urlscan.io logo urlscan.io
SecurityTrails logo

quitespecialshoppingat.lat Open in urlscan Pro
2606:4700:3035::ac43:9095  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.gwincasino.app/vzsaecse
Effective URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803...
Submission: On August 23 via manual from EG — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 6 domains to perform 27 HTTP transactions. The main IP is 2606:4700:3035::ac43:9095, located in United States and belongs to CLOUDFLARENET, US. The main domain is quitespecialshoppingat.lat.
TLS certificate: Issued by WE1 on July 5th 2024. Valid for: 3 months.
This is the only time quitespecialshoppingat.lat was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 216.107.139.139 396356 (LATITUDE-SH)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 23 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 2606:4700:303... 13335 (CLOUDFLAR...)
27 4
1    2606:4700:3032::6815:4488 (United States)

ASN13335 (CLOUDFLARENET, US)
www.gwincasino.app
1    216.107.139.139 (New York, United States)

ASN396356 (LATITUDE-SH, US)
www.dt2dt.com
1    2606:4700:3037::6815:52a8 (United States)

ASN13335 (CLOUDFLARENET, US)
www.directthruredir3ct.com
23    2606:4700:3035::ac43:9095 (United States)

ASN13335 (CLOUDFLARENET, US)
quitespecialshoppingat.lat
1    2606:4700:3036::6815:1b98 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2606:4700:3033::6815:5d7a (United States)

ASN13335 (CLOUDFLARENET, US)
trk-consulatu.com
3    2606:4700:3032::ac43:d1d6 (United States)

ASN13335 (CLOUDFLARENET, US)
event.trk-consulatu.com
Apex Domain
Subdomains		 Transfer
23 quitespecialshoppingat.lat
quitespecialshoppingat.lat
2 MB
4 trk-consulatu.com
trk-consulatu.com — Cisco Umbrella Rank: 116157
event.trk-consulatu.com — Cisco Umbrella Rank: 262105
3 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1950
426 KB
1 directthruredir3ct.com
www.directthruredir3ct.com
875 B
1 dt2dt.com
www.dt2dt.com
382 B
1 gwincasino.app
www.gwincasino.app
621 B
27 6
Domain Requested by
23 quitespecialshoppingat.lat 1 redirects quitespecialshoppingat.lat
3 event.trk-consulatu.com trk-consulatu.com
1 trk-consulatu.com quitespecialshoppingat.lat
1 use.fontawesome.com quitespecialshoppingat.lat
1 www.directthruredir3ct.com 1 redirects
1 www.dt2dt.com 1 redirects
1 www.gwincasino.app 1 redirects
27 7

This site contains no links.

Subject Issuer Validity Valid
quitespecialshoppingat.lat
WE1		 2024-07-05 -
2024-10-03		 3 months crt.sh
use.fontawesome.com
Cloudflare Inc ECC CA-3		 2023-10-12 -
2024-10-10		 a year crt.sh
trk-consulatu.com
WE1		 2024-08-18 -
2024-11-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Frame ID: 96537471EA2B2FF49075099FD4A5A87D
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Marriott - Survey Rewards

Page URL History Show full URLs

  1. https://www.gwincasino.app/vzsaecse HTTP 302
    https://www.dt2dt.com/bdAHAKrXFqXFQCYuPG6x8i7OylvdczPwMohIN-Nn3D-uqt8cyA0PzyBATkX6WBpYXD7d0Bs-bZQm... HTTP 302
    https://www.directthruredir3ct.com/2JJ31C8/27HPDQHF/?sub1=822870&sub2=770831069 HTTP 302
    https://quitespecialshoppingat.lat/KfyqdpEmLE/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5... HTTP 302
    http://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&sour... HTTP 307
    https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&sour... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

