urlscan.io logo urlscan.io
SecurityTrails logo

energy-gewinner24.com Open in urlscan Pro
213.238.42.217  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.google.com/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-strike-atlanta&ct=ga&c...
Effective URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub...
Submission: On November 28 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 5 countries across 11 domains to perform 15 HTTP transactions. The main IP is 213.238.42.217, located in Jena, Germany and belongs to WORK-AS N@work Internet Informationssysteme GmbH, DE. The main domain is energy-gewinner24.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 8th 2019. Valid for: 3 months.
This is the only time energy-gewinner24.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
1 1 69.195.124.50 46606 (UNIFIEDLA...)
1 176.114.9.149 56485 (THEHOST-AS)
3 3 209.205.219.178 55081 (24SHELLS)
3 6 2606:4700:10:... 13335 (CLOUDFLAR...)
1 1 212.32.250.17 60781 (LEASEWEB-...)
1 1 2a05:d018:483... 16509 (AMAZON-02)
1 1 2a05:d018:483... 16509 (AMAZON-02)
1 2 52.35.133.55 16509 (AMAZON-02)
6 213.238.42.217 9211 (WORK-AS N...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
15 7
1    2a00:1450:4001:818::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    69.195.124.50 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box850.bluehost.com
thewayofshea.com
1    176.114.9.149 (Ukraine)

ASN56485 (THEHOST-AS, UA)
PTR: dg.alekseev.freedomain.thehost.com.ua
176.114.9.149
3    209.205.219.178 (Piscataway, United States)

ASN55081 (24SHELLS - 24 SHELLS, US)
PTR: static-178-219-205-209.24shells.net
abc2.adtelligent.com
6    2606:4700:10::6814:aa1c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
r.adport.io
cdn.adport.io
1    212.32.250.17 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
track.leadsglb.com
1    2a05:d018:483:6130:7095:9e50:e827:1089 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
cd-down.com
1    2a05:d018:483:6110:28a3:5089:71b9:6ad5 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
gfstrck.com
2    52.35.133.55 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-35-133-55.us-west-2.compute.amazonaws.com
www.syntaurus.com
6    213.238.42.217 (Jena, Germany)

ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE)
energy-gewinner24.com
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
2    2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
Domain Requested by
6 energy-gewinner24.com energy-gewinner24.com
4 r.adport.io 3 redirects 176.114.9.149
3 abc2.adtelligent.com 3 redirects
2 fonts.gstatic.com energy-gewinner24.com
2 www.syntaurus.com 1 redirects r.adport.io
2 cdn.adport.io 176.114.9.149
1 fonts.googleapis.com energy-gewinner24.com
1 gfstrck.com 1 redirects
1 cd-down.com 1 redirects
1 track.leadsglb.com 1 redirects
1 thewayofshea.com 1 redirects
1 www.google.com
15 12

This site contains no links.

Subject Issuer Validity Valid
www.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
ssl490217.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-10-09 -
2020-04-16		 6 months crt.sh
*.trackrevenue.com
Amazon		 2019-06-26 -
2020-07-26		 a year crt.sh
energy-gewinner24.com
Let's Encrypt Authority X3		 2019-10-08 -
2020-01-06		 3 months crt.sh
*.googleapis.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Frame ID: 9E1AD3C9666A24760828842F08CFC0AA
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.google.com/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-st... Page URL
  2. https://thewayofshea.com/ydrscq/kmng74.php?ca=uber-strike-atlanta HTTP 302
    http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.20... Page URL
  3. https://abc2.adtelligent.com/tracking/pushclick?adid=02DB5AC3167FCEFB_377418_473927 HTTP 302
    https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9... Page URL
  4. https://r.adport.io/v/EOZ8L8cbp5hAJkPciKf89sbNDDcHw54FOXKxO1XfH-qAA0g-82eHMgOEV8SJ20QlGuwmKKm923... HTTP 302
    https://track.leadsglb.com/click?pid=26&offer_id=282&sub1=ed766070-1213-11ea-9fa3-114ffe561ee3&sub2=136... HTTP 302
    https://cd-down.com/?a=53609&c=197463&s1=26_13632_5238604&s2=5de01da23853030001090de6 HTTP 302
    https://gfstrck.com/?a=53609&c=197463&oc=87537&sr=t&s1=26_13632_5238604&s2=5de01da23853030001090... HTTP 302
    https://www.syntaurus.com/click/8qM00hDYRP?cid=8d5d9b379edc4551a836d31626ff577310d6c&sub-id=53609&sub-... HTTP 302
    https://www.syntaurus.com/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-... Page URL
  5. https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&s... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /gws/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

