1wgafz.top Open in urlscan Pro
154.197.121.1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Effective URL:
https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Submission: On October 29 via api (October 29th 2024, 8:50:38 pm UTC) from US — Scanned from CA

Summary HTTP 50 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 4 countries across 9 domains to perform 50 HTTP transactions. The main IP is 154.197.121.1, located in Seychelles and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is 1wgafz.top.
TLS certificate: Issued by WE1 on October 2nd 2024. Valid for: 3 months.

This is the only time 1wgafz.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 22	154.197.121.1 154.197.121.1	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	190.115.19.14 190.115.19.14	59692 (IQWEB) (IQWEB)
1	108.139.29.45 108.139.29.45	16509 (AMAZON-02) (AMAZON-02)
6	2607:f8b0:400... 2607:f8b0:400d:c00::61	15169 (GOOGLE) (GOOGLE)
4 8	172.217.197.148 172.217.197.148	15169 (GOOGLE) (GOOGLE)
1	108.138.106.124 108.138.106.124	16509 (AMAZON-02) (AMAZON-02)
2	49.13.81.104 49.13.81.104	24940 (HETZNER-AS) (HETZNER-AS)
2	2001:4860:480... 2001:4860:4802:34::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c00::9d	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:400d:c0d::9c	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:400d:c0c::5e	15169 (GOOGLE) (GOOGLE)
2	173.194.205.149 173.194.205.149	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c02::9b	15169 (GOOGLE) (GOOGLE)
1	18.164.96.90 18.164.96.90	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c21::63	15169 (GOOGLE) (GOOGLE)
50	16

22 154.197.121.1 (Seychelles) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

1wgafz.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 190.115.19.14 (Belize)

ASN59692 (IQWEB, AE)

partners.1win-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.29.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-45.jfk50.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:400d:c00::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.197.148 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: qa-in-f148.1e100.net

12572451.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
12688802.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.106.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-124.jfk50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 49.13.81.104 (Berlin, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.104.81.13.49.clients.your-server.de

rtb-demo.ubidex.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c00::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c0d::9c (Morganton, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0c::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.194.205.149 (United States)

ASN15169 (GOOGLE, US)
PTR: qm-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c02::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.164.96.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-90.jfk50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c21::63 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	1wgafz.top 1 redirects 1wgafz.top	1 MB
16	doubleclick.net 4 redirects 12572451.fls.doubleclick.net — Cisco Umbrella Rank: 330391 stats.g.doubleclick.net — Cisco Umbrella Rank: 136 td.doubleclick.net — Cisco Umbrella Rank: 192 12688802.fls.doubleclick.net — Cisco Umbrella Rank: 332055 ad.doubleclick.net — Cisco Umbrella Rank: 150 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42	4 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	508 KB
3	google.com analytics.google.com — Cisco Umbrella Rank: 147 www.google.com — Cisco Umbrella Rank: 3	64 B
2	google.ca www.google.ca — Cisco Umbrella Rank: 12143	127 B
2	ubidex.xyz rtb-demo.ubidex.xyz	1 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 877 script.hotjar.com — Cisco Umbrella Rank: 1177	61 KB
1	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 2890	37 KB
1	1win-cdn.com partners.1win-cdn.com — Cisco Umbrella Rank: 543644	2 KB
50	9

	Domain	Requested by
22	1wgafz.top	1 redirects 1wgafz.top partners.1win-cdn.com
6	www.googletagmanager.com	1wgafz.top www.googletagmanager.com
4	12688802.fls.doubleclick.net	2 redirects www.googletagmanager.com
4	td.doubleclick.net	www.googletagmanager.com
4	12572451.fls.doubleclick.net	2 redirects www.googletagmanager.com
2	ad.doubleclick.net	1wgafz.top
2	www.google.ca	1wgafz.top
2	analytics.google.com	www.googletagmanager.com
2	rtb-demo.ubidex.xyz	www.googletagmanager.com 1wgafz.top
1	www.google.com	1wgafz.top
1	script.hotjar.com	static.hotjar.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	static.hotjar.com	1wgafz.top
1	cdn.amplitude.com	1wgafz.top
1	partners.1win-cdn.com	1wgafz.top
50	16

This site contains no links.