27
Requests

100 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

4
IPs

1
Countries

2473 kB
Transfer

3319 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.gwincasino.app/vzsaecse HTTP 302
    https://www.dt2dt.com/bdAHAKrXFqXFQCYuPG6x8i7OylvdczPwMohIN-Nn3D-uqt8cyA0PzyBATkX6WBpYXD7d0Bs-bZQm_ahGXz-rkg~~ HTTP 302
    https://www.directthruredir3ct.com/2JJ31C8/27HPDQHF/?sub1=822870&sub2=770831069 HTTP 302
    https://quitespecialshoppingat.lat/KfyqdpEmLE/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com HTTP 302
    http://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com HTTP 307
    https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
quitespecialshoppingat.lat/
Redirect Chain
  • https://www.gwincasino.app/vzsaecse
  • https://www.dt2dt.com/bdAHAKrXFqXFQCYuPG6x8i7OylvdczPwMohIN-Nn3D-uqt8cyA0PzyBATkX6WBpYXD7d0Bs-bZQm_ahGXz-rkg~~
  • https://www.directthruredir3ct.com/2JJ31C8/27HPDQHF/?sub1=822870&sub2=770831069
  • https://quitespecialshoppingat.lat/KfyqdpEmLE/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
  • http://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
  • https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
28 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b44833e5f7ed8d0ea6345ecd1bea31a13757a8d1868899457f12f320e58c1830
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
8b7d4241afc94234-EWR
content-encoding
br
content-type
text/html
date
Fri, 23 Aug 2024 18:45:17 GMT
expires
Fri, 23 Aug 2024 18:45:16 GMT
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
interest-cohort=()
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OOmUJEXXrIIz%2FrioicwWYQisxoN7ot8qJNqq7oCc1RZ%2FuaNOmTX0m0kF6SIoQgY9c5Y3fDl%2FKkSde1Cvyc172%2B%2FEmcJL4u9T5TKmJHoxWVjMYyeg%2B4jytMHFnY42TCyvQyc3yVrIjirCfsWezTYSLLKEPtaXjxy9DA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Non-Authoritative-Reason
HSTS
style.css
quitespecialshoppingat.lat/css/ 		16 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/css/style.css
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25f5d56f1817babebde73eac3fdc8c02288dd6c9e88c9e658be7cc3b76483899
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 11 Jul 2024 11:01:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668fbb95-3ee2"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2BAfE%2FneZEj3FkylaqDW5lBSaz1wgl%2BrZUFbETmSF9Gui%2F7jtk%2BGyhg1aLktNFN6dbwkz%2FNDz8cC3fkcl91bq1hs%2BmMGFWR38vk32DZCm0tOwAvg5CDn2A5mOGaJMtLoHXdbEcHoYQRL7wiC71Ck9ZXohDVop%2B8pZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
no-cache
permissions-policy
interest-cohort=()
cf-ray
8b7d4242a8d24234-EWR
alt-svc
h3=":443"; ma=86400
expires
Fri, 23 Aug 2024 18:45:16 GMT
animate.min.css
quitespecialshoppingat.lat/css/ 		70 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/css/animate.min.css
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 11 Jul 2024 11:01:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668fbb95-11846"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ez4EoTsFSKnoEmKiAdK36PPw92oLEoJClX9AwiksAg0KDTnl9aU6TJKGoPr0y1l%2BUgjcxseIqtv7TrjJODmZDir1MoIl4oPb%2Fp1Lh4VMEA%2BDjvGInrkEYuBh%2BOS2cTaxIpgW61arphnKohyOQbgkOdslE7V9uBJRfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
no-cache
permissions-policy
interest-cohort=()
cf-ray
8b7d4242a8d34234-EWR
alt-svc
h3=":443"; ma=86400
expires
Fri, 23 Aug 2024 18:45:16 GMT
all.js
use.fontawesome.com/releases/v5.15.4/js/ 		1 MB
426 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.15.4/js/all.js
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf

Request headers

Referer
https://quitespecialshoppingat.lat/
Origin
https://quitespecialshoppingat.lat
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 22 Sep 2023 01:45:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1408738
etag
W/"5e29440867fdb02a48dffded02338c31"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VGctYogQs28JDY8d3uKODhGI60LQrvQdFmkihJccaEOiJus0oRJxt3RIJVSnpTfsdlWgyOwkCy4GnKwF6QUXPM3Uf9WL5rJoK9oo3HYxnrIN7fgRS6dCOlVmtrSuZIxfks9vRwFaUncLAan1a5MKnRv0"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
8b7d424528e342ad-EWR
alt-svc
h3=":443"; ma=86400
datehead.js
quitespecialshoppingat.lat/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/js/datehead.js
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e095b91cc9a20149cef660cd11b5ea0dfb7b13b511d2841913984bf78354740b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 11 Jul 2024 11:01:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668fbb95-999"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N2jP4wvm9tibwjbrm6XS9rMTty1jMWqWcMuPAwxPpScukW8buC%2BMriYzVPyr%2BKYzcxxwBS9X6NeS3gZnHzzdx8A4RjtqpVa2Azv2DG6rZkKVw7wpA9xdHa2xvW6At4nA9gV61YAvHnsNANdqwUwMzwtIOME6nGVtxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
no-cache
permissions-policy
interest-cohort=()
cf-ray
8b7d4242a8d44234-EWR
alt-svc
h3=":443"; ma=86400
expires
Fri, 23 Aug 2024 18:45:16 GMT
logo.png
quitespecialshoppingat.lat/images/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/logo.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b234cf7f45407a23894e0c2390cd3611ee6f650a51fd871865319f8f0df58fca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
28046
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-6d8e"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3gbvRSsu1qjBRzn21cGair6f01DGgoKQLjDpfuCxceQHQf%2Fanzw0NlDgr4Qt9hym5pCv%2BAKAr8kBYTib%2Fd7jWAn0jYl%2FkhksaKVdFBAxpSpgFP%2B7c2fWufUbUf2NOP2xBYEPRN9kZ9vOE5iGylhN%2BTDMkC8jpDiToQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d4242a8d64234-EWR
expires
Fri, 23 Aug 2024 18:45:16 GMT
flaglogo.png
quitespecialshoppingat.lat/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/flaglogo.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb97f1ceb86cf65febe6fc09278d503747f140e18297b6da6ee4bdcd41479f43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:17 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
1781
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-6f5"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xJcmXfx1Qo1tQg1Kp1%2FRxvberJHL962rd1CD89Jbg5pNMXxu%2Bnwc4IFxzIFJ0c6oBpfN64hZHQt8mWAsRV29HB2N8nvoNsf9ovlg7g5z2I7CPrU5bKb%2FsHx%2FGzdLgo1meq4Nmyjq1ld9tGdh4g0w4SYFO5S8FJh6zQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d4242a8d74234-EWR
expires
Fri, 23 Aug 2024 18:45:16 GMT
product.png
quitespecialshoppingat.lat/images/ 		556 KB
556 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/product.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b364a27d5e901d8f77aefd4cd0ac6229572e0aa9fde73d69236daf0763bae7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
568996
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-8aea4"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mr87eUpxMSM3XGHoy6zbIO%2FkIJlA5Ig%2B%2B0hO3GDIXIzfyKl2ch0vupKWctIgDAxi63B80C2taa%2FLcaIrHvldp%2Fn2YrA3u%2FvKGhdfcDFUok3zkFz7GM5D%2Fl1OYq2w0hCYqb1DdcLYPj6tgnZk7cjRYYMDy6%2BghJz7Mw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d424399d14234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
loadingBL.gif
quitespecialshoppingat.lat/images/ 		122 KB
122 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/loadingBL.gif
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d769b5e89c5845baca4f51f91d02fdf4a4cbeb9db32c30e1c1c1f7a539518216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
124490
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-1e64a"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FWo8AOE%2B%2B8u5bfU18Qki5aGF2GOHZBuJJDTj5cXyRsvKTHFx1J%2BWbfwm3QGxfp7kOpz9pzV0aRoVrNNkTYU4yDKJPa2G5csjyTwEwNRFsFOzPrwyZj3H5MjHVVx6mrdIqiD8tAU8Cb%2F0eyeV9NJve8qxlJUkw0HAnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42440a484234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
prize1.png
quitespecialshoppingat.lat/images/ 		556 KB
556 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/prize1.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3688af1ab5f7b5ee04e4a7d14db47338bfc9d089d516294b21bf3cf81ee72e29
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
568883
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-8ae33"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2FKf3iHyA4madI2v3wTaoQZa4ouN4sEXDq3efrNE5kMU%2FS9YB4mKGWU%2BcqZFut%2BHSknQJnGoelNqMjDnkVmAM9pKjlsbwSUwXchfPlpB40AX6N0rssRRgLxjdnt2%2FykQ2Eua9FBGW2L8PM5U8N9v9fObnOd0cNRjMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42441a614234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
1.jpg
quitespecialshoppingat.lat/images/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/1.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa34fa4a45cf0e1071529b887e64627c4d6019ae03f1c1adb18f292585eafad7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
