urlscan.io logo urlscan.io
SecurityTrails logo

s.linkswinner.pro Open in urlscan Pro
94.237.84.54  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top/SubscribeClick
Effective URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_...
Submission Tags: phishing apple Search All
Submission: On September 02 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 94.237.84.54, located in Finland and belongs to UPCLOUD, FI. The main domain is s.linkswinner.pro.
TLS certificate: Issued by R3 on August 14th 2023. Valid for: 3 months.
This is the only time s.linkswinner.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 45.141.159.22 206776 (INTERDEX-...)
1 1 35.241.7.124 15169 (GOOGLE)
1 1 94.237.99.118 202053 (UPCLOUD)
7 94.237.84.54 202053 (UPCLOUD)
3 2600:9000:26a... 16509 (AMAZON-02)
10 2
1    2606:4700:3030::6815:46b7 (United States)

ASN13335 (CLOUDFLARENET, US)
account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top
1    45.141.159.22 (Bulgaria)

ASN206776 (INTERDEX-NETWORK, SC)
PTR: no-rdns.krypton-network.com
track.emldmonly.com
1    35.241.7.124 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 124.7.241.35.bc.googleusercontent.com
trk.back-trak.com
1    94.237.99.118 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-99-118.de-fra1.upcloud.host
1d6ce02b5d0.tc4asdf.com
7    94.237.84.54 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-84-54.de-fra1.upcloud.host
s.linkswinner.pro
3    2600:9000:26a6:2200:13:27f7:6080:21 (United States)

ASN16509 (AMAZON-02, US)
d1u65k3qj4t7ya.cloudfront.net
Domain Requested by
7 s.linkswinner.pro s.linkswinner.pro
3 d1u65k3qj4t7ya.cloudfront.net s.linkswinner.pro
1 1d6ce02b5d0.tc4asdf.com 1 redirects
1 trk.back-trak.com 1 redirects
1 track.emldmonly.com 1 redirects
1 account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top 1 redirects
10 6

This site contains links to these domains. Also see Links.

Domain
jaffco.xyz
Subject Issuer Validity Valid
*.linkswinner.pro
R3		 2023-08-14 -
2023-11-12		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2022-12-08 -
2023-12-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Frame ID: 0CEE97EBCE0F52E00E695023E9FA6B30
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Congratulations!

Page URL History Show full URLs

  1. https://account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top/SubscribeClick HTTP 301
    https://track.emldmonly.com/C2Nrb3IBeC HTTP 302
    https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=2ebee5141bf448cb9d1758688c0ad8f522106&source=223952&p3= HTTP 302
    https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream HTTP 302
    https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818... Page URL

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

2
IPs

3
Countries

144 kB
Transfer

319 kB
Size

20
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top/SubscribeClick HTTP 301
    https://track.emldmonly.com/C2Nrb3IBeC HTTP 302
    https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=2ebee5141bf448cb9d1758688c0ad8f522106&source=223952&p3= HTTP 302
    https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream HTTP 302
    https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request win_gold
s.linkswinner.pro/
Redirect Chain
  • https://account-amazon-merchant-center-campaign-v3-signin-identifier.alme.top/SubscribeClick
  • https://track.emldmonly.com/C2Nrb3IBeC
  • https://trk.back-trak.com/t/NTg0XzUxNDc=/?p1=2ebee5141bf448cb9d1758688c0ad8f522106&source=223952&p3=
  • https://1d6ce02b5d0.tc4asdf.com/?p=4537&media_type=mainstream
  • https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
15 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
132ada2b7c97872aa075e19387c3dd174d3f8a92359ac6462a3ca01fad4b8ed8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 02 Sep 2023 23:09:30 GMT
log-id
1bf2ffdb-87ac-4732-8e9d-0fdf2676f9d5
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Sat, 02 Sep 2023 23:09:29 GMT
location
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
app.css
s.linkswinner.pro/css/offers/win_gold/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
6ad823d9abbb230248bf9a219014b713875caf1033ec924cba57fd4b96619585

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:31 GMT
content-encoding
gzip
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
W/"64f18ba3-f15"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sun, 01 Sep 2024 23:09:31 GMT
default@0.75x.png
s.linkswinner.pro/img/prizes/iphone-14/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/prizes/iphone-14/default@0.75x.png
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
eda7d0d12a2dcb4063802985a75a13935a6f4168a92b9c8861ca880801775fde

