1win.com Open in urlscan Pro
190.115.24.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://romaestate.co/link-alternatif-toto12/
Effective URL:
https://1win.com/
Submission Tags: @phish_report
Submission: On September 15 via api (September 15th 2024, 9:45:10 pm UTC) from FI — Scanned from FI

Summary HTTP 71 Redirects Behaviour Indicators

Summary

This website contacted 20 IPs in 7 countries across 15 domains to perform 71 HTTP transactions. The main IP is 190.115.24.78, located in Belize and belongs to IQWEB, AE. The main domain is 1win.com.
TLS certificate: Issued by R11 on September 3rd 2024. Valid for: 3 months.

This is the only time 1win.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 5	172.67.195.139 172.67.195.139	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	172.67.146.213 172.67.146.213	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	190.115.24.78 190.115.24.78	59692 (IQWEB) (IQWEB)
29	154.197.121.128 154.197.121.128	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
4	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
2	172.217.18.100 172.217.18.100	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	18.66.102.11 18.66.102.11	16509 (AMAZON-02) (AMAZON-02)
4 9	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
2 4	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:36::181	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1d::9c	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
1	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
1	13.32.27.107 13.32.27.107	16509 (AMAZON-02) (AMAZON-02)
1	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
2	34.215.105.9 34.215.105.9	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
71	20

5 172.67.195.139 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

romaestate.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.146.213 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cheaptitles.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

naturewildlife.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 190.115.24.78 (Belize)

ASN59692 (IQWEB, AE)
PTR: ddos-guard.net

1win.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 154.197.121.128 (Seychelles)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

v1.bundlecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.194.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

api.lab.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-11.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.181.230 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

12572451.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
12688802.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:36::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1d::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

www.google.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-107.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.215.105.9 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-215-105-9.us-west-2.compute.amazonaws.com

api2.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	bundlecdn.com v1.bundlecdn.com — Cisco Umbrella Rank: 309916	702 KB
10	doubleclick.net 2 redirects 12572451.fls.doubleclick.net — Cisco Umbrella Rank: 410574 stats.g.doubleclick.net — Cisco Umbrella Rank: 130 td.doubleclick.net — Cisco Umbrella Rank: 189 12688802.fls.doubleclick.net — Cisco Umbrella Rank: 429755 ad.doubleclick.net — Cisco Umbrella Rank: 153 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45	4 KB
6	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 8922	4 KB
6	1win.com 1win.com Failed	214 KB
5	romaestate.co 2 redirects romaestate.co	8 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	374 KB
4	amplitude.com api.lab.amplitude.com — Cisco Umbrella Rank: 4269 api2.amplitude.com — Cisco Umbrella Rank: 1195	989 B
3	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 4140	71 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 140	1 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 816 script.hotjar.com — Cisco Umbrella Rank: 1029	61 KB
1	google.fi www.google.fi — Cisco Umbrella Rank: 38754	455 B
1	google.ru www.google.ru — Cisco Umbrella Rank: 15049	63 B
1	gstatic.com www.gstatic.com	214 KB
1	naturewildlife.id 1 redirects naturewildlife.id	472 B
1	cheaptitles.co.nz 1 redirects cheaptitles.co.nz	472 B
71	15

	Domain	Requested by
29	v1.bundlecdn.com	1win.com v1.bundlecdn.com
6	mc.yandex.com	3 redirects mc.yandex.ru
6	1win.com	1win.com v1.bundlecdn.com
5	romaestate.co	2 redirects romaestate.co
4	www.googletagmanager.com	romaestate.co www.googletagmanager.com
3	td.doubleclick.net	www.googletagmanager.com
3	mc.yandex.ru	1 redirects romaestate.co
2	api2.amplitude.com	v1.bundlecdn.com
2	12688802.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	12572451.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.google.com	v1.bundlecdn.com
2	api.lab.amplitude.com	v1.bundlecdn.com
1	www.google.fi
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	ad.doubleclick.net
1	www.google.ru
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	static.hotjar.com	romaestate.co
1	www.gstatic.com	www.google.com
1	naturewildlife.id	1 redirects
1	cheaptitles.co.nz	1 redirects
71	23

This site contains no links.

Subject Issuer	Validity	Valid
romaestate.co WE1	`2024-09-11` - `2024-12-10`	3 months	crt.sh
1win.com R11	`2024-09-03` - `2024-12-02`	3 months	crt.sh
v1.bundlecdn.com WE1	`2024-07-24` - `2024-10-22`	3 months	crt.sh
*.lab.amplitude.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-11-29` - `2024-12-30`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh
*.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.com.ru WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2024-01-31` - `2025-03-02`	a year	crt.sh
*.google.fi WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://1win.com/
Frame ID: 97767F71992EB6F55662BF815EC2CE8E
Requests: 64 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5390742935121.828
Frame ID: 513EE7937A61340CA686605B7D3CBDFC
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=1982569574.1726436706&gtm=45je4990v894728184z89182494087za200zb9182494087&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=367215079
Frame ID: A05D0D37DA17199C4AE2D2A0EDF74731
Requests: 1 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F
Frame ID: A8F3D181CD890122E803A4490FFBDD0E
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F
Frame ID: E56586D7F5B6A33A33591D1849A432F4
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/16482547739?random=1726436705691&cv=11&fst=1726436705691&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Fromaestate.co%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=78705514.1726436705&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 94A977E57977157EF72245E622D7224D
Requests: 1 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: 025BDFE58C32F6F700C7747AB879CFF3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1win

Page URL History Show full URLs

https://romaestate.co/link-alternatif-toto12/ Page URL
https://romaestate.co/cdn-cgi/phish-bypass?atok=qYSnzf1eg0QfEW5J7G7NBOZOZbUU_jZwdDbFJ2d0n.E-172643... HTTP 301
https://romaestate.co/link-alternatif-toto12/ HTTP 301
https://cheaptitles.co.nz/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

71
Requests

92 %
HTTPS

33 %
IPv6

15
Domains

23
Subdomains

20
IPs

7
Countries

1649 kB
Transfer

5025 kB
Size

36
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://romaestate.co/link-alternatif-toto12/ Page URL
https://romaestate.co/cdn-cgi/phish-bypass?atok=qYSnzf1eg0QfEW5J7G7NBOZOZbUU_jZwdDbFJ2d0n.E-1726436699-0.0.1.1-%2Flink-alternatif-toto12%2F HTTP 301
https://romaestate.co/link-alternatif-toto12/ HTTP 301
https://cheaptitles.co.nz/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://romaestate.co/favicon.ico HTTP 301
https://cheaptitles.co.nz/ HTTP 301
https://naturewildlife.id/ HTTP 301
https://1win.com/

Request Chain 52

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5390742935121.828 HTTP 302
https://12572451.fls.doubleclick.net/activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5390742935121.828

Request Chain 57

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F HTTP 302
https://12688802.fls.doubleclick.net/activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F