Subject Issuer	Validity	Valid
1wgafz.top WE1	`2024-10-02` - `2024-12-31`	3 months	crt.sh
partners.1win-cdn.com R10	`2024-10-06` - `2025-01-04`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M02	`2023-12-14` - `2025-01-12`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
rtb-demo.ubidex.xyz R10	`2024-08-14` - `2024-11-12`	3 months	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.google.ca WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 11 frames:

Primary Page: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Frame ID: 4BC0C999B7B602C4E16EC5582AD2EF3A
Requests: 40 HTTP requests in this frame

Frame: https://1wgafz.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js
Frame ID: 1B7E00CEB25E388D790038F2BE2FA943
Requests: 2 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5270993903078.96
Frame ID: CD274AA84ACCE214BFC65168A9DDE741
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2F1wgafz.top
Frame ID: CE670E90C6353CBE6621BEF9DF4A67B9
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=381002163.1730235030&gtm=45je4as0v894728184z8894400803za200zb894400803&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101925629&z=472060792
Frame ID: 48A783869A3E9F8FD4B3B9B12232499C
Requests: 1 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26
Frame ID: 139676B40F5C610B5F6376D92217D44F
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26
Frame ID: 783351FC5ED814E365EB6A51A9D63717
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/16482547739?random=1730235030561&cv=11&fst=1730235030561&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9181323879z8894400803za200zb894400803&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878898~101878942~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=564111171.1730235030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: A527F99CDFFAEC7C5CECEC854E1FBB34
Requests: 1 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8959310327647.396
Frame ID: 6D73E61A70F1CDD919B269FF7D87C859
Requests: 1 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26
Frame ID: 3192DA47D29D67919276F076A0FDD458
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26
Frame ID: 3EED47120981A38F6645E239DDA2C6C2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1win

Page URL History Show full URLs

http://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437& HTTP 307
https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437& Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Page Statistics

50
Requests

98 %
HTTPS

47 %
IPv6

9
Domains

16
Subdomains

16
IPs

4
Countries

1918 kB
Transfer

3733 kB
Size

15
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437& HTTP 307
https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://1wgafz.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://1wgafz.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js

Request Chain 26

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5270993903078.96 HTTP 302
https://12572451.fls.doubleclick.net/activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5270993903078.96

Request Chain 34

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26 HTTP 302
https://12688802.fls.doubleclick.net/activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26

Request Chain 44

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8959310327647.396 HTTP 302
https://12572451.fls.doubleclick.net/activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8959310327647.396

Request Chain 45

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26 HTTP 302
https://12688802.fls.doubleclick.net/activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26

50 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request landing-fortune-wheel Show response
1wgafz.top/v3/
Redirect Chain

http://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

9 KB
3 KB

568ms
256ms

Document
text/html

154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d83ed80353a034afb800558798c084cae07eaf0567b479005ec28fe34811b462

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8da609c3280336f9-YYZ
content-encoding: br
content-type: text/html
date: Tue, 29 Oct 2024 20:50:29 GMT
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Location: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 index.umd.js Show response
partners.1win-cdn.com/ 4 KB
2 KB 505ms
126ms Script
application/javascript 190.115.19.14
IQWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://partners.1win-cdn.com/index.umd.js
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 190.115.19.14 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
Software: ddos-guard /
Resource Hash: 7f6668a7e9ef502207250ae107377a8dc32f43c20a8c38ab7a06d7acfffceef6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

ddg-cache-status: HIT
content-encoding: br
etag: "6719f3fa-100d"
age: 41135
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1977
date: Tue, 29 Oct 2024 09:24:55 GMT
content-type: application/javascript; charset=utf-8, application/javascript
last-modified: Thu, 24 Oct 2024 07:15:06 GMT
server: ddos-guard
vary: Accept-Encoding

GET
H2 200 index-3f6435fe.js Show response
1wgafz.top/v3/landing-fortune-wheel/assets/ 443 KB
145 KB 88ms
58ms Script
application/javascript 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-3f6435fe.js
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a12c39763e10643733c0f5320309c982de153bdd054e7cd286486c4c5cc83e74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-6ea02"
age: 2483
cf-ray: 8da609c529e436f9-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 index-342731dd.css
1wgafz.top/v3/landing-fortune-wheel/assets/ 33 KB
7 KB 86ms
57ms Stylesheet
text/css 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 342731dddaab9ddb4b950f8e1e1e58f2bba060ea69c4ae667e6038ca60b19e40

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-82ee"
age: 2483
cf-ray: 8da609c529df36f9-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: text/css
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 analytics-browser-2.10.0-min.js.gz Show response
cdn.amplitude.com/libs/ 132 KB
37 KB 315ms
88ms Script
application/javascript 108.139.29.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/analytics-browser-2.10.0-min.js.gz
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-45.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 044f740225e7e77b8f847092765f3907b20db17d7d284cae7333cf8445057c42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "20b93a719265b2b96ecf34884007b364"
x-amz-version-id: wIrttRVLYnGJahoaV97n3.OKDKgE260s
age: 109466
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: n_7JlT7f1DMhQzeiOq25yE4yXVkDXO0kQ5xSZSvZQoJzdSpvZW-SEg==
date: Mon, 28 Oct 2024 14:26:05 GMT
content-type: application/javascript
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Fri, 02 Aug 2024 16:46:07 GMT
cache-control: max-age=31536000
via: 1.1 bd3e3884ce6fe1fd36336541cce9ec7e.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37439
x-amz-cf-pop: JFK50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 390 KB
116 KB 369ms
197ms Script
application/javascript 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7&v=1730235029774