43861
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-ab55"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2wJSzzcSOpObEzOH%2FROZoTLQeUzAuNW5S8GBc%2B79vtSBgWhbyygN0Lznw3Nfs7zC2if5UuJ28fGqVr%2B7VIq0RJdDdXZs3db%2FsTeeFtx7m9p%2FzdOeIICMyPgwn1%2FPAOs3mPJiDbudhrM%2FIucdJAa033qECulGv535uw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42441a6c4234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
2.jpg
quitespecialshoppingat.lat/images/ 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/2.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
385528b5f550aa72947c3906f4d50ae4f478c5eef8cb6526229c88ce43261443
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
31837
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-7c5d"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dxOrb0S3CKkdPJbj1%2F7jYIRF%2BdU90pfXkK6eJuFDq%2FGt8H%2Bm8Td42DHRFIcd8pC%2FigwKQ4KBk1oO9SjqPL%2FmApEjSos4Ebcg3tbNsRP2rYwC9FeyYD6c5fpWUPmQk1VKw%2B9L5VOOVZJLJgkABd%2F2LtlIXqx%2FIw2X0g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42441a6d4234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
comm_pic_1.jpg
quitespecialshoppingat.lat/images/ 		116 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/comm_pic_1.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2162cfdce82eb9d2f9d89ff33732e3e4697532762df3e080e7cb1122a5170ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
118474
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-1ceca"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sdGaYVIWh8gYmzMXBlPiGs6TEPXKeVxZWLExfWl3bFclAQH%2BX1UvmrUcN5bLCORRvgFqR%2FsNVbFJwBlyr2%2FpkcXkUtu8QXWWdOLiXNKzkmmOBvvBqtCKRfDoPrhIHe4Y2Uc4voPG2FZaLHdZ9JcwRcpl4zmv28EapQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42441a6f4234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
3.jpg
quitespecialshoppingat.lat/images/ 		64 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/3.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5418439e04d58d4e7d335d1bfc325284a1ce21f426c24d69f8de527da97b7b76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
65241
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-fed9"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0WgjhrRAgKoH2qrCnL4nxexJZ8g65N1Xb85NDxdpjo%2F3tRn4k0a3q4UfkULti231zsFPPQXGXkkqSzIDOy9rfAXvWFQdiJ9JR9FPF9mzXvRd%2Bms2i%2FpZNIZW27kCay%2BhMhPHgqEO35q0D3dmdfzOU%2BklFZSxWmIExw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a714234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
4.jpg
quitespecialshoppingat.lat/images/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/4.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63aec2631ee77fdb2ccf7c41e0e952e25940fd52211aedd73280fcc0ac3ea3f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
37344
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-91e0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GjHpaPXy88zuMolKbpivh6O2glhamIlLo7fULIOoT4uLVRUFqiRX4GoS870W8TAPHQpVbcseoaarCT5lPeSGiSaFOuW68o%2Bx59DSZkdfY%2BmP6%2FSwqO10lb2%2BqMziFwtVpY0p8Ie6QcbCIDy1Qm2R1q9OGyEPFfIJtg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a724234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
comm_pic_2.jpg
quitespecialshoppingat.lat/images/ 		126 KB
127 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/comm_pic_2.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f09ee669f55e010c8fbd72d3f0a7e8f2940b38fa86f987b742de9a51427df18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
129128
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-1f868"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmhiqDVh9cae%2F2FPaKbZ1vaCk7oZCb0oIQj7I4nvSJ3v6i8oeg0nUSWJfgvNrGcW8S1TOI8IbWz3H6yxrFNnA%2Be5WBoJnmAoqln%2B5C8XVw4OF%2FOh4Jn7BR%2FZJTR64DbppUg9an4J2TbLdbM94PEn8m5H3eYmY%2BF7bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a744234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
5.jpg
quitespecialshoppingat.lat/images/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/5.jpg
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c50866e05aca5676441b1cd638692727cac416ff8532a176a85443da3a667edc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
44747
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-aecb"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=atfGrA7GzQAMnCqjWZS0xpRII7BhlF%2B0Miz1%2BRVFq7w6uag6G5vhFnsjQOIvJhk2LNhwAGQ3w3Jik9Kh5RxoLSvhDGFWprt7AjJkP%2FOaHCOmwx51VEi9tkoSHv4bP7DoWqzRrDLTlPSJBPw6ksj%2FW%2Fh8X244BiXUdg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a754234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
f_guarantee.png
quitespecialshoppingat.lat/images/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/f_guarantee.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
6352
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-18d0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LfcZE0kVk%2BOvFrDlPOFtJlkd3I3Zdc8zbCCkeyoSeDzmzGr9TO3PKrleDQnrNzTZuGPuPl52cPfPhBqc6ly5fKDWKoe%2Be0lwKJh8EnFpQAEdmokwBiFrj29bEHlYxlkV%2FQ0yVEVr1RDqgmIO1aZuigIs7SUMFdprWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a764234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