Request Chain 65

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10493.a9KdIBQ7iy2OLuGVSgWfNNQZAdnYR1Q0NYc11nKXq2XbgeIZLPVRtObJOqIRAUWu.-GbAhtGUX2hVdgMQnncucxiBu7Q%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10493.LfnYcw9n8T9G7W_M4dChZYclw8ADc7EQCJxi1sUOJRIUthKgUV5A4O7n2aYjdROmR8064gd8d1A46WRWuJcVPaGG_JnM3-EmjFSf7MGaV_5HLyk-w2YGKxgmRXtta9adT1oIsviLQM11u-EXaTv_NeP6pG1Zb5H7ToRMdTeVzFW0ZJwiFNP_EVI9zZilRbwZTT3NQIzavaHlol7GcjRnISCzKd_GmyRAB6SK2pVouX4%2C.uPykMnodL1TuHAbLUwg4LVXEKUY%2C HTTP 302
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10493.cQCHbdnFxkMiu7PoExhTvz5zbrUX9Q4nkn-KDlEtIyw1NgO_xbReTbvk5yhnDUoBOwRFWabgXY39R2ma6n2_eW-v8X3o3nlU5GYKdcR-mKfMS26Guw7o7YpEalR-JGSlXIofzZIIDcHBZ4I3M47Fb-5TmkzxsLi_FKj912mFTeWcS1LKA51GbwBt2qA1PfWAnAeiqlp_dGP04qYgcqXSZg%2C%2C.1Wdeu4rN5bNMXBRr8_Yx_uVBN9o%2C

Request Chain 69

https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A876195182456%3Ahid%3A689631091%3Az%3A180%3Ai%3A20240916004505%3Aet%3A1726436706%3Ac%3A1%3Arn%3A525564972%3Arqn%3A1%3Au%3A1726436706728739161%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A947%3Awv%3A2%3Ads%3A1%2C85%2C165%2C32%2C440%2C0%2C%2C195%2C1%2C1438%2C1438%2C0%2C1219%3Aco%3A0%3Acpf%3A1%3Ans%3A1726436703226%3Agi%3AR0ExLjEuMTk4MjU2OTU3NC4xNzI2NDM2NzA2%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726436706%3At%3A1win&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)eco(21037568)ti(1) HTTP 302
https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A876195182456%3Ahid%3A689631091%3Az%3A180%3Ai%3A20240916004505%3Aet%3A1726436706%3Ac%3A1%3Arn%3A525564972%3Arqn%3A1%3Au%3A1726436706728739161%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A947%3Awv%3A2%3Ads%3A1%2C85%2C165%2C32%2C440%2C0%2C%2C195%2C1%2C1438%2C1438%2C0%2C1219%3Aco%3A0%3Acpf%3A1%3Ans%3A1726436703226%3Agi%3AR0ExLjEuMTk4MjU2OTU3NC4xNzI2NDM2NzA2%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726436706%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29

71 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
romaestate.co/link-alternatif-toto12/ 4 KB
2 KB 158ms
70ms Document
text/html 172.67.195.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://romaestate.co/link-alternatif-toto12/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.195.139 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91c37f6f9a3428c7ff6d586dd887df451dc3576e710e5f821dcfc498c636a089

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cf-ray: 8c3bcd1b28172479-KBP
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 15 Sep 2024 21:44:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nzEnNm3DkvQWMjDgk0p3uNkVEX1SFp%2FY4qSY6MzOaiPsA5DmEBruIE%2FlYwXbxr5KGTsRnXSb3YtyXpn3fp13nOZ75COrxnGL9O9mOLY6oCxNylnM7uO5nh35japiPPf%2B"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
romaestate.co/cdn-cgi/styles/ 23 KB
5 KB 60ms
60ms Stylesheet
text/css 172.67.195.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://romaestate.co/cdn-cgi/styles/cf.errors.css

Requested by

Host: romaestate.co
URL: https://romaestate.co/link-alternatif-toto12/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.195.139 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://romaestate.co/link-alternatif-toto12/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Sep 2024 18:11:09 GMT
server: cloudflare
etag: W/"66e08bbd-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8c3bcd1b98c82479-KBP
expires: Sun, 15 Sep 2024 23:44:59 GMT

GET
H3 200 icon-exclamation.png
romaestate.co/cdn-cgi/images/ 452 B
635 B 60ms
60ms Image
image/png 172.67.195.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://romaestate.co/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: romaestate.co
URL: https://romaestate.co/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.195.139 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://romaestate.co/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:44:59 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Sep 2024 18:11:09 GMT
server: cloudflare
etag: "66e08bbd-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8c3bcd1c097b2479-KBP
content-length: 452
expires: Sun, 15 Sep 2024 23:44:59 GMT

GET

/
1win.com/
Redirect Chain

https://romaestate.co/favicon.ico
https://cheaptitles.co.nz/
https://naturewildlife.id/
https://1win.com/

0
0

GET
H2

200

Primary Request / Show response
1win.com/
Redirect Chain

https://romaestate.co/cdn-cgi/phish-bypass?atok=qYSnzf1eg0QfEW5J7G7NBOZOZbUU_jZwdDbFJ2d0n.E-1726436699-0.0.1.1-%2Flink-alternatif-toto12%2F
https://romaestate.co/link-alternatif-toto12/
https://cheaptitles.co.nz/
https://naturewildlife.id/
https://1win.com/

64 KB
26 KB

252ms
165ms

Document
text/html

190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

4f83299b70b23330183c8b0e8b494271d65f19e669bc64744322d6edfd5796ad

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://romaestate.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 15 Sep 2024 21:45:03 GMT
server: ddos-guard
vary: Origin
x-app-version: v2.113.2
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
x-match-domain: 1win.com
x-request-id: DwZOs5OB4qu2yoE6

Redirect headers

cache-control: max-age=3600
cf-ray: 8c3bcd35983d77ad-KBP
content-length: 167
content-type: text/html
date: Sun, 15 Sep 2024 21:45:03 GMT
expires: Sun, 15 Sep 2024 22:45:03 GMT
location: https://1win.com/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6hUIIbu2BxAa%2FX1EGQNO%2B8xNL%2F11KFQ5Skg8UOQx8ZyQjp3%2FlRXWvdpJsKyKygicNut3C4u96IPsnkFMqdIdQ006QuO99KBnpWDeK8aGsgmwBDMQc0%2FAStSnjifhX98movH%2BIw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 SFNSDisplay-latin.50a4eaff3.woff2
v1.bundlecdn.com/font/ 32 KB
32 KB 146ms
52ms Font
application/octet-stream 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/font/SFNSDisplay-latin.50a4eaff3.woff2
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68

Request headers

Referer: https://1win.com/
Origin: https://1win.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
cf-cache-status: HIT
last-modified: Fri, 26 Jul 2024 13:35:13 GMT
server: cloudflare
age: 4435485
etag: "66a3a611-8128"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 8c3bcd386b520a44-ARN
content-length: 33064
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 SFNSText-latin.f09aa5229.woff2
v1.bundlecdn.com/font/ 42 KB
43 KB 141ms
48ms Font
application/octet-stream 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/font/SFNSText-latin.f09aa5229.woff2
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6

Request headers

Referer: https://1win.com/
Origin: https://1win.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
cf-cache-status: HIT
last-modified: Fri, 26 Jul 2024 13:35:13 GMT
server: cloudflare
age: 4435485
etag: "66a3a611-a9f8"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 8c3bcd386b550a44-ARN
content-length: 43512
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 minified.js Show response
1win.com/core-js/3.33.3/ 238 KB
73 KB 45ms
45ms Script
application/javascript 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/core-js/3.33.3/minified.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

ce68e1614ab493deaecfa6eb9711736de0348248e1d559b5f6dfb5dc4c29b459

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Apr 2024 13:34:17 GMT
content-encoding: br
last-modified: Tue, 16 Apr 2024 12:36:13 GMT
server: ddos-guard
age: 13162246
etag: W/"661e70bd-3b989"
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
vary: Accept-Encoding
content-type: application/javascript
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-length: 74396
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 chunk-vendors.b5eb4d992.js Show response
v1.bundlecdn.com/js/ 247 KB
83 KB 101ms
100ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/chunk-vendors.b5eb4d992.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f007c721f3891c6fbc6555f58faf308a9187968bfca7439dd601ae93b621649b