15
Requests

93 %
HTTPS

50 %
IPv6

11
Domains

12
Subdomains

7
IPs

5
Countries

957 kB
Transfer

1003 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.google.com/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-strike-atlanta&ct=ga&cd=CAEYACoSNjQwNzUwNDkxNDIwODYyNTQ3Mho4YTNkMjUzYWYyYmFiZTY0OmNvbTplbjpVUw&usg=AFQjCNHtXPqr0jAkra82DudQIiQs0RAisA Page URL
  2. https://thewayofshea.com/ydrscq/kmng74.php?ca=uber-strike-atlanta HTTP 302
    http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb Page URL
  3. https://abc2.adtelligent.com/tracking/pushclick?adid=02DB5AC3167FCEFB_377418_473927 HTTP 302
    https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w Page URL
  4. https://r.adport.io/v/EOZ8L8cbp5hAJkPciKf89sbNDDcHw54FOXKxO1XfH-qAA0g-82eHMgOEV8SJ20QlGuwmKKm92391AtMIHpSQM9djOzISUtO4KhKzDlVcuiblG9ZSa9z0KtNcPder-XSXWO-SYsrs8khb-Bb6S4tjxM8KLg6AxmTzbIxjwbR4dKlPnU34t0Hqy84GLUvBoCR89TOAT-Dxel1TJdQa4oliEMSH00jalmCMQpdZqefblJ3gl_bMtCEnBfc_2281tndrtDzWdT73wt5mWkKaof4YSWNoMiY3JiQ3nxvKzbj1Kbvz-a7tkpjzqXTkpiqDisgXyYIo HTTP 302
    https://track.leadsglb.com/click?pid=26&offer_id=282&sub1=ed766070-1213-11ea-9fa3-114ffe561ee3&sub2=13632_5238604 HTTP 302
    https://cd-down.com/?a=53609&c=197463&s1=26_13632_5238604&s2=5de01da23853030001090de6 HTTP 302
    https://gfstrck.com/?a=53609&c=197463&oc=87537&sr=t&s1=26_13632_5238604&s2=5de01da23853030001090de6&vt=1574968738873&h=8a4ea113bde93ab417b12023b21c8e35c104e287&req=https%3A%2F%2Fcd-down.com%2F%3Fa%3D53609%26c%3D197463%26s1%3D26_13632_5238604%26s2%3D5de01da23853030001090de6&us=e329996c2daa42f6862091eb8e577ed6 HTTP 302
    https://www.syntaurus.com/click/8qM00hDYRP?cid=8d5d9b379edc4551a836d31626ff577310d6c&sub-id=53609&sub-id2=26_13632_5238604 HTTP 302
    https://www.syntaurus.com/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26sub-id%3D53609%26sub-id2%3D26_13632_5238604 Page URL
  5. https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://thewayofshea.com/ydrscq/kmng74.php?ca=uber-strike-atlanta HTTP 302
  • http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
Request Chain 2
  • https://abc2.adtelligent.com/tracking/icon?adid=02DB5AC3167FCEFB_377418_473927 HTTP 302
  • https://r.adport.io/i/ic/EOXDheK9vdOzDmp_kRMzk10g9fcnxQCdG33xjANu3fU41rc_7SbaRb9Fw-lm_xyRGWJYttNAmtJoN1HK8O8NEDmU-DxIJRHZH_4YMpjt_gDWcxLwgB5X9F5tUPWwEM3rItVl-kThG5rDH3PZCnGvVcbv2xW2LVfWGoBoFjsYwFNGx8TxyWUInTDc4n1-x60jpigdWrHgOAfjolceFfIFYtoHY0kY_mWgP0vmebg-KSHKzvVazb6rmub7Homz2RNxd2DcSIQ6_p-aTESU5Oi3IeOp9NbxqEtzdBOzWDxI1_Kk HTTP 302
  • https://cdn.adport.io/file/XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.png
Request Chain 3
  • https://abc2.adtelligent.com/tracking/image?adid=02DB5AC3167FCEFB_377418_473927 HTTP 302
  • https://r.adport.io/i/im/EHWtkUZ8qMBzKt8R1yjLn9oLIETT8DMY-BdgbkPFoW7c09jVJn4PxoIQjnBNc6FVc-Iy43smdtbh5IyP2RZzdmd6CS2Wb7fnozA4fe0uNhxNp1t09uoVdLtf4_MA3KMx1e-bznIxYc25t-MpE1wm62HVdvQk-A_DfPbzoPSfsLjjBKhFCI2nigLPS__qc9AYmlGPBggX8i2dbyce6BLyHZnxSFDciZCFejfh9J_gVpaDR8ZFdbJm7m7uPzDpcdaV5vWqmnftcCNSFL4lZX5qQd1ZMUXYTjErES_LNZDkiH4F HTTP 302
  • https://cdn.adport.io/file/6HMrzL3B1gpf5uUcbEfkQ4pK05WTbZmBKzKdBfVrTU8.jpg
Request Chain 4
  • https://abc2.adtelligent.com/tracking/pushclick?adid=02DB5AC3167FCEFB_377418_473927 HTTP 302
  • https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w
Request Chain 5
  • https://r.adport.io/v/EOZ8L8cbp5hAJkPciKf89sbNDDcHw54FOXKxO1XfH-qAA0g-82eHMgOEV8SJ20QlGuwmKKm92391AtMIHpSQM9djOzISUtO4KhKzDlVcuiblG9ZSa9z0KtNcPder-XSXWO-SYsrs8khb-Bb6S4tjxM8KLg6AxmTzbIxjwbR4dKlPnU34t0Hqy84GLUvBoCR89TOAT-Dxel1TJdQa4oliEMSH00jalmCMQpdZqefblJ3gl_bMtCEnBfc_2281tndrtDzWdT73wt5mWkKaof4YSWNoMiY3JiQ3nxvKzbj1Kbvz-a7tkpjzqXTkpiqDisgXyYIo HTTP 302
  • https://track.leadsglb.com/click?pid=26&offer_id=282&sub1=ed766070-1213-11ea-9fa3-114ffe561ee3&sub2=13632_5238604 HTTP 302
  • https://cd-down.com/?a=53609&c=197463&s1=26_13632_5238604&s2=5de01da23853030001090de6 HTTP 302
  • https://gfstrck.com/?a=53609&c=197463&oc=87537&sr=t&s1=26_13632_5238604&s2=5de01da23853030001090de6&vt=1574968738873&h=8a4ea113bde93ab417b12023b21c8e35c104e287&req=https%3A%2F%2Fcd-down.com%2F%3Fa%3D53609%26c%3D197463%26s1%3D26_13632_5238604%26s2%3D5de01da23853030001090de6&us=e329996c2daa42f6862091eb8e577ed6 HTTP 302
  • https://www.syntaurus.com/click/8qM00hDYRP?cid=8d5d9b379edc4551a836d31626ff577310d6c&sub-id=53609&sub-id2=26_13632_5238604 HTTP 302
  • https://www.syntaurus.com/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26sub-id%3D53609%26sub-id2%3D26_13632_5238604