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:31 GMT
last-modified
Fri, 01 Sep 2023 06:56:36 GMT
etag
"64f18b24-26e4"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
9956
expires
Sun, 01 Sep 2024 23:09:31 GMT
app.js
s.linkswinner.pro/js/ 		0
207 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/js/app.js?id=d41d8cd98f00b204e9800998ecf8427e
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:31 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-0"
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
0
expires
Sun, 01 Sep 2024 23:09:31 GMT
app.js
s.linkswinner.pro/js/offers/win_gold/ 		242 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.linkswinner.pro/js/offers/win_gold/app.js?id=03ed7013f4af599a61ae16bbb1969bf7
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
ca29d3e0e1844cc3a150c92817b2fd0b39601e155adefb8347569d3791049528

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:31 GMT
content-encoding
gzip
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
W/"64f18ba3-3c9d5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sun, 01 Sep 2024 23:09:31 GMT
bg.jpg
s.linkswinner.pro/img/offers/win_gold/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/offers/win_gold/bg.jpg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
35b6e5cc0b3a23ad26e7e6e444998d4aa95d66add467bd2e110a3ae67c61a3c7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:31 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-7b2f"
content-type
image/jpeg
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
31535
expires
Sun, 01 Sep 2024 23:09:31 GMT
softbank.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		264 B
647 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/softbank.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a6:2200:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de52a71178a5ec7a1583dce44d52c43ec4eb10c0acdd55ffe609d4d186b252ad

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sat, 02 Sep 2023 15:52:41 GMT
via
1.1 ca2138239b4f2ae23bfefdb88ff2567a.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:39 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P1
age
26212
etag
"889a1adf82c28e87eceac2dbeaf66df6"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
accept-ranges
bytes
content-length
264
x-amz-cf-id
bT-RBNGBFWrZsXJZ7d3FMMKyytZEOBXjv6JrcpjO6NJIl2hxUL047g==
kddi.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/kddi.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a6:2200:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
28b5004a80479892c4f5b71a4caee5eb4f92cbf92f7b843c90e4c6b21761c80b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sat, 02 Sep 2023 06:12:03 GMT
content-encoding
gzip
via
1.1 ca2138239b4f2ae23bfefdb88ff2567a.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:38 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P1
age
61050
etag
W/"da611a37af9b86a85bea64155bef82b2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
x-amz-cf-id
LaUKX6M0drAu3mgj4-iBqbfDIEasFyKp5D4Qxiiitte1taAcKPdS0g==
ntt_docomo.svg
d1u65k3qj4t7ya.cloudfront.net/carriers/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1u65k3qj4t7ya.cloudfront.net/carriers/ntt_docomo.svg
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/win_gold?tid=604qdozozckxrhds5wo8o0ogk,16346016,5,4537&ctrack=1693696169.818816140&p=4537&media_type=mainstream
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a6:2200:13:27f7:6080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c5160dd86255de8ea562f069fb3a3d25813ed7a09bebcded296eaa02b57bf83

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sat, 02 Sep 2023 09:40:03 GMT
content-encoding
gzip
via
1.1 ca2138239b4f2ae23bfefdb88ff2567a.cloudfront.net (CloudFront)
last-modified
Fri, 01 Jul 2022 12:26:39 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P1
age
48570
etag
W/"529e6bccd53270a95c7e4e16778e9a48"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-storage-class
REDUCED_REDUNDANCY
x-amz-cf-id
Alvm3fe7EsvMmM4sVC9EuvwQNn9G6AtWmwHcKuXtpYbwskc_CAHLaA==
seal.png
s.linkswinner.pro/img/offers/win_gold/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.linkswinner.pro/img/offers/win_gold/seal.png
Requested by
Host: s.linkswinner.pro
URL: https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.84.54 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-84-54.de-fra1.upcloud.host
Software
/
Resource Hash
27d6943fdeb7a2c881dbc9c7106e1162b139e905bd89beee69d69ac7cf336f39

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://s.linkswinner.pro/css/offers/win_gold/app.css?id=de90455ee47f9f949d02adbd2b80f5df
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
public
date
Sat, 02 Sep 2023 23:09:33 GMT
last-modified
Fri, 01 Sep 2023 06:58:43 GMT
etag
"64f18ba3-2ead"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
11949
expires
Sun, 01 Sep 2024 23:09:33 GMT

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| pd_options object| view number| w number| h function| step