f_secure_1.png
quitespecialshoppingat.lat/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/f_secure_1.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
9862
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-2686"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2BLtsoU4eE8KY1cGk2z3uderhCzXw9iLJfyuMraAO2ymBfLoQhaAED%2Bi%2F%2FGmSuzAOzTk%2B7xu%2BRyBgDzrgMNg0qdyyMrTpkeIDOs6yAW1nkbmSUrBVdB0D2AqGN5tzN2PUn6QHAeZJwBhVAB3Z7Ek5PMGGpZWCRi%2B4g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a774234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
logo2.png
quitespecialshoppingat.lat/images/ 		39 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/logo2.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4209ccdf4b7ab68f99da79bbd3cb7872947fa71e7a4eb861880254fea8205e42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
40052
last-modified
Thu, 11 Jul 2024 11:01:42 GMT
server
cloudflare
etag
"668fbb96-9c74"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PAPV%2F4S5vB1xFPdCTpa7DpHtGbZ5fOautG07UqTejMHyovgZrLUmi%2Fd3R0Ikt3iZs3NMK%2FNFofXtpmfchA8GOkduwZmVIsXV1dPZrJGX6c%2BzJZrT9z%2B%2Fbwge83yqMAH8GoYgmLy48gE1Q4rKYEZNzBZ97LrTUZ%2Ft%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a784234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
script.js
quitespecialshoppingat.lat/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/js/script.js
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9649cee5359a74187721e1ea83e7024d4c82a3562dc615d12418461763120469
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 11 Jul 2024 11:01:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668fbb95-2852"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yPQtea81L8emK0Hhi6HHqFrQAONtGrrLMsZlXRRfMGIRjQsyNEIUy%2FobENuKaOy4P7CofLQHJZreEIb4T3wZqpYzqX4LtFOfAIJNAlEZsF9P6cvYOqnpoqym3nBfNGfjqgQiC%2FpnE%2B%2BWfZDV8nQi4uasv3u8j%2FSxXw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
no-cache
permissions-policy
interest-cohort=()
cf-ray
8b7d42441a684234-EWR
alt-svc
h3=":443"; ma=86400
expires
Fri, 23 Aug 2024 18:45:17 GMT
bg.png
quitespecialshoppingat.lat/images/ 		239 KB
240 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quitespecialshoppingat.lat/images/bg.png
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94805ff66a9183afbb609d9bd78fa3c490f8f14cc9628f4c64d944b5df771abb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/css/style.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
244673
last-modified
Thu, 11 Jul 2024 11:01:43 GMT
server
cloudflare
etag
"668fbb97-3bbc1"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i6LkfOdYrtA7P1xdOX0n3X3W8rNUQKjrnsR1FAKRdmxXX506lpD2lqZewtylVXuuNtHdcn6f0uJl73KZmQVWbgC1c35L3MM6KljOPb3K0NaotD%2FGGB%2B0hphqfdUc4bbijZLZ01m5iws8WDf%2FmV2HQBavuv4Ij1mcBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
no-cache
permissions-policy
interest-cohort=()
accept-ranges
bytes
cf-ray
8b7d42442a7a4234-EWR
expires
Fri, 23 Aug 2024 18:45:17 GMT
64d5p99gj0
trk-consulatu.com/scripts/push/script/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-consulatu.com/scripts/push/script/64d5p99gj0?url=quitespecialshoppingat.lat
Requested by
Host: quitespecialshoppingat.lat
URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:5d7a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e51259be77d22082e867afa19c1b12f9360f60bbb3a53192e2b2cdf7fcd359e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quitespecialshoppingat.lat/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
2520
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 23 Aug 2024 18:45:18 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tyGll%2FVm7fcEyWTo8K4UMPy7cuocHax%2FjTrIbk8fidfgLFrAehUunbH%2BODLc0R7stH4ToMnIDC4CWaEosfWmkXous33T%2Fp0u6dNcTuo74H6Z5m7V3erYyBf7vj%2F138%2BoKIIneC1pxjX%2BkTxmirkUQg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
accept-ranges
bytes
cf-ray
8b7d42468ee641f8-EWR
expires
0
favicon.ico
quitespecialshoppingat.lat/ 		555 B
626 B 		Other
General
Check archive.org
Download Go to
Full URL
https://quitespecialshoppingat.lat/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:9095 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e209d6d6e97cb95d6246e176f50383d75b0ea94345c7cc1c0777e178935db3c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 18:45:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rX6vd0eKu6iyKRFmmNhPOkpgZQRhraTtHnXGAi1uZk7iuU2eQ6Ml5oq5BIF4MlA75%2B7kmbREfOfk7%2F3a6XVQzfYRew5ndt8Z%2FgtAkJZHUxRw5sXYSW87QbxwQwOg3RYSMvvfp1mIk2LSmoxrkGpWFdML0g5JNRzQmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
permissions-policy
interest-cohort=()
cf-ray
8b7d42470d554234-EWR
alt-svc
h3=":443"; ma=86400
w2dqz5vwdp
event.trk-consulatu.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/w2dqz5vwdp
Requested by
Host: trk-consulatu.com
URL: https://trk-consulatu.com/scripts/push/script/64d5p99gj0?url=quitespecialshoppingat.lat
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:d1d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quitespecialshoppingat.lat/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-type
application/json

