excavate.instant-receipt.gq Open in urlscan Pro
54.38.241.120 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/0cf9c2c9dfeb2d924581ad6da9a5e3f5c1606119
Effective URL:
https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Submission: On July 28 via manual (July 28th 2022, 5:18:49 pm UTC) from IN — Scanned from FR

Summary HTTP 10 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 5 IPs in 5 countries across 5 domains to perform 10 HTTP transactions. The main IP is 54.38.241.120, located in France and belongs to OVH, FR. The main domain is excavate.instant-receipt.gq.
TLS certificate: Issued by R3 on July 22nd 2022. Valid for: 3 months.

This is the only time excavate.instant-receipt.gq was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	54.38.241.120 54.38.241.120	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:400e:800::200a	15169 (GOOGLE) (GOOGLE)
4	13.224.189.110 13.224.189.110	16509 (AMAZON-02) (AMAZON-02)
1	95.216.114.195 95.216.114.195	24940 (HETZNER-AS) (HETZNER-AS)
3	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
10	5

2 54.38.241.120 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: vps-5602b4d0.vps.ovh.net

excavate.instant-receipt.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:800::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.189.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-110.fra2.r.cloudfront.net

hst.tradedoubler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.216.114.195 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.195.114.216.95.clients.your-server.de

hp1gbd78e5p.ideepourpro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	tradedoubler.com hst.tradedoubler.com — Cisco Umbrella Rank: 178891	50 KB
3	gstatic.com fonts.gstatic.com	68 KB
2	instant-receipt.gq 1 redirects excavate.instant-receipt.gq	13 KB
1	ideepourpro.com hp1gbd78e5p.ideepourpro.com	482 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 72	928 B
10	5

	Domain	Requested by
4	hst.tradedoubler.com	excavate.instant-receipt.gq
3	fonts.gstatic.com	fonts.googleapis.com
2	excavate.instant-receipt.gq	1 redirects
1	hp1gbd78e5p.ideepourpro.com	excavate.instant-receipt.gq
1	fonts.googleapis.com	excavate.instant-receipt.gq
10	5

This site contains links to these domains. Also see Links.

Domain
hp1gbd78e5p.ideepourpro.com

Subject Issuer	Validity	Valid
direct-receipt.gq R3	`2022-07-22` - `2022-10-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-07-11` - `2022-10-03`	3 months	crt.sh
*.tradedoubler.com Amazon	`2022-01-12` - `2023-02-10`	a year	crt.sh
hp1gbd78e5p.ideepourpro.com R3	`2022-07-20` - `2022-10-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Frame ID: 5BDEDC06919C67D68221B1735F97A5CB
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Promotion Prime Day

Page URL History Show full URLs

https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/0cf9c2c9dfeb2d9245... HTTP 301
https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

5
Countries

132 kB
Transfer

130 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/0cf9c2c9dfeb2d924581ad6da9a5e3f5c1606119
Title: Visualiser la version en ligne

Search URL Search Domain Scan URL

URL: https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/7020b678f444dfa5cd5046bd6cd1d06240bd0f9a

Search URL Search Domain Scan URL

URL: https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/ad1188ba169150b953eb3dafbe6216c978e91f02
Title: *Voir conditions

Search URL Search Domain Scan URL

URL: https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/39177d88f855f359e79d90cc867da509ad98999f
Title: (PrivacyPolicy)

Search URL Search Domain Scan URL

URL: https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/61855421994d12ca192e309aa423915a4fcc4843
Title: cliquant ici

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/0cf9c2c9dfeb2d924581ad6da9a5e3f5c1606119 HTTP 301
https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request pa3975dt0l679 Show response
excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/
Redirect Chain

https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/track-url/pa3975dt0l679/0cf9c2c9dfeb2d924581ad6da9a5e3f5c1606119
https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679

12 KB
13 KB

134ms
133ms

Document
text/html

54.38.241.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.38.241.120 , France, ASN16276 (OVH, FR),

