gpay.workers.zone Open in urlscan Pro
2606:4700:3034::6815:1d95  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response gpay.workers.zone/	10 KB 4 KB	2336ms 2305ms	Document text/html	2606:4700:3034::6815:1d95 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1d95 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 6d0a735c1a703546eed1a4088aa51eaa584cc57de1f3d40d1df4f8e29ac63346 Security Headers Name Value Strict-Transport-Security max-age=0; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0 cf-cache-status DYNAMIC cf-ray 8f2d6b3649da3619-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Mon, 16 Dec 2024 08:49:14 GMT last-modified Tue, 01 Jan 1980 00:00:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jJSu7iGdDqLS1wchn9U4dkYbRn5gdmdNhF7CImzjf8qL%2FeiYVLm35F9TFrxf93b1UPGWzAvWh4F8lMTCyynxdv8qUIXRJ8zFqw2djdKLZ3s5V6Rxnq0c%2FzmwwPeR%2FH8cAoMKZ3K%2FdomWw4msHHu5fA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=6324&min_rtt=6133&rtt_var=950&sent=9&recv=12&lost=0&retrans=0&sent_bytes=5002&recv_bytes=2290&delivery_rate=784633&cwnd=255&unsent_bytes=0&cid=483467ee29bd4ebe&ts=2312&x=0" strict-transport-security max-age=0; includeSubDomains; preload vary Accept-Encoding x-cloud-trace-context 7a0f3023e81ea98ef7c023cee00d89e4;o=1 x-content-type-options nosniff x-powered-by Express
GET H2	200	pay.js Show response pay.google.com/gp/p/js/	167 KB 49 KB	101ms 62ms	Script application/javascript	2a00:1450:4013:c06::5c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pay.google.com/gp/p/js/pay.js Requested by Host: gpay.workers.zone URL: https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4013:c06::5c Groningen, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d79bb88f8991067cf95124262f920d04905c08785b5e4a99131b35674c8ff2b0 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-pZrPwn5bX-yRF8TsT44JHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 16 Dec 2024 08:49:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." date Mon, 16 Dec 2024 08:49:15 GMT content-type application/javascript; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 reporting-endpoints default="/gp/p/_/InstantbuyFrontendHttp/web-reports?context=eJzjKtHikmII0JBiWFYqxbBkphSDxNeXTBpA7JQ-gzUIiFtvnmOdCsRzA86zhmeeZzVae57VCYiT_p1nLQJia_5LrIYKl1gdgfhX3iVW1Z5LrKZAXCRxhbUJiOtDr7JuuXqVdSPrNdZZFtdYA7KusQpxc3Rf_r-LTeDBmusKStpJ-YXxmXnFJYl5JUmllWlF-XklqXkpxalFZalF8UYGRiaGRoZGegbG8QUGAKIjRF4" content-security-policy script-src 'report-sample' 'nonce-pZrPwn5bX-yRF8TsT44JHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport cache-control private, max-age=600 cross-origin-opener-policy same-origin accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/InstantbuyFrontendHttp/cspreport/fine-allowlist permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* x-xss-protection 0 server ESF
GET H2	200	payframe pay.google.com/gp/p/ui/ Frame 90BC	0 0	229ms 202ms	Document text/html	2a00:1450:4013:c06::5c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fgpay.workers.zone&mid= Requested by Host: pay.google.com URL: https://pay.google.com/gp/p/js/pay.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4013:c06::5c Groningen, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-Pag4LBfDSv3eTPUY5et4qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://gpay.workers.zone/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=3600 content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-Pag4LBfDSv3eTPUY5et4qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport content-security-policy-report-only script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.de.EXcpQiqSfK4.