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0d89f31f4fb4e7ff987a391c58690f55516d7d25693aca467c79e545cf1529ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 29 Oct 2024 20:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 29 Oct 2024 18:14:29 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 118912
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 390 KB
117 KB 263ms
120ms Script
application/javascript 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-3f6435fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

255e06d2b5806c919d46016b9fa4a9ce9bcc909693d7161e00c5163d5a5950c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 29 Oct 2024 20:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 29 Oct 2024 18:14:29 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 118770
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 flags.svg
1wgafz.top/v3/landing-fortune-wheel/sprites/ 190 KB
45 KB 93ms
90ms Other
image/svg+xml 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/sprites/flags.svg
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-3f6435fe.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 790336a09030817df4a1adcef4e9bcf7d300d847d96597963cfa81f2c9fca8f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a795-2f93a"
age: 2482
cf-ray: 8da609c8895436b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 09:19:17 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 reg-form.svg
1wgafz.top/v3/landing-fortune-wheel/sprites/ 3 KB
1 KB 57ms
55ms Other
image/svg+xml 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/sprites/reg-form.svg
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-3f6435fe.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f769257f466c93c0dbc91b76c56ab876cc3ef91c4d0b3cd6a40f15b6bfb0c51f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "6703a795-a73"
age: 2482
expires: Wed, 30 Oct 2024 00:50:29 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 09:19:17 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
cf-ray: 8da609c8895536b7-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1216
server: cloudflare

GET
H3 200 logo-loader.svg
1wgafz.top/v3/landing-fortune-wheel/images/ 6 KB
3 KB 60ms
58ms Image
image/svg+xml 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/images/logo-loader.svg
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 705f162ccea371c7ca4af41a84964e2b6de1a47b5266b6cd9147ce8615cc6ccb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a795-1849"
age: 2482
cf-ray: 8da609c8895736b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 09:19:17 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 logo.svg
1wgafz.top/v3/landing-fortune-wheel/images/logo/ 4 KB
1 KB 96ms
95ms Image
image/svg+xml 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/images/logo/logo.svg
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3634b68c242ef07fd879838de719ccc22f67cbdbdbbd4bad7660678398f698de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "6703a795-e58"
age: 2482
expires: Wed, 30 Oct 2024 00:50:29 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 09:19:17 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
cf-ray: 8da609c8895936b7-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1151
server: cloudflare

GET
DATA 200
OK truncated
/ 311 B
0 Image
image/avif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/avif

GET
H3

200

main.js Show response
1wgafz.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/ Frame 1B7E
Redirect Chain

https://1wgafz.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://1wgafz.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?

8 KB
4 KB

244ms
244ms

Script
application/javascript

154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://1wgafz.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Server

154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d28fd70fd5f8781c51fcd79cecbbdd08de5923f25b0da2b7905a25f8381945aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: br
x-content-type-options: nosniff
cf-ray: 8da609c8f9bc36b7-YYZ
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
cf-ray: 8da609c8896036b7-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 29 Oct 2024 20:50:29 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 background-baa82c45.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 242 KB
242 KB 90ms
90ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/background-baa82c45.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: baa82c45de8747da4fa1f95c7059661d2421013236c2c3672028f7d09bfaf682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-3c7a8"
age: 2482
cf-ray: 8da609c8896236b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gift-9aed8d1c.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 108 KB
108 KB 54ms
54ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/gift-9aed8d1c.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aed8d1ca62c65606c7cc70ec6a34ed44fda9b39ddfd800279e0727c2c7a0282

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-1afa8"
age: 2482
cf-ray: 8da609c8896436b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 wheel-circle-ab41779f.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 260 KB
260 KB 90ms
90ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/wheel-circle-ab41779f.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab41779fc10cedb8b66c998e8d1724d6404b791c93d40e81ae7a075d774d52da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-40eca"
age: 2482
cf-ray: 8da609c8896736b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 wheel-bg-c9026479.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 41 KB
41 KB 93ms
92ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/wheel-bg-c9026479.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9026479eb79c93bd9cfb6ea5d52bf42b8a2e5d5a8c9426ce0146cd32ff65c65

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-a327"
age: 2482
cf-ray: 8da609c8896936b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gift-bg_768-6ef446d8.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 53 KB
53 KB 92ms
91ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/gift-bg_768-6ef446d8.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ef446d80a2e57f7e37944db08182db97705bfb66d2c9e26bee2b3cefeec4089

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-d217"
age: 2482
cf-ray: 8da609c8896b36b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gift-decor_768-7fb19b14.avif
1wgafz.top/v3/landing-fortune-wheel/assets/ 10 KB
10 KB 118ms
117ms Image
image/avif 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/gift-decor_768-7fb19b14.avif
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fb19b1467b61d67de500a2d100235d56b74b85b29389570019c3f626401d624