20 Cookies

Domain/Path Name / Value
.emldmonly.com/ Name: gdm_click_freq_v2_1_001
Value: 5bVyImjD520Hoc/CnETYYHabHq9i9P/g6/fR3hPDGqJdAW86DXN1b+s0p12QZLwg
.emldmonly.com/ Name: gdm_uid_v1_1_001
Value: mOWlLwawsAaT7INc835k+e2LEqx9K9XquhklImji898fY17YI7IVFFnKW01kuXqv
.emldmonly.com/ Name: gdm_suid_v2_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.emldmonly.com/ Name: gdm_uid_v2_1_001
Value: mOWlLwawsAaT7INc835k+e2LEqx9K9XquhklImji898fY17YI7IVFFnKW01kuXqv
.emldmonly.com/ Name: gdm_sid_v2_3_001
Value: XeGuH+ujeXaGdPvxCKb7B2vZlbdNMetekivBXkRHbZQggpfds88FAmcqEPjez82mDmKPRyriVIVtSMKV9ds2zz71UK9ajF4NQwftxu3ONKbgG/apMcwpTCozQiGKiwiTvsWvJphUWiO7lkm7rZb+Nj77TIFEJlF8TO6wfc4YtSMlsRwpoTp9uJuOY0dBJsqYtA7Jd+J9TbdWuD7zK0IXV41cNLi4JuOChdCZAdHdpjkRISVnw/lBCOkCgJUQkO31764C4pIhr2rRrx1sMr4xOxNsu9KvsHLX9FtIr5qskNQ34xlx+zt5f0pAhSxsd8/UjkbQyym4AmsRBckI/BuQnI3M4bgxmMtcMiJRUh2ozaWpjXnkmIyJMsaFDlhj6uMuDgj0IofkP3/T4aE+sdDHYE1SwFeyhavnhkfEuh0TrXgZVAsuAXU/EKhzzPA2CD8BB4Y0+6MSA3jnoMeLlu0RLq1XwlA9kmytC3ylxmmxKAfN6IJF/PgYxytMH0F25m29QIhFz3FwwHePsymJ80aaEwpW28pEn2gop0kRlvMQ4U4Y80mrwjtHW4r475GX5YwFYdj4LG7UE3QdwqcKe99wcEoC4HF5jp6+Wnf1ovaYUybtOH4GzR3Wat7yaXIet/MxXzRFEaWm77j5m/3IIfdZ5k+uhnT4H9onzVyoS14zlOv3HbeOGA/YTqlGfGHgSQtZp4tub91UgX/IDPRlAhy3GYz0UVwlgxlEO2D6MsA0uLE+e5T56uqqmco+CB95/IJeyoDp4xBu2HccqZMEX7Gx935/YDbEu6WBhGZYwl/XLEDEU9uiIFRbDOgvUM+oHsmcdMxeoITMmFPzyMi3SUjTJ13gZxFjZs0uMRqHr1rbfvOWxg6sBof1ju6qeU8l5N9yWrZBnS00Fqhm0k2bZYUb0fTemFUwdaZVthm0oq1FGhUaEa90lSg3Q1Q+PGIktMiaYcfEkHevoShYnBu7cPXdnb29dcC1mbp5sHy4TqdhUpttO8daXMzTQ3lU0/NrSYRrPZbZYnsrTwH29Wxb+f5KauABdUvhU8+NY63REsEP3aM=
.emldmonly.com/ Name: gdm_click_freq_v1_1_001
Value: 5bVyImjD520Hoc/CnETYYHabHq9i9P/g6/fR3hPDGqJdAW86DXN1b+s0p12QZLwg
.emldmonly.com/ Name: gdm_click_adv_freq_v2_1_001
Value: /Np31dPxWDeGZoWl2+V1TEnnP5T/YJGfA9YuV7CjPTEjXDT/8BtdL7xpjoAiIAqD
.emldmonly.com/ Name: gdm_suid_v1_1_001
Value: HPfHs3OFxkaNOwO68jCjbQ==
.emldmonly.com/ Name: gdm_click_adv_freq_v1_1_001
Value: /Np31dPxWDeGZoWl2+V1TEnnP5T/YJGfA9YuV7CjPTEjXDT/8BtdL7xpjoAiIAqD