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/fine-allowlist content-type text/html; charset=utf-8 cross-origin-opener-policy same-origin cross-origin-resource-policy same-site date Mon, 16 Dec 2024 08:49:15 GMT expires Mon, 16 Dec 2024 08:49:15 GMT origin-trial AssDE6uDpaVUq9mb8HyrCnDR4hxNa3P1PQl8E0huFRpGw4MFWswRwyuk1E68LufiBFMulCrRk3VCexIRW39eYwoAAABMeyJvcmlnaW4iOiJodHRwczovL3BheS5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJUcGNkIiwiZXhwaXJ5IjoxNzM1MzQzOTk5fQ== permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* reporting-endpoints default="/gp/p/_/InstantbuyFrontendBuyflowPayframeUi/web-reports?context=eJzjKtHikmII0JBiWFYqxbBkphSDxNeXTBpA7JQ-gzUIiFtvnmOdCsRzA86zhmeeZzVae57VCYiT_p1nLQJia_5LrIYKl1gdgfhX3iVW1Z5LrKZAXCRxhbUJiOtDr7JuuXqVdSPrNdZZFtdYA7KusQrxcHRf_r-LTeBB16Q5jEraSfmF8Zl5xSWJeSVJpZVpRfl5Jal5KcWpRWWpRfFGBkYmhkaGRnoGxvEFBgDaiER1" server ESF strict-transport-security max-age=31536000 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-content-type-options nosniff x-ua-compatible IE=edge x-xss-protection 0
GET H2	200	css fonts.googleapis.com/	9 KB 2 KB	43ms 17ms	Stylesheet text/css	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google+Sans_old:500 Requested by Host: client URL: about:client Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ced95c0bb24468c964a5ecdc29c9344bc2b5a904d63033daa4a5fae72a756584 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 16 Dec 2024 08:49:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 16 Dec 2024 08:49:15 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Mon, 16 Dec 2024 08:19:00 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	generate_gpay_btn_img pay.google.com/gp/p/ Frame D7E5	0 0	89ms 64ms	Document text/html	2a00:1450:4013:c06::5c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pay.google.com/gp/p/generate_gpay_btn_img?buttonColor=black&browserLocale=en&hl=en&buttonSizeMode=static&allowedPaymentMethods=%5B%7B%22type%22%3A%22CARD%22%2C%22parameters%22%3A%7B%22allowedAuthMethods%22%3A%5B%22PAN_ONLY%22%2C%22CRYPTOGRAM_3DS%22%5D%2C%22allowedCardNetworks%22%3A%5B%22AMEX%22%2C%22DISCOVER%22%2C%22INTERAC%22%2C%22JCB%22%2C%22MASTERCARD%22%2C%22VISA%22%5D%7D%7D%5D&gpayButtonVariantType=1&gpayButtonType=long Requested by Host: gpay.workers.zone URL: https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4013:c06::5c Groningen, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport script-src 'report-sample' 'nonce-vzfB30z-rz_9hKKIlffvlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport/allowlist script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayButtonUi.en.soaYGtz4vOQ.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/;report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport/fine-allowlist Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://gpay.workers.zone/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport script-src 'report-sample' 'nonce-vzfB30z-rz_9hKKIlffvlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport/allowlist script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayButtonUi.en.soaYGtz4vOQ.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/;report-uri /_/InstantbuyFrontendBuyflowPayButtonUi/cspreport/fine-allowlist content-type text/html; charset=utf-8 cross-origin-opener-policy same-origin cross-origin-resource-policy same-site date Mon, 16 Dec 2024 08:49:15 GMT expires Mon, 01 Jan 1990 00:00:00 GMT origin-trial AssDE6uDpaVUq9mb8HyrCnDR4hxNa3P1PQl8E0huFRpGw4MFWswRwyuk1E68LufiBFMulCrRk3VCexIRW39eYwoAAABMeyJvcmlnaW4iOiJodHRwczovL3BheS5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJUcGNkIiwiZXhwaXJ5IjoxNzM1MzQzOTk5fQ== permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache reporting-endpoints default="/gp/p/_/InstantbuyFrontendBuyflowPayButtonUi/web-reports?context=eJzjKtHikmII0JBiWFYqxbBkphSDxNeXTBpA7JQ-gzUIiFtvnmOdCsRzA86zhmeeZzVae57VCYiT_p1nLQJia_5LrIYKl1gdgfhX3iVW1Z5LrKZAXCRxhbUJiOtDr7JuuXqVdSPrNdZZFtdYA7KusQpxc3Rf_r-LTeDFgx-RStpJ-YXxmXnFJYl5JUmllWlF-XklqXkpxalFZalF8UYGRiaGRoZGegbG8QUGAL24RPQ" server ESF strict-transport-security max-age=31536000 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-content-type-options nosniff x-xss-protection 0