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
url
www.google.com/ 		996 B
874 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-strike-atlanta&ct=ga&cd=CAEYACoSNjQwNzUwNDkxNDIwODYyNTQ3Mho4YTNkMjUzYWYyYmFiZTY0OmNvbTplbjpVUw&usg=AFQjCNHtXPqr0jAkra82DudQIiQs0RAisA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
gws /
Resource Hash
821ad4fb2a1ce1f59f08182256599d4983b0f57916c1379c6993e144aa6725f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-strike-atlanta&ct=ga&cd=CAEYACoSNjQwNzUwNDkxNDIwODYyNTQ3Mho4YTNkMjUzYWYyYmFiZTY0OmNvbTplbjpVUw&usg=AFQjCNHtXPqr0jAkra82DudQIiQs0RAisA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Thu, 28 Nov 2019 19:18:55 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding
br
server
gws
content-length
509
x-xss-protection
0
set-cookie
NID=192=1SEMDEaVEIrcyoDAFrL3pD16pQA5OExt-U48wexZ7EIBoOU5HI2rdtzVIhchTUCOsAq2oGhsfctDX82FGwnFsKQApTuqQyAIP-viVdYcWIbOOC-4t94cjOBDWnRDGgV5y4dR3CRIoYPahC5yejfs1KyUy6GTGaNt5pEDbqbfC0Q; expires=Fri, 29-May-2020 19:18:55 GMT; path=/; domain=.google.com; HttpOnly CONSENT=WP.280db3; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
offer
176.114.9.149/
Redirect Chain
  • https://thewayofshea.com/ydrscq/kmng74.php?ca=uber-strike-atlanta
  • http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
879 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
Requested by
Host: www.google.com
URL: https://www.google.com/url?rct=j&sa=t&url=https://thewayofshea.com/ydrscq/kmng74.php%3Fca%3Duber-strike-atlanta&ct=ga&cd=CAEYACoSNjQwNzUwNDkxNDIwODYyNTQ3Mho4YTNkMjUzYWYyYmFiZTY0OmNvbTplbjpVUw&usg=AFQjCNHtXPqr0jAkra82DudQIiQs0RAisA
Protocol
HTTP/1.1
Server
176.114.9.149 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
dg.alekseev.freedomain.thehost.com.ua
Software
fasthttp /
Resource Hash
a6bb778cc2098eb8eb93c2661be620b209702e38d2e1972729e7eb0250f2f90c

Request headers

Host
176.114.9.149:8081
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.google.com/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.google.com/

Response headers

Server
fasthttp
Date
Thu, 28 Nov 2019 19:18:56 GMT
Content-Type
text/html
Content-Length
879
Access-Control-Allow-Methods
OPTIONS,GET,POST
Access-Control-Allow-Headers
*
Access-Control-Allow-Origin
https://www.google.com
Access-Control-Allow-Credentials
true
Connection
close

Redirect headers

status
302
server
nginx/1.14.1
date
Thu, 28 Nov 2019 19:18:56 GMT
content-type
text/html; charset=UTF-8
location
http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=5f34ebaee33be9ac735bfb2bf7510be7; path=/ _subid=3nrha4fus26q65uk; expires=Fri, 29-Nov-2019 19:18:56 GMT; Max-Age=86400; path=/; domain=.thewayofshea.com 2a2af=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE5OFwiOjE1NzQ5Njg3MzYsXCIxOTZcIjoxNTc0OTY4NzM2fSxcImNhbXBhaWduc1wiOntcIjQ0XCI6MTU3NDk2ODczNixcIjU4XCI6MTU3NDk2ODczNn0sXCJ0aW1lXCI6MTU3NDk2ODczNn0ifQ.5gTt20uwKVPIQZNxNz4LgHSirk5_stMuQ-bt4odAats; expires=Fri, 29-Nov-2019 19:18:56 GMT; Max-Age=86400; path=/; domain=.thewayofshea.com
XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.png
cdn.adport.io/file/
Redirect Chain
  • https://abc2.adtelligent.com/tracking/icon?adid=02DB5AC3167FCEFB_377418_473927
  • https://r.adport.io/i/ic/EOXDheK9vdOzDmp_kRMzk10g9fcnxQCdG33xjANu3fU41rc_7SbaRb9Fw-lm_xyRGWJYttNAmtJoN1HK8O8NEDmU-DxIJRHZH_4YMpjt_gDWcxLwgB5X9F5tUPWwEM3rItVl-kThG5rDH3PZCnGvVcbv2xW2LVfWGoBoFjsYwFNG...
  • https://cdn.adport.io/file/XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.png
43 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.adport.io/file/XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.png
Requested by
Host: 176.114.9.149
URL: http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:aa1c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:18:58 GMT
cf-cache-status
HIT
age
3497
cf-polished
origFmt=png, origSize=70118
status
200
content-disposition
inline; filename="XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.webp"
content-length
44356
last-modified
Wed, 27 Nov 2019 17:16:11 GMT
server
cloudflare
etag
"977af3823ed063e6061f098180b8d896"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
53ceb0d6282f5976-VIE
cf-bgj
imgq:100

Redirect headers

date
Thu, 28 Nov 2019 19:18:58 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://cdn.adport.io/file/XEGcF8eE9qII7z9POOfdAQOefNCy0x4jIl5M8vZFAsg.png
content-type
text/html; charset=utf-8
status
302
cf-ray
53ceb0d53f715976-VIE
6HMrzL3B1gpf5uUcbEfkQ4pK05WTbZmBKzKdBfVrTU8.jpg
cdn.adport.io/file/
Redirect Chain
  • https://abc2.adtelligent.com/tracking/image?adid=02DB5AC3167FCEFB_377418_473927
  • https://r.adport.io/i/im/EHWtkUZ8qMBzKt8R1yjLn9oLIETT8DMY-BdgbkPFoW7c09jVJn4PxoIQjnBNc6FVc-Iy43smdtbh5IyP2RZzdmd6CS2Wb7fnozA4fe0uNhxNp1t09uoVdLtf4_MA3KMx1e-bznIxYc25t-MpE1wm62HVdvQk-A_DfPbzoPSfsLjj...
  • https://cdn.adport.io/file/6HMrzL3B1gpf5uUcbEfkQ4pK05WTbZmBKzKdBfVrTU8.jpg
28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.adport.io/file/6HMrzL3B1gpf5uUcbEfkQ4pK05WTbZmBKzKdBfVrTU8.jpg
Requested by
Host: 176.114.9.149
URL: http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:aa1c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a169548edea563c4a74e3720f44b1fd80399bd3da0cdafae84c59965437e1a7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:18:58 GMT
cf-cache-status
HIT
age
3373
cf-polished
origSize=31869, status=webp_bigger
status
200
content-length
28542
last-modified
Wed, 27 Nov 2019 17:19:03 GMT
server
cloudflare
etag
"6d370c1ce8ea5ab6543b3a5431f7fbc4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
53ceb0d6282e5976-VIE
cf-bgj
imgq:100

