2Fdouble-offer-new.htm%22%2C%22referrer%22%3A%22NULL%22%2C%22utm_campaign%22%3A%22100138643_1853319_nodescription%22%2C%22utm_content%22%3A%22100138643%22%2C%22utm_medium%22%3A%22casap%22%2C%22utm_source%22%3A%22aff%22%7D
.888casino.com/ Name: 888Cookie
Value: isftd%3Dfalse%26isreal%3Dfalse%26lang%3Den%26OSR%3D1856981%26RefType%3DNoReferrer%26TestData%3D%7B%22country%22%3A%22gbr%22%2C%22mm_id%22%3A%2243258%22%2C%22orig-lp%22%3A%22https%3A%2F%2Fwww.888casino.com%2Fexclusive-mob%2Fdouble-offer.htm%22%2C%22referrer%22%3A%22NULL%22%2C%22utm_campaign%22%3A%22100138643_1856981_nodescription%22%2C%22utm_content%22%3A%22100138643%22%2C%22utm_medium%22%3A%22casap%22%2C%22utm_source%22%3A%22aff%22%7D

3 Console Messages

Source Level URL
Text
network error URL: https://heavytunas.com/uk/20.png
Message:
Failed to load resource: the server responded with a status of 404 ()
security error
Message:
Refused to frame 'https://play-www.777.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com".
security error
Message:
Refused to frame 'https://www.888casino.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.genesazrak.com *.888casinoarabic.net *.arabiccasino888.com *.casinoarabic888.com *.casinoarabic-888.com *.888-casinoarabic.com *.888casino-arabic.com http://wrapper.safe-installation.com/ https://wrapper.safe-installation.com/ http://localhost:* https://localhost:* *.bingosys.net *.secured-igaming-usa.com *.888.pt *.sisportsbook.com *.888poker.de *.888slots.de *.safe-iplay.com *.safe-installation.com *.payoutscentral.com *.triple8holdem.com *.888.com *.secured-qa.com *.secured-registration.com *.secureutils.com *.images4us.com *.onlinepersonalmessages.com *.888sport.com *.888sport.es *.888sport.it *.888sport.dk *.888sport.ro *.888sport.se *.888sport.us *.888sport.de *.777.com *.personalinfoonline.com *.888.de *.888casino.com *.888poker.com *.888casino.dk *.888poker.dk *.888.de *.888casino.ro *.888poker.ro *.888casino.se *.888poker.se *.888casino.es *.888poker.es *.888casino.it *.888poker.it *.888casino.us *.888poker.us *.888ladies.com *.888.pt cmsp *.harrahscasino.com *.wsop.com *.delawarepark.com *.doverdowns.com *.harringtongamingonline.com *.secured-igaming-services.com *.secured-igaming-usa.com *.igaming-services.com *.888.ca *.888casino.ca *.888poker.ca *.888sport.ca *.888.nl *.888casino.nl *.888poker.nl *.888sport.nl *.ar-888-casino.com *.888casino-ar.com *.ar888-casino.com *.arab888-casino.com *.casinoelarab-888.com *.alarab-888casino.com *.casinoalarab-888.com *.888casino-alarab.com *.888casino-arabian.com *.arabian-888casino.com *.888-casino-arabian.com *.888-casino-alarab.com".