Submitted URL: https://translate.google.lk/website?sl=en&tl=id&hl=id&client=srp&u=https://1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80....
Effective URL: https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H
Submission: On December 24 via manual from CH — Scanned from CH

Summary

This website contacted 7 IPs in 4 countries across 8 domains to perform 13 HTTP transactions. The main IP is 185.155.184.38, located in Switzerland and belongs to AS5398, CH. The main domain is efayn.com.
TLS certificate: Issued by R3 on December 1st 2023. Valid for: 3 months.
This is the only time efayn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Apex Domain
Subdomains
Transfer
4 gstatic.com
www.gstatic.com
89 KB
3
function sub() { [native code] }.
5 KB
3 google.com
translate.google.com — Cisco Umbrella Rank: 1298
31 KB
2 yadro.ru
counter.yadro.ru — Cisco Umbrella Rank: 12199
2 KB
1 efayn.com
efayn.com
38 KB
1 translate.goog
1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
3 KB
1 google.lk
translate.google.lk — Cisco Umbrella Rank: 432291
737 B
0 nicetorsome.live Failed
2441.nicetorsome.live Failed
13 8
Domain Requested by
4 www.gstatic.com 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
www.gstatic.com
3 1wviz19de22.xn--b1axgbba.xn--p1ai 1 redirects 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
1wviz19de22.xn--b1axgbba.xn--p1ai
3 translate.google.com 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
www.gstatic.com
2 counter.yadro.ru 1 redirects 1wviz19de22.xn--b1axgbba.xn--p1ai
1 efayn.com 1wviz19de22.xn--b1axgbba.xn--p1ai
1 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
1 translate.google.lk 1 redirects
0 2441.nicetorsome.live Failed efayn.com
13 8

This site contains no links.

Subject Issuer Validity Valid
*.googleusercontent.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
*.google.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
efayn.com
R3
2023-12-01 -
2024-02-29
3 months crt.sh

This page contains 2 frames:

Frame: https://2441.nicetorsome.live/vibysfss/article2441.doc?u=n7rwwwl&o=at5ruqf&t=197H&f=1&sid=t9~famgcw0vnhokgqtnfjoosuhd&fp=sUj5ZvCsudFY0pMSecWrfw%3D%3D
Frame ID: 83E7DFE4A6F2F2FF760BC02178E3BEF7
Requests: 12 HTTP requests in this frame

Frame: https://translate.google.com/websitetranslationui?parent=https%3A%2F%2F1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog&pfu=https%3A%2F%2F1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog%2F%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc&u=https%3A%2F%2F1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80.%D1%80%D1%84%2F&sl=en&tl=id&opu=https%3A%2F%2Ftranslate.google.com%2Fwebsite%3Fsl%3Den%26tl%3Did%26hl%3Did%26client%3Dsrp%26u%3Dhttps%3A%2F%2F1wviz19de22.%25D1%2581%25D1%2581%25D0%25BE%25D1%2580%25D0%25B2%25D1%2580.%25D1%2580%25D1%2584%2F%26anno%3D2&client=srp&hl=id
Frame ID: B3ACB6E37F7111F08A216FBA1D0ADD09
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://translate.google.lk/website?sl=en&tl=id&hl=id&client=srp&u=https://1wviz19de22.%D1%81%D1%81%D0%B... HTTP 302
    https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc Page URL
  2. http://1wviz19de22.xn--b1axgbba.xn--p1ai/ Page URL
  3. http://1wviz19de22.xn--b1axgbba.xn--p1ai/ HTTP 303
    https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H Page URL