Redirect headers

date
Thu, 28 Nov 2019 19:18:58 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://cdn.adport.io/file/6HMrzL3B1gpf5uUcbEfkQ4pK05WTbZmBKzKdBfVrTU8.jpg
content-type
text/html; charset=utf-8
status
302
cf-ray
53ceb0d53f725976-VIE
EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEu...
r.adport.io/c/
Redirect Chain
  • https://abc2.adtelligent.com/tracking/pushclick?adid=02DB5AC3167FCEFB_377418_473927
  • https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMN...
1 KB
790 B 		Document
General
Check archive.org
Download Go to
Full URL
https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w
Requested by
Host: 176.114.9.149
URL: http://176.114.9.149:8081/offer?sid=USA_All_k1&keys=uber+strike+atlanta&lan=&redir=http%3A%2F%2F149.202.65.142%2FmxJV5f%3Fsub_id_1%3DUSA_k1_tb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:aa1c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
095e147c990a964045de29c624b9805fc28abad79d6889d87b3830db8009b119

Request headers

:method
GET
:authority
r.adport.io
:scheme
https
:path
/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
cookie
__cfduid=d0bac52d45a96d98b0e66ca40cbd821661574968738
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 28 Nov 2019 19:18:58 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
53ceb0d6e8b95976-VIE
content-encoding
br

Redirect headers

Server
VertaMedia 1.0
Date
Thu, 28 Nov 2019 19:18:58 GMT
Content-Length
0
Location
https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Keep-Alive
timeout=7200
d.php
www.syntaurus.com/main/
Redirect Chain
  • https://r.adport.io/v/EOZ8L8cbp5hAJkPciKf89sbNDDcHw54FOXKxO1XfH-qAA0g-82eHMgOEV8SJ20QlGuwmKKm92391AtMIHpSQM9djOzISUtO4KhKzDlVcuiblG9ZSa9z0KtNcPder-XSXWO-SYsrs8khb-Bb6S4tjxM8KLg6AxmTzbIxjwbR4dKlPnU3...
  • https://track.leadsglb.com/click?pid=26&offer_id=282&sub1=ed766070-1213-11ea-9fa3-114ffe561ee3&sub2=13632_5238604
  • https://cd-down.com/?a=53609&c=197463&s1=26_13632_5238604&s2=5de01da23853030001090de6
  • https://gfstrck.com/?a=53609&c=197463&oc=87537&sr=t&s1=26_13632_5238604&s2=5de01da23853030001090de6&vt=1574968738873&h=8a4ea113bde93ab417b12023b21c8e35c104e287&req=https%3A%2F%2Fcd-down.com%2F%3Fa%...
  • https://www.syntaurus.com/click/8qM00hDYRP?cid=8d5d9b379edc4551a836d31626ff577310d6c&sub-id=53609&sub-id2=26_13632_5238604
  • https://www.syntaurus.com/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26s...
239 B
456 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.syntaurus.com/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26sub-id%3D53609%26sub-id2%3D26_13632_5238604
Requested by
Host: r.adport.io
URL: https://r.adport.io/c/EKva-9ST3BJRMtc34Ct-yUTsSjoOhJ1tbT2u353zgFz-wSDEleAtXHAWIKUkh2KQvF8IamAQl9aVdnZCE5yHSUbh0giZFpZFHokfcm2BiZlo139JUlie9OVxJeaCI7pWMicMaGIK1kv3pFEZ4Pd7QDDC96KG0aWlT-rKIXH2qHP_OMNn24zXwtGK6AcgFypNHOnEuTYXvVH2vhQ6UHzJrcJKvaXlzkaBOaD-sZd0Ztr7rOJm-gsOPT-fS5U69dJxeJjk0L6EmhgDPduFG9JjSvUs1B5zTAiYpuh-xXqKgdFVqS6xDzQL94i6DZuikjzC7w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.35.133.55 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-35-133-55.us-west-2.compute.amazonaws.com
Software
nginx/1.11.6 /
Resource Hash
6945cdfee0e95bbab7941228c271f6b6f6107a0448e7445da1d124b73fc20cc7

