track.auroraveil.bid Open in urlscan Pro
104.21.87.224  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Page URL
2. https://track.auroraveil.bid/proceed.php?domain=directcashtransfers.com&hash=7998a735fcd590cbcbcecd4a8d2797d8&u=eyJkb21haW4iOiJkaXJlY3RjYXNodHJhbnNmZXJzLmNvbSIsImRvbWFpbl9pZCI6IjMxMzY3ODg5IiwiZm9sZGVyX2lkIjpudWxsLCJtaWQiOiIxODIiLCJmaWx0ZXJfaWQiOm51bGwsImFkdmVydGlzZXJfaWQiOiI4IiwidGFyZ2V0IjoiaHR0cDpcL1wvdmVsZXMtc3dnLmNvbVwvemNsa3Zpc2l0b3JcLzk4YWM5MDMxLTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyM1wvNjAxOTE3M2ItNjc1ZS00ODUyLTk4ZjQtZDRmNDdlZGJiOTcyP2NhbXBhaWduaWQ9OThiYWU4MTQtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzIiwiaXBfYWRkcmVzcyI6IjE4NS4xOTguNjIuMTQ3IiwidHlwZSI6ImphdmFfcmVkaXJlY3QiLCJiaWQiOiIwLjAwMzA0In0= Page URL
3. https://track.auroraveil.bid/beam.php?tcid=&target=aHR0cDovL3ZlbGVzLXN3Zy5jb20vemNsa3Zpc2l0b3IvOThhYzkwMzEtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzLzYwMTkxNzNiLTY3NWUtNDg1Mi05OGY0LWQ0ZjQ3ZWRiYjk3Mj9jYW1wYWlnbmlkPTk4YmFlODE0LTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyMw==&hash=e5a861a3c22356d439109f13977d1fab&m=MTgy Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response y4tn8kqb2ohimgmm.directcashtransfers.com/	9 KB 4 KB	1932ms 375ms	Document text/html	65.21.240.245 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.21.240.245 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS static.245.240.21.65.clients.your-server.de Software openresty / Resource Hash 2c9e7e7ca2cd02414ca3e4503e79a368da81eff43dbc20e9876ee7202128ee9a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=utf8 date Fri, 25 Oct 2024 13:02:32 GMT server openresty x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	200	css fonts.googleapis.com/	794 B 840 B	1534ms 56ms	Stylesheet text/css	142.250.184.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Poppins Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.202 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f10.1e100.net Software ESF / Resource Hash a619c7ffa7d48d0a2901958b94251ccf03df56d451086b23af37adc84ed00fe9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Fri, 25 Oct 2024 13:32:29 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:29 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Fri, 25 Oct 2024 11:34:07 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	css fonts.googleapis.com/	1 KB 479 B	1534ms 59ms	Stylesheet text/css	142.250.184.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Neucha|Cabin+Sketch Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.202 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f10.1e100.net Software ESF / Resource Hash f674bc589cc070db3e3a42de7a0ddd10874d50c685016c270bed74ef6ac35afa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Fri, 25 Oct 2024 13:32:29 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:29 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Fri, 25 Oct 2024 13:23:52 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	feed.js Show response static.traffic.club/	13 KB 14 KB	1105ms 81ms	Script application/javascript	78.46.152.77 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://static.traffic.club/feed.js Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 78.46.152.77 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS dedi4171.your-server.de Software Apache / Resource Hash 23bec1376312be873fdff35109bd4f2499f0fb8ee7742b3caf8eef22e9b96ae8 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers accept-ranges bytes content-length 13729 etag "35a1-5f4cd71024340" date Fri, 25 Oct 2024 13:32:29 GMT last-modified Thu, 16 Feb 2023 09:01:25 GMT content-type application/javascript server Apache