GET H2	200	payment_white_36dp.png www.gstatic.com/images/icons/material/system/1x/	149 B 446 B	35ms 8ms	Image image/png	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/icons/material/system/1x/payment_white_36dp.png Requested by Host: gpay.workers.zone URL: https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 004d7aa90e2889f6291a71c84ac3d3e394e0cade32bd41dc214736418f769181 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers age 516443 report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} x-content-type-options nosniff expires Wed, 10 Dec 2025 09:21:52 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 10 Dec 2024 09:21:52 GMT last-modified Thu, 02 Nov 2023 22:48:00 GMT content-type image/png vary Origin cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" content-length 149 x-xss-protection 0 server sffe
GET H2	200	dark_gpay.svg www.gstatic.com/instantbuy/svg/	2 KB 1 KB	34ms 7ms	Image image/svg+xml	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/instantbuy/svg/dark_gpay.svg Requested by Host: gpay.workers.zone URL: https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f383d270511912b2da11555947cb3e6012e6375cb5f0d90493c25f6048169073 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers content-encoding br age 468707 report-to {"group":"instantbuy-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/instantbuy-eng"}]} x-content-type-options nosniff expires Wed, 10 Dec 2025 22:37:28 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 10 Dec 2024 22:37:28 GMT last-modified Sun, 25 Jun 2023 02:58:00 GMT content-type image/svg+xml vary Accept-Encoding content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng cache-control public, max-age=31536000 cross-origin-opener-policy same-origin; report-to="instantbuy-eng" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 871 x-xss-protection 0 server sffe
GET H3	200	4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2 fonts.gstatic.com/s/googlesans/v60/	22 KB 22 KB	23ms 7ms	Font font/woff2	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v60/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google+Sans_old:500 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software sffe / Resource Hash bf7fd548e6b782afc630d74d28dc23043f5f7f1c4128d205369071830c878308 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://gpay.workers.zone Referer https://fonts.googleapis.com/ Response headers age 224864 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Sat, 13 Dec 2025 18:21:31 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 13 Dec 2024 18:21:31 GMT last-modified Wed, 31 Jul 2024 20:32:05 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 22316 x-xss-protection 0 server sffe
GET H2	200	light_square_gpay.svg www.gstatic.com/instantbuy/svg/	2 KB 1012 B	9ms 8ms	Other image/svg+xml	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/instantbuy/svg/light_square_gpay.svg Requested by Host: gpay.workers.zone URL: https://gpay.workers.zone/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c76f766ed128ff1c05cbab4f53e470751b475152992a770d42273047bc1708c5 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers content-encoding br age 420840 report-to {"group":"instantbuy-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/instantbuy-eng"}]} x-content-type-options nosniff expires Thu, 11 Dec 2025 11:55:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 11 Dec 2024 11:55:15 GMT last-modified Fri, 03 Mar 2023 17:58:00 GMT content-type image/svg+xml vary Accept-Encoding content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng cache-control public, max-age=31536000 cross-origin-opener-policy same-origin; report-to="instantbuy-eng" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 894 x-xss-protection 0 server sffe