Request headers

:method
GET
:authority
www.syntaurus.com
:scheme
https
:path
/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26sub-id%3D53609%26sub-id2%3D26_13632_5238604
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
cookie
AWSALB=0tJLcdh3HhOuRvB/x/Iny1VtDU+cDLLFqOFHvUUI0T8zzyp5qfKR96KI1AZYvPyfH+BQaM13zXUELvfqOjxRtOZxeWWDp3wVm8II+/cf1FyX9hG3igf6dyku2Z/y; XSRF-TOKEN=eyJpdiI6InZaaUxhcmVqcktzaHdwS0dKRlpFUWc9PSIsInZhbHVlIjoiRkp0Z3I0VE1TOUNjR005Z01aZjFEXC83VlFibDFRVVZNYU1EK3RCOE1XanZiK0R0UzlZZExmTGVJOXdqbXM4TkNhWjF4OVBZVHhcL3NKd2c2Q0pMckhOQT09IiwibWFjIjoiMzQ2MDY5OTY5MjliNjFkMTMyZTIzMGMzNzlkNjcwMTU3YjZlZjk3MGEwYjA2YzI2NTJhZDAzZmYxYWMyOWIxZiJ9; session=eyJpdiI6InlJZ20zUXZzVnZEYmZ2ZnQxMXhPeXc9PSIsInZhbHVlIjoiYnFPWFcrUkQ1WHBkaVBMUG14elFNQ1pLajRLVFZlOTRURFdaemNpY2txcjFtbUFQdzZVWVE5WFwvc1BRVzBBZ1pMOEp4bE8rZUZ6S1Z5bWxvVGdGXC9Wdz09IiwibWFjIjoiMmUyMDA3YjI0YWFkYzA5ZmJiNjFmZjE5NmJmOWVjNGJhNjZlOTBhNWIxM2E3M2E3Y2EzM2Q0ZjEyOTFiZTc0NyJ9; ept2=eyJpdiI6IkQ2REZkTTQ3Z1VOV2RUY2xXNmFxR0E9PSIsInZhbHVlIjoiaWZ0VklpbVJYMXFCalhHT0QxWHNSTDVEaXlxWks1XC9NTE1IekF4SnNcL20xXC8rWlhMSWNOY3VLOTJLK29WSDg5eGd4c0UrNXBBYTA2enJzNElBTFBlb2JKMmpzOEVEN05mY2Jqa1JTQWRIUFQ3a1Y0UVpnQzlKcG4yelJHYXBORWdUTkoxbmVXRWNpbndyVmhtV1RFeU5veDlUbDQ3bDVoaWJGUDF5R29Xc0pIaXNqQ2tkOUNFcWp3TTkrUFNNV2VcLyIsIm1hYyI6IjZjZTUyZTRmZjFiNGQ0Y2NlMTAyY2M0ODJkNzAxOGE3YTMxNmY1ZDcxMWY1NzIwYzAwOTY2OTE4MjIwNzI3OGQifQ%3D%3D; 3ASHCLUcRown5UotfHkVKoYI7VurIDInVH3qaQG3=eyJpdiI6ImhLUzRcLzM2TDhsRDFDT29TSkFOdFNBPT0iLCJ2YWx1ZSI6IlBwblJieVQzTW1DMmRiVEFXWStZcjF4dGMzMXB6ak9TWHJ1dzVIMmh2ajY1QXlcLzVJUUtIMUNRQmFKYkdrUHpGTndsb3h3OFUwYUZ4a3BGOXZ5V0JhNXJ6dDMrK2FYT1BzdGVIc0ljSzNLTnRyYWppQnd3dXJoU2hPOFNaaEhVTVgzSGtVYk1yNDVwWDFObGltbnNQQ1hqRXF2VCs3UCtKSllmSEpiUWpqeGNEN2tXTVRMaE9PV0pJbWlRZWg5UDRVZ2pRK1NRTkdTNTg5czBcL2pOYldUdENKYTQ0OTc4am8zRGlDdzZ4eUJFOSs2WHpzODFuSFRZZWtiSnVVS1wvREk4WHdiQ1poeXdXN0xVR01pOSt6THFQRUtNOGQ0XC80NGhFWUdIMHErTDBRXC9IZ2V2U05TU25DMzlHVHZpeDRGWXZuUFBldGJ0ZEIxdUxrcHZVUlwvM3JDVHhaZU5uejhyNlJPbGJSTkU4K25hSUo5SFV1YzROREN0bHZOWVc3SG5VdVBWWEg1Nlc5MGE4M2Q4Y1cwQVwvMVBON1FTdk5ydjAyZEt6SXU2TytYR0paTFhtOWtxbmtoU25qcklxK2VsOFNmSm5OdnorT0pVTXBnY2hOdGVtSjd1MDR6S3MrMWRtbFwvenIweWptY1ltblFndlFhQTBqZVVmNHhVV2Q5a0RyV3FpbzFxTFVNVERwU1dFVWRyT3c5YTMrRjA5cFgzWkNWZWRwNjhWMEFcL29ZVjczM21qMklNSG5NV3hCbGRieVFUODVScjZ6TXErZVwvenJub1RYbUU5QW9lVlBNNzVEWHhkQUQ5U2JhczhmNmpaRjRNblJvV1o0NE04N2JxTllSQjB6YXZjVmE2YktWKzJkd2J4UlJHSjhUZz09IiwibWFjIjoiNzgzNGJhNmE3ZTExYjhiZTU5YjkwODBlOGRjNDViMTc5YmVmMmMyNmI2ODNlZDAyODVkNTkxZjE3OGUzYzk4MyJ9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 28 Nov 2019 19:18:59 GMT
content-type
text/html; charset=UTF-8
set-cookie
AWSALB=t5Adi0pfwqq3vuMcACl1psVVaE665Ps9X6QW0VHaz7G5jgVnKX9t89liV95o4Yopcm+yFmaZvSbdL4wMVcyrm/v0pBqfzvVX5qkcWVWYnDeE6jTlIABpEpuu/k8l; Expires=Thu, 05 Dec 2019 19:18:59 GMT; Path=/
server
nginx/1.11.6
content-encoding
gzip