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 04 Sep 2024 13:22:20 GMT
server: cloudflare
age: 980046
etag: W/"66d85f0c-3dbdd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd38fd07992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 chunk-common.3aab8b5e2.js Show response
v1.bundlecdn.com/js/ 383 KB
115 KB 55ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fc1e95aebc3c7a3ac0c1d02caae4874ff8f274a5ac8837c189fe075cc413569

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207611
etag: W/"66e427cb-5fd72"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd38fd0d992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 index.561959207.js Show response
v1.bundlecdn.com/js/ 386 KB
126 KB 94ms
94ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/index.561959207.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce8c2a594c8630b3824b0c92156601c4082d074ae778a049b322d76daf2aa45a

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207611
etag: W/"66e427cb-6076a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd390d23992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 index.aedf85995.css
v1.bundlecdn.com/css/ 6 KB
1 KB 126ms
51ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/index.aedf85995.css
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9be12e59a210d45411e025096615d4308c44a0cffeb791dd452e443c675e8481

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 26 Jul 2024 11:07:50 GMT
server: cloudflare
age: 4444297
etag: W/"66a38386-185b"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd387c71992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 1win-normal.svg
1win.com/img/logo/main/ 5 KB
2 KB 81ms
80ms Image
image/svg+xml 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1win.com/img/logo/main/1win-normal.svg
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS: ddos-guard.net
Software: ddos-guard /
Resource Hash: a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 15:57:34 GMT
content-encoding: br
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
age: 2872050
etag: W/"66bb644e-1221"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-length: 1474
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 desktop.6cac9b504.js Show response
v1.bundlecdn.com/js/ 115 KB
32 KB 89ms
89ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/desktop.6cac9b504.js
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c5ec8bcb4b305c7e678fd57c1eb2e21dcf58c172cc2f38cfa06d36bd97db781

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207585
etag: W/"66e427cb-1cb00"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd390d22992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 desktop.f2c7d307d.css
v1.bundlecdn.com/css/ 64 KB
12 KB 53ms
53ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/desktop.f2c7d307d.css
Requested by: Host: 1win.com
URL: https://1win.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f87ad06cc9ed9ee43362260fb7b3de880f89a89a88dd0fe3b69e6aca09a710d

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 Sep 2024 10:55:42 GMT
server: cloudflare
age: 297782
etag: W/"66e2c8ae-1007d"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd390d1f992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

POST
H2 200 affiliate:link_visit
1win.com/ 37 B
411 B 160ms
157ms Ping
application/json 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/affiliate:link_visit

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard / Express

Resource Hash

9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
server: ddos-guard
etag: W/"25-Zj67mG54TfZ031q1ea2QwFUXWX4"
x-powered-by: Express
access-control-max-age: 7200
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1win.com
access-control-expose-headers: Authorization
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Content-Type, Authorization, X-Origin

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 18860.1f1e193d8.js Show response
v1.bundlecdn.com/js/ 28 KB
10 KB 51ms
50ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/18860.1f1e193d8.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f6e3e5c53c730a88de6f874ab17cb1283f0ed8580bb22b57578f4f0d601f700

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Aug 2024 12:57:34 GMT
server: cloudflare
age: 2104932
etag: W/"66c735be-6ea0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3adf1d992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 60215.4be1063fc.js Show response
v1.bundlecdn.com/js/ 76 KB
18 KB 48ms
48ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/60215.4be1063fc.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 464315c4b50d1c2fc205a9922c85615b83279ca54d05b48f77c1e4577778f131

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207606
etag: W/"66e427cb-12f45"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3adf22992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 47904.b8027b5a4.css
v1.bundlecdn.com/css/ 53 KB
10 KB 51ms
50ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/47904.b8027b5a4.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 394daf2ca11c67f7a6188bc8e31f5dd7e2985db4de06dbc67ab4db2c0886cb7c

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 Sep 2024 10:55:43 GMT
server: cloudflare
age: 297852
etag: W/"66e2c8af-d4aa"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3aef24992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 47904.b1e198e30.js Show response
v1.bundlecdn.com/js/ 372 KB
111 KB 55ms
55ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/47904.b1e198e30.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ef00bcf97163af4dfa37c83cd3d9acf5c1df36bf0b354c17c6fe650682895d6

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207614
etag: W/"66e427cb-5d1fe"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3aef26992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 84167.9fbe47741.js Show response
v1.bundlecdn.com/js/ 8 KB
3 KB 51ms
51ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/84167.9fbe47741.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92ea9bd64fc986968b38a1003174a422f7ea9ff287f3e60257c88edd3577882b

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207584
etag: W/"66e427cb-1e3a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3aef27992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 en Show response
1win.com/fss/translations/ 377 KB
112 KB 150ms
149ms XHR
application/json 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/fss/translations/en?domain=1win.com&appName=web

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

c8f45a2ed95aa92a09929abf62f92cb483c3ab4b4de42f6c38afa96d38e5f02a

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Accept: application/json, text/plain, */*
Referer: https://1win.com/
X-Origin: 1win.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:04 GMT
content-encoding: gzip
x-app-version: v2.113.2
server: ddos-guard
etag: W/"a0d36-aixO/ARtfO+RgEV7lgIE8JpmDYo"
vary: Origin
x-match-domain: 1win.com
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
x-request-id: pCMb4JqUToQqQNlh

GET
H2 200 allv4 Show response
v1.bundlecdn.com/common/banners/ 20 KB
5 KB 1974ms
1973ms XHR
application/json 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://v1.bundlecdn.com/common/banners/allv4?localeId=14&lang=en&tzOffset=180

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d735d0917cec6e566ff92509d7a65113afb15457afd258c4695a91c829f9dac1

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:06 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
etag: W/"682d-8BlLPGBfqRLxwwFt5MT+nzcnRWw"
vary: Origin
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, stale-while-revalidate=300
cf-ray: 8c3bcd3c2f4f0a44-ARN

GET
H2 200 vardata Show response
api.lab.amplitude.com/sdk/v2/ 2 KB
771 B 249ms
248ms Fetch
application/json 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/v2/vardata?v=0

