urlscan.io logo urlscan.io
SecurityTrails logo

s.linkswinner.pro Open in urlscan Pro
94.237.93.242  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top/SubscribeClick
Effective URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_...
Submission Tags: phishing apple Search All
Submission: On September 01 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 94.237.93.242, located in Finland and belongs to UPCLOUD, FI. The main domain is s.linkswinner.pro.
TLS certificate: Issued by R3 on August 14th 2023. Valid for: 3 months.
This is the only time s.linkswinner.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 45.141.159.22 206776 (INTERDEX-...)
1 1 35.201.98.21 396982 (GOOGLE-CL...)
1 1 94.237.99.118 202053 (UPCLOUD)
7 94.237.93.242 202053 (UPCLOUD)
3 2600:9000:20c... 16509 (AMAZON-02)
10 2
1    2606:4700:3035::6815:9d (United States)

ASN13335 (CLOUDFLARENET, US)
account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top
1    45.141.159.22 (Bulgaria)

ASN206776 (INTERDEX-NETWORK, SC)
PTR: no-rdns.krypton-network.com
track.emldmonly.com
1    35.201.98.21 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 21.98.201.35.bc.googleusercontent.com
trk.back-trak.com
1    94.237.99.118 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-99-118.de-fra1.upcloud.host
1d6ce02b5d0.tc4asdf.com
7    94.237.93.242 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-93-242.de-fra1.upcloud.host
s.linkswinner.pro
3    2600:9000:20c4:9400:13:27f7:6080:21 (United States)

ASN16509 (AMAZON-02, US)
d1u65k3qj4t7ya.cloudfront.net
Domain Requested by
7 s.linkswinner.pro s.linkswinner.pro
3 d1u65k3qj4t7ya.cloudfront.net s.linkswinner.pro
1 1d6ce02b5d0.tc4asdf.com 1 redirects
1 trk.back-trak.com 1 redirects
1 track.emldmonly.com 1 redirects
1 account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top 1 redirects
10 6

This site contains links to these domains. Also see Links.

Domain
jaffco.xyz
Subject Issuer Validity Valid
*.linkswinner.pro
R3		 2023-08-14 -
2023-11-12		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2022-12-08 -
2023-12-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Frame ID: 10D248DC1AB12544DAEE8830A5CD0503
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Congratulations!

Page URL History Show full URLs

  1. https://account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top/SubscribeClick HTTP 301
    https://track.emldmonly.com/C2Nrb3IBeC HTTP 302
    https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=b35f29bd5589455b8406a0257a5a8ada22106&source=223952&p3= HTTP 302
    https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream HTTP 302
    https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825... Page URL

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

2
IPs

3
Countries

144 kB
Transfer

319 kB
Size

20
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top/SubscribeClick HTTP 301
    https://track.emldmonly.com/C2Nrb3IBeC HTTP 302
    https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=b35f29bd5589455b8406a0257a5a8ada22106&source=223952&p3= HTTP 302
    https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream HTTP 302
    https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request win_gold
s.linkswinner.pro/
Redirect Chain
  • https://account-amazon-merchant-center-campaign-v3-signin-identifier.gowd.top/SubscribeClick
  • https://track.emldmonly.com/C2Nrb3IBeC
  • https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=b35f29bd5589455b8406a0257a5a8ada22106&source=223952&p3=
  • https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream
  • https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
15 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
0ff00d8237aac3de1dada76d948381e869f03f0168004416fd5e3102fd212199

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Sep 2023 16:49:17 GMT
log-id
63c2342c-6873-4980-a394-ba501a362e0b
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Fri, 01 Sep 2023 16:49:16 GMT
location
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
app.css
s.linkswinner.pro/css/offers/win_gold/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
6ad823d9abbb230248bf9a219014b713875caf1033ec924cba57fd4b96619585

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:17 GMT
content-encoding
gzip
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
W/"64f18ba3-f15"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sat, 31 Aug 2024 16:49:17 GMT
default@0.75x.png
s.linkswinner.pro/img/prizes/iphone-14/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/prizes/iphone-14/default@0.75x.png
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
eda7d0d12a2dcb4063802985a75a13935a6f4168a92b9c8861ca880801775fde