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-28f9"
age: 2482
cf-ray: 8da609c8896c36b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: image/avif
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 SFProDisplay-Regular-25702f41.woff2
1wgafz.top/v3/landing-fortune-wheel/assets/ 87 KB
88 KB 96ms
95ms Font
font/woff2 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/SFProDisplay-Regular-25702f41.woff2
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25702f412567ceea60b108a2445c493f6f9d72ac11d24736fb5c334384de1150

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-15da4"
age: 2482
cf-ray: 8da609c8b98736b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: font/woff2
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 SFProDisplay-Medium-db50cb75.woff2
1wgafz.top/v3/landing-fortune-wheel/assets/ 97 KB
98 KB 97ms
96ms Font
font/woff2 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/SFProDisplay-Medium-db50cb75.woff2
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: db50cb7512558b476b9bf46a1ff5be0cbc7dbcb5b4df3e1d571c2acd85dcff76

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-18578"
age: 2482
cf-ray: 8da609c8b98836b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: font/woff2
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 SFProDisplay-Heavy-d9bfe0de.woff2
1wgafz.top/v3/landing-fortune-wheel/assets/ 98 KB
98 KB 102ms
101ms Font
font/woff2 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/SFProDisplay-Heavy-d9bfe0de.woff2
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9bfe0de09ed0ff81a2f7c1d72e18e0177e4b347c5f6f9c5a052c1254068711f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-18790"
age: 2482
cf-ray: 8da609c8b98a36b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: font/woff2
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 SFProDisplay-Bold-1952af3a.woff2
1wgafz.top/v3/landing-fortune-wheel/assets/ 96 KB
96 KB 280ms
279ms Font
font/woff2 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/SFProDisplay-Bold-1952af3a.woff2
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1952af3afb6be47c8b366c6e9b44cde5efb1ebd2fa9f832912ef41caddee279e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://1wgafz.top
Referer: https://1wgafz.top/v3/landing-fortune-wheel/assets/index-342731dd.css

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "6703a796-17fb8"
age: 2482
cf-ray: 8da609c8b98b36b7-YYZ
expires: Wed, 30 Oct 2024 00:50:29 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:29 GMT
content-type: font/woff2
last-modified: Mon, 07 Oct 2024 09:19:18 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 200 8da609c3280336f9 Show response
1wgafz.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 1B7E 0
660 B 56ms
50ms XHR
text/plain 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/cdn-cgi/challenge-platform/h/g/jsd/r/8da609c3280336f9
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

cf-ray: 8da609cb3c3a36b7-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
97 KB 68ms
67ms Script
application/javascript 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7eb9af942b69cfa49857a896159ba5e3cd96a87956dc1d367262125b1600a144

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 29 Oct 2024 20:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99219
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
97 KB 123ms
122ms Script
application/javascript 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4bb1345c2a06a9e9986503479235c558d2c0bd65f19a650166e337f3c6e559e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 29 Oct 2024 20:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 29 Oct 2024 18:14:29 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98871
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 226 KB
81 KB 95ms
95ms Script
application/javascript 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

26b8bf8a7e6ddfa37260e050667257c77ce8a44fa71d67f9767142bc2017991a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Tue, 29 Oct 2024 20:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 29 Oct 2024 18:14:29 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82851
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;o...
12572451.fls.doubleclick.net/ Frame CD27
Redirect Chain

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
https://12572451.fls.doubleclick.net/activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...

0
0

108ms
107ms

Document
text/html

172.217.197.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12572451.fls.doubleclick.net/activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5270993903078.96?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.197.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qa-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 1003
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Tue, 29 Oct 2024 20:50:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12572451.fls.doubleclick.net/activityi;dc_pre=COWgguO7tIkDFXMBTwgdk0kDng;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=5270993903078.96?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 hotjar-2606090.js Show response
static.hotjar.com/c/ 13 KB
5 KB 322ms
110ms Script
application/javascript 108.138.106.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.106.124 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-106-124.jfk50.r.cloudfront.net

Software

Resource Hash

24204d7506b849257f774de1ee2715c6d54268c883a6d6c038350a862401a6aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-encoding: br
etag: W/d40ce50bc73da7456952185d8d39d314
age: 52
x-content-type-options: nosniff
x-cache-hit: 1
x-cache: Hit from cloudfront
x-amz-cf-id: b3gVpDj3Si8mN3oxzAB6bZs9a_KXNCuzAlxdkpuClxMdFUeiqw4jVQ==
date: Tue, 29 Oct 2024 20:49:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
via: 1.1 54798bbc2ce3e33c706761634ac87e48.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3

GET
H/1.1 200
OK js Show response
rtb-demo.ubidex.xyz/pixel/ 441 B
775 B 703ms
260ms Script
text/javascript 49.13.81.104
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb-demo.ubidex.xyz/pixel/js?auth=yreuye&event=landing_page_view&uid=undefined
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 49.13.81.104 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.104.81.13.49.clients.your-server.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: adc57b25de40732df0ea15858661b98e273693c87fb7f343cab826b2d55cab6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 441
Date: Tue, 29 Oct 2024 20:50:30 GMT
Content-Type: text/javascript
Server: nginx/1.18.0 (Ubuntu)