Redirect headers

status
302
date
Thu, 28 Nov 2019 19:18:59 GMT
content-type
text/html; charset=UTF-8
set-cookie
AWSALB=0tJLcdh3HhOuRvB/x/Iny1VtDU+cDLLFqOFHvUUI0T8zzyp5qfKR96KI1AZYvPyfH+BQaM13zXUELvfqOjxRtOZxeWWDp3wVm8II+/cf1FyX9hG3igf6dyku2Z/y; Expires=Thu, 05 Dec 2019 19:18:59 GMT; Path=/ XSRF-TOKEN=eyJpdiI6InZaaUxhcmVqcktzaHdwS0dKRlpFUWc9PSIsInZhbHVlIjoiRkp0Z3I0VE1TOUNjR005Z01aZjFEXC83VlFibDFRVVZNYU1EK3RCOE1XanZiK0R0UzlZZExmTGVJOXdqbXM4TkNhWjF4OVBZVHhcL3NKd2c2Q0pMckhOQT09IiwibWFjIjoiMzQ2MDY5OTY5MjliNjFkMTMyZTIzMGMzNzlkNjcwMTU3YjZlZjk3MGEwYjA2YzI2NTJhZDAzZmYxYWMyOWIxZiJ9; expires=Thu, 28-Nov-2019 21:18:59 GMT; Max-Age=7200; path=/ session=eyJpdiI6InlJZ20zUXZzVnZEYmZ2ZnQxMXhPeXc9PSIsInZhbHVlIjoiYnFPWFcrUkQ1WHBkaVBMUG14elFNQ1pLajRLVFZlOTRURFdaemNpY2txcjFtbUFQdzZVWVE5WFwvc1BRVzBBZ1pMOEp4bE8rZUZ6S1Z5bWxvVGdGXC9Wdz09IiwibWFjIjoiMmUyMDA3YjI0YWFkYzA5ZmJiNjFmZjE5NmJmOWVjNGJhNjZlOTBhNWIxM2E3M2E3Y2EzM2Q0ZjEyOTFiZTc0NyJ9; expires=Thu, 28-Nov-2019 21:18:59 GMT; Max-Age=7200; path=/; HttpOnly ept2=eyJpdiI6IkQ2REZkTTQ3Z1VOV2RUY2xXNmFxR0E9PSIsInZhbHVlIjoiaWZ0VklpbVJYMXFCalhHT0QxWHNSTDVEaXlxWks1XC9NTE1IekF4SnNcL20xXC8rWlhMSWNOY3VLOTJLK29WSDg5eGd4c0UrNXBBYTA2enJzNElBTFBlb2JKMmpzOEVEN05mY2Jqa1JTQWRIUFQ3a1Y0UVpnQzlKcG4yelJHYXBORWdUTkoxbmVXRWNpbndyVmhtV1RFeU5veDlUbDQ3bDVoaWJGUDF5R29Xc0pIaXNqQ2tkOUNFcWp3TTkrUFNNV2VcLyIsIm1hYyI6IjZjZTUyZTRmZjFiNGQ0Y2NlMTAyY2M0ODJkNzAxOGE3YTMxNmY1ZDcxMWY1NzIwYzAwOTY2OTE4MjIwNzI3OGQifQ%3D%3D; expires=Fri, 29-Nov-2019 19:18:59 GMT; Max-Age=86400; path=/; HttpOnly 3ASHCLUcRown5UotfHkVKoYI7VurIDInVH3qaQG3=eyJpdiI6ImhLUzRcLzM2TDhsRDFDT29TSkFOdFNBPT0iLCJ2YWx1ZSI6IlBwblJieVQzTW1DMmRiVEFXWStZcjF4dGMzMXB6ak9TWHJ1dzVIMmh2ajY1QXlcLzVJUUtIMUNRQmFKYkdrUHpGTndsb3h3OFUwYUZ4a3BGOXZ5V0JhNXJ6dDMrK2FYT1BzdGVIc0ljSzNLTnRyYWppQnd3dXJoU2hPOFNaaEhVTVgzSGtVYk1yNDVwWDFObGltbnNQQ1hqRXF2VCs3UCtKSllmSEpiUWpqeGNEN2tXTVRMaE9PV0pJbWlRZWg5UDRVZ2pRK1NRTkdTNTg5czBcL2pOYldUdENKYTQ0OTc4am8zRGlDdzZ4eUJFOSs2WHpzODFuSFRZZWtiSnVVS1wvREk4WHdiQ1poeXdXN0xVR01pOSt6THFQRUtNOGQ0XC80NGhFWUdIMHErTDBRXC9IZ2V2U05TU25DMzlHVHZpeDRGWXZuUFBldGJ0ZEIxdUxrcHZVUlwvM3JDVHhaZU5uejhyNlJPbGJSTkU4K25hSUo5SFV1YzROREN0bHZOWVc3SG5VdVBWWEg1Nlc5MGE4M2Q4Y1cwQVwvMVBON1FTdk5ydjAyZEt6SXU2TytYR0paTFhtOWtxbmtoU25qcklxK2VsOFNmSm5OdnorT0pVTXBnY2hOdGVtSjd1MDR6S3MrMWRtbFwvenIweWptY1ltblFndlFhQTBqZVVmNHhVV2Q5a0RyV3FpbzFxTFVNVERwU1dFVWRyT3c5YTMrRjA5cFgzWkNWZWRwNjhWMEFcL29ZVjczM21qMklNSG5NV3hCbGRieVFUODVScjZ6TXErZVwvenJub1RYbUU5QW9lVlBNNzVEWHhkQUQ5U2JhczhmNmpaRjRNblJvV1o0NE04N2JxTllSQjB6YXZjVmE2YktWKzJkd2J4UlJHSjhUZz09IiwibWFjIjoiNzgzNGJhNmE3ZTExYjhiZTU5YjkwODBlOGRjNDViMTc5YmVmMmMyNmI2ODNlZDAyODVkNTkxZjE3OGUzYzk4MyJ9; expires=Thu, 28-Nov-2019 21:18:59 GMT; Max-Age=7200; path=/; HttpOnly
server
nginx/1.11.6
cache-control
no-cache, private
location
/main/d.php?s=1&link=https%3A%2F%2Fenergy-gewinner24.com%3FPR_ID%3DAF-gpmp71-8161%26token-id%3DxwbbTdRwcD-5de01da31e18ea63c966facf%26sub-id%3D%26sub-id2%3D%26sub-id3%3D%26sub-id%3D53609%26sub-id2%3D26_13632_5238604
Primary Request /
energy-gewinner24.com/ 		64 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
0b5482f0a08cae9c0c014d7204b0a2213bb5a381f43c3bd5a4f46583830fba96
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
energy-gewinner24.com
:scheme
https
:path
/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200 200 OK
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store
vary
Accept-Encoding
content-encoding
gzip
pragma
no-cache
x-xss-protection
1; mode=block
x-request-id
3676be1b-35c7-4914-a873-e8d0a70fd0c1
x-runtime
0.057963
x-content-type-options
nosniff nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
date
Thu, 28 Nov 2019 19:19:00 GMT
set-cookie
_energy_gewinner24_com_session=QnhydHJtWHhoU05ISVJjaGx0WERNdjJuUDcxNlNnOVZwV25SdnNXRFBPSFlRUGx5MWZ3TW9YQlltTUtXYUhyQ3plNmVCeTJ0c1Q1VTJmQzUxUlRvUklPQVR0S1lyTWRXVzlkOEwyS2pNUkI0RDFXYUVwL1Q2VGFhL0FDcm10Z1FyamZmRFdVYlBGbUppd1VJNFdmbFBPOUYwczBuNWgvUW5JOExHbHNuTmxOVGtnWFlGelp2TThqek10K0VuMU5qSk83MG1DVGFMOFFWTUtjZndlMm8yL3lqd2VCNHVTbGF6bUd5NjN3Y1hlMU5nY3pVOWJzSE5TOU5qWEpzTlU0UTQvWFFBcVQ0bGdXaXJqMGhvcC9XM1pMZFZDZ2RPaklPaDcyb01vZDQ1blhHbjl1QmtHOEZ1VW5TU1FJSng5c0U0T2M1WW1PRTkzaElMUDZEb2JFa2I3TGIrQmRYdUZ1bjFEYUo1VlBhMHdkQjNFc1BhQm9GdW1jeTl6N2N1TU5LLzFOQ1hkempQNjNtbUF6czFla3BZRFljV1VtUTkrVXhzeEFTNWNIOUw0MXZDRG9WVEZnaEpDYkpvazVJT09OTlgydHVnZmlLWDh1ZDNoRjEva010MXdzOTF3VjR6Z1BmVHZUaTh1ZkFZeU5KdHBrMHhQWlhpMUQzN2JwcHJtRTNKWXh0WUR4VXdDYWZiU1VreiswRlJucERTWExUMXYvb2ZuMzE1c1N3VTdSYlU5MUxrTVpzN1Y3V1Z1TTduU3FOS215ZXZFaHp0OEVVQzF2RlU1d3lRcnBEdkNrM1YrRkxjTEZ2b2Y1ODg4eGoxc2ZseHRmRU40MDFXMmp1N094Tmh0aVFiVXBVVjdqSGNqWTJhaWNORjJ3M0JFUXZ6QXRlNzFGeFZnam54cGJHMDI5b2dJTFRhRSs0UkFuQkk2dTNZTU5wK3ZkL3lFZXB1ejExUWZoUWtCb0haMmZ4TkZ3SHpZL3pCdDhUQUQyMkhlME5OV2R2YTNXM2p6YXBxMnFSaHpYeHFRM2NLV201MmNKcC9heHJHckZSWGlrcmx1dUxORnZaYlhTaGpVaz0tLTQxaThWTFFKbzlSNXVEUS8zdWpqUEE9PQ%3D%3D--4ea49d38ee83bfd0e0dbba45e94df5f78e21c26a; path=/; expires=Thu, 28 Nov 2019 22:19:00 -0000; HttpOnly
strict-transport-security
max-age=63072000; includeSubdomains
css
fonts.googleapis.com/ 		4 KB
696 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Oswald:600%7CUbuntu
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0ccd48d6f5749e070606c8693fdd40c3642e799c155b09d535c2305528749aea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 28 Nov 2019 19:19:00 GMT
server
ESF
access-control-allow-origin
*
date
Thu, 28 Nov 2019 19:19:00 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Thu, 28 Nov 2019 19:19:00 GMT
page-441f49347bfd2ac9b05e800332689a05ee6490215252d43732dd46f9649e69df.css
energy-gewinner24.com/assets/ 		123 KB
123 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://energy-gewinner24.com/assets/page-441f49347bfd2ac9b05e800332689a05ee6490215252d43732dd46f9649e69df.css
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
38bf1871d594c86ea4d91d6f867b77138bc2c13c082a993e04e46f58a0b1c013
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:19:00 GMT
x-content-type-options
nosniff
last-modified
Thu, 31 May 2018 16:55:15 GMT
etag
"5b1028f3-1eab8"
strict-transport-security
max-age=63072000; includeSubdomains
content-type
text/css
status
200
accept-ranges
bytes
content-length
125624
page-057431183d9e05dfcd26139de8bea794077bbf9dfc205f95c491292d2ab79418.js
energy-gewinner24.com/assets/ 		434 KB
435 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://energy-gewinner24.com/assets/page-057431183d9e05dfcd26139de8bea794077bbf9dfc205f95c491292d2ab79418.js
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
057431183d9e05dfcd26139de8bea794077bbf9dfc205f95c491292d2ab79418
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:19:00 GMT
x-content-type-options
nosniff
last-modified
Fri, 15 Nov 2019 11:38:43 GMT
etag
"5dce8e43-6c873"
strict-transport-security
max-age=63072000; includeSubdomains
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
444531
preis.png
energy-gewinner24.com/system/uploads/plain_images/images/000/001/091/original/ 		128 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://energy-gewinner24.com/system/uploads/plain_images/images/000/001/091/original/preis.png?1570606819
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
3e2befea7d053e89171856edb1cf7dfce3312c2b0383047dc524212149b37bf8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:19:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 09 Oct 2019 07:40:19 GMT
etag
"5d9d8ee3-1ff26"
strict-transport-security
max-age=63072000; includeSubdomains
content-type
image/png
status
200
accept-ranges
bytes
content-length
130854
1574968740-1.gif
energy-gewinner24.com/views/ 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://energy-gewinner24.com/views/1574968740-1.gif
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff, nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Nov 2019 19:19:00 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
vary
Accept-Encoding
content-type
image/gif
status
200, 200 OK
cache-control
no-cache, no-store
content-transfer-encoding
binary
content-disposition
inline
strict-transport-security
max-age=63072000; includeSubdomains
x-runtime
0.020448
x-xss-protection
1; mode=block
x-request-id
248a0873-002f-4132-b9e7-8a16494bc021
expires
Fri, 01 Jan 1990 00:00:00 GMT
background.jpg
energy-gewinner24.com/system/uploads/plain_images/images/000/001/092/original/ 		150 KB
150 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://energy-gewinner24.com/system/uploads/plain_images/images/000/001/092/original/background.jpg?1570606819
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.238.42.217 Jena, Germany, ASN9211 (WORK-AS N@work Internet Informationssysteme GmbH, DE),
Reverse DNS
Software
/
Resource Hash
b88017c8bdc4f321a1203fad2f7b09da6fb7108180b6e4d35d927ecb9b506f4a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains
X-Content-Type-Options nosniff