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:17 GMT
last-modified
Fri, 01 Sep 2023 06:56:36 GMT
etag
"64f18b24-26e4"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
9956
expires
Sat, 31 Aug 2024 16:49:17 GMT
app.js
s.linkswinner.pro/js/ 		0
207 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/js/app.js?id=d41d8cd98f00b204e9800998ecf8427e
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:17 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-0"
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
0
expires
Sat, 31 Aug 2024 16:49:17 GMT
app.js
s.linkswinner.pro/js/offers/win_gold/ 		242 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/js/offers/win_gold/app.js?id=03ed7013f4af599a61ae16bbb1969bf7
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
ca29d3e0e1844cc3a150c92817b2fd0b39601e155adefb8347569d3791049528

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:17 GMT
content-encoding
gzip
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
W/"64f18ba3-3c9d5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sat, 31 Aug 2024 16:49:17 GMT
bg.jpg
s.linkswinner.pro/img/offers/win_gold/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/offers/win_gold/bg.jpg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
35b6e5cc0b3a23ad26e7e6e444998d4aa95d66add467bd2e110a3ae67c61a3c7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:18 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-7b2f"
content-type
image/jpeg
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
31535
expires
Sat, 31 Aug 2024 16:49:18 GMT
softbank.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		264 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/softbank.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c4:9400:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de52a71178a5ec7a1583dce44d52c43ec4eb10c0acdd55ffe609d4d186b252ad

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Fri, 01 Sep 2023 12:45:18 GMT
via
1.1 03b7e9f8df503f6b2ae9c8f94431c7ee.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:39 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
age
14641
etag
"889a1adf82c28e87eceac2dbeaf66df6"
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
accept-ranges
bytes
content-length
264
x-amz-cf-id
pKhUa_sZVYC2wOuc1h9okXNcPFMJKTELDu6vLoE5bGzh9H2o60MlvA==
kddi.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/kddi.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c4:9400:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
28b5004a80479892c4f5b71a4caee5eb4f92cbf92f7b843c90e4c6b21761c80b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Fri, 01 Sep 2023 14:34:34 GMT
content-encoding
br
via
1.1 03b7e9f8df503f6b2ae9c8f94431c7ee.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:38 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
age
8767
etag
W/"da611a37af9b86a85bea64155bef82b2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
x-amz-cf-id
FFBxnX11goT57WzsILVZtTqyL_7nwWv_aCb-cI7t3oq4336Q70VeKQ==
ntt_docomo.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/ntt_docomo.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=6048bguew9jjlea3pcqo0gk04,16346016,5,4537&ctrack=1693586956.825950992&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c4:9400:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c5160dd86255de8ea562f069fb3a3d25813ed7a09bebcded296eaa02b57bf83

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 22:30:59 GMT
content-encoding
br
via
1.1 03b7e9f8df503f6b2ae9c8f94431c7ee.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:39 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
age
65900
etag
W/"529e6bccd53270a95c7e4e16778e9a48"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
x-amz-cf-id
0FnxpHuEGrSt-17uQdZ71Ae_r-HzNuYdAP8WHd0l1btTHQSbJrqvFw==
seal.png
s.linkswinner.pro/img/offers/win_gold/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/offers/win_gold/seal.png
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
27d6943fdeb7a2c881dbc9c7106e1162b139e905bd89beee69d69ac7cf336f39

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Fri, 01 Sep 2023 16:49:20 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-2ead"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
11949
expires
Sat, 31 Aug 2024 16:49:20 GMT

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| pd_options object| view number| w number| h function| step