Reverse DNS

vps-5602b4d0.vps.ovh.net

Software

nginx/1.20.1 / PHP/7.2.24

Resource Hash

42bbc1c557311421983ee253bdc52c05234f24ac21ed940f8e73b541ff182a39

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 28 Jul 2022 17:18:45 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.20.1
Transfer-Encoding: chunked
X-Powered-By: PHP/7.2.24
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 28 Jul 2022 17:18:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Thu, 28 Jul 2022 17:18:45 GMT
Location: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Pragma: no-cache
Server: nginx/1.20.1
X-Powered-By: PHP/7.2.24
X-XSS-Protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
928 B 83ms
30ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap

Requested by

Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

52519e8c754d4fd14b9ea19ff3f3e758ad1978858827881984e7da06a285ef97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 28 Jul 2022 15:34:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 28 Jul 2022 17:18:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 28 Jul 2022 17:18:45 GMT

GET
H/1.1 200
OK line.png
hst.tradedoubler.com/file/304696/0722/img/ 3 KB
3 KB 85ms
25ms Image
image/png 13.224.189.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hst.tradedoubler.com/file/304696/0722/img/line.png
Requested by: Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-110.fra2.r.cloudfront.net
Software: Apache /
Resource Hash: 8793167e92c51f6731307753de37b8b9dfecd0890056559e439605838a91d2dd

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 18:18:56 GMT
Via: 1.1 9568a708c8ab21597698ebe7dce6c42e.cloudfront.net (CloudFront)
Last-Modified: Fri, 08 Jul 2022 13:00:45 GMT
Server: Apache
Age: 601189
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Length: 2861
X-Amz-Cf-Id: jmIm6WNfF_QbZG51Ys5h5HRALCBkfH2IXGFBva3tN9sF7Hw_OArttQ==

GET
H/1.1 200
OK logo_amazon.png
hst.tradedoubler.com/file/304696/0722/img/ 6 KB
7 KB 65ms
24ms Image
image/png 13.224.189.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hst.tradedoubler.com/file/304696/0722/img/logo_amazon.png
Requested by: Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-110.fra2.r.cloudfront.net
Software: Apache /
Resource Hash: c046e51fca94024fc64a9b486ad3e943c538a9c6422b66ad0fa5670683067c66

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Fri, 22 Jul 2022 06:34:55 GMT
Via: 1.1 9568a708c8ab21597698ebe7dce6c42e.cloudfront.net (CloudFront)
Last-Modified: Fri, 08 Jul 2022 13:00:45 GMT
Server: Apache
Age: 557030
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Length: 6602
X-Amz-Cf-Id: rZd9wFmMHa7sIXZ4mPXl5BHf01DGepg8y3tBirzVjy__vHQaRB7ijw==

GET
H/1.1 200
OK cta1.png
hst.tradedoubler.com/file/304696/0722/img/ 6 KB
7 KB 75ms
24ms Image
image/png 13.224.189.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hst.tradedoubler.com/file/304696/0722/img/cta1.png
Requested by: Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-110.fra2.r.cloudfront.net
Software: Apache /
Resource Hash: 3e59111b658e09538dd614730dd4470775f69e9e5fb7c0350026629d1846014d

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 19:52:28 GMT
Via: 1.1 0e75d8f2d484ce463fc04f5c422aa178.cloudfront.net (CloudFront)
Last-Modified: Fri, 08 Jul 2022 13:00:45 GMT
Server: Apache
Age: 595577
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Length: 6330
X-Amz-Cf-Id: r7ps_KVpB6HgTEPDhxYNlDu_qdhMl4vKjuWb5iRzsc1Xb2ABmQbdGQ==

GET
H/1.1 200
OK primeday_banner.jpg
hst.tradedoubler.com/file/304696/0722/img/ 33 KB
33 KB 77ms
26ms Image
image/jpeg 13.224.189.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hst.tradedoubler.com/file/304696/0722/img/primeday_banner.jpg
Requested by: Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-110.fra2.r.cloudfront.net
Software: Apache /
Resource Hash: af0e61dc2cabc2e77685b59e40b8ee69a3eba655d3aa96e1d1a59efd8dcca212