GET H2	404	favicon.ico gpay.workers.zone/	150 B 705 B	1880ms 1880ms	Other text/html	2606:4700:3034::6815:1d95 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://gpay.workers.zone/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1d95 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c Security Headers Name Value Content-Security-Policy default-src 'none' Strict-Transport-Security max-age=0; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://gpay.workers.zone/ Response headers content-encoding zstd cf-cache-status MISS report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bp1ZOpEaKlyRkLVH7Md3xoT2GwNLG6QTNq3cmDs6W8LxzbnnkNfb9vF0tnFGc00WGhixLDBaGASfwNsI6p5hA9VPssRGE%2BGJh8DiwF1d5WXdyWc9icpkr0IkGxcxeYutExSJfHjVH5y92DfcWUFYww%3D%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=11432&min_rtt=6133&rtt_var=10702&sent=15&recv=16&lost=0&retrans=0&sent_bytes=8748&recv_bytes=2449&delivery_rate=831143&cwnd=257&unsent_bytes=0&cid=483467ee29bd4ebe&ts=4598&x=0" date Mon, 16 Dec 2024 08:49:17 GMT content-type text/html; charset=utf-8 vary Accept-Encoding x-cloud-trace-context ff20bf21edc711e68fd3d7fdbfbfa52f strict-transport-security max-age=0; includeSubDomains; preload content-security-policy default-src 'none' cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8f2d6b473f2d3619-FRA x-powered-by Express server cloudflare

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| getGoogleIsReadyToPayRequest function| getGooglePaymentDataRequest function| getGooglePaymentsClient function| onGooglePayLoaded function| addGooglePayButton function| getGoogleTransactionInfo function| prefetchGooglePaymentData function| onGooglePaymentButtonClicked function| processPayment function| displayRequestObject function| displayResponseObject object| denylistedDomainsHashedValueListForGpayButtonWithCardInfo object| whitelistedDomainsHashedValueListForGpayButtonWithCardInfo object| denylistedMerchentIdsHashedValueListForGpayButtonWithCardInfo object| denylistedMerchantIdsHashedValueListForGpayButtonVariant object| allowlistedMerchantDomainsForBnplDynamicButton object| allowlistedMerchantDomainsForRlmiaDynamicButton object| allowlistedMerchantDomainsForPopupModeLoadingScreen string| dynamicGpayButtonVariant object| google

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.google.com/	1970-01-21 06:09:10	Name: NID Value: 520=maoFu_PrSnsOqivi0_sHhwcIb-rK3lQWAv3x2Y_wsVPuk3E2E0tlGrzcwI6I0GROFPXCWQgQVZw9NoPpMdwEkstAcNcI4Rk5z5i-eC3iU0uV6ChuZXsQRh_KfhujF-ZQUHE2JFIbpy6sxDYrt5iFvN7C3OExXDltUs0ZGMx4bm_elZk

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://gpay.workers.zone/ Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://gpay.workers.zone/ Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".
other	warning	URL: https://gpay.workers.zone/ Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://gpay.workers.zone/ Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".
network	error	URL: https://gpay.workers.zone/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
gpay.workers.zone
pay.google.com
www.gstatic.com
142.250.186.131
2606:4700:3034::6815:1d95
2a00:1450:4001:810::2003
2a00:1450:4001:813::200a
2a00:1450:4013:c06::5c
004d7aa90e2889f6291a71c84ac3d3e394e0cade32bd41dc214736418f769181
6d0a735c1a703546eed1a4088aa51eaa584cc57de1f3d40d1df4f8e29ac63346
6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c
bf7fd548e6b782afc630d74d28dc23043f5f7f1c4128d205369071830c878308
c76f766ed128ff1c05cbab4f53e470751b475152992a770d42273047bc1708c5
ced95c0bb24468c964a5ecdc29c9344bc2b5a904d63033daa4a5fae72a756584
d79bb88f8991067cf95124262f920d04905c08785b5e4a99131b35674c8ff2b0
f383d270511912b2da11555947cb3e6012e6375cb5f0d90493c25f6048169073