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bbe8f034cf83f8e2b54538d197f9a6b4e03e91c080413ff309da07efd8277a41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://1win.com/
Authorization: Api-Key client-Ss5BFx7UDrTj948TJHfc5ZUoTW67EjvZ
X-Amp-Exp-User: eyJsaWJyYXJ5IjoiZXhwZXJpbWVudC1qcy1jbGllbnQvMS4xMC4wIiwibGFuZ3VhZ2UiOiJlbi1VUyIsInBsYXRmb3JtIjoiV2ViIiwib3MiOiJDaHJvbWUgMTI4IiwiZGV2aWNlX21vZGVsIjoiTGludXgiLCJkZXZpY2VfaWQiOiIzNWMyMWVjYy1kNjcxLTQxNzktYTQyMi05ZTVhZTI4MzhhMjYiLCJ1c2VyX3Byb3BlcnRpZXMiOnsiZGV2aWNlX3R5cGUiOiJkZXNrdG9wIiwicGxhdGZvcm0iOiJ3ZWIiLCJvcyI6Im90aGVyIiwicGxhdGZvcm1fbGFuZ3VhZ2UiOiJlbiIsImRvbWFpbiI6IjF3aW4uY29tIiwidGltZV96b25lIjoiRXVyb3BlL0hlbHNpbmtpIiwicmVmZXJyaW5nX2RvbWFpbiI6InJvbWFlc3RhdGUuY28ifX0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 0
x-cache: MISS
cache-tag: client-Ss5BFx7UDrTj948TJHfc5ZUoTW67EjvZ
content-length: 558
x-served-by: cache-fra-etou8220141-FRA
x-timer: S1726436705.858420,VS0,VE193
x-amzn-trace-id: Root=1-66e75560-62584cc70e034d637bc7f93c
vary: Origin, Origin
content-type: application/json;charset=utf-8
access-control-allow-origin: https://1win.com
cache-control: no-store
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 vardata
api.lab.amplitude.com/sdk/v2/ Frame 0
0 177ms
55ms Preflight 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.lab.amplitude.com/sdk/v2/vardata?v=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-amp-exp-user
Access-Control-Request-Method: GET
Origin: https://1win.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-amp-exp-user
access-control-allow-methods: GET,POST,HEAD
access-control-allow-origin: https://1win.com
access-control-max-age: 1800
age: 2796
cache-control: no-store
content-length: 0
date: Sun, 15 Sep 2024 21:45:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amzn-trace-id: Root=1-66e74a74-780567eb33c46557662edb15
x-cache: HIT
x-cache-hits: 119
x-content-type-options: nosniff
x-served-by: cache-fra-etou8220141-FRA
x-timer: S1726436705.802906,VS0,VE0

GET
H2 200 favicon-32x32.png
1win.com/img/icons/ 536 B
630 B 42ms
42ms Other
image/png 190.115.24.78
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/img/icons/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.24.78 , Belize, ASN59692 (IQWEB, AE),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

82dcbd3db370fd49d3a130886970cfd48796750ab3767c8b6985a2bf825b250b

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 16:09:11 GMT
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
age: 2871353
etag: "66bb644e-218"
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
content-type: image/png
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 536
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 firebase-app.js Show response
1win.com/firebase/8.1.1/ 19 KB
0 105ms
105ms Script
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/firebase/8.1.1/firebase-app.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 14:49:06 GMT
content-encoding: br
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
age: 2876158
etag: W/"66bb644e-4ded"
vary: Accept-Encoding
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
content-type: application/javascript
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-length: 6578
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 377 KB
111 KB 219ms
90ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Requested by

Host: romaestate.co
URL: https://romaestate.co/link-alternatif-toto12/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ef2a26f3584ca27e45ab12258f5600ed5a2dfe00a0e988a4aafe6446cc81d415

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113242
x-xss-protection: 0
last-modified: Sun, 15 Sep 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 15 Sep 2024 21:45:05 GMT

GET
H2 200 24179.d55208029.js Show response
v1.bundlecdn.com/js/ 28 KB
7 KB 56ms
46ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/24179.d55208029.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 107e4f2aa932ded604151c11aefd3e5471af520c26c503938aa99184b83adba4

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 Sep 2024 09:30:01 GMT
server: cloudflare
age: 302980
etag: W/"66e2b499-6e0c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b13992c-ARN
expires: Wed, 13 Sep 2034 21:45:04 GMT

GET
H2 200 55032.211ffa07a.js Show response
v1.bundlecdn.com/js/ 7 KB
3 KB 58ms
49ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/55032.211ffa07a.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3df4b3bf9f6db36c6b9f30b956f88320e05d824152e4c0c5f8cab550e930d5f9

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 05 Sep 2024 08:34:50 GMT
server: cloudflare
age: 909524
etag: W/"66d96d2a-1bd6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b15992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 58183.6a2f83b21.js Show response
v1.bundlecdn.com/js/ 82 KB
24 KB 61ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/58183.6a2f83b21.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4742a7c7bbc3c690cd8bebf51d127b5ef9197fb49313a15ece626a4972c10aa8

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 26 Aug 2024 14:28:36 GMT
server: cloudflare
age: 188283
etag: W/"66cc9114-148e5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b16992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 68618.d62065178.js Show response
v1.bundlecdn.com/js/ 10 KB
4 KB 57ms
51ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/68618.d62065178.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13b15f93eb2d98d4f7e9d58c481b6e04e54a0caed2b0b19a51cfb2a61adc8449

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 27 Aug 2024 09:42:11 GMT
server: cloudflare
age: 1684088
etag: W/"66cd9f73-272d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b17992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 60385.06f32d4d1.js Show response
v1.bundlecdn.com/js/ 9 KB
3 KB 57ms
52ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/60385.06f32d4d1.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7cc97d5681d6d3e5921465551231c25df6ea5dec92aeb116e7dd146daef4565

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Aug 2024 12:57:34 GMT
server: cloudflare
age: 2104933
etag: W/"66c735be-241d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b19992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 3403.fdf5a2524.js Show response
v1.bundlecdn.com/js/ 10 KB
4 KB 59ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/3403.fdf5a2524.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0c06e8d6ffe3aa5720ec0b9802044e4badd2edb2513437e5c5fdaa5b6592689

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 10 Sep 2024 14:27:03 GMT
server: cloudflare
age: 458003
etag: W/"66e05737-29a6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b1f992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 41014.76d9b4079.css
v1.bundlecdn.com/css/ 45 KB
10 KB 57ms
52ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/41014.76d9b4079.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a32624aa552d924b6fc5334ffe646524e0bc3e5a510a24712d324d50806baa2

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 10 Sep 2024 14:27:03 GMT
server: cloudflare
age: 457974
etag: W/"66e05737-b4ab"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b1b992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 41014.1b30f798e.js Show response
v1.bundlecdn.com/js/ 53 KB
14 KB 57ms
53ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/41014.1b30f798e.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67fcfdb76fab63a1032de55bdf6289e3b6ccf64c3afcacaf89076cf211daf44f

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 10 Sep 2024 14:27:03 GMT
server: cloudflare
age: 457974
etag: W/"66e05737-d4f7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b21992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 756.cfe432ea5.js Show response
v1.bundlecdn.com/js/ 9 KB
3 KB 58ms
54ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/756.cfe432ea5.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9123cebe41c1fc2c79b22d627451ea38662dc1933286f0bd7ff7a03721821bf1

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 06 Sep 2024 13:02:44 GMT
server: cloudflare
age: 808420
etag: W/"66dafd74-23e1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b23992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 21003.edbc02e34.js Show response
v1.bundlecdn.com/js/ 25 KB
7 KB 89ms
85ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/21003.edbc02e34.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfbc03c9abeb9b5a91be7afb101f70b860b65717f399e8b844a4412189450507

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 207545
etag: W/"66e427cb-62ee"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e6b79992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 18145.14110b342.css
v1.bundlecdn.com/css/ 8 KB
3 KB 59ms
56ms Stylesheet
text/css 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/css/18145.14110b342.css
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ed1066c3c6947d7a10e0413d11f5c453bd20068061e25a4a3b9c1f5d78e8a90