Response headers

x-pushplatformapp-params
date
Fri, 23 Aug 2024 18:45:19 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z4EVgtI1LEWJu8O9Qjkw8%2F5KyG%2FWhCBCGQ5LWntVqeaOidyJMyBeDrUQekpMLknwluAwzQIoUx090UqkFe5%2B2FbOFjtDWwdnUr5Hcjy7rxhH%2FwJfbAuDPa0XcnwrmdzzjsU6covzZVy0px53IFnZB0aatYbLuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
8b7d424a9bf78c4d-EWR
expires
0
w2dqz5vwdp
event.trk-consulatu.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/w2dqz5vwdp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:d1d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://quitespecialshoppingat.lat
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8b7d424a3b398c4d-EWR
content-length
0
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
date
Fri, 23 Aug 2024 18:45:19 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lqr3vMmwv2Bq%2Fdvu%2FxTvbAVV6qfwBvrFnZsb%2FikUaFuzUQEMToL0F2B%2BvHQRaj8nTao8y9NX8M3xHUqid2TiihEPAXOUFXKmqmLs5eSG%2FeIG4RBIqNUWH5mVk7SRdawymyABnyPg5VyEiXO6ZlESy6Xx%2BsVuxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
w2dqz5vwdp
event.trk-consulatu.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/w2dqz5vwdp
Requested by
Host: trk-consulatu.com
URL: https://trk-consulatu.com/scripts/push/script/64d5p99gj0?url=quitespecialshoppingat.lat
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:d1d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quitespecialshoppingat.lat/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-type
application/json

