gestyy.com Open in urlscan Pro
172.67.68.51 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gestyy.com/eh6vdw
Submission: On February 01 via manual (February 1st 2024, 9:05:31 pm UTC) from PL — Scanned from CH

Summary HTTP 104 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 34 IPs in 8 countries across 41 domains to perform 104 HTTP transactions. The main IP is 172.67.68.51, located in United States and belongs to CLOUDFLARENET, US. The main domain is gestyy.com.

This is the only time gestyy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	172.67.68.51 172.67.68.51	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.217.16.142 172.217.16.142	15169 (GOOGLE) (GOOGLE)
3	142.250.185.106 142.250.185.106	15169 (GOOGLE) (GOOGLE)
3	104.26.6.218 104.26.6.218	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.243.61.227 192.243.61.227	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
12	139.45.197.250 139.45.197.250	9002 (RETN-AS) (RETN-AS)
1	95.216.206.230 95.216.206.230	24940 (HETZNER-AS) (HETZNER-AS)
3	23.109.170.60 23.109.170.60	7979 (SERVERS-COM) (SERVERS-COM)
3	172.217.18.8 172.217.18.8	15169 (GOOGLE) (GOOGLE)
3	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
1	104.26.5.107 104.26.5.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.64.196.8 172.64.196.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	192.243.59.20 192.243.59.20	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	3.64.223.139 3.64.223.139	16509 (AMAZON-02) (AMAZON-02)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
3	185.162.85.3 185.162.85.3	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	185.162.85.14 185.162.85.14	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	212.117.187.148 212.117.187.148	7979 (SERVERS-COM) (SERVERS-COM)
2	212.117.186.12 212.117.186.12	7979 (SERVERS-COM) (SERVERS-COM)
1	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
1	142.250.181.227 142.250.181.227	15169 (GOOGLE) (GOOGLE)
4	23.109.87.223 23.109.87.223	7979 (SERVERS-COM) (SERVERS-COM)
1	216.239.34.36 216.239.34.36	15169 (GOOGLE) (GOOGLE)
6	192.243.59.13 192.243.59.13	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1 1	212.117.186.124 212.117.186.124	7979 (SERVERS-COM) (SERVERS-COM)
1	162.19.19.14 162.19.19.14	16276 (OVH) (OVH)
1 1	212.117.186.20 212.117.186.20	7979 (SERVERS-COM) (SERVERS-COM)
1 1	185.162.87.203 185.162.87.203	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
3	45.133.44.33 45.133.44.33	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
1 1	172.67.74.33 172.67.74.33	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.197.238 139.45.197.238	9002 (RETN-AS) (RETN-AS)
1	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
1	104.26.6.19 104.26.6.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	172.64.108.10 172.64.108.10	13335 (CLOUDFLAR...) (CLOUDFLARENET)
104	34

6 172.67.68.51 (United States)

ASN13335 (CLOUDFLARENET, US)

gestyy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.142 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f142.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.26.6.218 (None, )

ASN13335 (CLOUDFLARENET, US)

static.sh.st	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.61.227 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

endangersquarereducing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 139.45.197.250 (United Kingdom)

ASN9002 (RETN-AS, GB)

ptauxofi.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
amunfezanttor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.216.206.230 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.230.206.216.95.clients.your-server.de

ubbfpm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.109.170.60 (Netherlands)

ASN7979 (SERVERS-COM, US)

ja.rewashwudu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.8 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.5.107 (None, )

ASN13335 (CLOUDFLARENET, US)

analytics.shorte.st	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.196.8 (United States)

ASN13335 (CLOUDFLARENET, US)

friendshipmale.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.243.59.20 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

divergeimperfect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
capaciousdrewreligion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jestinquire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.64.223.139 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-64-223-139.eu-central-1.compute.amazonaws.com

proftrafficcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.162.85.3 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

xngqoc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.162.85.14 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

prhzxq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.117.187.148 (Luxembourg, Luxembourg)

ASN7979 (SERVERS-COM, US)

eveneraw.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.117.186.12 (Luxembourg, Luxembourg)

ASN7979 (SERVERS-COM, US)

siltagefutiley.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f3.1e100.net

www.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.109.87.223 (Netherlands)

ASN7979 (SERVERS-COM, US)

liberia.artertapirus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
gripy.swaggydestroy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.34.36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.243.59.13 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

jestinquire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
unseenreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.117.186.124 (Luxembourg, Luxembourg) 1 redirects

ASN7979 (SERVERS-COM, US)

koronaararao.guru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.19.14 (France)

ASN16276 (OVH, FR)
PTR: ns3220861.ip-162-19-19.eu

intendrebend.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.117.186.20 (Luxembourg, Luxembourg) 1 redirects

ASN7979 (SERVERS-COM, US)

viewyentreat.guru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.162.87.203 (Amsterdam, Netherlands) 1 redirects

ASN39572 (ADVANCEDHOSTERS-AS, NL)

yyyjqi.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.133.44.33 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

i.wmgtr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

xdiwbc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.33 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ads.shorte.st	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.238 (United Kingdom)

ASN9002 (RETN-AS, GB)

shorteh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.6.19 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.yourwebbars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.64.108.10 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.creative-bars1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	creative-bars1.com cdn.creative-bars1.com — Cisco Umbrella Rank: 27267	63 KB
10	ptauxofi.net ptauxofi.net — Cisco Umbrella Rank: 336460	60 KB
8	jestinquire.com jestinquire.com	15 KB
6	gestyy.com gestyy.com	40 KB
3	wmgtr.com i.wmgtr.com — Cisco Umbrella Rank: 19053	39 KB
3	xngqoc.com xngqoc.com — Cisco Umbrella Rank: 385301	97 B
3	gstatic.com fonts.gstatic.com	79 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	216 KB
3	rewashwudu.com ja.rewashwudu.com	151 KB
3	sh.st static.sh.st	115 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	4 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2029	21 KB
2	swaggydestroy.com gripy.swaggydestroy.com — Cisco Umbrella Rank: 331739	3 KB
2	unseenreport.com unseenreport.com — Cisco Umbrella Rank: 21727	850 B
2	xdiwbc.com xdiwbc.com — Cisco Umbrella Rank: 402017	4 KB
2	artertapirus.com liberia.artertapirus.com — Cisco Umbrella Rank: 108267	2 KB
2	siltagefutiley.top siltagefutiley.top — Cisco Umbrella Rank: 196893	2 KB
2	eveneraw.digital eveneraw.digital	667 B
2	prhzxq.com prhzxq.com — Cisco Umbrella Rank: 510771	600 B
2	amunfezanttor.com amunfezanttor.com — Cisco Umbrella Rank: 67255	350 B
2	divergeimperfect.com divergeimperfect.com	16 KB
2	shorte.st analytics.shorte.st Failed ads.shorte.st	760 B
1	yourwebbars.com cdn.yourwebbars.com — Cisco Umbrella Rank: 50056	1 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 236	397 B
1	shorteh.com shorteh.com	514 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 600	16 KB
1	yyyjqi.xyz 1 redirects yyyjqi.xyz — Cisco Umbrella Rank: 111319	137 B
1	viewyentreat.guru 1 redirects viewyentreat.guru — Cisco Umbrella Rank: 31048	1 KB
1	intendrebend.top intendrebend.top — Cisco Umbrella Rank: 37735	9 KB
1	koronaararao.guru 1 redirects koronaararao.guru — Cisco Umbrella Rank: 59161	1 KB
1	capaciousdrewreligion.com capaciousdrewreligion.com	329 B
1	google.ch www.google.ch — Cisco Umbrella Rank: 29645	455 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	455 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	2 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11663	540 B
1	proftrafficcounter.com proftrafficcounter.com — Cisco Umbrella Rank: 15666	296 B
1	friendshipmale.com friendshipmale.com — Cisco Umbrella Rank: 18684	28 KB
1	ubbfpm.com ubbfpm.com — Cisco Umbrella Rank: 468275	197 KB
1	endangersquarereducing.com endangersquarereducing.com	26 KB
0	scarpeweevily.top Failed scarpeweevily.top Failed
0	cdnid.net Failed cdnid.net Failed
104	41