Page Statistics

13
Requests

69 %
HTTPS

71 %
IPv6

8
Domains

8
Subdomains

7
IPs

4
Countries

166 kB
Transfer

1062 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://translate.google.lk/website?sl=en&tl=id&hl=id&client=srp&u=https://1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80.%D1%80%D1%84 HTTP 302
    https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc Page URL
  2. http://1wviz19de22.xn--b1axgbba.xn--p1ai/ Page URL
  3. http://1wviz19de22.xn--b1axgbba.xn--p1ai/ HTTP 303
    https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://translate.google.lk/website?sl=en&tl=id&hl=id&client=srp&u=https://1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80.%D1%80%D1%84 HTTP 302
  • https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Request Chain 10
  • https://counter.yadro.ru/hit;refleader?t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%3A//1wviz19de22.xn--b1axgbba.xn--p1ai/;hJust%20a%20moment...;0.13565039543156598 HTTP 302
  • https://counter.yadro.ru/hit;refleader?q;t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%3A//1wviz19de22.xn--b1axgbba.xn--p1ai/;hJust%20a%20moment...;0.13565039543156598

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/
Redirect Chain
  • https://translate.google.lk/website?sl=en&tl=id&hl=id&client=srp&u=https://1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80.%D1%80%D1%84
  • https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
7 KB
3 KB
Document
General
Full URL
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bdfaa2164a66d5e40610bfa391a8c7c324dcc3310b52f860a9f9a9be4d8abed8
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-security-policy
frame-ancestors *.translate.goog
content-type
text/html; charset=UTF-8
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Sun, 24 Dec 2023 18:41:03 GMT
expires
Sun, 24 Dec 2023 18:41:03 GMT
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
server
ESF
x-content-type-options
nosniff
x-robots-tag
none
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
content-type
application/binary
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 24 Dec 2023 18:41:03 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
location
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
server
ESF
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-robots-tag
none
x-xss-protection
0
m=corsproxy
www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/
82 KB
29 KB
Script
General
Full URL
https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/m=corsproxy
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
df49ef7179b1bebf93a5fbfe9e8e7533d14d9bc8e6a6214ddcd0133e44c302e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 20 Dec 2023 19:45:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
341739
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29157
x-xss-protection
0
last-modified
Wed, 20 Dec 2023 04:10:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 19 Dec 2024 19:45:24 GMT
m=phishing_protection
www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/
36 KB
14 KB
Script
General
Full URL
https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/m=phishing_protection
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f93e21c7cf6c9b4483d3f4900258e88deae5d1c5c9ae0ddb060696019b348ed6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 20 Dec 2023 19:45:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
341739
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14025
x-xss-protection
0
last-modified
Wed, 20 Dec 2023 04:10:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 19 Dec 2024 19:45:24 GMT
m=navigationui
www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy,phishing_protection/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy,phishing_protection/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/m=navigationui
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
415b2b606e4581e7902945ef8a8dbfeaee328bd8ad820afa68c7060ae37aaa9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 20 Dec 2023 19:45:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
341739
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9341
x-xss-protection
0
last-modified
Wed, 20 Dec 2023 04:10:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 19 Dec 2024 19:45:24 GMT
element.js
translate.google.com/translate_a/
88 KB
31 KB
Script
General
Full URL
https://translate.google.com/translate_a/element.js?cb=gtElInit&hl=id&client=wt_srp
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 24 Dec 2023 18:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
lazy.min.js
www.gstatic.com/feedback/js/help/prod/service/
106 KB
37 KB
Script
General
Full URL
https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy,phishing_protection/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/m=navigationui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Sun, 24 Dec 2023 18:22:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1084
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/product-feedback-gathering
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37048
x-xss-protection
0
last-modified
Mon, 11 Dec 2023 23:36:53 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="product-feedback-gathering"
vary
Accept-Encoding, Origin
report-to
{"group":"product-feedback-gathering","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/product-feedback-gathering"}]}
content-type
text/javascript
cache-control
public, max-age=3000
accept-ranges
bytes
expires
Sun, 24 Dec 2023 19:12:59 GMT
websitetranslationui
translate.google.com/ Frame B3AC
675 KB
0
Document
General
Full URL
https://translate.google.com/websitetranslationui?parent=https%3A%2F%2F1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog&pfu=https%3A%2F%2F1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog%2F%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc&u=https%3A%2F%2F1wviz19de22.%D1%81%D1%81%D0%BE%D1%80%D0%B2%D1%80.%D1%80%D1%84%2F&sl=en&tl=id&opu=https%3A%2F%2Ftranslate.google.com%2Fwebsite%3Fsl%3Den%26tl%3Did%26hl%3Did%26client%3Dsrp%26u%3Dhttps%3A%2F%2F1wviz19de22.%25D1%2581%25D1%2581%25D0%25BE%25D1%2580%25D0%25B2%25D1%2580.%25D1%2580%25D1%2584%2F%26anno%3D2&client=srp&hl=id
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.de.qYvzC9NchRE.O/am=wA/d=1/exm=corsproxy,phishing_protection/ed=1/rs=AN8SPfrcjLlOocG39_bIeoEy-8TxSvHd2A/m=navigationui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog require-trusted-types-for 'script';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport script-src 'report-sample' 'nonce-9mTNMebTiIne_8vGlj-XPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
X-Xss-Protection 0