GET H2	200	banner_ads.js Show response y4tn8kqb2ohimgmm.directcashtransfers.com/	111 B 326 B	76ms 75ms	Script application/javascript	65.21.240.245 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://y4tn8kqb2ohimgmm.directcashtransfers.com/banner_ads.js Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.21.240.245 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS static.245.240.21.65.clients.your-server.de Software openresty / Resource Hash 4aa355b64f75bc8293836eb2ca7ff4a0d7230f361c2e9b1b2d7394ac7c540f90 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control max-age=2592000, public etag "5d8c7311-6f" pragma public expires Sun, 24 Nov 2024 13:02:32 GMT accept-ranges bytes content-length 111 date Fri, 25 Oct 2024 13:02:32 GMT content-type application/javascript last-modified Thu, 26 Sep 2019 08:13:05 GMT server openresty
GET H2	200	js Show response www.googletagmanager.com/gtag/	301 KB 103 KB	4826ms 529ms	Script application/javascript	142.250.184.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-LTZ10XBX1X Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f8.1e100.net Software Google Tag Manager / Resource Hash 5d9f007823fcc458d4d4b5bee802aae80476237297a9a11ef89329f8e2d342f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Fri, 25 Oct 2024 13:32:34 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:34 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 104345 x-xss-protection 0 server Google Tag Manager
GET H2	200	glade.js Show response securepubads.g.doubleclick.net/static/	281 B 660 B	4408ms 110ms	Script text/javascript	142.250.185.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/static/glade.js Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f2.1e100.net Software sffe / Resource Hash f26e40109b0475bacea3fc2fcad5a91f2003e11c4bbe736141982da246ac155e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip age 277651 report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} x-content-type-options nosniff expires Tue, 29 Oct 2024 08:25:03 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 22 Oct 2024 08:25:03 GMT last-modified Mon, 08 Aug 2022 15:14:26 GMT content-type text/javascript vary Accept-Encoding cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" content-length 214 x-xss-protection 0 server sffe
GET H2	200	font-awesome.min.css maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/	20 KB 5 KB	1538ms 62ms	Stylesheet text/css	104.18.10.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cdn-status 200 content-encoding br cf-cache-status HIT etag W/"bbfef9385083d307ad2692c0cf99f611" age 316119 x-content-type-options nosniff alt-svc h3=":443"; ma=86400 date Fri, 25 Oct 2024 13:32:29 GMT last-modified Mon, 25 Jan 2021 22:04:53 GMT content-type text/css; charset=utf-8 vary Accept-Encoding, Accept-Encoding cdn-cache HIT cdn-cachedat 03/18/2024 13:06:50 cdn-requestpullcode 200 strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31919000 cdn-requestpullsuccess True timing-allow-origin * cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 8865ee910644b9a134862e38181d89c1 cross-origin-resource-policy cross-origin cdn-pullzone 252412 cdn-proxyver 1.04 cf-ray 8d8292ad99f15264-MXP access-control-allow-origin * cdn-edgestorageid 718 server cloudflare cdn-requestcountrycode US
GET H2	200	feed.php Show response track.traffic.club/	3 KB 3 KB	2088ms 1170ms	XHR text/html	167.233.8.197 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://track.traffic.club/feed.php?direct=g4tcd&mid=182&f=182&keyword=directcashtransfers.com&domain=y4tn8kqb2ohimgmm.directcashtransfers.com Requested by Host: static.traffic.club URL: https://static.traffic.club/feed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.233.8.197 Taufkirchen, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.197.8.233.167.clients.your-server.de Software nginx / Resource Hash 4055c88974c0bcf7af0eda2f9577ecb461725ef771d06b796d3c88dc90ee5024 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control no-cache, must-revalidate content-encoding none x-content-type-options nosniff access-control-allow-origin * content-length 3285 date Fri, 25 Oct 2024 13:32:32 GMT x-xss-protection 1; mode=block content-type text/html; charset=utf8 server nginx