Response headers

x-pushplatformapp-params
date
Fri, 23 Aug 2024 18:45:20 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v2tdnIIdyBesnll67r2xzPaA1ukEx%2Bk3bwFLfNgyGfKIuJBbNMLGpV0BM2Jrd0EVR6hGGQDENzDtAYKXWviwjgjaDCkNzIDBxXo72iNOOBaI3MknFqyOaEO90%2F4Js7msP1IXElEgUVQceukMcgmcP%2Fg7ix7QOg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
8b7d42519b418c4d-EWR
expires
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| datehax function| datenhax function| datenhay function| startTimer object| answers number| lastQnum function| toNext object| states object| dones object| loadImg object| loadBgCol function| drawloader number| qn number| dsq object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore function| setAttributes

4 Cookies

Domain/Path Name / Value
.dt2dt.com/ Name: uid14518
Value: 770831069-20240823144516-11611bb62835807e92f08f0dc31c9a10-
www.directthruredir3ct.com/ Name: uniqueClick_27HPDQHF
Value: a7fc561d-86fc-41f5-b947-c250e91dac0a:1724438717
www.directthruredir3ct.com/ Name: transaction_id
Value: bcbbd71147b24e60b3a136637f4e9c1b
quitespecialshoppingat.lat/ Name: SESSIONIDS
Value: KfyqdpEmLE

2 Console Messages

Source Level URL
Text
network error URL: https://quitespecialshoppingat.lat/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
other error URL: https://quitespecialshoppingat.lat/?encoded_value=STPMF8&sub1=822870&sub2=770831069&sub3=&sub4=&sub5=19492&source_id=&ip=2600%3A803%3Aa88%3A3090%3A%3A90&domain=www.directthruredir3ct.com
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

event.trk-consulatu.com
quitespecialshoppingat.lat
trk-consulatu.com
use.fontawesome.com
www.directthruredir3ct.com
www.dt2dt.com
www.gwincasino.app
216.107.139.139
2606:4700:3032::6815:4488
2606:4700:3032::ac43:d1d6
2606:4700:3033::6815:5d7a
2606:4700:3035::ac43:9095
2606:4700:3036::6815:1b98
2606:4700:3037::6815:52a8
25f5d56f1817babebde73eac3fdc8c02288dd6c9e88c9e658be7cc3b76483899
2f09ee669f55e010c8fbd72d3f0a7e8f2940b38fa86f987b742de9a51427df18
3688af1ab5f7b5ee04e4a7d14db47338bfc9d089d516294b21bf3cf81ee72e29
385528b5f550aa72947c3906f4d50ae4f478c5eef8cb6526229c88ce43261443
4209ccdf4b7ab68f99da79bbd3cb7872947fa71e7a4eb861880254fea8205e42
5418439e04d58d4e7d335d1bfc325284a1ce21f426c24d69f8de527da97b7b76
54b364a27d5e901d8f77aefd4cd0ac6229572e0aa9fde73d69236daf0763bae7
5e51259be77d22082e867afa19c1b12f9360f60bbb3a53192e2b2cdf7fcd359e
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
63aec2631ee77fdb2ccf7c41e0e952e25940fd52211aedd73280fcc0ac3ea3f7
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf
94805ff66a9183afbb609d9bd78fa3c490f8f14cc9628f4c64d944b5df771abb
9649cee5359a74187721e1ea83e7024d4c82a3562dc615d12418461763120469
b234cf7f45407a23894e0c2390cd3611ee6f650a51fd871865319f8f0df58fca
b44833e5f7ed8d0ea6345ecd1bea31a13757a8d1868899457f12f320e58c1830
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c50866e05aca5676441b1cd638692727cac416ff8532a176a85443da3a667edc
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
d769b5e89c5845baca4f51f91d02fdf4a4cbeb9db32c30e1c1c1f7a539518216
e095b91cc9a20149cef660cd11b5ea0dfb7b13b511d2841913984bf78354740b
e209d6d6e97cb95d6246e176f50383d75b0ea94345c7cc1c0777e178935db3c5
eb97f1ceb86cf65febe6fc09278d503747f140e18297b6da6ee4bdcd41479f43
f2162cfdce82eb9d2f9d89ff33732e3e4697532762df3e080e7cb1122a5170ee
fa34fa4a45cf0e1071529b887e64627c4d6019ae03f1c1adb18f292585eafad7