.emldmonly.com/ Name: gdm_sid_v1_3_001
Value: XeGuH+ujeXaGdPvxCKb7B2vZlbdNMetekivBXkRHbZQggpfds88FAmcqEPjez82mDmKPRyriVIVtSMKV9ds2zz71UK9ajF4NQwftxu3ONKbgG/apMcwpTCozQiGKiwiTvsWvJphUWiO7lkm7rZb+Nj77TIFEJlF8TO6wfc4YtSMlsRwpoTp9uJuOY0dBJsqYtA7Jd+J9TbdWuD7zK0IXV41cNLi4JuOChdCZAdHdpjkRISVnw/lBCOkCgJUQkO31764C4pIhr2rRrx1sMr4xOxNsu9KvsHLX9FtIr5qskNQ34xlx+zt5f0pAhSxsd8/UjkbQyym4AmsRBckI/BuQnI3M4bgxmMtcMiJRUh2ozaWpjXnkmIyJMsaFDlhj6uMuDgj0IofkP3/T4aE+sdDHYE1SwFeyhavnhkfEuh0TrXgZVAsuAXU/EKhzzPA2CD8BB4Y0+6MSA3jnoMeLlu0RLq1XwlA9kmytC3ylxmmxKAfN6IJF/PgYxytMH0F25m29QIhFz3FwwHePsymJ80aaEwpW28pEn2gop0kRlvMQ4U4Y80mrwjtHW4r475GX5YwFYdj4LG7UE3QdwqcKe99wcEoC4HF5jp6+Wnf1ovaYUybtOH4GzR3Wat7yaXIet/MxXzRFEaWm77j5m/3IIfdZ5k+uhnT4H9onzVyoS14zlOv3HbeOGA/YTqlGfGHgSQtZp4tub91UgX/IDPRlAhy3GYz0UVwlgxlEO2D6MsA0uLE+e5T56uqqmco+CB95/IJeyoDp4xBu2HccqZMEX7Gx935/YDbEu6WBhGZYwl/XLEDEU9uiIFRbDOgvUM+oHsmcdMxeoITMmFPzyMi3SUjTJ13gZxFjZs0uMRqHr1rbfvOWxg6sBof1ju6qeU8l5N9yWrZBnS00Fqhm0k2bZYUb0fTemFUwdaZVthm0oq1FGhUaEa90lSg3Q1Q+PGIktMiaYcfEkHevoShYnBu7cPXdnb29dcC1mbp5sHy4TqdhUpttO8daXMzTQ3lU0/NrSYRrPZbZYnsrTwH29Wxb+f5KauABdUvhU8+NY63REsEP3aM=
.1d6ce02b5d0.tc4asdf.com/ Name: rts-trck
Value: 1
.tc4asdf.com/ Name: t-uuid
Value: 604qdozp31pggk0afrg1wk0os
.tc4asdf.com/ Name: ab
Value: B
.tc4asdf.com/ Name: traffic-visited-domain
Value: linkswinner.pro
.tc4asdf.com/ Name: traffic-back-ivr
Value: ok
s.linkswinner.pro/ Name: XSRF-TOKEN
Value: eyJpdiI6IjJrSmlnSkp3OFVkcmV2MlFyRk40cFE9PSIsInZhbHVlIjoiaG5lUDVXb3BCRHhPdkkwYXRDMzBwQ2M2K05hNGRKWXk2T2pPbDVoUEV1WklZdTZBMVlmc0lFZ3l0akhYNlRjT3RGd1JTdTVxajVkckhHU1pXd25YVW82MUNmUmpydGd0R0R3aU80KzI2ZEdmVVJ6b1VabklUZU84WlJSaXEwVE4iLCJtYWMiOiJhMzVjOWE5ZDUzODQxMWI2YzYwNGQxMmUwNTI4NDA0ZDcwMmZhMTk0ZjM0ZWM0OTliMDBmM2E0NjQ0NDdkNTliIiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: ivr_offers_session