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	4789ms 516ms	Script text/javascript	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip age 379 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],} x-content-type-options nosniff expires Fri, 25 Oct 2024 15:26:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:26:15 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 20994 server Golfe2
GET H2	200	rtb.min.js Show response static.trafficclub.com/	7 KB 3 KB	4798ms 530ms	Script application/javascript	143.204.98.118 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.trafficclub.com/rtb.min.js Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-118.fra50.r.cloudfront.net Software Apache / Resource Hash 6249d2dcfb60c3c54da30e6a64dec8ae78f54483af7549354a8c7679796dd89c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip etag W/"1b66-5ff4596259eb3" age 36557 via 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id T3Zc7xViCpGAQ4ps7RMDhnGqk8AUV__9XrbIbre1DUGxHaZzB-qkFA== date Fri, 25 Oct 2024 08:31:53 GMT content-type application/javascript last-modified Thu, 29 Jun 2023 14:33:40 GMT server Apache x-amz-cf-pop FRA50-C1 vary Accept-Encoding
GET H2	200	summer_ballon.jpg y4tn8kqb2ohimgmm.directcashtransfers.com/assets/images/	166 KB 166 KB	283ms 281ms	Image image/jpeg	65.21.240.245 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://y4tn8kqb2ohimgmm.directcashtransfers.com/assets/images/summer_ballon.jpg Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.21.240.245 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS static.245.240.21.65.clients.your-server.de Software openresty / Resource Hash a91a4a6d81038e8390eb5fd8dd83fb146bac24b5128f25820f321643e7ffd229 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control max-age=2592000, public etag "5b5aac92-2981c" pragma public expires Sun, 24 Nov 2024 13:02:34 GMT accept-ranges bytes content-length 170012 date Fri, 25 Oct 2024 13:02:34 GMT content-type image/jpeg last-modified Fri, 27 Jul 2018 05:24:34 GMT server openresty
GET H2	200	q5uGsou0JOdh94bfvQlt.woff2 fonts.gstatic.com/s/neucha/v17/	25 KB 25 KB	3488ms 834ms	Font font/woff2	142.250.185.195 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/neucha/v17/q5uGsou0JOdh94bfvQlt.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Neucha|Cabin+Sketch Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f3.1e100.net Software sffe / Resource Hash 5e0c6ca42b9531a42a7994e3ed907ea9e3a360dcaa6f77847ef587340d21d6ac Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://y4tn8kqb2ohimgmm.directcashtransfers.com Referer https://fonts.googleapis.com/ Response headers age 248668 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Wed, 22 Oct 2025 16:28:05 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 22 Oct 2024 16:28:05 GMT last-modified Mon, 09 May 2022 18:40:23 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 25376 x-xss-protection 0 server sffe