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame CE67 0
0 250ms
89ms Document
text/html 2607:f8b0:400d:c00::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2F1wgafz.top

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Wed, 29 Oct 2025 20:50:30 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 265ms
119ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je4as0v894728184z8894400803za200zb894400803&_p=1730235029802&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101823848~101925629&cid=381002163.1730235030&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dp=%2Fv3%2Flanding-fortune-wheel&sid=1730235030&sct=1&seg=0&dl=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&dt=1win&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&tfd=1850
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://1wgafz.top
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
541 B 411ms
162ms Ping
text/plain 2607:f8b0:400d:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-548949LWLW&cid=381002163.1730235030&gtm=45je4as0v894728184z8894400803za200zb894400803&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533422~101823848~101925629
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c00::9d Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://1wgafz.top
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:30 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 48A7 0
0 258ms
61ms Document
text/html 2607:f8b0:400d:c0d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-548949LWLW&gacid=381002163.1730235030&gtm=45je4as0v894728184z8894400803za200zb894400803&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101925629&z=472060792

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 644ms
517ms Image
image/gif 2607:f8b0:400d:c0c::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-548949LWLW&cid=381002163.1730235030&gtm=45je4as0v894728184z8894400803za200zb894400803&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533422~101823848~101925629&tag_exp=101533422~101823848~101925629&z=921740001

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 29 Oct 2024 20:50:31 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv...
12688802.fls.doubleclick.net/ Frame 1396
Redirect Chain

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;u...
https://12688802.fls.doubleclick.net/activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;u...

0
0

121ms
119ms

Document
text/html

172.217.197.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12688802.fls.doubleclick.net/activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.197.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qa-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 427
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Tue, 29 Oct 2024 20:50:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12688802.fls.doubleclick.net/activityi;dc_pre=CPmFkuO7tIkDFRADTwgdmbcnzw;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0...
td.doubleclick.net/td/fls/rul/ Frame 7833 0
0 205ms
68ms Document
text/html 2607:f8b0:400d:c0d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl...
ad.doubleclick.net/ 0
23 B 670ms
485ms Image
image/png 173.194.205.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9811517407647;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1471611283;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.205.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qm-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 29 Oct 2024 20:50:31 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"3557037361245570401"}],"aggregatable_trigger_data":[{"filters":[{"14":["13647302"]}],"key_piece":"0xf2bcf486b336d7ad","source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","24835884","24835885","24835886","24835887"]},{"key_piece":"0xf186d04f51261d8b","not_filters":{"14":["13647302"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","24835884","24835885","24835886","24835887"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"20557008":36,"20557009":36,"20557010":36,"20557011":3530,"21":6356,"24835884":32,"24835885":32,"24835886":32,"24835887":3177},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"6383347776584868812","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"3557037361245570401","filters":[{"14":["13647302"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"3557037361245570401","filters":[{"14":["13647302"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"3557037361245570401","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"3557037361245570401","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["12688802"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/ 5 KB
2 KB 245ms
64ms Script
text/javascript 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/16482547739/?random=1730235030561&cv=11&fst=1730235030561&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9181323879z8894400803za200zb894400803&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878898~101878942~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=564111171.1730235030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

475667bb346baccd14688368577c80a31d84029d32a8e4d1da927346560110e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2406
date: Tue, 29 Oct 2024 20:50:30 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 16482547739
td.doubleclick.net/td/rul/ Frame A527 0
0 139ms
67ms Document
text/html 2607:f8b0:400d:c0d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/16482547739?random=1730235030561&cv=11&fst=1730235030561&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9181323879z8894400803za200zb894400803&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878898~101878942~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=564111171.1730235030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16482547739&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 modules.625495a901d247c3e8d4.js Show response
script.hotjar.com/ 221 KB
55 KB 276ms
69ms Script
application/javascript 18.164.96.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.625495a901d247c3e8d4.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2606090.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-90.jfk50.r.cloudfront.net

Software

Resource Hash

c0d57eff0936a57e0c8d6bc93314585c734e5ade88d6de970e1e305ae5d87224

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

x-robots-tag: none
content-encoding: br
etag: "862c1be6e71cd836a43ce679991261fd"
age: 103643
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: Iczns7E4L0SX-qsvTe5rzgzbsN8wOytldPiZlrhLnO2Mkp1XqyXMOA==
date: Mon, 28 Oct 2024 16:03:06 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 28 Oct 2024 16:02:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56056
x-amz-cf-pop: JFK50-P5

GET
H3 200 /
www.google.com/pagead/1p-user-list/16482547739/ 42 B
64 B 298ms
67ms Image
image/gif 2607:f8b0:4004:c21::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/16482547739/?random=1730235030561&cv=11&fst=1730232000000&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9181323879z8894400803za200zb894400803&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878898~101878942~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=564111171.1730235030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d3nGfai5M1dVMXQNGoJdRBCBZUkIa4g&random=352056533&rmt_tld=0&ipr=y