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 06 Sep 2024 13:02:44 GMT
server: cloudflare
age: 808382
etag: W/"66dafd74-21e6"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3e3b1d992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
967 B 191ms
70ms Script
text/javascript 172.217.18.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f4.1e100.net

Software

ESF /

Resource Hash

af0a1041be52852f255661c3fd8566b9fe9c99d0391f11fb0a03eaa3bf1a5543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
expires: Sun, 15 Sep 2024 21:45:05 GMT

GET
H2 200 1279.2ddf52e8a.js Show response
v1.bundlecdn.com/js/ 911 B
694 B 49ms
49ms Script
application/javascript 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.bundlecdn.com/js/1279.2ddf52e8a.js
Requested by: Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/index.561959207.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b563de728f7ad9022ef94968360931749d32898f02f524b66a73c2630126f4a3

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Aug 2024 12:57:33 GMT
server: cloudflare
age: 2104918
etag: W/"66c735bd-38f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 8c3bcd3edbf6992c-ARN
expires: Wed, 13 Sep 2034 21:45:05 GMT

GET
H2 200 1win-normal.34748aac6.svg
v1.bundlecdn.com/img/ 5 KB
2 KB 47ms
46ms Image
image/svg+xml 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/1win-normal.34748aac6.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 481
etag: W/"66e427cb-1221"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8c3bcd3eec00992c-ARN
expires: Mon, 16 Sep 2024 01:45:05 GMT

GET
H2 200 fi.svg
v1.bundlecdn.com/img/flags/ 207 B
245 B 48ms
48ms Image
image/svg+xml 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/flags/fi.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86a11ca8f8761ee42f5ad8f3ec57fed81d52d3b809ce86d9209305dc5c0fb0be

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 2183
etag: W/"66e427cb-cf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8c3bcd3eec02992c-ARN
expires: Mon, 16 Sep 2024 01:45:05 GMT

GET
H2 200 title Show response
1win.com/common/ 29 B
0 100ms
100ms XHR
application/json

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/common/title?path=bets&lang=en

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

c07b2c0a515caf1306fb4d9366fab5758253eeadcf8c0414cb44ccd48f82e59a

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Accept: application/json, text/plain, */*
Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: gzip
server: ddos-guard
etag: W/"25-bM/5z02X/xOkKbh8eZCiJpcKcd0"
vary: Origin, Accept-Encoding
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, stale-while-revalidate=300

GET
H2 200 bear.7b736fe37-290.webp
v1.bundlecdn.com/img/ 15 KB
15 KB 48ms
47ms Image
image/webp 154.197.121.128
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://v1.bundlecdn.com/img/bear.7b736fe37-290.webp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.128 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66c4135905d8889570877f8bf74d092dbcda1ec84d16791a9eab736415fd396c

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Sep 2024 11:53:47 GMT
server: cloudflare
age: 1452
etag: "66e427cb-3adc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8c3bcd3efc0a992c-ARN
content-length: 15068
expires: Mon, 16 Sep 2024 01:45:05 GMT

GET
H2 200 firebase-messaging.js Show response
1win.com/firebase/8.1.1/ 40 KB
0 1ms
1ms Script
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL

https://1win.com/firebase/8.1.1/firebase-messaging.js

Requested by

Host: 1win.com
URL: https://1win.com/

Protocol

Server

-, , ASN (),

Reverse DNS

Software

ddos-guard /

Resource Hash

58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 15:21:35 GMT
content-encoding: br
last-modified: Tue, 13 Aug 2024 13:49:02 GMT
server: ddos-guard
age: 2874209
etag: W/"66bb644e-9f25"
vary: Accept-Encoding
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
content-type: application/javascript
ddg-cache-status: HIT,HIT
cache-control: max-age=315360000
content-length: 10915
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 recaptcha__fi.js Show response
www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/ 540 KB
214 KB 204ms
68ms Script
text/javascript 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__fi.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e021ef9edf3b2db8151fa1fccc8f46fa13aecc81a8bcfffdde84606b0232811d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Origin: https://1win.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 14 Sep 2024 01:17:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160085
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 218670
x-xss-protection: 0
last-modified: Tue, 03 Sep 2024 02:00:38 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 14 Sep 2025 01:17:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
93 KB 92ms
90ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0e7e7396a64646afe6200ee5370a98d615e7ce53b938e42c52724731a355ff67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95014
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Sep 2024 21:45:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
93 KB 135ms
134ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

28b3459e8825410253b4a69098d2d54909af1b6a241cf5264c1fec9b1dede1d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94651
x-xss-protection: 0
last-modified: Sun, 15 Sep 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 15 Sep 2024 21:45:05 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 89ms
89ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a3a224466f300debb3501190462d41a9038d53a3d014aedda7062fe2167c8dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78904
x-xss-protection: 0
last-modified: Sun, 15 Sep 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 15 Sep 2024 21:45:05 GMT

GET
H2 200 hotjar-2606090.js Show response
static.hotjar.com/c/ 12 KB
5 KB 184ms
56ms Script
application/javascript 18.66.102.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Requested by

Host: romaestate.co
URL: https://romaestate.co/link-alternatif-toto12/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-11.fra56.r.cloudfront.net

Software

Resource Hash

6eedc22350a65b6ff2c1a86b60582b4896ff5945415547b4bfcd3efbd1da911c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Sun, 15 Sep 2024 21:44:37 GMT
via: 1.1 3f3b012fad703fdac0f14efdb7b78b6e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 28
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/9cfe93e9d3c75b5995d2af386f5c4816
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: mmgGlPiUb2593BeBMt7lxSzhdBVrGddIdfJncJbDMeZOUxUdd0432g==

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 202 KB
70 KB 234ms
126ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: romaestate.co
URL: https://romaestate.co/link-alternatif-toto12/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

6071fb99e587aa37f08c8f14a5718a3bda75cae32fd1d4ccd0718733a362ab64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
last-modified: Thu, 12 Sep 2024 15:07:17 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "66e303a5-115c6"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 71110
expires: Sun, 15 Sep 2024 22:45:05 GMT

GET
H2

200

activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;o...
12572451.fls.doubleclick.net/ Frame 513E
Redirect Chain

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
https://12572451.fls.doubleclick.net/activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...

0
0

71ms
70ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12572451.fls.doubleclick.net/activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5390742935121.828?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNL4R8ZZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 1000
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Sun, 15 Sep 2024 21:45:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12572451.fls.doubleclick.net/activityi;dc_pre=CKiawfT1xYgDFWmJgwcdqXIcgg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5390742935121.828?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 110ms
35ms Fetch
text/plain 2001:4860:4802:36::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je4990v894728184z89182494087za200zb9182494087&_p=1726436704957&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=1982569574.1726436706&ul=fi-fi&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dp=%2F&sid=1726436705&sct=1&seg=0&dl=https%3A%2F%2F1win.com%2F&dr=https%3A%2F%2Fromaestate.co%2F&dt=1win&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_url=https%3A%2F%2F1win.com%2F&up.UserID=&up.platform_language=en&up.device_type=desktop&up.platform=web&up.os=other&tfd=2312
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://1win.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
249 B 222ms
73ms Ping
text/plain 2a00:1450:400c:c1d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-548949LWLW&cid=1982569574.1726436706&gtm=45je4990v894728184z89182494087za200zb9182494087&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://1win.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame A05D 0
0 211ms
76ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=1982569574.1726436706&gtm=45je4990v894728184z89182494087za200zb9182494087&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=367215079

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ru/ads/ 42 B
63 B 154ms
76ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ru/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-548949LWLW&cid=1982569574.1726436706&gtm=45je4990v894728184z89182494087za200zb9182494087&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0&tag_exp=0&z=271064313

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;...
12688802.fls.doubleclick.net/ Frame A8F3
Redirect Chain

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uap...
https://12688802.fls.doubleclick.net/activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa...