Request headers

Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
frame-ancestors https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog require-trusted-types-for 'script';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport script-src 'report-sample' 'nonce-9mTNMebTiIne_8vGlj-XPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport/allowlist
content-type
text/html; charset=utf-8
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-site
date
Sun, 24 Dec 2023 18:41:03 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
x-ua-compatible
IE=edge
x-xss-protection
0
/
1wviz19de22.xn--b1axgbba.xn--p1ai/
5 KB
4 KB
Document
General
Full URL
http://1wviz19de22.xn--b1axgbba.xn--p1ai/
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
HTTP/1.1
Server
2606:4700:3034::6815:2d6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb4e6cae32a1e6aa37c1feb40c567c5808f79d11d17321fe0d8e8e1199f6bddb
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Referer
https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
83aaf9f03add83ac-MXP
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sun, 24 Dec 2023 18:41:04 GMT
Expires
Mon, 26 Jul 1997 05:00:00 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=epZ9wQZVfsIkURkJ6B1q42Nq%2BMYPnxYggLRcG23c3y0hmvftSr%2BK0Scp4DkebCNyLn%2FeUBT0bhEtoF96zyoHlbO6GiL7Utei7VOP02AKLPIBjpsEK6JQEU6yn5I%2FT75ZXZnWyClR3kCQ1VhuVmkI%2F0M3jPn%2Fi9l9mqYAq%2F348%2BA%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
X-Frame-Options
DENY
X-Powered-CMS
Antibot.Cloud (See: https://antibot.cloud/)
X-Robots-Tag
noindex
alt-svc
h3=":443"; ma=86400
cspreport
translate.google.com/_/TranslateWebserverWebsiteTranslationUi/ Frame B3AC
0
286 B
Other
General
Full URL
https://translate.google.com/_/TranslateWebserverWebsiteTranslationUi/cspreport
Requested by
Host: 1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog
URL: https://1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/?_x_tr_sl=en&_x_tr_tl=id&_x_tr_hl=id&_x_tr_pto=tc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-YIaUKI88vdJn5cvrGsO8Kg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://translate.google.com/
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Sun, 24 Dec 2023 18:41:04 GMT
content-security-policy
script-src 'report-sample' 'nonce-YIaUKI88vdJn5cvrGsO8Kg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/TranslateWebserverWebsiteTranslationUi/cspreport
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires
Mon, 01 Jan 1990 00:00:00 GMT
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-CH,de;q=0.9
Referer
http://1wviz19de22.xn--b1axgbba.xn--p1ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/gif
hit;refleader
counter.yadro.ru/
Redirect Chain
  • https://counter.yadro.ru/hit;refleader?t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%3A...
  • https://counter.yadro.ru/hit;refleader?q;t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%...
362 B
848 B
Image
General
Full URL
https://counter.yadro.ru/hit;refleader?q;t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%3A//1wviz19de22.xn--b1axgbba.xn--p1ai/;hJust%20a%20moment...;0.13565039543156598
Requested by
Host: 1wviz19de22.xn--b1axgbba.xn--p1ai
URL: http://1wviz19de22.xn--b1axgbba.xn--p1ai/
Protocol
HTTP/1.1
Server
88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS
host204.rax.ru
Software
nginx/1.17.9 /
Resource Hash
a73d6739819ba98621e4bdb24bc2fbc2c88583479558b9878e5b986d3b59341d
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-CH,de;q=0.9
Referer
http://1wviz19de22.xn--b1axgbba.xn--p1ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 24 Dec 2023 18:41:04 GMT
Strict-Transport-Security
max-age=86400
Server
nginx/1.17.9
Content-Type
image/gif
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin
*
Cache-control
no-cache
Connection
keep-alive
Content-Length
362
Expires
Fri, 23 Dec 2022 21:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 24 Dec 2023 18:41:04 GMT
Strict-Transport-Security
max-age=86400
Server
nginx/1.17.9
Content-Type
text/html
Location
https://counter.yadro.ru/hit;refleader?q;t52.6;rhttps%3A//1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog/%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc;s1600*1200*24;uhttp%3A//1wviz19de22.xn--b1axgbba.xn--p1ai/;hJust%20a%20moment...;0.13565039543156598
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Cache-control
no-cache
Connection
keep-alive
Content-Length
32
Expires
Fri, 23 Dec 2022 21:00:00 GMT
ab.php
1wviz19de22.xn--b1axgbba.xn--p1ai/antibot/
349 B
1 KB
Script
General
Full URL
http://1wviz19de22.xn--b1axgbba.xn--p1ai/antibot/ab.php?h1=14610e53b520c4726dff4bd3ddf63f69&h2=84fd12a528c49800b93aa84aeadd4a04&ip=2a05:ad00:000b:0000:0129:0000:0000:0001&via=&v=5.07&r=1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog&rand=1703443264
Requested by
Host: 1wviz19de22.xn--b1axgbba.xn--p1ai
URL: http://1wviz19de22.xn--b1axgbba.xn--p1ai/
Protocol
HTTP/1.1
Server
2606:4700:3034::6815:2d6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options DENY