GET H2	200	fontawesome-webfont.woff maxcdn.bootstrapcdn.com/font-awesome/4.1.0/fonts/	82 KB 82 KB	903ms 130ms	Font font/woff	104.18.10.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/fonts/fontawesome-webfont.woff?v=4.1.0 Requested by Host: maxcdn.bootstrapcdn.com URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://y4tn8kqb2ohimgmm.directcashtransfers.com Referer https://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css Response headers cdn-status 200 cf-cache-status MISS etag "fdf491ce5ff5b2da02708cd0e9864719" x-content-type-options nosniff alt-svc h3=":443"; ma=86400 date Fri, 25 Oct 2024 13:32:31 GMT content-type font/woff last-modified Mon, 25 Jan 2021 22:04:53 GMT cdn-cachedat 08/25/2022 04:48:59 cdn-cache HIT cdn-requestpullcode 200 strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding cache-control public, max-age=31919000 cdn-requestpullsuccess True timing-allow-origin * cdn-requesttime 0 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 0e6a62a687033d2d337fbe5401c26cd8 cross-origin-resource-policy cross-origin cdn-pullzone 252412 cdn-proxyver 1.02 cf-ray 8d8292b6aa7b0e2a-MXP accept-ranges bytes access-control-allow-origin * content-length 83760 cdn-edgestorageid 860 server cloudflare cdn-requestcountrycode US
GET DATA	200 OK	truncated /	0 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type text/css
GET H2	200	jquery.min.js ajax.googleapis.com/ajax/libs/jquery/2.2.0/	84 KB 30 KB	1233ms 53ms	Script text/javascript	216.58.206.74 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js Requested by Host: static.trafficclub.com URL: https://static.trafficclub.com/rtb.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.74 , United States, ASN15169 (GOOGLE, US), Reverse DNS mil07s08-in-f10.1e100.net Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding gzip age 248886 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Wed, 22 Oct 2025 16:24:30 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 22 Oct 2024 16:24:30 GMT last-modified Tue, 03 Mar 2020 19:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30089 x-xss-protection 0 server sffe
POST H2	200	collect www.google-analytics.com/j/	3 B 438 B	65ms 57ms	XHR text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1541864858&t=event&ni=1&_s=1&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&ul=it-it&de=UTF-8&dt=directcashtransfers.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Blocking%20Ads&ea=No&_u=YEBAAEABAAAAACAAI~&jid=1011375939&gjid=1470056032&cid=1579826231.1729863155&tid=UA-43967021-7&_gid=1223953004.1729863155&_r=1&_slc=1&cd1=ts_landing_5&cd2=130&cd3=yes&z=1509013781 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:35 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://y4tn8kqb2ohimgmm.directcashtransfers.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 3 server Golfe2
POST H2	200	collect www.google-analytics.com/j/	15 B 86 B	99ms 96ms	XHR text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1541864858&t=pageview&_s=1&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&ul=it-it&de=UTF-8&dt=directcashtransfers.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAACAAI~&jid=2067945384&gjid=1419162270&cid=1579826231.1729863155&tid=UA-43967021-13&_gid=1223953004.1729863155&_r=1&_slc=1&z=2006150983 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:35 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://y4tn8kqb2ohimgmm.directcashtransfers.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 15 server Golfe2
GET H2	200	collect www.google-analytics.com/	35 B 345 B	98ms 95ms	Image image/gif	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1541864858&t=pageview&_s=2&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&ul=it-it&de=UTF-8&dt=directcashtransfers.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=&gjid=&cid=1579826231.1729863155&tid=UA-43967021-7&_gid=1223953004.1729863155&cd1=ts_landing_5&cd2=130&cd3=yes&z=1715176602 Requested by Host: y4tn8kqb2ohimgmm.directcashtransfers.com URL: https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers age 54374 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],} x-content-type-options nosniff expires Mon, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 24 Oct 2024 22:26:21 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 server Golfe2