0
0

85ms
84ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12688802.fls.doubleclick.net/activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 344
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Sun, 15 Sep 2024 21:45:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12688802.fls.doubleclick.net/activityi;dc_pre=CI2VyPT1xYgDFRuhgwcdU-wKDQ;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;g...
td.doubleclick.net/td/fls/rul/ Frame E565 0
0 139ms
82ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=n...
ad.doubleclick.net/ 0
23 B 185ms
111ms Image
image/png 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=1831562663667;npa=0;auiddc=78705514.1726436705;ps=1;pcor=333883557;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4990v9188705310z89182494087za201zb9182494087;gcd=13l3l3l3l1l1;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2F1win.com%2F?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"4007816317176249391"}],"aggregatable_trigger_data":[{"filters":[{"14":["13647302"]}],"key_piece":"0x779b3833d9192eb1","source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","638603056","638603057","638603058","638603059"]},{"key_piece":"0x1e4b4a8d51103097","not_filters":{"14":["13647302"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","638603056","638603057","638603058","638603059"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"20557008":36,"20557009":36,"20557010":36,"20557011":3530,"21":6356,"638603056":32,"638603057":32,"638603058":32,"638603059":3177},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"968207759439358336","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"4007816317176249391","filters":[{"14":["13647302"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"4007816317176249391","filters":[{"14":["13647302"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"4007816317176249391","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"4007816317176249391","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["12688802"]}}
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.6e8cbd39caed17f0d1c0.js Show response
script.hotjar.com/ 223 KB
56 KB 238ms
79ms Script
application/javascript 13.32.27.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.6e8cbd39caed17f0d1c0.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-107.fra56.r.cloudfront.net

Software

Resource Hash

448797aade8c774bb0d8bf418eb7469865095c4e9016fc13095204ba2b6dc3e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:41:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 1ee1abe42f3acbda66e5d1252319566a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 371039
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56449
last-modified: Wed, 11 Sep 2024 14:40:34 GMT
etag: "92b2dc3a86a608117dd7c4d6660c942b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: JLcnwuOVyXl8teZfhvEvBYYtu9yn8wVVbQdPR-hMbU26D7lSsfIRyw==

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/ 5 KB
2 KB 222ms
75ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/?random=1726436705691&cv=11&fst=1726436705691&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Fromaestate.co%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=78705514.1726436705&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

cafe /

Resource Hash

2955765bae19cde6db96107f735d477b14f7e14d1a13f094ce2b43ccb8215184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2320
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 16482547739
td.doubleclick.net/td/rul/ Frame 94A9 0
0 87ms
85ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/16482547739?random=1726436705691&cv=11&fst=1726436705691&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Fromaestate.co%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=78705514.1726436705&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 21:45:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 httpapi
api2.amplitude.com/2/ Frame 0
0 580ms
186ms Preflight 34.215.105.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.amplitude.com/2/httpapi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.215.105.9 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-215-105-9.us-west-2.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://1win.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET, POST
access-control-allow-origin: *
access-control-max-age: 86400
content-length: 0
date: Sun, 15 Sep 2024 21:45:06 GMT
strict-transport-security: max-age=15768000

POST
H2 200 httpapi Show response
api2.amplitude.com/2/ 94 B
218 B 206ms
202ms Fetch
application/json 34.215.105.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.amplitude.com/2/httpapi

Requested by

Host: v1.bundlecdn.com
URL: https://v1.bundlecdn.com/js/chunk-common.3aab8b5e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.215.105.9 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-215-105-9.us-west-2.compute.amazonaws.com

Software

Resource Hash

941a034b211a9775af3cf19503b03e661f0c7efabeccecff5616af9c115fbbd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Sun, 15 Sep 2024 21:45:06 GMT
strict-transport-security: max-age=15768000
content-length: 94
content-type: application/json

GET
H2

200

sync_cookie_image_finish
mc.yandex.ru/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10493.a9KdIBQ7iy2OLuGVSgWfNNQZAdnYR1Q0NYc11nKXq2XbgeIZLPVRtObJOqIRAUWu.-GbAhtGUX2hVdgMQnncucxiBu7Q%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10493.LfnYcw9n8T9G7W_M4dChZYclw8ADc7EQCJxi1sUOJRIUthKgUV5A4O7n2aYjdROmR8064gd8d1A46WRWuJcVPaGG_JnM3-EmjFSf7MGaV_5HLyk-w2YGKxgmRXtta9adT1oIsviLQM...
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10493.cQCHbdnFxkMiu7PoExhTvz5zbrUX9Q4nkn-KDlEtIyw1NgO_xbReTbvk5yhnDUoBOwRFWabgXY39R2ma6n2_eW-v8X3o3nlU5GYKdcR-mKfMS...

43 B
585 B

49ms
49ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10493.cQCHbdnFxkMiu7PoExhTvz5zbrUX9Q4nkn-KDlEtIyw1NgO_xbReTbvk5yhnDUoBOwRFWabgXY39R2ma6n2_eW-v8X3o3nlU5GYKdcR-mKfMS26Guw7o7YpEalR-JGSlXIofzZIIDcHBZ4I3M47Fb-5TmkzxsLi_FKj912mFTeWcS1LKA51GbwBt2qA1PfWAnAeiqlp_dGP04qYgcqXSZg%2C%2C.1Wdeu4rN5bNMXBRr8_Yx_uVBN9o%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 21:45:06 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10493.cQCHbdnFxkMiu7PoExhTvz5zbrUX9Q4nkn-KDlEtIyw1NgO_xbReTbvk5yhnDUoBOwRFWabgXY39R2ma6n2_eW-v8X3o3nlU5GYKdcR-mKfMS26Guw7o7YpEalR-JGSlXIofzZIIDcHBZ4I3M47Fb-5TmkzxsLi_FKj912mFTeWcS1LKA51GbwBt2qA1PfWAnAeiqlp_dGP04qYgcqXSZg%2C%2C.1Wdeu4rN5bNMXBRr8_Yx_uVBN9o%2C
strict-transport-security: max-age=31536000
date: Sun, 15 Sep 2024 21:45:06 GMT
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
575 B 62ms
60ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 15 Sep 2024 21:45:05 GMT
last-modified: Thu, 12 Sep 2024 15:07:17 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "66e303a5-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Sun, 15 Sep 2024 22:45:05 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/16482547739/ 42 B
64 B 75ms
74ms Image
image/gif 172.217.18.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/16482547739/?random=1726436705691&cv=11&fst=1726434000000&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Fromaestate.co%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=78705514.1726436705&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfiRMEUrSbC9Q7k1bAEOX889dAldA33tMZIhZu1kacH4c7Upeb&random=1530213590&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.fi/pagead/1p-user-list/16482547739/ 42 B
455 B 210ms
78ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.fi/pagead/1p-user-list/16482547739/?random=1726436705691&cv=11&fst=1726434000000&bg=ffffff&guid=ON&async=1&gtm=45be4990v9181323879z89182494087za200zb9182494087&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2F1win.com%2F&ref=https%3A%2F%2Fromaestate.co%2F&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=78705514.1726436705&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfiRMEUrSbC9Q7k1bAEOX889dAldA33tMZIhZu1kacH4c7Upeb&random=1530213590&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/92006234/
Redirect Chain

https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3...
https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxp...