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::63 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 29 Oct 2024 20:50:31 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/16482547739/ 42 B
64 B 64ms
63ms Image
image/gif 2607:f8b0:400d:c0c::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/16482547739/?random=1730235030561&cv=11&fst=1730232000000&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9181323879z8894400803za200zb894400803&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878898~101878942~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&hn=www.googleadservices.com&frm=0&tiba=1win&npa=0&pscdl=noapi&auid=564111171.1730235030&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d3nGfai5M1dVMXQNGoJdRBCBZUkIa4g&random=352056533&rmt_tld=1&ipr=y

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 29 Oct 2024 20:50:30 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK pixel
rtb-demo.ubidex.xyz/ 0
301 B 143ms
139ms Image
text/plain 49.13.81.104
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-demo.ubidex.xyz/pixel?auth=yreuye&event=landing_page_view&uid=undefined&site=1wgafz.top&ln=en-CA
Requested by: Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 49.13.81.104 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.104.81.13.49.clients.your-server.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Tue, 29 Oct 2024 20:50:31 GMT
Server: nginx/1.18.0 (Ubuntu)

POST
H3 200 affiliate:link_visit
1wgafz.top/ 37 B
976 B 233ms
229ms Ping
application/json 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://1wgafz.top/affiliate:link_visit

Requested by

Host: partners.1win-cdn.com
URL: https://partners.1win-cdn.com/index.umd.js

Protocol

Security

QUIC, , AES_128_GCM

Server

154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f

Security Headers

Name

Value

X-Frame-Options

ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

access-control-max-age: 7200
access-control-expose-headers: Authorization
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"25-Zj67mG54TfZ031q1ea2QwFUXWX4"
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:31 GMT
content-type: application/json; charset=utf-8
x-frame-options: ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
access-control-allow-headers: Content-Type, Authorization, X-Origin
access-control-allow-credentials: true
cf-ray: 8da609d0a9a236b7-YYZ
access-control-allow-origin: https://1wgafz.top
x-powered-by: Express
server: cloudflare

GET
H3

200

activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;o...
12572451.fls.doubleclick.net/ Frame 6D73
Redirect Chain

https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
https://12572451.fls.doubleclick.net/activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...

0
0

83ms
82ms

Document
text/html

172.217.197.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12572451.fls.doubleclick.net/activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8959310327647.396?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.197.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qa-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 1028
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Tue, 29 Oct 2024 20:50:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12572451.fls.doubleclick.net/activityi;dc_pre=CPvzpOO7tIkDFXKu0QQdgpE2TQ;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=8959310327647.396?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv...
12688802.fls.doubleclick.net/ Frame 3192
Redirect Chain

https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;u...
https://12688802.fls.doubleclick.net/activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;u...

0
0

87ms
87ms

Document
text/html

172.217.197.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12688802.fls.doubleclick.net/activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.197.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qa-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Tue, 29 Oct 2024 20:50:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12688802.fls.doubleclick.net/activityi;dc_pre=CPe1p-O7tIkDFVKy0QQdbiQunA;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0...
td.doubleclick.net/td/fls/rul/ Frame 3EED 0
0 67ms
63ms Document
text/html 2607:f8b0:400d:c0d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-12688802&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1wgafz.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Oct 2024 20:50:31 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl...
ad.doubleclick.net/ 0
22 B 130ms
128ms Image
image/png 173.194.205.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12688802;type=actio0;cat=allpa0;ord=1;num=9661688808879;npa=0;auiddc=564111171.1730235030;ps=1;pcor=1385993911;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4as0v9188705310z8894400803za201zb894400803;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101823848~101925629;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26?

Requested by

Host: 1wgafz.top
URL: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.205.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qm-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 29 Oct 2024 20:50:31 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"3557037361245570401"}],"aggregatable_trigger_data":[{"filters":[{"14":["13647302"]}],"key_piece":"0xf2bcf486b336d7ad","source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","24835884","24835885","24835886","24835887"]},{"key_piece":"0xf186d04f51261d8b","not_filters":{"14":["13647302"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","20557008","20557009","20557010","20557011","24835884","24835885","24835886","24835887"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"20557008":36,"20557009":36,"20557010":36,"20557011":3530,"21":6356,"24835884":32,"24835885":32,"24835886":32,"24835887":3177},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"13287932849976214882","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"3557037361245570401","filters":[{"14":["13647302"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"3557037361245570401","filters":[{"14":["13647302"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"3557037361245570401","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"3557037361245570401","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["12688802"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H3 200 favicon.svg
1wgafz.top/v3/landing-fortune-wheel/favicons/ 1 KB
757 B 64ms
63ms Other
image/svg+xml 154.197.121.1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://1wgafz.top/v3/landing-fortune-wheel/favicons/favicon.svg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 154.197.121.1 , Seychelles, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: da27421d59a3829fd6292f822eed7c6b1b7a745870d6b736dc67220627d9d656