Value: eyJpdiI6IjJIMW80YWtaaFN3M1dRT0hSYVM4SVE9PSIsInZhbHVlIjoia0cxU2tTN0FaVXhCMmQ1UDdtemtLWmhYYjhiRlp5VmNLYzhmMGt6MHJvWGh6VVJmeDBmRGxwNnpvWEpSMlZpQi9XMWE0UStpZzBkbTZMR3JoNGd5ZkdzY0gyZXNTMnAvSjdHZkE4bHhTdkg4ME9zaWNPdlhhNUJ0citHUVQ4QmEiLCJtYWMiOiJkOGZkMWFkM2UzNzE1OTAzNjRkMTJmMjU5NGRlMGJiOGFmOGY4OTkyODRkOWYxZjk0NGRmMTVjYzg3MDc2OTQ3IiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: SESS_TRAF
Value: eyJpdiI6IlJwSmZIai9LOGRRR1hPcXh6VUxQaUE9PSIsInZhbHVlIjoiZHNZaHpXM0RBVTh4dmZlVkFrOTA4UWN0ZXpZSmVoZm01S1pkRGtRSDVMRFdSOEYyWUdHYWRtOXV4dnFicmdKR2pCdDZnMVVPZTBJQmNTb0x1QUJnYmJ6RVJrQ0NsTkt1WThDNG4ySjE4QldVMSsxL0ZiOFZ2QzYrM2s0d0Q4WW1wc3RTY1VMZXZla3dicUwxays1elZKa2xNRVhaU1lhMjhBK2pmRzJrM3NhUFg4ZWZydU1lMFlxckg0emZ0VFMrQTUxZkJSc0FNbjRJWVhpcHgzV0wwRGdJUFM5djZrbkNRd2M4WmlwNWpkZz0iLCJtYWMiOiJmODBiNjRhNjhjYTMxMWRhYTdmNzg2MWJkZWFhZmVmZDBhNDg0OTVhMGZhNjEzYzkyNGMwMjEzYzQ2ZDRjYjlhIiwidGFnIjoiIn0%3D
s.linkswinner.pro/ Name: visit
Value: eyJpdiI6Imw2S25vRUkyNWg1aWJNM0NwZGZDTlE9PSIsInZhbHVlIjoiZUp3ZEFjSC9tZVdTNFFsYXBXVWZlQ0lDYlVaYkhIU0c3SituODRRMHZpSDBFZk1hWmwwaVhSRmV4bmhRcGRUSiIsIm1hYyI6ImE0Mjc5ZjUxN2RmOWUzMGJjYTY2MTVkOTdmZGFiM2EyNzUwNTUyODM5MThjOGUwZmEwNjE5MzMwOTljY2M0N2QiLCJ0YWciOiIifQ%3D%3D
s.linkswinner.pro/ Name: ubdDSCcP9Tjg7bVQtjmvhiSzYgq2wNexOJYBIrVF
Value: eyJpdiI6IjhVRUVZdE0vdU43eDhkUFhzbXBnSXc9PSIsInZhbHVlIjoiaFJWdDVQYjNqVG1aeVhxMVNxNkRLWjBHaUlicmRJZGZqakpWVkxRblRTM1F3NGg0Z2lGREM0RjRyZ2VDSGxyTFhKUmdoL2NaOVFwb0RjdnZNbkJBZ2VBZVBiTTlyb2FiYnBHYWJzRDZrUG1kUXBxREp4V3BtMkFRcWt5OE5uZ1ozQldhbEdybmtybDNBZ2xGbmM1MG9qd0JNcjVFTGlQOFNmN1lid0QzcUVCMnJBT21wQjI0RS9tNkJQVy9zRnNBZ0NMOTI3VWtyck41Unl5Lzhldi9RU2ZLdWVPaFFnSmlaNUxCK0Z2M3RweWVHTkNvUEU4WWNhaURSQ1pzWXNuMmEvMHJXclZaVXZNL2J1Snl0ZjFZQnBiMk9KRVVPd3BuYVRISXNpTE1Vd3Z2dVcvZTg4QnlSaXJxQy9oRjZ4VGFTVzRGeC82a1VLcTR6ZGhKYTVSZFRzM2hKc1JXRmcya3MrSWxDTmJxS0gxQW0vWHBOV1NzQ2E2OWxCRmJEQ2M0ZWRCSWtkVmt6Y0RKazFWeVN1ajdNTGJuS2s1M2F6UmMwR1o3aFdSRUNBdHAxVE9ndTZUOS9Od0txN0wrM1ExcWVtcUZsbzFPTjdabUdhOVJTdkhGUXFZTCs3dHBTNytzL2NSVXp6WHJyQWJUNTZaajRYNXJBR1N4eDJpclhqOGRwcmpqSzNVTHQxZjBvcmw1a01uTnVRPT0iLCJtYWMiOiI4YmY0YWE4YzcyYjBjZmM4YzVlODk1YTg3Mzk1NTYyNGM5NTZiYzljMWIwZjJlOGMyMmRhYzI5OTVkNzJkMmUzIiwidGFnIjoiIn0%3D