593 B
990 B

69ms
68ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A876195182456%3Ahid%3A689631091%3Az%3A180%3Ai%3A20240916004505%3Aet%3A1726436706%3Ac%3A1%3Arn%3A525564972%3Arqn%3A1%3Au%3A1726436706728739161%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A947%3Awv%3A2%3Ads%3A1%2C85%2C165%2C32%2C440%2C0%2C%2C195%2C1%2C1438%2C1438%2C0%2C1219%3Aco%3A0%3Acpf%3A1%3Ans%3A1726436703226%3Agi%3AR0ExLjEuMTk4MjU2OTU3NC4xNzI2NDM2NzA2%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726436706%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

469f7d31eccc39da2f80434a677332ad98b413e008a73d8059b1e227388247c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1win.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Sun, 15-Sep-2024 21:45:06 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1win.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 593
x-xss-protection: 1; mode=block
expires: Sun, 15-Sep-2024 21:45:06 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Sep 2024 21:45:06 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 15-Sep-2024 21:45:06 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1win.com%2F&page-ref=https%3A%2F%2Fromaestate.co%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ac4o2nplw0gn9nduetxpw3hlsrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Afi-FI%3Av%3A1450%3Acn%3A1%3Adp%3A0%3Als%3A876195182456%3Ahid%3A689631091%3Az%3A180%3Ai%3A20240916004505%3Aet%3A1726436706%3Ac%3A1%3Arn%3A525564972%3Arqn%3A1%3Au%3A1726436706728739161%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A947%3Awv%3A2%3Ads%3A1%2C85%2C165%2C32%2C440%2C0%2C%2C195%2C1%2C1438%2C1438%2C0%2C1219%3Aco%3A0%3Acpf%3A1%3Ans%3A1726436703226%3Agi%3AR0ExLjEuMTk4MjU2OTU3NC4xNzI2NDM2NzA2%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1726436706%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2821037568%29ti%281%29
access-control-allow-origin: https://1win.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 15-Sep-2024 21:45:06 GMT