20 Cookies

Domain/Path Name / Value
.emldmonly.com/ Name: gdm_sid_v2_3_001
Value: /qbFWXjfzNAIlcjDrf5P9aON5rFQLp7UQZV/3+AlClWgxFETXrnF+6+jJ4/gjIEXNvjslarQpk4lHussU9KELQ4r44gxJmR4bSP4xPHfnoN/Dal/5H0tlyep8UbgSHIObWBy8+bDtOlseygvGyaN3uP1u6ketnESBMwvJR/F/2Hs0O4n+FuO9gLaU1s0WjPeHi3+YwgbJbPMsGD124x4rFEejb6Ryj/W+s/F9lI+fq09Dt0oHmUiNoWxJzYHOJszCF7SrEHjHEv98bzLT0xmHXHO7cACNjEQOJ0ktbjeyGPLBbMMJR1TvHQxu/AGVx+x8+uE8gfVBU+DmCXLbAha9ZXSCaH9gc84MAwb/xLfWOOa1Z74w1YmbSmnu6nKyz0kG18ao4bxC3Fe26rXwwSmP+MHkHU+AMwVsYzP0P4qEl8U80lp7Fu9dSaUgAGAttuJ8GXlwnjkC42QGayrt3YjoN/kJVGh3jXoJoiLAvc6YNMYoEKQqkw93A+X2tasjOgxuy2uOFUZVMlUwfgiiiRt2ifPTmmmvAT+qiZTbIkP10Z7uIlMNweDuGjHXU+HzsvVDVCGIhCNf+C6SkKDlm3arnL355w4iTVSrgKUAwxWHE+DuSDy1gPb3lNDSmr5Nj5OljD0sKt0F6JwIB/eiMOjtQ2Znrko2K5Nn0CZJSGhLT6Nwo6gJa8lE90JjoUdT2ltqaKDlNxNy2qn99+VFp78Uwlb6/NuqzTsCfro2Iv3eIWRdYC224Juhm3r2wNqWHJ3veYz3uhVXg3hH8nhm2YoPFW41IaGN5qTdd+kASw01Jw6OGbZEN+6/DCc/8WtP/NnAe5ukJbD2W3xYf8tUfSmbOIe/qzcNaalOzLav20IwmBNxu8E8jNxrPqsJ7R+EjF85IgZxADSdlKsPINuCWQSbxSM5gFOXDalnHFBB8fu8NWgmzQnavPOf61T66LD08aNWRpR/1liuzgbF8aVlxLIFtL+mdMonOBqD8D86ceAMlZenxcYJfznJwrew9Y7L2QWMNOJS5rOJY/9jwpUEohB65xT9DR2s5XQqa1pbTZssy0=
.emldmonly.com/ Name: gdm_uid_v1_1_001
Value: +ZzzuCpppbvto9QuC10HwU6lvmBuWtYo4PvugSjkkCnJlszuYTVkivJJS4Ne2nMf
.emldmonly.com/ Name: gdm_click_freq_v1_1_001
Value: 5bVyImjD520Hoc/CnETYYGdO/yMYOoze4/122nVuzL16TBgkt8lr29FOdggpLt+U
.emldmonly.com/ Name: gdm_sid_v1_3_001
Value: /qbFWXjfzNAIlcjDrf5P9aON5rFQLp7UQZV/3+AlClWgxFETXrnF+6+jJ4/gjIEXNvjslarQpk4lHussU9KELQ4r44gxJmR4bSP4xPHfnoN/Dal/5H0tlyep8UbgSHIObWBy8+bDtOlseygvGyaN3uP1u6ketnESBMwvJR/F/2Hs0O4n+FuO9gLaU1s0WjPeHi3+YwgbJbPMsGD124x4rFEejb6Ryj/W+s/F9lI+fq09Dt0oHmUiNoWxJzYHOJszCF7SrEHjHEv98bzLT0xmHXHO7cACNjEQOJ0ktbjeyGPLBbMMJR1TvHQxu/AGVx+x8+uE8gfVBU+DmCXLbAha9ZXSCaH9gc84MAwb/xLfWOOa1Z74w1YmbSmnu6nKyz0kG18ao4bxC3Fe26rXwwSmP+MHkHU+AMwVsYzP0P4qEl8U80lp7Fu9dSaUgAGAttuJ8GXlwnjkC42QGayrt3YjoN/kJVGh3jXoJoiLAvc6YNMYoEKQqkw93A+X2tasjOgxuy2uOFUZVMlUwfgiiiRt2ifPTmmmvAT+qiZTbIkP10Z7uIlMNweDuGjHXU+HzsvVDVCGIhCNf+C6SkKDlm3arnL355w4iTVSrgKUAwxWHE+DuSDy1gPb3lNDSmr5Nj5OljD0sKt0F6JwIB/eiMOjtQ2Znrko2K5Nn0CZJSGhLT6Nwo6gJa8lE90JjoUdT2ltqaKDlNxNy2qn99+VFp78Uwlb6/NuqzTsCfro2Iv3eIWRdYC224Juhm3r2wNqWHJ3veYz3uhVXg3hH8nhm2YoPFW41IaGN5qTdd+kASw01Jw6OGbZEN+6/DCc/8WtP/NnAe5ukJbD2W3xYf8tUfSmbOIe/qzcNaalOzLav20IwmBNxu8E8jNxrPqsJ7R+EjF85IgZxADSdlKsPINuCWQSbxSM5gFOXDalnHFBB8fu8NWgmzQnavPOf61T66LD08aNWRpR/1liuzgbF8aVlxLIFtL+mdMonOBqD8D86ceAMlZenxcYJfznJwrew9Y7L2QWMNOJS5rOJY/9jwpUEohB65xT9DR2s5XQqa1pbTZssy0=
.emldmonly.com/ Name: gdm_suid_v1_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.emldmonly.com/ Name: gdm_uid_v2_1_001
Value: +ZzzuCpppbvto9QuC10HwU6lvmBuWtYo4PvugSjkkCnJlszuYTVkivJJS4Ne2nMf
.emldmonly.com/ Name: gdm_click_adv_freq_v2_1_001
Value: /Np31dPxWDeGZoWl2+V1TODxmYmjiuiyIca7U2AVJiAkhQtKZkWU+o9HYzU4O08f
.emldmonly.com/ Name: gdm_click_adv_freq_v1_1_001
Value: /Np31dPxWDeGZoWl2+V1TODxmYmjiuiyIca7U2AVJiAkhQtKZkWU+o9HYzU4O08f
.emldmonly.com/ Name: gdm_click_freq_v2_1_001
Value: 5bVyImjD520Hoc/CnETYYGdO/yMYOoze4/122nVuzL16TBgkt8lr29FOdggpLt+U
.emldmonly.com/ Name: gdm_suid_v2_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.1d6ce02b5d0.tc4asdf.com/ Name: rts-trck
Value: 1
.tc4asdf.com/ Name: t-uuid
Value: 6048bguez4pgg1rtjqdus84g0
.tc4asdf.com/ Name: ab
Value: B
.tc4asdf.com/ Name: traffic-visited-domain
Value: linkswinner.pro
.tc4asdf.com/ Name: traffic-back-ivr
Value: ok
s.linkswinner.pro/ Name: XSRF-TOKEN
Value: eyJpdiI6Ilg5VlJJeVROWEVYWHcxaGdWemhiWUE9PSIsInZhbHVlIjoicUNJZlJ6VGc4ZWd2K0lEaU0zRXl2T2xpOWJUd0tZUUQreUx5WDJuTk9sNXVuckt0bEVYaEFYT0UrMmovclVPNUhQcDI0UXdPNFNVUm42ZlR2Tk5ISzgzc1A2ckNvZGlPVUF1UHhlZmhWUlFEbVl1a3VWYUMxN1Qydm0xcVVrN0wiLCJtYWMiOiI5MTE2NzYxY2UyNWRjZThjM2U2ZWU4NTc1N2FmMTQwYmFjMzgzNTIwZjRkY2M3NGJmOTljZjRjYWU1ZjM0MjI5IiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: ivr_offers_session