POST H2	204	collect www.google-analytics.com/g/	0 0	75ms 75ms	Fetch text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-LTZ10XBX1X&gtm=45je4al0v878811334za200&_p=1729863150267&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101686685~101823848&cid=1579826231.1729863155&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729863155&sct=1&seg=0&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&dt=directcashtransfers.com&en=page_view&_fv=1&_ss=1&_ee=1&tfd=9212 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-LTZ10XBX1X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://y4tn8kqb2ohimgmm.directcashtransfers.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:35 GMT content-type text/plain server Golfe2
POST H2	204	collect www.google-analytics.com/g/	0 0	84ms 83ms	Fetch text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-LTZ10XBX1X&gtm=45je4al0v878811334za200&_p=1729863150267&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101686685~101823848&cid=1579826231.1729863155&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1729863155&sct=1&seg=0&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&dt=directcashtransfers.com&en=screen_view&_ee=1&ep.domain=directcashtransfers.com&ep.template=ts_landing_5&ep.member=130&ep.SSL=yes&_et=81&tfd=9296 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-LTZ10XBX1X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://y4tn8kqb2ohimgmm.directcashtransfers.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:35 GMT content-type text/plain server Golfe2
GET H2	200	rtb.php track.traffic.club/	650 B 837 B	457ms 440ms	XHR text/html	167.233.8.197 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://track.traffic.club/rtb.php?hash=70e0a3c4c4b04a83739f150c9c13d790&mid=182&f=182&request=rtb&keyword=%20&domain=y4tn8kqb2ohimgmm.directcashtransfers.com Requested by Host: static.trafficclub.com URL: https://static.trafficclub.com/rtb.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.233.8.197 Taufkirchen, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.197.8.233.167.clients.your-server.de Software nginx / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control no-cache, must-revalidate content-encoding none x-content-type-options nosniff access-control-allow-origin * content-length 650 date Fri, 25 Oct 2024 13:32:36 GMT x-xss-protection 1; mode=block content-type text/html; charset=utf8 server nginx
GET H2	200	js www.googletagmanager.com/gtag/	275 KB 97 KB	91ms 85ms	Script application/javascript	142.250.184.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-K0FNZEWP0D&cx=c&_slc=1 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f8.1e100.net Software Google Tag Manager / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Fri, 25 Oct 2024 13:32:35 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:35 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 99011 x-xss-protection 0 server Google Tag Manager
GET H2	200	proceed.php track.auroraveil.bid/	663 B 1 KB	773ms 376ms	Document text/html	104.21.87.224 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://track.auroraveil.bid/proceed.php?domain=directcashtransfers.com&hash=7998a735fcd590cbcbcecd4a8d2797d8&u=eyJkb21haW4iOiJkaXJlY3RjYXNodHJhbnNmZXJzLmNvbSIsImRvbWFpbl9pZCI6IjMxMzY3ODg5IiwiZm9sZGVyX2lkIjpudWxsLCJtaWQiOiIxODIiLCJmaWx0ZXJfaWQiOm51bGwsImFkdmVydGlzZXJfaWQiOiI4IiwidGFyZ2V0IjoiaHR0cDpcL1wvdmVsZXMtc3dnLmNvbVwvemNsa3Zpc2l0b3JcLzk4YWM5MDMxLTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyM1wvNjAxOTE3M2ItNjc1ZS00ODUyLTk4ZjQtZDRmNDdlZGJiOTcyP2NhbXBhaWduaWQ9OThiYWU4MTQtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzIiwiaXBfYWRkcmVzcyI6IjE4NS4xOTguNjIuMTQ3IiwidHlwZSI6ImphdmFfcmVkaXJlY3QiLCJiaWQiOiIwLjAwMzA0In0= Requested by Host: static.trafficclub.com URL: https://static.trafficclub.com/rtb.