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1wgafz.top/v3/landing-fortune-wheel?sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437&

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "6703a795-5b5"
age: 3733
expires: Wed, 30 Oct 2024 00:50:31 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 20:50:31 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 09:19:17 GMT
vary: Accept-Encoding
cache-control: public, max-age=14400
cf-ray: 8da609d40d0536b7-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 528
server: cloudflare

POST
H2 204 collect
analytics.google.com/g/ 0
0 61ms
59ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je4as0v894728184z8894400803za200zb894400803&_p=1730235029802&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101823848~101925629&cid=381002163.1730235030&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&dp=%2Fv3%2Flanding-fortune-wheel&sid=1730235030&sct=1&seg=0&dl=https%3A%2F%2F1wgafz.top%2Fv3%2Flanding-fortune-wheel%3Fsub1%3D12b21bec-9561-11ef-9bcf-399d9fd6bc68%26sub2%3D96437%26&dt=1win&_s=2&tfd=8015
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://1wgafz.top/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://1wgafz.top
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 20:50:36 GMT
content-type: text/plain
server: Golfe2

Verdicts & Comments Add Verdict or Comment

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.1wgafz.top/	1970-01-21 00:37:16	Name: __cf_bm Value: pABrOv2pW_VzU0toEclMNEwBrpHN6XdOVk86nR6Msbg-1730235029-1.0.1.1-Ri6wVsDgiceN9lb2xR97qdijd.7eR.0Ji1Z2_opwnmjSxY6yrMT0fr8cxuyT090X5SNCOkgMo.t3rwbZxAYjJg
.1wgafz.top/	1969-12-31 23:59:59	Name: _cfuvid Value: w21bqFUX60_VAXuWN42twkabSc_sv2Lvmi75sC25PKA-1730235029163-0.0.1.1-604800000
.1wgafz.top/	1970-01-21 09:22:51	Name: AMP_494cccfe21 Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjIxN2EzZDIxOS1kMTlhLTQ0NTItYmQ4OS1jNjdiNmRiMTI3NjIlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzMwMjM1MDMwMTMwJTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJwYWdlQ291bnRlciUyMiUzQTAlN0Q=
.1wgafz.top/	1970-01-21 02:46:51	Name: _gcl_au Value: 1.1.564111171.1730235030
.1wgafz.top/	1970-01-21 09:22:51	Name: cf_clearance Value: _4x7Rt4Pmdx2QHWZ6gvP1k9OehmtZzbq_.RlC21FIpg-1730235030-1.2.1.1-F5RPE347usruUuEhZ4CspmipQ5TBh8UYyk85GB7UWPKQJAYyOAgHuPUAJ1OYBuUGXXXwXodR80Kq_62foQMhLjgU7iirl4ep7.rx6nih36RpC0M7R7.hht3M4shnUmI6rWIuRau.ZjJiCtof89mty6Ae8a9iSxew0RuKRIdxjFL8WcX.iFtUyTBKnBblOVzUVlTluE_G0q5nhU0rZoLodO9gEY.bkCerFWS14owOTNOm1HfGCid2gp6J210j7YL0m7TUTeFXfeSor_yqGbfKXsJaJWS7yDCkNSnKLAjN7aOpbmrC9pPxSze5JeOycDjY8_eV_9He3EFJPq7qBCGE4rVE3XiPtdwb0.5.ucQUg9OPLv8f7gMfadnHJBuKM0Ti
.1wgafz.top/	1970-01-21 10:13:15	Name: _ga Value: GA1.1.381002163.1730235030
.doubleclick.net/	1970-01-21 04:56:27	Name: receive-cookie-deprecation Value: 1
.1wgafz.top/	1970-01-21 09:22:51	Name: _hjSessionUser_2606090 Value: eyJpZCI6Ijg5NGNkZjIxLTlmZWMtNTJhNS05ZDczLWNjMTQxNTJkZDdmYSIsImNyZWF0ZWQiOjE3MzAyMzUwMzA5ODYsImV4aXN0aW5nIjpmYWxzZX0=
.1wgafz.top/	1970-01-21 00:37:16	Name: _hjSession_2606090 Value: eyJpZCI6IjQ4M2M0MjRlLTA3MTctNGJmYS1iZjJhLTAxZWZkMDgyOGY0OSIsImMiOjE3MzAyMzUwMzA5ODgsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
1wgafz.top/	1969-12-31 23:59:59	Name: _hjHasCachedUserAttributes Value: true
1wgafz.top/	1970-01-21 01:21:53	Name: sub_ids Value: sub1=12b21bec-9561-11ef-9bcf-399d9fd6bc68&sub2=96437
1wgafz.top/	1970-01-21 01:21:53	Name: visit_domain Value: 1wgafz.top