Value: eyJpdiI6Im0vVGxQSHVCaDVsd1NZSktXVFFMbXc9PSIsInZhbHVlIjoibm1zejE1Qm9wdTJMeXhQMTV0bmJQTGQ2M1FLUDJyYUsrS1pKVFJQKy9Sb29QSGtkT0NyMmtrUjhhSytGS3lhMmxVNkhYT29pVWJwNjhCcjgyRjR3Y3g4TVhZWWJRcW5JYnJ4UmFod2MyYW1sa2QwRGRRSkFNbjJoSTZWMkIzMHQiLCJtYWMiOiI0YzRiY2JlNDg1NGU3YWJlOTZhMTI0Njc3OGQzMDQ2MmFmYTg2ZTY5YTYzMTRjYzkzN2ViOTA4MTI5NWUyMGRjIiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: SESS_TRAF
Value: eyJpdiI6Ik1Ma1FneW5PMGJPenN2WFQ2WFZUWnc9PSIsInZhbHVlIjoiYVpjalhhbFhHRWd5NVpqQlJrM0NWMk1WdkJ2YXZkZnNvNWJYODNsaCtTQWRDNFRrYVczbXlJeTlyUDJZS0J3N1hFV2JvZ3JYd0JiQzFEaWViamdEeXZSNDluRG9lODhrazJJS3ZpazNJamZFVlZIczI1ZkpKTGlSNW52c3BpZk02bHRrTXZSQmpuTWhVMVFTeXRTZ3NoWUF3MUlISHo0TzZiaEZZczhSSGFwRFNBRHFINlptTVlGVXNLRnlCV2lDOSttazB6cGVsRWJhcVZkQW1ZUjdBQ1NJT25ITzE3eWlIdklhLzhSdGJ1QT0iLCJtYWMiOiJjYWJhM2EzMjJlMDFmM2QwMjFjZjk0YTg1MGRhM2M1YTJhYmQ4ZTI0OTlhNGYzMjIyODY4MDkwMTM2OWMyYTJmIiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: visit
Value: eyJpdiI6ImQ5T05vUHpIVHp6WGNZeElzTFJ4WXc9PSIsInZhbHVlIjoiZ1ljZitkQ0NUcnc5MS9SZExodXZDTC9WNmRXQWV2MitVTFY1YUYvTDEvVVJYdXVQMzV6VnFpTHJ2aDJaL3RMKyIsIm1hYyI6ImY5MjU2ZWZkOWQ0NjAyNTRlZTkyOTk5Yzk0ODM5MWQ0Yzg3MTdlZjQwOWJmMmNlNmI4OGI4OTUzNGEzNTVlNmQiLCJ0YWciOiIifQ%3D%3D
s.linkswinner.pro/ Name: TjYNyXRLaJHALlakoEkPlVvRBNPADvaHurTUitXR
Value: eyJpdiI6IjVUYzlEWXpObzBLU3ZvajF5blY2UlE9PSIsInZhbHVlIjoiQzVLNlM0bzI4WG5SdEMrZHlDS3FScURWeS9rZlp2VUExNnhWVWt0OVBPU3hZbGlEZU5WMmRkUjQ0V0diOXpHVnJNT2dhRWpMaEJwOWk2QnJ0bVNpaXVreGF0MzlDb0M4dm4rYlBZNGREMnhNS1ZrZ1pBQ0xwQWlLcjFFamlrVEswWjRqTkxYSlJJaktORFJDbVN0NXRyZ1hJNHoxNUZIWDFjZlp4TllZcmsxelMrcG9TUThjM0RxY2szcElreGFsSGNkMGRyNlp5NGJpd2xjOHhwYUpDNkpxeUhqZ3BvT2xNcjc3UXNpQW5SY25iamNpdGI3ak1tNUdOclJOS3p5T25CUktsU21xTC9RV2RQczk5R1pqbWEwTm5EUnRUd21VZHc2MG9ydkd6MTI2c0QxWUpUb1RKQjVHZUpQL09PZ2dMOU9kdjNyUERpV3JBWUthWURISHBHUksrUlZCT1p5ald3SlMxdHYrMGllaEpjK3BGUUtmT1FWbkg1aTF0QmVtd25yZldmeHdXbXFrQS9GZnFaQzRvTmV4Q3F5SWM2Rkc3WkZpVURTZHBDWThqTWNtd0IzL0sycVFaUkJYQlJKZmFzR1hBR0VlMUUzK3Jidy92S0wyN1NoVWVBRVA3ZnVMU1IzdUtoazZGTHB2QU5DVm5HN3YxZVRSYSttMDR2ZllTUXBtL3F3c2V4TXpyeXo2aEdFUHpRPT0iLCJtYWMiOiIxNTY0ZmU3MDFkZGQ3NmU4NGRmYTM0MmZiYWU3NDg0ZGU2YzcwYTRjOTcwZDlmMDg3OTBjYWEyZmQ5ZWFlYjRkIiwidGFnIjoiIn0%3D