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.87.224 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 8d8292db6b3ecb09-DUS content-encoding none content-type text/html; charset=utf8 date Fri, 25 Oct 2024 13:32:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jSUOBRb1IjrxVfnKW4fmCNBgFUvA1VjxTFOZ11EAE8uDsmYXbc5cdmqU%2B3tDZxqBaIzZi1ZBUJhPFf4u2%2FWoz8y5gvw9MA5YY9GtuE72nFuaUy86BNJvBNG%2BJ%2B2r7VDyP3hBJZoMoA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=17972&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3904&recv_bytes=2746&delivery_rate=207619&cwnd=182&unsent_bytes=0&cid=0cf270ad46d12040&ts=641&x=0" vary accept-encoding x-content-type-options nosniff x-xss-protection 1; mode=block
POST H2	204	collect www.google-analytics.com/g/	0 0	62ms 50ms	Fetch text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-K0FNZEWP0D&gtm=45je4al0v9123205263za200&_p=1729863150267&gcd=13l3l3l3l2l1&npa=0&dma=0&tag_exp=101533422~101686685~101823848&ul=it-it&sr=1600x1200&cid=1579826231.1729863155&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fy4tn8kqb2ohimgmm.directcashtransfers.com%2F&dt=directcashtransfers.com&sid=1729863156&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=10151 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K0FNZEWP0D&cx=c&_slc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://y4tn8kqb2ohimgmm.directcashtransfers.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://y4tn8kqb2ohimgmm.directcashtransfers.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 25 Oct 2024 13:32:36 GMT content-type text/plain server Golfe2
GET H2	200	Primary Request beam.php Show response track.auroraveil.bid/	36 B 505 B	1030ms 1014ms	Document text/html	104.21.87.224 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://track.auroraveil.bid/beam.php?tcid=&target=aHR0cDovL3ZlbGVzLXN3Zy5jb20vemNsa3Zpc2l0b3IvOThhYzkwMzEtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzLzYwMTkxNzNiLTY3NWUtNDg1Mi05OGY0LWQ0ZjQ3ZWRiYjk3Mj9jYW1wYWlnbmlkPTk4YmFlODE0LTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyMw==&hash=e5a861a3c22356d439109f13977d1fab&m=MTgy Requested by Host: track.auroraveil.bid URL: https://track.auroraveil.bid/proceed.php?domain=directcashtransfers.com&hash=7998a735fcd590cbcbcecd4a8d2797d8&u=eyJkb21haW4iOiJkaXJlY3RjYXNodHJhbnNmZXJzLmNvbSIsImRvbWFpbl9pZCI6IjMxMzY3ODg5IiwiZm9sZGVyX2lkIjpudWxsLCJtaWQiOiIxODIiLCJmaWx0ZXJfaWQiOm51bGwsImFkdmVydGlzZXJfaWQiOiI4IiwidGFyZ2V0IjoiaHR0cDpcL1wvdmVsZXMtc3dnLmNvbVwvemNsa3Zpc2l0b3JcLzk4YWM5MDMxLTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyM1wvNjAxOTE3M2ItNjc1ZS00ODUyLTk4ZjQtZDRmNDdlZGJiOTcyP2NhbXBhaWduaWQ9OThiYWU4MTQtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzIiwiaXBfYWRkcmVzcyI6IjE4NS4xOTguNjIuMTQ3IiwidHlwZSI6ImphdmFfcmVkaXJlY3QiLCJiaWQiOiIwLjAwMzA0In0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.87.224 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ead6ad7bbff5034d764b2f3e2f8bf347096211a5566283df54d5376ad9c3c8c2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 8d8292e81fcacb09-DUS content-encoding br content-type text/html; charset=UTF-8 date Fri, 25 Oct 2024 13:32:39 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y9BzlQbA0SaOUO7kZu9M3gZxrIeg5ugEMcw12npYeNgWuJ1AEaUnnZtyFXlzaz4YCPpKjM6Dy1D01ljeus8%2BgJaWUHm2h7laFw5ZopM%2B7%2FnyTxJaqdBuknJQz2M71bdp86V8Jcp0gA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=21063&sent=11&recv=12&lost=0&retrans=0&sent_bytes=5294&recv_bytes=3059&delivery_rate=207619&cwnd=185&unsent_bytes=0&cid=0cf270ad46d12040&ts=3416&x=0" vary Accept-Encoding x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	