Request headers

accept-language
de-CH,de;q=0.9
Referer
http://1wviz19de22.xn--b1axgbba.xn--p1ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sun, 24 Dec 2023 18:41:07 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
X-Powered-CMS
Antibot.Cloud (See: https://antibot.cloud/)
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Server
cloudflare
X-Frame-Options
DENY
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xcsq08wO3GOOQlopdrh6RPjdhY5zeawm7Fvoil22YCQIN%2F58say20jlO9g9LnGib%2FiBbmgM7xhNQ00OEluXyLnv88IxHrOSpFS5NnesGwg%2F2wLdIUQRzrbVIhQQsOp76S62VH3YwAe53CEL%2BlGagwer7GS%2FNSD%2FrvgylXxkKI10%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
X-Robots-Tag
noindex
CF-RAY
83aafa03dde083ac-MXP
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Primary Request /
efayn.com/
Redirect Chain
  • http://1wviz19de22.xn--b1axgbba.xn--p1ai/
  • https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H
37 KB
38 KB
Document
General
Full URL
https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H
Requested by
Host: 1wviz19de22.xn--b1axgbba.xn--p1ai
URL: http://1wviz19de22.xn--b1axgbba.xn--p1ai/antibot/ab.php?h1=14610e53b520c4726dff4bd3ddf63f69&h2=84fd12a528c49800b93aa84aeadd4a04&ip=2a05:ad00:000b:0000:0129:0000:0000:0001&via=&v=5.07&r=1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog&rand=1703443264
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
185.155.184.38 , Switzerland, ASN5398 (AS5398, CH),
Reverse DNS
Software
nginx /
Resource Hash
508d11b4dcc4d06ebd3237a447c4aa66461bdcef81bf83c0bec1cb9da29d34cb