Request headers

Referer
https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 28 Nov 2019 19:19:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 09 Oct 2019 07:40:19 GMT
etag
"5d9d8ee3-2569a"
strict-transport-security
max-age=63072000; includeSubdomains
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
153242
4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v14/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ubuntu/v14/4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Oswald:600%7CUbuntu
Origin
https://energy-gewinner24.com

Response headers

date
Thu, 21 Nov 2019 11:37:53 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:17:45 GMT
server
sffe
age
632467
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
13720
x-xss-protection
0
expires
Fri, 20 Nov 2020 11:37:53 GMT
TK3_WkUHHAIjg75cFRf3bXL8LICs1y9osUZiYySUhiCXAA.woff
fonts.gstatic.com/s/oswald/v29/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/oswald/v29/TK3_WkUHHAIjg75cFRf3bXL8LICs1y9osUZiYySUhiCXAA.woff
Requested by
Host: energy-gewinner24.com
URL: https://energy-gewinner24.com/?PR_ID=AF-gpmp71-8161&token-id=xwbbTdRwcD-5de01da31e18ea63c966facf&sub-id=&sub-id2=&sub-id3=&sub-id=53609&sub-id2=26_13632_5238604
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
03185734f433a049672e1d8aaa0e8ea16c693a8d60f4ede727f6e49bb472a80d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Oswald:600%7CUbuntu
Origin
https://energy-gewinner24.com