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Fri, 22 Jul 2022 06:34:55 GMT
Via: 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
Last-Modified: Fri, 08 Jul 2022 13:00:45 GMT
Server: Apache
Age: 557030
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Length: 33363
X-Amz-Cf-Id: COgcELU5CQD0iVOYzLqAlJbC0EI0m4sL2V-D_lKbLahQt8xY0dANWA==

GET
H/1.1 200
OK pa3975dt0l679
hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-opening/ 0
482 B 349ms
85ms Image
application/json 95.216.114.195
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hp1gbd78e5p.ideepourpro.com/index.php/campaigns/th516jqbgad8b/track-opening/pa3975dt0l679

Requested by

Host: excavate.instant-receipt.gq
URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

95.216.114.195 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.195.114.216.95.clients.your-server.de

Software

Apache / PHP/7.2.24

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://excavate.instant-receipt.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Jul 2022 17:18:45 GMT
Last-Modified: Thu, 28 Jul 2022 17:18:45 GMT
Server: Apache
X-Powered-By: PHP/7.2.24
P3P: CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=100
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
24 KB 90ms
26ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://excavate.instant-receipt.gq
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 17:08:09 GMT
x-content-type-options: nosniff
age: 173436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Jul 2023 17:08:09 GMT

GET
H2 200 S6u9w4BMUTPHh50XSwiPGQ.woff2
fonts.gstatic.com/s/lato/v23/ 22 KB
22 KB 113ms
50ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://excavate.instant-receipt.gq
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 17:12:19 GMT
x-content-type-options: nosniff
age: 173186
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22504
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 16:04:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Jul 2023 17:12:19 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 124ms
62ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://excavate.instant-receipt.gq
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 17:08:09 GMT
x-content-type-options: nosniff
age: 173436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Jul 2023 17:08:09 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			excavate.instant-receipt.gq/	1969-12-31 23:59:59	Name: mwsid Value: mc15en85iqh2dvn1f7q0c9l5g1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/line.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/logo_amazon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/cta1.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/primeday_banner.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679(Line 178) Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/line.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679(Line 178) Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/logo_amazon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679(Line 178) Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/cta1.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679 Message: Mixed Content: The page at 'https://excavate.instant-receipt.gq/index.php/campaigns/th516jqbgad8b/web-version/pa3975dt0l679' was loaded over HTTPS, but requested an insecure element 'http://hst.tradedoubler.com/file/304696/0722/img/primeday_banner.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

excavate.instant-receipt.gq
fonts.googleapis.com
fonts.gstatic.com
hp1gbd78e5p.ideepourpro.com
hst.tradedoubler.com
13.224.189.110
2a00:1450:4001:806::2003
2a00:1450:400e:800::200a
54.38.241.120
95.216.114.195
08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92
3e59111b658e09538dd614730dd4470775f69e9e5fb7c0350026629d1846014d
42bbc1c557311421983ee253bdc52c05234f24ac21ed940f8e73b541ff182a39
52519e8c754d4fd14b9ea19ff3f3e758ad1978858827881984e7da06a285ef97
8793167e92c51f6731307753de37b8b9dfecd0890056559e439605838a91d2dd
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
af0e61dc2cabc2e77685b59e40b8ee69a3eba655d3aa96e1d1a59efd8dcca212
c046e51fca94024fc64a9b486ad3e943c538a9c6422b66ad0fa5670683067c66
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

excavate.instant-receipt.gq Open in urlscan Pro 54.38.241.120 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

5 Countries

132 kBTransfer

130 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

1 Cookies

8 Console Messages

Security Headers

Indicators

excavate.instant-receipt.gq Open in urlscan Pro
54.38.241.120 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

5
Countries

132 kB
Transfer

130 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions