window-replacements-rewards.today Open in urlscan Pro
2606:4700:3035::6815:1e91  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

• https://www.googleadservices.com/pagead/conversion/852667600/?label=pbDuCJuIvakZENDZypYD&guid=ON&script=0 HTTP 302
• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/852667600/?label=pbDuCJuIvakZENDZypYD&guid=ON&script=0&ct_cookie_present=false&random=474558980&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII08WxAg&pscrd=IhMIy-DZjKKJigMV_yyICR2zWgJeMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL3dpbmRvdy1yZXBsYWNlbWVudHMtcmV3YXJkcy50b2RheS8

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response window-replacements-rewards.today/	12 KB 5 KB	559ms 137ms	Document text/html	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://window-replacements-rewards.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3f29eb8c25caf43fee32d9b076ef5ef7e07310f3faa518652c5e6f19cd055552 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8ebbe8a9990a41fe-EWR content-encoding zstd content-type text/html; charset=UTF-8 date Mon, 02 Dec 2024 14:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAR2t8qtHyFv1cRbBdoZ8EV5RMlavi16bM%2F8GyW%2FDh43eEmiuSaIv6yO7%2FaFh8Btbmck9uPA04%2BhZUuuvVdEa9tiv6xgNVO4OrLfDfhrpyCS1ulVl3bgHCh%2FC63oYTIkQ%2FTFW%2Fm9IAKQzVQkPyDJHLT%2BC4%2BPCdtwdz%2FdLm9hdIQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=21339&min_rtt=18297&rtt_var=11230&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3920&recv_bytes=2333&delivery_rate=222914&cwnd=254&unsent_bytes=0&cid=292f64238aa371e7&ts=263&x=0" vary Accept-Encoding x-adblock-key MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOkfkOV3lsGKqQ9j5bagzq3wjNQNxWwn/esVXnQFKykdGNnnz7w5UeA2I4OuWHWvh0oBKk747TbfSyNssqOrybkCAwEAAQ==_rHHId0K/xnra1h2n3ZfOHe+WxTCvfo/+4FTAjLvo0XczxuUW/X002FooIMLjMqko47kutmyrXpJ1BqhdY2MjeA==
GET H3	200	caf.js Show response www.google.com/adsense/domains/	149 KB 54 KB	338ms 74ms	Script text/javascript	2607:f8b0:4004:c1d::63 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::63 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1140d65033248a4f98e59e32c9d61aaceb0b0b4198816fdef7ade41e23fbfe14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers content-encoding gzip etag "14357866324420297488" report-to {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} x-content-type-options nosniff expires Mon, 02 Dec 2024 14:11:54 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 02 Dec 2024 14:11:54 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding link <https://syndicatedsearch.goog>; rel="preconnect" cache-control private, max-age=3600 cross-origin-opener-policy same-origin; report-to="ads-afs-ui" cross-origin-resource-policy cross-origin accept-ranges bytes x-xss-protection 0 server sffe
GET H2	200	6e3a82979a1e73c3323cc8d1a4e46b46.js Show response ob.togreencolumn.com/i/	104 KB 38 KB	340ms 88ms	Script text/javascript	2600:9000:250b:6e00:2:17ff:2c80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:250b:6e00:2:17ff:2c80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Caddy / Resource Hash 1837e96ac6e784d72c5ae4f2f2add69c9d2ae67a1363957c5c5d8d044de657a8 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers cache-control max-age=43200 content-encoding gzip etag "19fd8-CrBoMGhK57ZRT/OCyBGR+TpBuO0" age 25682 via 1.1 0d5152d594f96742d61c8aadd196aec6.cloudfront.net (CloudFront) expires Mon, 02 Dec 2024 19:03:53 GMT x-cache Hit from cloudfront content-length 38847 x-amz-cf-id mnRhVCCmTqiVCuovhBz2o-_GO3sv1tNCNvB6-HBStGcj0qhySjRdZA== date Mon, 02 Dec 2024 07:03:53 GMT content-type text/javascript; charset=utf-8 vary Accept-Encoding server Caddy x-amz-cf-pop IAD12-P4
GET H3	200	8424.jpg www.relevantlinks.net/img.php/image_id/	36 KB 36 KB	313ms 97ms	Image image/jpeg	2606:4700:3108::ac42:2b41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.relevantlinks.net/img.php/image_id/8424.jpg Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3108::ac42:2b41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 28349c38fe446eb7d54a2cde34f39e2e71e02df4c11211331ac029da54ba6f41 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT age 549426 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vFVWMHPKZT5YB68k6an7S5lAS%2F%2BICcJdmbyqSdrWJmfbb1ABOB8c97NbXTjamiuVgSDW6x0UDUsoh786GkMBCAuhRr8dCQnZnxURc%2FHXetpBBvlS%2BSjAE9VcgxPiAZAV%2FzVEbzE1X0A%2FDf%2BS1QETpdxvpyo%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ebbe8adae161875-EWR accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=45644&min_rtt=45613&rtt_var=17127&sent=13&recv=8&lost=0&retrans=0&sent_bytes=4250&recv_bytes=4327&delivery_rate=68821&cwnd=12000&unsent_bytes=0&cid=8a6be12aef75def7&ts=99&x=1", cfHdrFlush;dur=0 content-length 36645 date Mon, 02 Dec 2024 14:11:55 GMT content-type image/jpeg last-modified Sat, 23 Nov 2024 10:31:09 GMT vary Accept-Encoding server cloudflare
GET H3	200	cookie.js Show response partner.googleadservices.com/gampad/	420 B 277 B	330ms 71ms	Script text/javascript	2607:f8b0:4004:c21::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://partner.googleadservices.com/gampad/cookie.js?domain=window-replacements-rewards.today&client=partner-dp-domainactive15_3ph_xml&product=SAS&callback=__sasCookie&cookie_types=v1%2Cv2 Requested by Host: www.google.com URL: https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c21::9b Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 033c99bff5e933ca3d2cca57659c0058e7a445058cffe68b875961e78dc2ed1c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers timing-allow-origin * content-encoding gzip cross-origin-resource-policy cross-origin x-content-type-options nosniff alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 256 date Mon, 02 Dec 2024 14:11:55 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	ads syndicatedsearch.goog/afs/ Frame FD2F	0 0	433ms 215ms	Document text/html	2607:f8b0:4004:c17::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://syndicatedsearch.goog/afs/ads?adsafe=medium&psid=5733297675&pcsa=false&channel=seg2243%2Cseg7&client=dp-domainactive15_3ph_xml&r=m&hl=en&rpbu=https%3A%2F%2Fwindow-replacements-rewards.today%2F%3Fcaf_results%3D1%26acid%3D0%26asrc%3D%26at2%3D15%26at3%3Dseg2243%252Cseg7%26atxt%3D%26avid%3D%26ct%3D184%26psqs%3D%26sqs%3DHome%2BWindow%2BReplacement%2BOptions%252CNeed%2BA%2BWindow%2BReplaced%252CNew%2BHome%2BWindow%2BInstallation%252CTop%2BWindow%2BReplacement%2BCompanies%252CWindow%2BReplacement%2BCompanies%2BNear%2BMe%252CWindow%2BReplacement%2BService%26t1%3D%26t2%3D%26t3%3D%26tpct%3D%26u%3D%26u2%3D%26uuid%3D9f84e0a8-d1fe-48fd-b83a-f0df32374ed1%26rfpi%3D%26ec%3D%26at4%3D5733297675%26sescnt%3D1&terms=Home%20Window%20Replacement%20Options%2CNeed%20A%20Window%20Replaced%2CNew%20Home%20Window%20Installation%2CTop%20Window%20Replacement%20Companies%2CWindow%20Replacement%20Companies%20Near%20Me%2CWindow%20Replacement%20Service&kw=Home%20Window%20Replacement%20Options&type=3&uiopt=false&swp=as-drid-2743584736007933&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301437%2C17301439%2C17301442%2C17301542%2C17301266%2C72717108%2C49280903%2C72771954&format=r6&nocache=4011733148715028&num=0&output=afd_ads&domain_name=window-replacements-rewards.today&v=3&bsl=8&pac=0&u_his=2&u_tz=-480&dt=1733148715030&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1200&frm=0&uio=-&cont=kwBlock1&drt=0&jsid=caf&nfp=1&jsv=697661440&rurl=https%3A%2F%2Fwindow-replacements-rewards.today%2F Requested by Host: www.google.com URL: https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::65 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software gws / Resource Hash Security Headers Name Value Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-trkptJVxe5jxL0tUJPu1JQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other X-Xss-Protection 0 Request headers Referer https://window-replacements-rewards.today/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=3600 content-disposition inline content-encoding br content-length 3508 content-security-policy object-src 'none';base-uri 'self';script-src 'nonce-trkptJVxe5jxL0tUJPu1JQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other content-type text/html; charset=UTF-8 cross-origin-opener-policy same-origin-allow-popups; report-to="gws" date Mon, 02 Dec 2024 14:11:55 GMT expires Mon, 02 Dec 2024 14:11:55 GMT report-to {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} server gws x-xss-protection 0
GET H3	200	pxlt.php Show response window-replacements-rewards.today/include/	2 B 670 B	165ms 165ms	Script text/javascript	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://window-replacements-rewards.today/include/pxlt.php?uuid=9f84e0a8-d1fe-48fd-b83a-f0df32374ed1&cb=67527347 Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0889a34434e586e918436027c4e8b4c3380f84643731bdeb57024adb8745cf53 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BcGlATf1qMWtuTjaWjy%2BcEXKNBoU9pgVqGwNR%2FX0bKhacA5OhrhtxbDB4qqlz7OTMbLQVa5%2BSbcX1rZB7%2FeA1MvZGuvm3%2BIMREvD%2BNdBM4qHXzaawTQW9Qt8uJa710bum%2FP11ZqqvYnupBCF7OTR0TtrDoErUW71Q7c7oeVFBwU%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ebbe8ad3ade176c-EWR alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=55192&min_rtt=48760&rtt_var=17659&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4233&recv_bytes=4458&delivery_rate=386&cwnd=12000&unsent_bytes=0&cid=11b2e2071a661991&ts=836&x=1", cfHdrFlush;dur=0 content-length 2 date Mon, 02 Dec 2024 14:11:55 GMT content-type text/javascript;charset=UTF-8 server cloudflare
GET H2	200	ct Show response obs.togreencolumn.com/	4 KB 2 KB	664ms 183ms	Script text/javascript	2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://obs.togreencolumn.com/ct?id=59128&url=https%3A%2F%2Fwindow-replacements-rewards.today%2F&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1733148715373&hl=2&op=0&ag=4270235709&rand=03980622282726802990257602681680645052401229929406521011560283772500012785790288951718&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDU3NDFdLFsiYWJuY2giLDIzXSxbMTIsIntcImN0eFwiOlwid2ViZ2xcIixcInZcIjpcImludGVsIGluYy5cIixcInJcIjpcImludGVsIGlyaXMgb3BlbmdsIGVuZ2luZVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMCAob3BlbmdsIGVzIGdsc2wgZXMgMS4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wIChvcGVuZ2wgZXMgMi4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJiZW5cIjo4LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MTkzMDgyMDI3OSxcInNlY1wiOlwiXCJ9Il0sWy0yMywiKyJdLFstMjUsIi0iXSxbLTMxLCJmYWxzZSJdLFstMzgsImksLTEsLTEsMCwwLDEsMCwxNTksMjYxLDEzOSwtMSwwLDg2NC41LDg2NC41LDEyMzAsMTIzMCJdLFstNDAsIjMzIl0sWy01MywiMTAwIl0sWy01NywiV0UwWlYxeE9jVmhYWFZWY1N4Y0ZXbFpVU1V4TlhGMEhHV0pZU2hsWVNVbFZRR1FaRVZ4UFdGVVpXRTBaQlZoWFZsZEFWRlpNU2djWkVRTU9Bd2dNQ1FvSkFSQVZHUVZZVjFaWFFGUldURW9IQXdnQkF3b0pFQlZZVFJsNFMwdFlRQmRQWEJrUlVVMU5TVW9ERmhaV1d4ZE5WbDVMWEZ4WFdsWlZURlJYRjFwV1ZCWlFGZzljQ2xnQkN3QU9BRmdJWEE0S1dnb0tDd3BhV2dGZENGZ05YQTBQV3cwUEYxTktBd2dERHc0QkN3b1FGVmhOR1VzWkVWRk5UVWxLQXhZV1Zsc1hUVlplUzF4Y1YxcFdWVXhVVnhkYVZsUVdVQllQWEFwWUFRc0FEZ0JZQ0Z3T0Nsb0tDZ3NLV2xvQlhRaFlEVndORDFzTkR4ZFRTZ01JQXc0TERBPT0iXSxbLTQsIjxodG1sIGRhdGEtYWRibG9ja2tleT1cIk1Gd3dEUVlKS29aSWh2Y05BUUVCQlFBRFN3QXdTQUpCQU9rZmtPVjNsc0dLcVE5ajViYWd6cTN3ak5RTnhXd24vZXNWWG5RRkt5a2RHTm5uejd3NVVlQTJJNE91V0hXdmgwb0JLazc0N1RiZlN5TnNzcU9yeWJrQ0F3RUFBUT09X3JISElkMEsveG5yYTFoMm4zWmZPSGUrV3hUQ3Zmby8rNEZUQWpMdm8wWGN6eHVVVy9YMDAyRm9vSU1Mak1xa280N2t1dG15clhwSjFCcWhkWTJNamVBPT1cIiBsYW5nPVwiZW5cIj48aGVhZD4gICAgPHNjcmlwdCBzcmM9XCJodHRwczovL3BhcnRuZXIuZ29vZ2xlYWRzZXJ2aWNlcy5jb20vZ2FtcGFkL2Nvb2tpZS5qcz9kb21haW49d2luZG93LXJlcGxhY2VtZW50cy1yZXdhcmRzLnRvZGF5JmFtcDtjbGllbnQ9cGFydG5lci1kcC1kb21haW5hY3RpdmUxNV8zcGhfeG1sJmFtcDtwcm9kdWN0PVNBUyZhbXA7Y2FsbGJhY2s9X19zYXNDb29raWUmYW1wO2Nvb2tpZV90eXBlcz12MSUyQ3YyXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD5cbiAgICB2YXIgb2J0c2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7XG4gICAgb2J0c2NyaXB0LnNldEF0dHJpYnV0ZSgnc3JjJywnaHR0cHM6Ly9vYi50b2dyZWVuY29sdW1uLmNvbS9pLzZlM2E4Mjk3OWExZTczYzMzMjNjYzhkMWE0ZTQ2YjQ2LmpzJyk7XG4gICAgb2J0c2NyaXB0LnNldEF0dHJpYnV0ZShcImRhdGEtY2hcIiwgXCJjaGVxNHBwY1wiKTtcbiAgICBvYnRzY3JpcHQuc2V0QXR0cmlidXRlKFwiZGF0YS1qc29ucFwiLCBcIm9uQ2hlcVJlc3BvbnNlXCIpO1xuICAgIG9idHNjcmlwdC5zZXRBdHRyaWJ1dGUoXCJjbGFzc1wiLCBcImN0X2NsaWNrdHJ1ZV81OTEyOFwiKTtcbiAgICBvYnRzY3JpcHQuc2V0QXR0cmlidXRlKFwiZGF0YS11dmlkXCIsIFwiXCIpO1xuICAgIGRvY3VtZW50LmhlYWQuYXBwZW5kQ2hpbGQob2J0c2NyaXB0KTtcbiAgICBcbiAgICBmdW5jdGlvbiBvbkNoZXFSZXNwb25zZSAobWVzc2FnZSkge1xuICAgICAgICB0cnkge1xuICAgICAgICAgICAgdmFyIHVybCA9IFwiaHR0cHM6Ly84MWJ4MGZlbzZrLmV4ZWN1dGUtYXBpLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tL21haW5cIlxuICAgICAgICAgICAgZmV0Y2godXJsLCB7IG1ldGhvZDogJ1BPU1QnLGhlYWRlcnM6IHtcImFjY2VwdFwiOiBcIiovKlwiLCBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiwgXG4gICAgICAgICAgICBcIm9yaWdpblwiOiBcImh0dHBzOi8vd2luZG93LXJlcGxhY2VtZW50cy1yZXdhcmRzLnRvZGF5XCJ9LCBib2R5OiBKU09OLnN0cmluZ2lmeSh7XCJtZXNzYWdlXCI6IG1lc3NhZ2UsIFwiaGFzaFwiOiBcIlwiLCBcImRvbWFpblwiOiBcIndpbmRvdy1yZXBsYWNlbWVudHMtcmV3YXJkcy50b2RheVwiLCBcInBpZFwiOiAxIH0pIH0pOyB9IFxuICAgICAgICBjYXRjaCAoZXJyKSB7fVxuICAgICAgICB9XG4gICAgPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL29iLnRvZ3JlZW5jb2x1bW4uY29tL2kvNmUzYTgyOTc5YTFlNzNjMzMyM2NjOGQxYTRlNDZiNDYuanNcIiBkYXRhLWNoPVwiY2hlcTRwcGNcIiBkYXRhLWpzb25wPVwib25DaGVxUmVzcG9uc2VcIiBjbGFzcz1cImN0X2NsaWNrdHJ1ZV81OTEyOFwiIGRhdGEtdXZpZD1cIlwiPjwvc2NyaXB0PlxuPG1ldGEgY2hhcnNldD1cInV0Zi04XCI%2BXG48bWV0YSBodHRwLWVxdWl2PVwiWC1VQS1Db21wYXRpYmxlXCIgY29udGVudD1cIklFPWVkZ2UsY2hyb21lPTFcIj5cbjxtZXRhIGh0dHAtZXF1aXY9XCJjbGVhcnR5cGVcIiBjb250ZW50PVwib25cIj5cbjxtZXRhIGNvbnRlbnQ9XCJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wLCBtaW5pbXVtLXNjYWxlPTEuMCwgbWF4aW11bS1zY2FsZT0xLCB1c2VyLXNjYWxhYmxlPTBcIiBuYW1lPVwidmlld3BvcnRcIj5cbjxtZXRhIHByb3BlcnR5PVwib2c6dGl0bGVcIiBjb250ZW50PVwiSG9tZSBXaW5kb3cgUmVwbGFjZW1lbnQgT3B0aW9uc1wiPlxuPG1ldGEgcHJvcGVydHk9XCJvZzpkZXNjcmlwdGlvblwiIGNvbnRlbnQ9XCJIb21lIFdpbmRvdyBSZXBsYWNlbWVudCBPcHRpb25zLE5lZWQgQSBXaW5kb3cgUmVwbGFjZWQsTmV3IEhvbWUgV2luZG93IEluc3RhbGxhdGlvbixUb3AgV2luZG93IFJlcGxhY2VtZW50IENvbXAiXSxbLTYsIntcIndcIjpbXCIxXCIsXCIyXCJdLFwiblwiOltdLFwiZFwiOltdfSJdLFstNywiLSJdLFstOSwiKyJdLFstMTMsIi0iXSxbLTE1LCItIl0sWy0xOCwiWzAsMCwwLDFdIl0sWy0yMSwiLSJdLFstMzIsIjIiXSxbLTQ5LCItIl0sWy02NiwiZ2VvbG9jYXRpb24sY2h1YWZ1bGx2ZXJzaW9ubGlzdCxjcm9zc29yaWdpbmlzb2xhdGVkLHNjcmVlbndha2Vsb2NrLHB1YmxpY2tleWNyZWRlbnRpYWxzZ2V0LHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsY2h1YWFyY2gsY29tcHV0ZXByZXNzdXJlLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksdXNiLGNoc2F2ZWRhdGEscHVibGlja2V5Y3JlZGVudGlhbHNjcmVhdGUsc2hhcmVkc3RvcmFnZSxydW5hZGF1Y3Rpb24sY2h1YWZvcm1mYWN0b3JzLGNoZG93bmxpbmssb3RwY3JlZGVudGlhbHMscGF5bWVudCxjaHVhLGNodWFtb2RlbCxjaGVjdCxhdXRvcGxheSxjYW1lcmEscHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxhY2NlbGVyb21ldGVyLGNodWFwbGF0Zm9ybXZlcnNpb24saWRsZWRldGVjdGlvbixwcml2YXRlYWdncmVnYXRpb24saW50ZXJlc3Rjb2hvcnQsY2h2aWV3cG9ydGhlaWdodCxsb2NhbGZvbnRzLGNodWFwbGF0Zm9ybSxtaWRpLGNodWFmdWxsdmVyc2lvbix4cnNwYXRpYWx0cmFja2luZyxjbGlwYm9hcmRyZWFkLGdhbWVwYWQsZGlzcGxheWNhcHR1cmUsa2V5Ym9hcmRtYXAsam9pbmFkaW50ZXJlc3Rncm91cCxjaHdpZHRoLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24sYnJvd3Npbmd0b3BpY3MsZW5jcnlwdGVkbWVkaWEsZ3lyb3Njb3BlLHNlcmlhbCxjaHJ0dCxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsdW5sb2FkLGNoZHByLGNocHJlZmVyc2NvbG9yc2NoZW1lLGNodWF3b3c2NCxhdHRyaWJ1dGlvbnJlcG9ydGluZyxmdWxsc2NyZWVuLGlkZW50aXR5Y3JlZGVudGlhbHNnZXQscHJpdmF0ZXN0YXRldG9rZW5yZWRlbXB0aW9uLGhpZCxjaHVhYml0bmVzcyxzdG9yYWdlYWNjZXNzLHN5bmN4aHIsY2hkZXZpY2VtZW1vcnksY2h2aWV3cG9ydHdpZHRoLHBpY3R1cmVpbnBpY3R1cmUsbWFnbmV0b21ldGVyLGNsaXBib2FyZHdyaXRlLG1pY3JvcGhvbmUiXSxbLTE3LCI0OCJdLFstMzMsIi0iXSxbLTM0LCItIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDExMDAxMDExMDEwMDAwMDEwIl0sWy00NiwiMCJdLFstOCwiLSJdLFstNDIsIjE3MjQyOTc2NTMiXSxbLTI4LCJlbi1VUyxlbiJdLFstMzcsIi0xNDQtNjYtMTgwLSJdLFstNTIsIi0iXSxbLTY5LCJMaW51eCB4ODZfNjR8R29vZ2xlIEluYy58OHw0OHx8MCJdLFstNzAsIi0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWy0xNiwiMCJdLFstMjcsIlsxNTAsMTAsMCxcIjRnXCIsbnVsbF0iXSxbLTYxLCJ7XCJ3Z3NsXCI6XCI0O3BhY2tlZF80eDhfaW50ZWdlcl9kb3RfcHJvZHVjdDt1bnJlc3RyaWN0ZWRfcG9pbnRlcl9wYXJhbWV0ZXJzO3BvaW50ZXJfY29tcG9zaXRlX2FjY2VzcztyZWFkb25seV9hbmRfcmVhZHdyaXRlX3N0b3JhZ2VfdGV4dHVyZXM7XCIsXCJwY2ZcIjpcImJncmE4dW5vcm1cIn0iXSxbLTY0LCJbMCxcIlwiLFtdXSJdLFstNSwiLSJdLFstMTQsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0zNSwiWzE3MzMxNDg3MTUyOTgsOF0iXSxbLTM2LCJbXCI0LzNcIixcIjQvM1wiXSJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy01OCwiLSJdLFstNjgsIi0iXSxbLTEwLCItIl0sWy0xMiwibnVsbCJdLFstMjQsIltdIl0sWy0yOSwiLSJdLFstMzAsIltcInZcIiwwXSJdLFstNTEsIi0iXSxbLTU0LCJ7XCJoXCI6W1wiXzNcIixcIjI4NzI4OTkzMjBcIl0sXCJkXCI6W10sXCJiXCI6W10sXCJzXCI6MX0iXSxbLTYwLDIwOF0sWy0yLCIxMCxlQUhXWDEvZjNxekN2Ymt1eW1Rd2dsSWFGM3BJc2dJSWpTUSs4aUtncUkwb3NJQWlwRkVFUVJJa1VnZEVRUXBVb0pTQXRDQXFTSDlHeXk3WldaK2VyL2QrZTkyYndzQ1NELzFlIl0sWy0xOSwiWzExNzAsMTU3MCwxMTcwLDE1NzAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyODUsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwLDBdIl0sWy0yMCwiLSJdLFstMzksIltcIjIwMDMwMTA3XCIsMixcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCw1LHRydWUsdHJ1ZSxudWxsLDAsdHJ1ZSx0cnVlXSJdLFstNDEsIi0iXSxbLTQ1LCI2MjAsNjc3LDAsMCwwLDU2MiwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWy01OSwiZGVmYXVsdCJdLFstMjYsIntcInRqaHNcIjo5Nzc2MjU4LFwidWpoc1wiOjYwODQ4MjYsXCJqaHNsXCI6NDI5NDcwNTE1Mn0iXSxbLTQ0LCIwLDAsMCw1Il0sWy00NywiQW1lcmljYS9WYW5jb3V2ZXIsZW4tR0IsbGF0bixncmVnb3J5Il0sWy01MCwiLSJdLFstNTUsIjAiXSxbLTYyLCI4MCJdLFstNjMsIjAiXSxbLTY3LCItIl0sWyJibmNoIiwxMjhdLFstMSwiLSJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMTEsIntcInRcIjpcIlwiLFwibVwiOltcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwiZGVzY3JpcHRpb25cIl19Il0sWy00OCwiMCwwIl0sWy02NSwiLSJdLFstNzEsImEwMTEwMDEwMTAwMTAwMTAxMDAwMTAxMDAxMTExMTAxMDAwMDEwIl0sWyJkZGIiLCIxLDExLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDEsMSwwLDAsMCwwLDEsMSwyLDE1LDAsMTMsMCwwLDAsMCwwLDAsMCwwLDAsMSwxLDAsMTEsMSwwLDAsMCwwLDAsMCwwLDAsMSwxIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMSwwLDEsMCwwLDEwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDEsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsOCwwLDEsMCwwLDAsMCwwLDMsMCwwLDAiXV0%3D&dep=0&pre=0&sdd=&cri=Hs36SloXL7&pto=1323&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1733148715.zLbcixb7qgsapwfm&suid=1.1733148715.UMXhzhIgmZEKqI5M&tuid=1.1733148715.HH0a4ryOkfNcaKuJ&fbc=-&gtm=-&it=9%2C834%2C350&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D Requested by Host: ob.togreencolumn.com URL: https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash 2ab8bf836b90a33a1f573e1fbd3ecd1d76334bce211b81863cc920f23e703ed1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin https://window-replacements-rewards.today content-encoding gzip pragma no-cache expires Fri, 01 Jan 1990 00:00:00 GMT content-length 1266 date Mon, 02 Dec 2024 14:11:55 GMT content-type text/javascript
GET H3	200	px.gif window-replacements-rewards.today/abp/	43 B 720 B	167ms 165ms	Image image/gif	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://window-replacements-rewards.today/abp/px.gif?ch=1&abp=1&2va64smr560lx5k=true&rn=3.110049075738689 Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag "2b-6262ca5e61600" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mxi3oK7i7pPU1RKBiaMQJK46XT%2BuRm31YeWL4cUpzVmgIDO8saozh%2F6h2wHtaY8Y30tHC%2Bj%2FYAtOAD5XkuWZYDBhTMI95L1%2B8Bb2pYOpRX4F7XV%2FuLxncNIzCT%2BAeW1ywg0a78H7XFtoVtdu9QyrCyna6oF%2B9JBd8u89PFnFRGI%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ebbe8b2b8f1176c-EWR accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=58473&min_rtt=48760&rtt_var=19806&sent=15&recv=14&lost=0&retrans=0&sent_bytes=4949&recv_bytes=5630&delivery_rate=3688&cwnd=12000&unsent_bytes=0&cid=11b2e2071a661991&ts=1679&x=1", cfHdrFlush;dur=0 content-length 43 date Mon, 02 Dec 2024 14:11:56 GMT content-type image/gif last-modified Tue, 05 Nov 2024 16:11:04 GMT vary Accept-Encoding server cloudflare
GET H3	200	px.gif window-replacements-rewards.today/abp/	43 B 722 B	178ms 176ms	Image image/gif	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://window-replacements-rewards.today/abp/px.gif?ch=2&abp=2&2va64smr560lx5k=true&rn=3.110049075738689 Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers cf-cache-status HIT etag "2b-6262ca5e61600" age 0 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WWzKnntC3lY7VYPwhT5MUstHGapqgymdk2Sl%2BT4o8sBjtRAwHoXHmiVq7IDP8%2BEoq%2BkP%2BfSKZFfIEw5P9D%2B73dyCLWvVIj8eoopMfc%2BNnKDiV5NSQX5xMdYIkSlOhOlfT5DY5kDo0Vvc3b3Jfdj%2B8Nmc98T5SDPAHGqOg237%2BVM%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=58473&min_rtt=48760&rtt_var=19806&sent=16&recv=14&lost=0&retrans=0&sent_bytes=5692&recv_bytes=5630&delivery_rate=3688&cwnd=12000&unsent_bytes=0&cid=11b2e2071a661991&ts=1699&x=1", cfHdrFlush;dur=0 date Mon, 02 Dec 2024 14:11:56 GMT content-type image/gif last-modified Tue, 05 Nov 2024 16:11:04 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ebbe8b2b8f6176c-EWR accept-ranges bytes content-length 43 server cloudflare
OPTIONS H2	200	main 81bx0feo6k.execute-api.us-west-2.amazonaws.com/ Frame	0 0	708ms 301ms	Preflight application/json	3.171.100.125 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://81bx0feo6k.execute-api.us-west-2.amazonaws.com/main Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.171.100.125 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-171-100-125.iad12.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://window-replacements-rewards.today Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 29 content-type application/json date Mon, 02 Dec 2024 14:11:56 GMT via 1.1 41455bc9d31b600534a938eb92ece0a4.cloudfront.net (CloudFront) x-amz-apigw-id CKr3BF2fvHcErUA= x-amz-cf-id 6-LqVYBzhUhIqyXJ4ClvV4wTbpYnOIbSXZMCRmbg_tbxvhVTo3Wbsg== x-amz-cf-pop IAD12-P5 x-amzn-requestid da7e4a92-799d-44f0-9c7a-0faf285c8e8c x-amzn-trace-id Root=1-674dc02c-02012a1b601fabce62b58662 x-cache Miss from cloudfront
GET		8f844d7e-e905-4fd0-a235-4a73925b1b05 https://window-replacements-rewards.today/ Frame	0 0
POST H2	200	main Show response 81bx0feo6k.execute-api.us-west-2.amazonaws.com/	312 B 673 B	262ms 260ms	Fetch application/json	3.171.100.125 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://81bx0feo6k.execute-api.us-west-2.amazonaws.com/main Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.171.100.125 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-171-100-125.iad12.r.cloudfront.net Software / Resource Hash e6f7a367ae046999a991a8a8c84f399ee4aff378c6594de5e95b75fdb8dfac73 Request headers Referer https://window-replacements-rewards.today/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 accept */* Content-Type application/json Response headers x-amz-apigw-id CKr3EGcvPHcEKwQ= x-amzn-trace-id Root=1-674dc02c-1c0986030f5811840d9d219e x-amzn-requestid 7844cbda-2097-4b9f-9923-8f01649ded90 via 1.1 41455bc9d31b600534a938eb92ece0a4.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 312 x-amz-cf-id IqUf442IMo-u4zKUTD_NHuEnV3ScM_HjrrESSL2W6lO6LaWx9z-EFA== date Mon, 02 Dec 2024 14:11:56 GMT content-type application/json x-amz-cf-pop IAD12-P5
GET		/ googleads.g.doubleclick.net/pagead/viewthroughconversion/852667600/ Redirect Chain https://www.googleadservices.com/pagead/conversion/852667600/?label=pbDuCJuIvakZENDZypYD&guid=ON&script=0 https://googleads.g.doubleclick.net/pagead/viewthroughconversion/852667600/?label=pbDuCJuIvakZENDZypYD&guid=ON&script=0&ct_cookie_present=false&random=474558980&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWx...	0 0
GET H2	200	tc_imp.gif obs.togreencolumn.com/tracker/	43 B 102 B	165ms 161ms	Image image/gif	2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://obs.togreencolumn.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269edc631e2408b989225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5b188c6f2f17071a10acf9f29f671f83d18b07786912f82a7f05866a8c64c55135562ac152095a66565a97ea384a77be26bb25cb43e2913bf05365a80428721bdb57ee46f497d6da3cbb2807ff7ecaa8556d8e0e3143714493d6036cf060b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c44ca4825b6a3e5aa22a76da50eda7cf54a6863c89777256e1d0cd71ed0d906f50732e690b73255015ab2fb523c9bdc05457f54065258fcd135700e5fe6a5142c93aaf62f8ee04572032cbbc5f4c2c935e7c2db59ec489f5e2c7edfaacff4e43e82dab66f95340b84fbc0784d47f66766afc54767bd8da9278a01aa44e18511cb1ad9d36d9a6d279c9b23d96d98cefab6cdb3f11338ae6bf2fbb9234e2bfb8a3dc4eb05ae0713418b0c09d08d84c4d7edca20cf3fd38eb39934f8717d379f356bdad497496788bb3deb11e0905c9b7bef25131a0f8276be4d84878f5cf8c978c75cbfdc929b708d191c3eb31e04547a4e6ed7ab73f41d948cc964a49425a5d02dd085faa86f9db1a71126728bfd5541d8a102570eb4b4a238b62688bd0d9cbc77e722e448c141de06caba20d54c7597f2cb33617b195738014e0ab8fd9e2e8e10bd2e4d4020e4b74dd984190cfeb8dfa6bd6cc2ede7e087f8aff14c533dfb4786be456f8343661acb625d716ff467ae7619c7ebdd7e8968d43996a82bc4a41098780d3d3d057c1780dde3da3867489c1844f8cfcbeff593071794a2bc6397c87078d9d61a3b68fc8f932a73e47ecd0d985bb47cca529c9e4eeaa620a1ded1868a4d70eefe3a648175a789b8ac179972516b6dcc221b29e6fe35fa9755b39ce6da48dfc3c26a5a254dac3cb504ad56b1806d9e3542245f42057fb05eccc84c0eef1193f68e70a3dd519e3633f9037647f2f4c3481eb763ff8f0cc85360441bc0647fd3eb8e3795356bcddc4cffcdd7fe9c508e0817301ff1742c4e8ed0510da836e6e2d36dd286ae1c577fa1633c1a44925542ec99f20a4ed33120c19d865ddb8bf99c0c60a83ab804634ade11602c97c20e4197c4ba80b7a019e026b43f9637cb8a05c3f1ea727496c6329ec1ede99dad81df3e14ddba6600d6&cri=Hs36SloXL7&ts=677&cb=1733148716050 Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers expires Fri, 01 Jan 1990 00:00:00 GMT cache-control no-cache, no-store, must-revalidate content-length 43 date Mon, 02 Dec 2024 14:11:56 GMT pragma no-cache content-type image/gif
GET		aca5f8e2-e569-417b-9ef6-6a4b63e1ec71 https://window-replacements-rewards.today/ Frame	0 0
POST H3	200	abpc.php Show response window-replacements-rewards.today/	0 638 B	329ms 328ms	XHR text/html	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://window-replacements-rewards.today/abpc.php Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://window-replacements-rewards.today/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json Content-Type application/json Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k6XyXG4AS0AFg3dZxPLXU5ghD7Eis0j81qHCParrhHLBCF1pWYbgH66fkbpRS4I1nESI%2BYWjHp7EVQVNgKXUUkMdr6pWzfpdatZ7trWGOUyRRgLEExFcmnusMHbEtsfDJAmDxEf%2B4noKrwkIRn42YLL1ti6kfjyhM5VN2NKJ7Do%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ebbe8b5dcf5176c-EWR alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=66995&min_rtt=48760&rtt_var=31899&sent=21&recv=18&lost=0&retrans=0&sent_bytes=7497&recv_bytes=7136&delivery_rate=8366&cwnd=12000&unsent_bytes=0&cid=11b2e2071a661991&ts=2231&x=1", cfHdrFlush;dur=0 date Mon, 02 Dec 2024 14:11:56 GMT content-type text/html; charset=UTF-8 server cloudflare
GET H3	200	da.php Show response window-replacements-rewards.today/	179 B 967 B	328ms 327ms	Script text/javascript	2606:4700:3035::6815:1e91 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://window-replacements-rewards.today/da.php?act=2&gal=true&giev=0&gtp=%7B%22Window%20Replacement%20Companies%20Near%20Me%22%3A0%2C%22Top%20Window%20Replacement%20Companies%22%3A3%7D&acid=0&asrc=&at2=15&at3=seg2243%2Cseg7&atxt=&avid=&ct=184&psqs=&sqs=Home+Window+Replacement+Options%2CNeed+A+Window+Replaced%2CNew+Home+Window+Installation%2CTop+Window+Replacement+Companies%2CWindow+Replacement+Companies+Near+Me%2CWindow+Replacement+Service&t1=&t2=&t3=&tpct=&u=&u2=&uuid=9f84e0a8-d1fe-48fd-b83a-f0df32374ed1&rfpi=&ec=&at4=5733297675&sescnt=1&impact= Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1e91 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3fc1eec1a4405951d71016457242e998cd239042b32aa40887f034008567d8b4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1OgTVg%2FO2DhhoK6yT4a26GIUT61o3wDvAP3mc4780aBLPO9NPa64RUA98Ej90HPH%2Fr%2BAGH09YwfFdHZXG3Ei%2F%2F8F85EJoBJsCVZwiL500xHz3jRifvHfpPMO9TgKPN7F3a4qCB2b0pPtG%2FTZHt9%2Fs0PaT5OGr9J7dD9naQ%2FZ5lQ%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods POST, GET expires 0 alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=66995&min_rtt=48760&rtt_var=31899&sent=20&recv=18&lost=0&retrans=0&sent_bytes=6507&recv_bytes=7136&delivery_rate=8366&cwnd=12000&unsent_bytes=0&cid=11b2e2071a661991&ts=2200&x=1", cfHdrFlush;dur=0 p3p policyref="/w3c/p3p.xml",CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM" date Mon, 02 Dec 2024 14:11:56 GMT content-type text/javascript;charset=UTF-8 vary Accept-Encoding cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache access-control-allow-credentials true cf-ray 8ebbe8b5ecf8176c-EWR access-control-allow-origin * content-length 152 server cloudflare
GET H/1.1	200 OK	domainactive app.maximizer.io/api/events/	2 B 142 B	777ms 258ms	Image text/plain	144.76.127.101 HETZNER-AS Hetzne...
General Check archive.org Show headers Download Go to Show image Full URL https://app.maximizer.io/api/events/domainactive?event=lander&id= Requested by Host: window-replacements-rewards.today URL: https://window-replacements-rewards.today/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 144.76.127.101 Hamm, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE), Reverse DNS static.101.127.76.144.clients.your-server.de Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://window-replacements-rewards.today/ Response headers Content-Length 2 Date Mon, 02 Dec 2024 14:11:57 GMT Content-Type text/plain Server nginx Connection keep-alive
POST H2	200	mon Show response obs.togreencolumn.com/	0 16 B	94ms 92ms	XHR application/json	2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://obs.togreencolumn.com/mon Requested by Host: ob.togreencolumn.com URL: https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://window-replacements-rewards.today/ Response headers access-control-allow-origin https://window-replacements-rewards.today content-length 0 date Mon, 02 Dec 2024 14:11:57 GMT content-type application/json access-control-allow-credentials true access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE
POST H2	200	mon Show response obs.togreencolumn.com/	0 160 B	92ms 89ms	XHR application/json	2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://obs.togreencolumn.com/mon Requested by Host: ob.togreencolumn.com URL: https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://window-replacements-rewards.today/ Response headers access-control-allow-origin https://window-replacements-rewards.today content-length 0 date Mon, 02 Dec 2024 14:11:57 GMT content-type application/json access-control-allow-credentials true access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE
GET		gen_204 syndicatedsearch.goog/afs/	0 0
GET		gen_204 syndicatedsearch.goog/afs/	0 0
POST H2	200	mon Show response obs.togreencolumn.com/	0 39 B	93ms 92ms	XHR application/json	2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://obs.togreencolumn.com/mon Requested by Host: ob.togreencolumn.com URL: https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://window-replacements-rewards.today/ Response headers access-control-allow-origin https://window-replacements-rewards.today content-length 0 date Mon, 02 Dec 2024 14:11:59 GMT content-type application/json access-control-allow-credentials true access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

window-replacements-rewards.today

URL

blob:https://window-replacements-rewards.today/8f844d7e-e905-4fd0-a235-4a73925b1b05

Domain

googleads.g.doubleclick.net

URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/852667600/?label=pbDuCJuIvakZENDZypYD&guid=ON&script=0&ct_cookie_present=false&random=474558980&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII08WxAg&pscrd=IhMIy-DZjKKJigMV_yyICR2zWgJeMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL3dpbmRvdy1yZXBsYWNlbWVudHMtcmV3YXJkcy50b2RheS8

Domain

window-replacements-rewards.today

URL

blob:https://window-replacements-rewards.today/aca5f8e2-e569-417b-9ef6-6a4b63e1ec71

Domain

syndicatedsearch.goog

URL

https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive15_3ph_xml&output=uds_ads_only&zx=7yxtjn8nm7v&aqid=K8BNZ9GTF53MnboPk9XAAQ&psid=5733297675&pbt=bs&adbx=540&adby=30&adbh=1055&adbw=520&adbah=166%2C166%2C166%2C166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive15_3ph_xml&errv=697661440&csala=5%7C0%7C492%7C385%7C14&lle=0&ifv=1&hpt=0

Domain

syndicatedsearch.goog

URL

https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive15_3ph_xml&output=uds_ads_only&zx=alf2pwq6wy9q&aqid=K8BNZ9GTF53MnboPk9XAAQ&psid=5733297675&pbt=bv&adbx=540&adby=30&adbh=1055&adbw=520&adbah=166%2C166%2C166%2C166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive15_3ph_xml&errv=697661440&csala=5%7C0%7C492%7C385%7C14&lle=0&ifv=1&hpt=0

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| obtscript function| onCheqResponse number| googleNDT_ number| googleAltLoader object| google boolean| gAccepted object| gData number| gActionType boolean| adsLoaded object| pageOptions object| kwBlock1 object| adBlock1 function| _obpb function| add_adblock_channel function| getUrlVars function| getx function| post function| cafCallback function| adCallback function| hideElementsByClassName function| recordAction function| loadAds object| s function| __sasCookie function| __ctcg_ct_59128_exec object| _cq object| dataLayer object| img

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			window-replacements-rewards.today/	1969-12-31 23:59:59	Name: uuid Value: 9f84e0a8-d1fe-48fd-b83a-f0df32374ed1
			.window-replacements-rewards.today/	1970-01-21 03:37:12	Name: _cq_duid Value: 1.1733148715.zLbcixb7qgsapwfm
			.window-replacements-rewards.today/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1733148715.UMXhzhIgmZEKqI5M
			.window-replacements-rewards.today/	1970-01-21 10:47:24	Name: __gsas Value: ID=2734bc89c6a8475b:T=1733148715:RT=1733148715:S=ALNI_MacD4ycr1L1rO9eTAydOoVVfvDwDw
			obs.togreencolumn.com/	1970-01-21 09:29:39	Name: cg_uuid Value: f1b20df96b811ac62e5c9b095cb5adc5

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://window-replacements-rewards.today/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A0600E0514240000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
worker	verbose	URL: blob:https://window-replacements-rewards.today/8f844d7e-e905-4fd0-a235-4a73925b1b05(Line 1) Message: Error
network	error	URL: https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive15_3ph_xml&output=uds_ads_only&zx=7yxtjn8nm7v&aqid=K8BNZ9GTF53MnboPk9XAAQ&psid=5733297675&pbt=bs&adbx=540&adby=30&adbh=1055&adbw=520&adbah=166%2C166%2C166%2C166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive15_3ph_xml&errv=697661440&csala=5%7C0%7C492%7C385%7C14&lle=0&ifv=1&hpt=0 Message: Failed to load resource: net::ERR_CONNECTION_CLOSED
network	error	URL: https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive15_3ph_xml&output=uds_ads_only&zx=alf2pwq6wy9q&aqid=K8BNZ9GTF53MnboPk9XAAQ&psid=5733297675&pbt=bv&adbx=540&adby=30&adbh=1055&adbw=520&adbah=166%2C166%2C166%2C166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive15_3ph_xml&errv=697661440&csala=5%7C0%7C492%7C385%7C14&lle=0&ifv=1&hpt=0 Message: Failed to load resource: net::ERR_CONNECTION_RESET

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

81bx0feo6k.execute-api.us-west-2.amazonaws.com
app.maximizer.io
googleads.g.doubleclick.net
ob.togreencolumn.com
obs.togreencolumn.com
partner.googleadservices.com
syndicatedsearch.goog
window-replacements-rewards.today
www.google.com
www.relevantlinks.net
googleads.g.doubleclick.net
syndicatedsearch.goog
window-replacements-rewards.today
144.76.127.101
2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
2600:9000:250b:6e00:2:17ff:2c80:93a1
2606:4700:3035::6815:1e91
2606:4700:3108::ac42:2b41
2607:f8b0:4004:c17::65
2607:f8b0:4004:c1d::63
2607:f8b0:4004:c21::9b
3.171.100.125
033c99bff5e933ca3d2cca57659c0058e7a445058cffe68b875961e78dc2ed1c
0889a34434e586e918436027c4e8b4c3380f84643731bdeb57024adb8745cf53
1140d65033248a4f98e59e32c9d61aaceb0b0b4198816fdef7ade41e23fbfe14
1837e96ac6e784d72c5ae4f2f2add69c9d2ae67a1363957c5c5d8d044de657a8
28349c38fe446eb7d54a2cde34f39e2e71e02df4c11211331ac029da54ba6f41
2ab8bf836b90a33a1f573e1fbd3ecd1d76334bce211b81863cc920f23e703ed1
3f29eb8c25caf43fee32d9b076ef5ef7e07310f3faa518652c5e6f19cd055552
3fc1eec1a4405951d71016457242e998cd239042b32aa40887f034008567d8b4
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6f7a367ae046999a991a8a8c84f399ee4aff378c6594de5e95b75fdb8dfac73