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame 025B 0
0 178ms
64ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1win.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1046
content-type: text/html
date: Sun, 15 Sep 2024 21:45:06 GMT
etag: "66e303a5-416"
expires: Sun, 15 Sep 2024 22:45:06 GMT
last-modified: Thu, 12 Sep 2024 15:07:17 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 1win.com
URL: https://1win.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.romaestate.co/	1970-01-20 23:35:23	Name: __cf_mw_byp Value: qYSnzf1eg0QfEW5J7G7NBOZOZbUU_jZwdDbFJ2d0n.E-1726436699-0.0.1.1-/link-alternatif-toto12/
.1win.com/	1970-01-21 08:19:32	Name: __ddg1_ Value: FXiWfNIlZVTyh1NpTx5s
1win.com/	1970-01-21 00:18:35	Name: visit_domain Value: 1win.com
1win.com/	1969-12-31 23:59:59	Name: core-sticky Value: http://10.233.108.223:80
1win.com/	1970-01-21 08:19:32	Name: 1w_lang Value: en
1win.com/	1969-12-31 23:59:59	Name: 1w_locale Value: 14
.1win.com/	1970-01-21 01:43:32	Name: _gcl_au Value: 1.1.78705514.1726436705
.1win.com/	1970-01-21 08:19:32	Name: AMP_494cccfe21 Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjIzNWMyMWVjYy1kNjcxLTQxNzktYTQyMi05ZTVhZTI4MzhhMjYlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzI2NDM2NzA0NjUwJTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTcyNjQzNjcwNTQyMyUyQyUyMmxhc3RFdmVudElkJTIyJTNBOCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==
.1win.com/	1970-01-21 09:09:56	Name: _ga Value: GA1.1.1982569574.1726436706
.1win.com/	1970-01-21 09:09:56	Name: _ga_548949LWLW Value: GS1.1.1726436705.1.0.1726436705.60.0.0
.yandex.ru/	1970-01-21 08:19:32	Name: yashr Value: 6323600271726436705
.doubleclick.net/	1970-01-21 03:53:08	Name: receive-cookie-deprecation Value: 1
.1win.com/	1970-01-21 08:19:32	Name: _ym_uid Value: 1726436706728739161
.1win.com/	1970-01-21 08:19:32	Name: _ym_d Value: 1726436706
.doubleclick.net/	1970-01-21 00:17:08	Name: ar_debug Value: 1
.mc.yandex.com/	1970-01-20 23:33:57	Name: sync_cookie_csrf Value: 701271531fake
.doubleclick.net/	1970-01-21 08:55:32	Name: IDE Value: AHWqTUmP24VJgwSeHns8octOlQAUOyyx_R_-dHJnf_74s4HFrQ1NmyzVWVrFDHeq
.yandex.com/	1970-01-21 09:09:56	Name: i Value: UUFoj4o4Cqz2Vwj578Zg9+OABPtwIHuF3iCfDMBuy4ynMRLwWTlHewwVoakpHrQnHyO5KrIwYQxqhP6l3TOjBIMOFxs=
.yandex.com/	1970-01-21 08:19:32	Name: yandexuid Value: 7708238281726436705
.yandex.com/	1970-01-21 08:19:32	Name: yashr Value: 2398010771726436705
.mc.yandex.ru/	1970-01-20 23:33:57	Name: sync_cookie_csrf Value: 2611429274fake
.1win.com/	1970-01-21 08:19:32	Name: _hjSessionUser_2606090 Value: eyJpZCI6IjhiYjBlMTVlLTM4YWYtNTY2OC05OTRkLTc3N2I1NzQxNzY2NCIsImNyZWF0ZWQiOjE3MjY0MzY3MDYwMDEsImV4aXN0aW5nIjpmYWxzZX0=
.1win.com/	1970-01-20 23:33:58	Name: _hjSession_2606090 Value: eyJpZCI6ImNiZGFiNmZhLWRkNjAtNDI4OC1iNjNlLTg4MTRhMzQ2ZWY2OCIsImMiOjE3MjY0MzY3MDYwMDIsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
1win.com/	1969-12-31 23:59:59	Name: _hjHasCachedUserAttributes Value: true
.1win.com/	1970-01-20 23:35:08	Name: _ym_isad Value: 2
.mc.yandex.com/	1970-01-20 23:35:23	Name: sync_cookie_ok Value: synced
.yandex.ru/	1970-01-21 09:09:56	Name: yandexuid Value: 7708238281726436705
.yandex.ru/	1970-01-21 09:09:56	Name: yuidss Value: 7708238281726436705
.yandex.ru/	1970-01-21 09:09:56	Name: i Value: UUFoj4o4Cqz2Vwj578Zg9+OABPtwIHuF3iCfDMBuy4ynMRLwWTlHewwVoakpHrQnHyO5KrIwYQxqhP6l3TOjBIMOFxs=
.yandex.ru/	1970-01-21 09:09:56	Name: yp Value: 1726523106.yu.6067731321726436705
.yandex.ru/	1970-01-21 08:19:32	Name: ymex Value: 1729028706.oyu.6067731321726436705
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1059577191726436706
.yandex.com/	1970-01-21 08:19:32	Name: yuidss Value: 7708238281726436705
.yandex.com/	1970-01-21 08:19:32	Name: ymex Value: 1757972706.yrts.1726436706
.yandex.com/	1970-01-21 08:19:32	Name: receive-cookie-deprecation Value: 1
.yandex.com/	1970-01-21 09:09:56	Name: bh Value: KgI/MGDiqp23Bg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12572451.fls.doubleclick.net
12688802.fls.doubleclick.net
1win.com
ad.doubleclick.net
analytics.google.com
api.lab.amplitude.com
api2.amplitude.com
cheaptitles.co.nz
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
naturewildlife.id
romaestate.co
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
td.doubleclick.net
v1.bundlecdn.com
www.google.com
www.google.fi
www.google.ru
www.googletagmanager.com
www.gstatic.com
1win.com
13.32.27.107
142.250.181.230
142.250.185.198
142.250.186.163
151.101.194.132
154.197.121.128
172.217.18.100
172.67.146.213
172.67.195.139
18.66.102.11
188.114.97.3
190.115.24.78
2001:4860:4802:36::181
216.58.212.162
2a00:1450:4001:801::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2008
2a00:1450:4001:81d::2003
2a00:1450:400c:c1d::9c
2a02:6b8::1:119
34.215.105.9
01a87f9f8138f66274cfedb855c0bfbe1529600a65ed26b0c863533e1e94abce
06e02d3d2d01bb2c88786b0a2dd2d692f6659c0159ec4754f7db49c12e03b0d6
0a32624aa552d924b6fc5334ffe646524e0bc3e5a510a24712d324d50806baa2
0a3a224466f300debb3501190462d41a9038d53a3d014aedda7062fe2167c8dd
0e7e7396a64646afe6200ee5370a98d615e7ce53b938e42c52724731a355ff67
0f6e3e5c53c730a88de6f874ab17cb1283f0ed8580bb22b57578f4f0d601f700
0f87ad06cc9ed9ee43362260fb7b3de880f89a89a88dd0fe3b69e6aca09a710d
107e4f2aa932ded604151c11aefd3e5471af520c26c503938aa99184b83adba4
13b15f93eb2d98d4f7e9d58c481b6e04e54a0caed2b0b19a51cfb2a61adc8449
28b3459e8825410253b4a69098d2d54909af1b6a241cf5264c1fec9b1dede1d1
2955765bae19cde6db96107f735d477b14f7e14d1a13f094ce2b43ccb8215184
394daf2ca11c67f7a6188bc8e31f5dd7e2985db4de06dbc67ab4db2c0886cb7c
3df4b3bf9f6db36c6b9f30b956f88320e05d824152e4c0c5f8cab550e930d5f9
448797aade8c774bb0d8bf418eb7469865095c4e9016fc13095204ba2b6dc3e3
464315c4b50d1c2fc205a9922c85615b83279ca54d05b48f77c1e4577778f131
469f7d31eccc39da2f80434a677332ad98b413e008a73d8059b1e227388247c1
4742a7c7bbc3c690cd8bebf51d127b5ef9197fb49313a15ece626a4972c10aa8
4f83299b70b23330183c8b0e8b494271d65f19e669bc64744322d6edfd5796ad
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
58a372bb9d424111a2e73c427edb10db91c0f05e8f323f046d20f5cf8fd6f30f
5ef00bcf97163af4dfa37c83cd3d9acf5c1df36bf0b354c17c6fe650682895d6
6071fb99e587aa37f08c8f14a5718a3bda75cae32fd1d4ccd0718733a362ab64
66c4135905d8889570877f8bf74d092dbcda1ec84d16791a9eab736415fd396c
67fcfdb76fab63a1032de55bdf6289e3b6ccf64c3afcacaf89076cf211daf44f
6ed1066c3c6947d7a10e0413d11f5c453bd20068061e25a4a3b9c1f5d78e8a90
6eedc22350a65b6ff2c1a86b60582b4896ff5945415547b4bfcd3efbd1da911c
7c5ec8bcb4b305c7e678fd57c1eb2e21dcf58c172cc2f38cfa06d36bd97db781
7fc1e95aebc3c7a3ac0c1d02caae4874ff8f274a5ac8837c189fe075cc413569
82dcbd3db370fd49d3a130886970cfd48796750ab3767c8b6985a2bf825b250b
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
86a11ca8f8761ee42f5ad8f3ec57fed81d52d3b809ce86d9209305dc5c0fb0be
9123cebe41c1fc2c79b22d627451ea38662dc1933286f0bd7ff7a03721821bf1
91c37f6f9a3428c7ff6d586dd887df451dc3576e710e5f821dcfc498c636a089
92ea9bd64fc986968b38a1003174a422f7ea9ff287f3e60257c88edd3577882b
941a034b211a9775af3cf19503b03e661f0c7efabeccecff5616af9c115fbbd8
9be12e59a210d45411e025096615d4308c44a0cffeb791dd452e443c675e8481
9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f
a5cb3d03f299b837679eaa793491a03acc5fc1afdbc7f207b7566646f3bd2ecb
a7cc97d5681d6d3e5921465551231c25df6ea5dec92aeb116e7dd146daef4565
af0a1041be52852f255661c3fd8566b9fe9c99d0391f11fb0a03eaa3bf1a5543
b0c06e8d6ffe3aa5720ec0b9802044e4badd2edb2513437e5c5fdaa5b6592689
b563de728f7ad9022ef94968360931749d32898f02f524b66a73c2630126f4a3
bbe8f034cf83f8e2b54538d197f9a6b4e03e91c080413ff309da07efd8277a41
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
c07b2c0a515caf1306fb4d9366fab5758253eeadcf8c0414cb44ccd48f82e59a
c8f45a2ed95aa92a09929abf62f92cb483c3ab4b4de42f6c38afa96d38e5f02a
ce68e1614ab493deaecfa6eb9711736de0348248e1d559b5f6dfb5dc4c29b459
ce8c2a594c8630b3824b0c92156601c4082d074ae778a049b322d76daf2aa45a
d735d0917cec6e566ff92509d7a65113afb15457afd258c4695a91c829f9dac1
df3772666587111462634070c47969ad9687bbf80d0694bb2e6c33be39434d68
dfbc03c9abeb9b5a91be7afb101f70b860b65717f399e8b844a4412189450507
e021ef9edf3b2db8151fa1fccc8f46fa13aecc81a8bcfffdde84606b0232811d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2a26f3584ca27e45ab12258f5600ed5a2dfe00a0e988a4aafe6446cc81d415
f007c721f3891c6fbc6555f58faf308a9187968bfca7439dd601ae93b621649b
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

1win.com Open in urlscan Pro 190.115.24.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

71 Requests

92 %HTTPS

33 %IPv6

15 Domains

23 Subdomains

20 IPs

7 Countries

1649 kBTransfer

5025 kBSize

36 Cookies

0 Outgoing links

Page URL History

Redirected requests

71 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

1win.com Open in urlscan Pro
190.115.24.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

71
Requests

92 %
HTTPS

33 %
IPv6

15
Domains

23
Subdomains

20
IPs

7
Countries

1649 kB
Transfer

5025 kB
Size

36
Cookies

71 HTTP transactions
1 data transactions