200	favicon.ico track.auroraveil.bid/	0 491 B	127ms 58ms	Other image/x-icon	104.21.87.224 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://track.auroraveil.bid/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.87.224 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://track.auroraveil.bid/beam.php?tcid=&target=aHR0cDovL3ZlbGVzLXN3Zy5jb20vemNsa3Zpc2l0b3IvOThhYzkwMzEtOTJkNS0xMWVmLWE1NTUtMGFmZmQwOWQ2NzIzLzYwMTkxNzNiLTY3NWUtNDg1Mi05OGY0LWQ0ZjQ3ZWRiYjk3Mj9jYW1wYWlnbmlkPTk4YmFlODE0LTkyZDUtMTFlZi1hNTU1LTBhZmZkMDlkNjcyMw==&hash=e5a861a3c22356d439109f13977d1fab&m=MTgy Response headers cf-cache-status HIT etag "52302d56-0" age 2848 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rhAD0lELM0pSinFwl9CITTp7%2FOqydpdk%2B%2FdY12Ue0POEsHUhW7qo33PIq7YgZgiH7lDcxS%2FTxDRKOCTG0p4PpvtmGIEQoIW0Dv0Yo6q0%2Bp0awJ1HK63WW74g5hwPtKs5AHnrKsN5Dg%3D%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=21642&sent=15&recv=16&lost=0&retrans=0&sent_bytes=5865&recv_bytes=3431&delivery_rate=207619&cwnd=186&unsent_bytes=0&cid=0cf270ad46d12040&ts=4262&x=0" date Fri, 25 Oct 2024 13:32:40 GMT content-type image/x-icon last-modified Wed, 11 Sep 2013 08:44:06 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8d8292f23882cb09-DUS accept-ranges bytes content-length 0 x-xss-protection 1; mode=block server cloudflare

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			y4tn8kqb2ohimgmm.directcashtransfers.com/	1970-01-21 00:31:35	Name: ndsp Value: eyJkb21haW5OYW1lIjoiZGlyZWN0Y2FzaHRyYW5zZmVycy5jb20iLCJtZW1iZXIiOiIxMzAiLCJ0ZW1wbGF0ZSI6InRzX2xhbmRpbmdfNSIsInVzZXJBZ2VudCI6Ik1vemlsbGFcLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0XC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWVcLzEzMC4wLjAuMCBTYWZhcmlcLzUzNy4zNiIsInNlc3Npb24iOiJiMjY0ODhhYTkyOWZkZGNlYmI0MmYwNzk4Mzk1MWFlMiIsInRpbWVfaW5pdCI6MTcyOTg2MTM1Mn0%3D
			.directcashtransfers.com/	1970-01-21 00:32:29	Name: _gid Value: GA1.2.1223953004.1729863155
			.directcashtransfers.com/	1970-01-21 00:31:03	Name: _gat_mainCounter Value: 1
			.directcashtransfers.com/	1970-01-21 00:31:03	Name: _gat_tcCounter Value: 1
			.directcashtransfers.com/	1970-01-21 10:07:03	Name: _ga Value: GA1.1.1579826231.1729863155
			.directcashtransfers.com/	1970-01-21 10:07:03	Name: _ga_K0FNZEWP0D Value: GS1.2.1729863156.1.0.1729863156.0.0.0
			.directcashtransfers.com/	1970-01-21 10:07:03	Name: _ga_LTZ10XBX1X Value: GS1.1.1729863155.1.0.1729863157.0.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
securepubads.g.doubleclick.net
static.traffic.club
static.trafficclub.com
track.auroraveil.bid
track.traffic.club
www.google-analytics.com
www.googletagmanager.com
y4tn8kqb2ohimgmm.directcashtransfers.com
104.18.10.207
104.21.87.224
142.250.184.202
142.250.184.232
142.250.185.130
142.250.185.195
142.250.186.142
143.204.98.118
167.233.8.197
216.58.206.74
65.21.240.245
78.46.152.77
23bec1376312be873fdff35109bd4f2499f0fb8ee7742b3caf8eef22e9b96ae8
2c9e7e7ca2cd02414ca3e4503e79a368da81eff43dbc20e9876ee7202128ee9a
4055c88974c0bcf7af0eda2f9577ecb461725ef771d06b796d3c88dc90ee5024
4aa355b64f75bc8293836eb2ca7ff4a0d7230f361c2e9b1b2d7394ac7c540f90
5d9f007823fcc458d4d4b5bee802aae80476237297a9a11ef89329f8e2d342f7
5e0c6ca42b9531a42a7994e3ed907ea9e3a360dcaa6f77847ef587340d21d6ac
6249d2dcfb60c3c54da30e6a64dec8ae78f54483af7549354a8c7679796dd89c
66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
a619c7ffa7d48d0a2901958b94251ccf03df56d451086b23af37adc84ed00fe9
a91a4a6d81038e8390eb5fd8dd83fb146bac24b5128f25820f321643e7ffd229
b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ead6ad7bbff5034d764b2f3e2f8bf347096211a5566283df54d5376ad9c3c8c2
f26e40109b0475bacea3fc2fcad5a91f2003e11c4bbe736141982da246ac155e
f674bc589cc070db3e3a42de7a0ddd10874d50c685016c270bed74ef6ac35afa