Request headers

Referer
http://1wviz19de22.xn--b1axgbba.xn--p1ai/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Cache-Control
no-transform
Connection
keep-alive
Content-Length
38191
Content-Type
text/html
Date
Sun, 24 Dec 2023 18:41:07 GMT
Server
nginx
cache-control
private

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
83aafa044e6d83ac-MXP
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 24 Dec 2023 18:41:07 GMT
Location
https://efayn.com/?u=n7rwwwl&o=at5ruqf&t=197H
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kgLZsGaLEKPU%2F3uu8CPaRfiswPq34VQ0xAjZ6tacOXlGnmy4%2FELpoYBBsx0Id1uQ5%2B%2FQInNWtn2IiAFhaZ5P%2BFYA%2FdV2OOvc%2B%2FmGndAauDM16DvvzvevZF1VQ7VYnR5TZoUK57CPc0uyt1QnMxbT3Xh1EJ%2B8F0h8Xx8jvy4MuT8%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400
article2441.doc
2441.nicetorsome.live/vibysfss/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
2441.nicetorsome.live
URL
https://2441.nicetorsome.live/vibysfss/article2441.doc?u=n7rwwwl&o=at5ruqf&t=197H&f=1&sid=t9~famgcw0vnhokgqtnfjoosuhd&fp=sUj5ZvCsudFY0pMSecWrfw%3D%3D

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| requestLink object| CryptoJS function| b function| P function| getUrlParameter function| getCookie function| getBackendParamsByName function| getBackendParamsByNameReverse function| rString function| randomString function| a function| rString2 function| getSessionVal function| go function| gb function| gw string| voiceslist function| populateVoiceList function| A1 function| A2 function| A3 function| A4 function| A5 function| A6 function| A7 function| A8 function| A9 function| A10 function| A11 boolean| permissions function| getPermissionStatus function| A12 function| A13 function| A14 function| A15 function| A16 function| A17 function| A18 function| A19 function| A20 function| A21 function| A22 function| A42 function| A43 function| A60 function| A78 function| A86 function| A89 function| A92 function| chk function| parseURL function| get_sb string| browser

9 Cookies

Domain/Path Name / Value
.google.lk/ Name: __Secure-ENID
Value: 16.SE=g7sKMU6mzFEIr0ZDlNPw55cvuyEXZxbV0-iJF7oW41UXPqdlHaeoB7n1W4lpgAK2IV45Ybc6IbxZG-TnUYgnqF87qair4OcfjXfKyT708q2gdGACHS_fUedHnRnbWWCSUj4OdBZ6iuS8ZeHQA7vH7Jjqj4z-2BrDx_Qeza_oiGI
.google.lk/ Name: CONSENT
Value: PENDING+737
1wviz19de22.xn--b1axgbba.xn--p1ai/ Name: ab_referer
Value: https%3A%2F%2F1wviz19de22-xn----b1axgbba-xn----p1ai.translate.goog%2F%3F_x_tr_sl%3Den%26_x_tr_tl%3Did%26_x_tr_hl%3Did%26_x_tr_pto%3Dtc
.yadro.ru/ Name: FTID
Value: 1bY7j02Uhiei1bY7j0002CNE
.yadro.ru/ Name: VID
Value: 22qOD-3jSVei1bY7j0002CNu
1wviz19de22.xn--b1axgbba.xn--p1ai/ Name: antibot
Value: 11e1a3dc949acd155df720a93270d2c4
efayn.com/ Name: sid
Value: t9~famgcw0vnhokgqtnfjoosuhd
efayn.com/ Name: p1
Value: https://nicetorsome.live/vibysfss/
efayn.com/ Name: s1
Value: sfh1gznvjmd4ed1i

1 Console Messages

Source Level URL
Text
security error (Line 6)
Message:
This document requires 'TrustedScript' assignment.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0