.doubleclick.net/	1970-01-21 01:20:27	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 10:13:15	Name: IDE Value: AHWqTUnhynURJU7DEWPNAzE7LdaTH5akU6nCPw3MQKv-b1vIHt-NfgLzd-ZfVC2E
.1wgafz.top/	1970-01-21 10:13:15	Name: _ga_548949LWLW Value: GS1.1.1730235030.1.0.1730235031.59.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12572451.fls.doubleclick.net
12688802.fls.doubleclick.net
1wgafz.top
ad.doubleclick.net
analytics.google.com
cdn.amplitude.com
googleads.g.doubleclick.net
partners.1win-cdn.com
rtb-demo.ubidex.xyz
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
td.doubleclick.net
www.google.ca
www.google.com
www.googletagmanager.com
108.138.106.124
108.139.29.45
154.197.121.1
172.217.197.148
173.194.205.149
18.164.96.90
190.115.19.14
2001:4860:4802:34::181
2607:f8b0:4004:c21::63
2607:f8b0:400d:c00::61
2607:f8b0:400d:c00::9d
2607:f8b0:400d:c02::9b
2607:f8b0:400d:c0c::5e
2607:f8b0:400d:c0d::9c
49.13.81.104
044f740225e7e77b8f847092765f3907b20db17d7d284cae7333cf8445057c42
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7
0d89f31f4fb4e7ff987a391c58690f55516d7d25693aca467c79e545cf1529ce
1952af3afb6be47c8b366c6e9b44cde5efb1ebd2fa9f832912ef41caddee279e
24204d7506b849257f774de1ee2715c6d54268c883a6d6c038350a862401a6aa
255e06d2b5806c919d46016b9fa4a9ce9bcc909693d7161e00c5163d5a5950c4
25702f412567ceea60b108a2445c493f6f9d72ac11d24736fb5c334384de1150
26b8bf8a7e6ddfa37260e050667257c77ce8a44fa71d67f9767142bc2017991a
342731dddaab9ddb4b950f8e1e1e58f2bba060ea69c4ae667e6038ca60b19e40
3634b68c242ef07fd879838de719ccc22f67cbdbdbbd4bad7660678398f698de
475667bb346baccd14688368577c80a31d84029d32a8e4d1da927346560110e7
4bb1345c2a06a9e9986503479235c558d2c0bd65f19a650166e337f3c6e559e8
6ef446d80a2e57f7e37944db08182db97705bfb66d2c9e26bee2b3cefeec4089
705f162ccea371c7ca4af41a84964e2b6de1a47b5266b6cd9147ce8615cc6ccb
790336a09030817df4a1adcef4e9bcf7d300d847d96597963cfa81f2c9fca8f5
7eb9af942b69cfa49857a896159ba5e3cd96a87956dc1d367262125b1600a144
7f6668a7e9ef502207250ae107377a8dc32f43c20a8c38ab7a06d7acfffceef6
7fb19b1467b61d67de500a2d100235d56b74b85b29389570019c3f626401d624
9aed8d1ca62c65606c7cc70ec6a34ed44fda9b39ddfd800279e0727c2c7a0282
9c3b25f260defd6991608963a30a67cad0981ecce13e5975b1a6304887514d7f
a12c39763e10643733c0f5320309c982de153bdd054e7cd286486c4c5cc83e74
ab41779fc10cedb8b66c998e8d1724d6404b791c93d40e81ae7a075d774d52da
adc57b25de40732df0ea15858661b98e273693c87fb7f343cab826b2d55cab6c
baa82c45de8747da4fa1f95c7059661d2421013236c2c3672028f7d09bfaf682
c0d57eff0936a57e0c8d6bc93314585c734e5ade88d6de970e1e305ae5d87224
c9026479eb79c93bd9cfb6ea5d52bf42b8a2e5d5a8c9426ce0146cd32ff65c65
d28fd70fd5f8781c51fcd79cecbbdd08de5923f25b0da2b7905a25f8381945aa
d83ed80353a034afb800558798c084cae07eaf0567b479005ec28fe34811b462
d9bfe0de09ed0ff81a2f7c1d72e18e0177e4b347c5f6f9c5a052c1254068711f
da27421d59a3829fd6292f822eed7c6b1b7a745870d6b736dc67220627d9d656
db50cb7512558b476b9bf46a1ff5be0cbc7dbcb5b4df3e1d571c2acd85dcff76
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f769257f466c93c0dbc91b76c56ab876cc3ef91c4d0b3cd6a40f15b6bfb0c51f

1wgafz.top Open in urlscan Pro 154.197.121.1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

50 Requests

98 %HTTPS

47 %IPv6

9 Domains

16 Subdomains

16 IPs

4 Countries

1918 kBTransfer

3733 kBSize

15 Cookies

0 Outgoing links

Page URL History

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

1wgafz.top Open in urlscan Pro
154.197.121.1 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

98 %
HTTPS

47 %
IPv6

9
Domains

16
Subdomains

16
IPs

4
Countries

1918 kB
Transfer

3733 kB
Size

15
Cookies

50 HTTP transactions
1 data transactions