Response headers

date
Wed, 20 Nov 2019 11:37:48 GMT
x-content-type-options
nosniff
last-modified
Mon, 21 Oct 2019 23:04:45 GMT
server
sffe
age
718872
content-type
font/woff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
13080
x-xss-protection
0
expires
Thu, 19 Nov 2020 11:37:48 GMT

Verdicts & Comments Add Verdict or Comment

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| filter_street_list function| get_cities function| get_streets function| transliterate function| do_nothing function| ajax_trigger_group function| ajax_save_coreg function| validation_check function| init_iframe_spinner function| lsa function| h_put_f function| put_f function| check_unfinished_coregs function| parse_text function| replacer function| _willTriggerCoregGroups function| _willTriggerQuestion function| _willTriggerSaveCoregs function| _willPresentPopunder function| _displayCoregElement function| _hideCoregElement function| _showHideNextQuestion function| Participant function| $ function| jQuery object| jQuery112401337826986013193 number| coreg_answer_count function| setNewFormGroup function| setCookie function| getCookie function| showText function| hideText function| firstPageClientValidation function| secondPageClientValidation function| FieldValidation function| FormField

1 Cookies

Domain/Path Name / Value
energy-gewinner24.com/ Name: _energy_gewinner24_com_session
Value: VzVMOE82RHVLQjZmVndmRzFsUHFoMGdQK3V0Qys2WnJoalNYTHp1UkR6NzNVRmxQcVp1SnFXdGFlSFZTSWlDOVpjanQ5Q1MzNUFkRnNvVVh2TFlHTlF6VTJMc1E2bFM1N3dOQnBHVUQxYlVjYVBDb1NwdjlaV1A3Slh3NDBQT3k0bHBacUVLTEVDUUsvUlNOa3ErTU0wRlhMaHdpWWE3U3lKRDdKa2VlR1B4MXhFeFJ3dUIxUTMya2JjZ2hraGZHQTl3YUZwMVhPVUsrdnpoZ09vNFV5WEd6M040aVVSUzFOTzllWkZPQTNlY2xxcFg0WVE1RkNicTNVSlJXdVluRHNYUWU1ZHo2YkFaYS8xQ3FXQlBiaFpNNU00ZE00Sit5c09nV1ZKRHE4ZzJQOTFPMk9Tbkk0RFRxblV0dzIrejdvSm5IeXM0NkQwSW9WYm11LzBGZ0Q4enYwcXRsVzlRcGs4RlRRTGNaU0F0aHBobk8zL2FCL295TTJFaWFpVlg2THlPamhVM1FDV1daeEJ5UGtia1dTNWZFQnhvSyszZUJHaWVBNWtUWjNTY0c2ZDM4YnVKY0FqdWNlRDFRS00rZzNkbll1b2FPOExFZldqSEtoN0gvdnJuT2hEK3N1MC9oQ1dPRnJhamlmaG9EYktrczJtcUsycFdla1Z4TXRSWGR6K0NFazlaTlpIeEg5M1l5VGpPdy9ocVJNVThObkpjTS9YenplTHdNWFh4ZldWL0JyNlZLVU9ON3p1YldRdTFqUUZhNTZvcjJvWmNMSTJ1eFZOdnRKZmM1T01ZQlpWazlQb0xzMTBiTUQybW42dFVFTjk2Q2pEYjNmWUV1YXJBMG5rU0llVTVydTZTSy9raEw1cFBnb1dBTUloQjFGaDZwWjFBSis3NTBWRUtDTUFlWStydlZrUFBFR0kxOUM0OUZhZCtIdFY4ZDRkVHRpSGU3bHovV1gwakpiQXd5UHhqZE9vaDI4R04ycUNDZnZwYUdCM2JIc094MHBTd0NnakFEbG55TThmOEJxQUZvWCtoNlVkbDMrYUgvTjhLd1RtQWMvMHl0ZkJDVS9McWxLbWw0WGs0NUNLQmhkOEEwcUEwNTRvbDhta09pNWZpTzhVMFlsNkRzL2c9PS0tSzRteHh3bFJFcHVOZm80Y1ZNeEI5UT09--4ad7f50afe3e79cb5a8832aee0346d46ecf63214

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abc2.adtelligent.com
cd-down.com
cdn.adport.io
energy-gewinner24.com
fonts.googleapis.com
fonts.gstatic.com
gfstrck.com
r.adport.io
thewayofshea.com
track.leadsglb.com
www.google.com
www.syntaurus.com
176.114.9.149
209.205.219.178
212.32.250.17
213.238.42.217
2606:4700:10::6814:aa1c
2a00:1450:4001:800::200a
2a00:1450:4001:818::2004
2a00:1450:4001:81f::2003
2a05:d018:483:6110:28a3:5089:71b9:6ad5
2a05:d018:483:6130:7095:9e50:e827:1089
52.35.133.55
69.195.124.50
03185734f433a049672e1d8aaa0e8ea16c693a8d60f4ede727f6e49bb472a80d
057431183d9e05dfcd26139de8bea794077bbf9dfc205f95c491292d2ab79418
095e147c990a964045de29c624b9805fc28abad79d6889d87b3830db8009b119
0b5482f0a08cae9c0c014d7204b0a2213bb5a381f43c3bd5a4f46583830fba96
0ccd48d6f5749e070606c8693fdd40c3642e799c155b09d535c2305528749aea
38bf1871d594c86ea4d91d6f867b77138bc2c13c082a993e04e46f58a0b1c013
3e2befea7d053e89171856edb1cf7dfce3312c2b0383047dc524212149b37bf8
5a169548edea563c4a74e3720f44b1fd80399bd3da0cdafae84c59965437e1a7
6945cdfee0e95bbab7941228c271f6b6f6107a0448e7445da1d124b73fc20cc7
821ad4fb2a1ce1f59f08182256599d4983b0f57916c1379c6993e144aa6725f4
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a6bb778cc2098eb8eb93c2661be620b209702e38d2e1972729e7eb0250f2f90c
b88017c8bdc4f321a1203fad2f7b09da6fb7108180b6e4d35d927ecb9b506f4a