	Domain	Requested by
14	cdn.creative-bars1.com	divergeimperfect.com gestyy.com
10	ptauxofi.net	gestyy.com ptauxofi.net
8	jestinquire.com	divergeimperfect.com
6	gestyy.com	gestyy.com static.sh.st
3	i.wmgtr.com
3	xngqoc.com	ubbfpm.com
3	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagmanager.com	gestyy.com www.googletagmanager.com www.google-analytics.com
3	ja.rewashwudu.com	gestyy.com ja.rewashwudu.com
3	static.sh.st	gestyy.com
3	fonts.googleapis.com	client ja.rewashwudu.com
2	gripy.swaggydestroy.com	ja.rewashwudu.com
2	unseenreport.com
2	xdiwbc.com	ubbfpm.com
2	liberia.artertapirus.com	ja.rewashwudu.com
2	siltagefutiley.top	ja.rewashwudu.com
2	eveneraw.digital	ja.rewashwudu.com
2	prhzxq.com	ubbfpm.com
2	amunfezanttor.com	gestyy.com
2	divergeimperfect.com	endangersquarereducing.com gestyy.com
2	www.google-analytics.com	gestyy.com www.google-analytics.com
1	cdn.yourwebbars.com	divergeimperfect.com
1	bam.nr-data.net	js-agent.newrelic.com
1	shorteh.com	static.sh.st
1	ads.shorte.st	1 redirects
1	js-agent.newrelic.com	gestyy.com
1	yyyjqi.xyz	1 redirects
1	viewyentreat.guru	1 redirects
1	intendrebend.top
1	koronaararao.guru	1 redirects
1	region1.google-analytics.com	www.googletagmanager.com
1	capaciousdrewreligion.com	endangersquarereducing.com
1	www.google.ch	gestyy.com
1	www.google.com	gestyy.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	my.rtmark.net	gestyy.com
1	proftrafficcounter.com	endangersquarereducing.com
1	friendshipmale.com	endangersquarereducing.com
1	analytics.shorte.st	static.sh.st
1	ubbfpm.com	gestyy.com
1	endangersquarereducing.com	gestyy.com
0	scarpeweevily.top Failed	gestyy.com
0	cdnid.net Failed	gestyy.com
104	43

This site contains links to these domains. Also see Links.

Domain
shorte.st
divergeimperfect.com

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
ptauxofi.net R3	`2023-11-16` - `2024-02-14`	3 months	crt.sh
ubbfpm.com R3	`2024-01-24` - `2024-04-23`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
proftrafficcounter.com Amazon RSA 2048 M03	`2023-11-21` - `2024-12-19`	a year	crt.sh
rtmark.net R3	`2023-12-23` - `2024-03-22`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
amunfezanttor.com R3	`2024-01-31` - `2024-04-30`	3 months	crt.sh
xngqoc.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
prhzxq.com R3	`2024-01-13` - `2024-04-12`	3 months	crt.sh
eveneraw.digital R3	`2024-01-16` - `2024-04-15`	3 months	crt.sh
siltagefutiley.top R3	`2023-12-27` - `2024-03-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google.ch GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
jestinquire.com R3	`2024-01-26` - `2024-04-25`	3 months	crt.sh
xdiwbc.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-15` - `2025-02-15`	a year	crt.sh
shorteh.com R3	`2023-11-24` - `2024-02-22`	3 months	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-23` - `2024-07-22`	a year	crt.sh
i.wmgtr.com R3	`2023-12-22` - `2024-03-21`	3 months	crt.sh
creative-bars1.com GTS CA 1P5	`2023-12-19` - `2024-03-18`	3 months	crt.sh

This page contains 9 frames:

Primary Page: http://gestyy.com/eh6vdw
Frame ID: CC192C4B9C999815B4FCA6367261F4AA
Requests: 70 HTTP requests in this frame

Frame: data://truncated
Frame ID: 96FA6654C5678B8BB047C58C89977879
Requests: 1 HTTP requests in this frame

Frame: https://intendrebend.top/g/fe/14/fe142d03180e3e0d33be4f8198b8e46bd249be94.png
Frame ID: C1A3C0332E10EEC7010AA0BC2ABD8497
Requests: 1 HTTP requests in this frame

Frame: https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png
Frame ID: 924A12CCE2038B5C7225AE5E810970BF
Requests: 1 HTTP requests in this frame

Frame: https://shorteh.com/afu.php?zoneid=1241630
Frame ID: 8DE425929D5C925A43AD3E48C963BE1D
Requests: 1 HTTP requests in this frame

Frame: https://i.wmgtr.com/cic/OJBQYZwCURPd6BF8btuONpjIM-VxdxF2.png
Frame ID: 92EE3F0CA1FAFD0F762D1B92C33BB46E
Requests: 1 HTTP requests in this frame

Frame: https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png
Frame ID: 9AB2FD3D8A0F20EC5AF8092DDBBAA764
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap
Frame ID: E223CAEC28CB973A2F4B75891B997637
Requests: 14 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700,800
Frame ID: FA9A07D95408B98C86A5C7FE46C58952
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(1) New Message!sawssad-ninja-vector-full-export-v2

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

104
Requests

58 %
HTTPS

0 %
IPv6

41
Domains

43
Subdomains

34
IPs

8
Countries

1114 kB
Transfer

2389 kB
Size

30
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://shorte.st/?utm_source=shst&utm_medium=intermediate&utm_campaign=logo

Search URL Search Domain Scan URL

URL: https://shorte.st/
Title: Shorten urls and earn money

Search URL Search Domain Scan URL

URL: http://divergeimperfect.com/ge3tfn17?wrfmqb=12&refer=http%3A%2F%2Fgestyy.com%2Feh6vdw&kw=%5B%22earn%22%2C%22money%22%2C%22on%22%2C%22short%22%2C%22links%22%2C%22make%22%2C%22short%22%2C%22links%22%2C%22and%22%2C%22earn%22%2C%22the%22%2C%22biggest%22%2C%22money%22%2C%22-%22%2C%22shorte%22%2C%22st%22%5D&key=34c6b37755370ea4318f4ff4946df449&scrWidth=1600&scrHeight=1200&tz=1&v=24.1.v.12&ship=&psid=gestyy.com,gestyy.com&sub3=invoke_layer&res=14.29&dev=r&uuid=8ce248ea-e4bb-43da-9224-54a41066abc5%3A3%3A1

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 53

https://koronaararao.guru/tsk/pDHGGoK8gcBDOGiyDw_5q5jMs2C283_16I2BqEWCWwe_ewH09b127blZTPB8pfbIWvsmt3KyBrNVGp2v2zbiPuNYpXG3XzIe5ilzE8lCSdk HTTP 302
https://intendrebend.top/g/fe/14/fe142d03180e3e0d33be4f8198b8e46bd249be94.png

Request Chain 55

https://viewyentreat.guru/tsk/HngjoDBPr_xz7ZUFDuSESiimFjjKRZLc6xddVqpm0EXEtvZWvxryrRRWQzsDb6VpxvEoqQQ1*n4VcPZRZVT7_7bhfyKaKKOnObcpb2IrDSQ4nmEX_8TKFtYcUDq5a8hW HTTP 302
https://yyyjqi.xyz/dsp/ph/icm?aid=16407396100160243140&mid=0&sid=1746&t=1706821523&subid=46223 HTTP 302
https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png

Request Chain 60

http://ads.shorte.st/ads.php?key=2ea5b261f06ca771033a5fa9e22493f1&width=1024&height=768&ch=1&cp.dest_domain=hightimescentre.com&cp.oid=1&cp.referrer=&cp.locked=0&cp.proxy=0&cp.quarantine_status=1&cp.vno=1&cp.enc_url=mgNOP3lZly/TiY1sSom7ZjDkRQlV+XIn7E7RAinq9QNFT/aPBB3w96a+QHp9OQxcmgnOzEhlEaiXcEmOp1wqwA==&cp.asid=bd49df19d0b8154e5c4889332542679baa353e6f&title=&description=&keywords=&captcha_verified=0 HTTP 302
https://shorteh.com/afu.php?zoneid=1241630

Request Chain 75

http://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap HTTP 307
https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap

104 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request eh6vdw Show response
gestyy.com/ 92 KB
36 KB 1940ms
1622ms Document
text/html 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://gestyy.com/eh6vdw

Protocol

HTTP/1.1

Server

172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/5.6.40-0+deb8u16

Resource Hash

355ebedca9bc730fd25abc43fd3a7bd49dd0ed64aa1adf247e2aaa578cb5364c

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
CF-RAY: 84ed26bdad4d0c53-MRS
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:14 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2BP0jrj5Ow6LgU9O8WgrnjKCHSy01cUErCsJJzBKAsuoJRB43%2FwJ%2B6ELZHJblH1QDEzOeVInqSxKGKIp4YjICYVIZfTSTckXZJbUluEDHz%2BZeEBFchnkp1c3S3Y%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: DENY
X-Powered-By: PHP/5.6.40-0+deb8u16
X-Server-ID: shn01
X-UA-Compatible: IE=Edge

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

52 KB
21 KB

844ms
74ms

Script
text/javascript

172.217.16.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Server

172.217.16.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f142.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 01 Feb 2024 19:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 4627
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 01 Feb 2024 21:48:09 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 css
fonts.googleapis.com/ 3 KB
983 B 902ms
131ms Stylesheet
text/css 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:400,700

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

ESF /

Resource Hash

c3c736b80c318c7323b9f2b6a3b2ddd6e78e5aeeed7e9d648c6b1d7e97691024

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Feb 2024 21:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Feb 2024 21:05:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Feb 2024 21:05:16 GMT

GET
H/1.1 200
OK tracking.gif
gestyy.com/bundles/advertisement/img/ 0
747 B 135ms
135ms Image
image/gif 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gestyy.com/bundles/advertisement/img/tracking.gif?test=bd49df19d0b8154e5c4889332542679baa353e6f
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/eh6vdw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:15 GMT
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Content-Length: 0
X-UA-Compatible: IE=Edge
Last-Modified: Wed, 29 Jun 2022 08:56:54 GMT
Server: cloudflare
ETag: "62bc13d6-0"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LaZ2N05%2BKcOn%2FxoYIOOuaKu7dvu0w29%2Fkhr5E7BCREoU%2FfMya24MvNCpfdS%2B7lpux%2B60d5%2FOjAqZ%2FMl9C2ntkyNU6oM%2FSL6j6a2xv9siv%2FM2WdpssZG8B1tgyeg%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/gif
Access-Control-Allow-Origin: *
X-Server-ID: shn08
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 84ed26c70b610c53-MRS

GET
H/1.1 200
OK advertisement-tracking-1.gif
gestyy.com/bundles/smeweb/img/ 43 B
763 B 201ms
200ms Image
image/gif 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gestyy.com/bundles/smeweb/img/advertisement-tracking-1.gif?t=1706821513
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/eh6vdw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:15 GMT
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Content-Length: 43
X-UA-Compatible: IE=Edge
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWm7%2FbJG0VGFxOr%2BtC%2FlDIfrpy%2FyuYFQNh8Exs4hpy1EMNUHxd7JBJd9gT8wBa%2BlrJsD2Cd845sPF19p1iiLG8WUuDmZnb9kQYT2uiMkG6yg5%2Bq3Xy4rde4Ijq8%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/gif
Access-Control-Allow-Origin: *
X-Server-ID: shn05
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 84ed26c70d1c18ab-MRS

GET
H/1.1 200
OK tracking-1.gif
gestyy.com/bundles/smeweb/img/ 43 B
761 B 138ms
138ms Image
image/gif 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gestyy.com/bundles/smeweb/img/tracking-1.gif?t=1706821513
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/eh6vdw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:15 GMT
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Content-Length: 43
X-UA-Compatible: IE=Edge
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lAHahLCO3AfrUtDaz0ZmD40jlTAjeHRGoM%2Bd%2FkKgV0VFjlqI6Xiz3dCl55%2Fz3u58tRAo6GQ31N84jGtSYYuXsOrq1ZnGCd%2B%2Ba0xTajiCjZgwuPtqnRiNDcu3sjQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/gif
Access-Control-Allow-Origin: *
X-Server-ID: shn05
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 84ed26c7ec9b0c53-MRS

GET
H/1.1 200
OK logo1707.png
static.sh.st/b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/ 6 KB
7 KB 771ms
206ms Image
image/png 104.26.6.218
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.sh.st/b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2022-06-29.0
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 104.26.6.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd7607ab554a8c5af9aed32593ae99aaf0682198dbbd277372e8b663bd98b001

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:16 GMT
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 50120
Connection: keep-alive
Content-Length: 6226
X-UA-Compatible: IE=Edge
Last-Modified: Fri, 17 Jul 2015 13:29:04 GMT
Server: cloudflare
ETag: "55a90320-1852"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R3xl%2BE5s8pnxe%2B3si4xA0cWvAckDe9psjDj1%2FvAZuDJtZb2kf5DeHOpJCiX6nJcvkwYnl8N84e4oMeR%2FCyziE6FzSoD2m%2ByLs%2BlWosqD4ZDGc4Bes%2BjbzEye9YDRng%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
X-Server-ID: shn05
Cache-Control: max-age=86400
Accept-Ranges: bytes
CF-RAY: 84ed26cc090f0db4-MRS
Expires: Fri, 02 Feb 2024 07:09:56 GMT

GET
H/1.1 200
OK interstitial-page.js Show response
static.sh.st/js/packed/ 79 KB
25 KB 746ms
246ms Script
application/javascript 104.26.6.218
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 104.26.6.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88bb3be0111402f5ca81aaa36cbf7c4a2755099c5d0446831331e1d1d8e7a1ef

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:16 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 35930
Cf-Polished: origSize=102880
Transfer-Encoding: chunked
Connection: keep-alive
X-UA-Compatible: IE=Edge
Cf-Bgj: minify
Last-Modified: Wed, 29 Jun 2022 08:57:49 GMT
Server: cloudflare
ETag: W/"62bc140d-191e0"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oIDrq%2FV%2FQxyICGBXcmESn12PjBjA3QxP7%2Blg6ujtIf1gQDWc3k6FS%2BoSW41Q6nNBYvdX%2FYW5K4zSRt6jZz9UvYuMC%2FYdUC5NXTcJm0jB8tN7F%2FofkG0Vz5BdVZESjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
X-Server-ID: shn03
Cache-Control: max-age=86400
CF-RAY: 84ed26cc2f7141eb-MRS
Expires: Fri, 02 Feb 2024 11:06:26 GMT

GET
H/1.1 200
OK 34c6b37755370ea4318f4ff4946df449.js Show response
endangersquarereducing.com/34/c6/b3/ 67 KB
26 KB 698ms
678ms Script
application/javascript 192.243.61.227
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

HTTP/1.1

Server

192.243.61.227 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

6bf4cc8a7de60cff486afc2a187456f30a2b67195062f5cbb4d8d67ed45de857

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:16 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: c2e9db8804dce1f366b04abaa819a540
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 tag.min.js Show response
ptauxofi.net/pfe/current/ 14 KB
6 KB 829ms
167ms Script
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/pfe/current/tag.min.js?z=4157053
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: f8cdb6c9c3134ebb5141b8ccc649c79bdf3ad6cfcfe4672912f5e3503b9e0156

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:16 GMT
content-encoding: gzip
last-modified: Thu, 01 Feb 2024 15:33:35 GMT
server: nginx
etag: W/"65bbb9cf-384a"
content-type: application/javascript
cache-control: no-cache
access-control-allow-credentials: true

GET
H/1.1 200
OK inpage.js Show response
ubbfpm.com/ms/1102360/ 196 KB
197 KB 1272ms
270ms Script
application/javascript 95.216.206.230
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ubbfpm.com/ms/1102360/inpage.js

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

95.216.206.230 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.230.206.216.95.clients.your-server.de

Software

nginx /

Resource Hash

37800f9f2bb9d6543c17667dca9695da535d5b01fcf095db9d20d9782f1d22d0

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:17 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin
Last-Modified: Fri, 21 Apr 2023 15:45:14 GMT
Server: nginx
X-Permitted-Cross-Domain-Policies: none
ETag: "6442af8a-31022"
X-Download-Options: noopen
X-Frame-Options: sameorigin
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 200738
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 46223 Show response
ja.rewashwudu.com/fmwhVStpL4dxap/ 484 KB
149 KB 693ms
635ms Script
application/javascript 23.109.170.60
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

HTTP/1.1

Server

23.109.170.60 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

975a1175bf7ad4db4c493ba3945217dd4fcd10845c83f1aae485999f5444baf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: http://gestyy.com
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Credentials: true
Vary: Accept-Encoding
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 160 KB
59 KB 983ms
148ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SFMWPJ

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1a98a26399a133e045bed1aeb54f50e537d213a9b04424d4bb7c228b6e276e61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 59569
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 01 Feb 2024 21:05:17 GMT

GET
H/1.1 200
OK widget-sprite.png
static.sh.st/bundles/smeweb/img/ 83 KB
83 KB 366ms
260ms Image
image/png 104.26.6.218
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.sh.st/bundles/smeweb/img/widget-sprite.png?2022-06-29.0
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 104.26.6.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8146dfca511f063c33c05e13e151ed3d3456441590a4b1358bbc99b320a02b8d

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:16 GMT
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 48214
Connection: keep-alive
Content-Length: 84545
X-UA-Compatible: IE=Edge
Last-Modified: Wed, 29 Jun 2022 08:56:53 GMT
Server: cloudflare
ETag: "62bc13d5-14a41"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EUscOW5kgvHpZxsZ4jNKJn9DCkj1KkX1ZR468NlbFkJkGDLZLy3ih4kcptO8lpkAo8fDEFJR9AxwdVjkaDCY4AhIVyLKGQoKatBzZYBO%2F6tfHum%2FchLSdI7F7Oq3%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
X-Server-ID: shn07
Cache-Control: max-age=86400
Accept-Ranges: bytes
CF-RAY: 84ed26cd4b120db4-MRS
Expires: Fri, 02 Feb 2024 07:41:42 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v29/ 47 KB
48 KB 1083ms
85ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://gestyy.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 22:26:00 GMT
x-content-type-options: nosniff
age: 167957
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48208
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 22:26:00 GMT

POST displayed
analytics.shorte.st/ 0
0

OPTIONS
H/1.1 403
Forbidden displayed
analytics.shorte.st/ Frame 0
0 672ms
344ms Preflight
text/html 104.26.5.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://analytics.shorte.st/displayed

Protocol

HTTP/1.1

Server

104.26.5.107 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Access-Control-Request-Headers: x-requested-with
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

CF-RAY: 84ed26d16b465f9b-MRS
Cache-Control: max-age=15
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:17 GMT
Expires: Thu, 01 Feb 2024 21:05:32 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Referrer-Policy: same-origin
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JxcCNjXIUxWAvH0WvWURPgx4XLpxnMSv4gGXSA%2BqzV5G89iENvaDL0e0yVjm8P2yyKt7klO4LHADgBJ9L3CFsTjMbH7gviTH15Bm6TYpVIkNxJoW4EBGnBotM1Ti6vezZOO2ALs%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK sfp.js Show response
friendshipmale.com/ 83 KB
28 KB 4883ms
4562ms Script
application/javascript 172.64.196.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://friendshipmale.com/sfp.js

Requested by

Host: endangersquarereducing.com
URL: http://endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js

Protocol

HTTP/1.1

Server

172.64.196.8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:17 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
X-Request-ID: ca72d7798c7e3a7c5f3a4ad184afc511
Last-Modified: Thu, 01 Feb 2024 21:05:17 GMT
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Nr0jtMMaRrks0P9XINi89%2Fau4Qet5ni44boecwsbVLabQRtvuImCZRRmgCYViLnqSlNbs6PY0KcZ6L6RPlbULYtPK73AASs2%2F7n8pFZGAx2XzqDtDx4qULmgV7gGi497d15odY%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
CF-RAY: 84ed26d51d5f3cda-CDG
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK 0826667673c6afa9f85340ed4fc8ef57.js Show response
divergeimperfect.com/08/26/66/ 42 KB
16 KB 379ms
365ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js

Requested by

Host: endangersquarereducing.com
URL: http://endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js

Protocol

HTTP/1.1

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

d1d989de4d11ec845ebcb9edecd3841ba0f5d546ce88d223d97c2d490e76426e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:17 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: 3dedb6c5cc4a957e966bdaa295ad2e9e
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 stats Show response
proftrafficcounter.com/ 40 B
296 B 411ms
216ms XHR
text/html 3.64.223.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://proftrafficcounter.com/stats
Requested by: Host: endangersquarereducing.com
URL: http://endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.64.223.139 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-64-223-139.eu-central-1.compute.amazonaws.com
Software: fasthttp /
Resource Hash: 213a97b33eded6d9201319e09d858b07367120ff7d0154efe91414493a291e29

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: http://gestyy.com
date: Thu, 01 Feb 2024 21:05:17 GMT
access-control-allow-credentials: true
server: fasthttp
content-length: 40
vary: Origin
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK purst
divergeimperfect.com/pixel/ 0
469 B 379ms
366ms Image
text/plain 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://divergeimperfect.com/pixel/purst?dl=0&th=0&sc=0&rs=3748.2999954223633&rd=3748.2999954223633&fd=1711.599998474121&bv=24.1.v.12&tmpl=70
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:17 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 universal.min.js Show response
ptauxofi.net/pfe/current/ 86 KB
33 KB 386ms
218ms Fetch
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/pfe/current/universal.min.js?v=3.1.481
Requested by: Host: ptauxofi.net
URL: https://ptauxofi.net/pfe/current/tag.min.js?z=4157053
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 60dc15960085ad22a80319abc704c34dc18de284538f90f68a08e839db53fc59

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:17 GMT
content-encoding: gzip
last-modified: Thu, 01 Feb 2024 15:33:35 GMT
server: nginx
etag: W/"65bbb9cf-157b7"
content-type: application/javascript
access-control-allow-origin: http://gestyy.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 zone Show response
ptauxofi.net/ 909 B
1 KB 170ms
169ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ptauxofi.net/zone?pub=0&zone_id=4157053&is_mobile=false&domain=gestyy.com&var=&ymid=&var_3=&tg=0&sw=3.1.481

Requested by

Host: ptauxofi.net
URL: https://ptauxofi.net/pfe/current/tag.min.js?z=4157053

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ee6861e9f4ceed823b402ba9e36ecd77663367d08f7e27895f6c89348c631a37

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-trace-id: cf9aa9b9339f56676adc9b487cf9c377
date: Thu, 01 Feb 2024 21:05:17 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 909

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 297ms
297ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-997869120&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFMWPJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

2727119946bcb058e297c8e666051ecce7542220d0ac8776e3054beb8208d338

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 73686
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 01 Feb 2024 21:05:17 GMT

OPTIONS
H2 200 custom
ptauxofi.net/ Frame 0
0 4327ms
4326ms Preflight
text/plain 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/custom
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: http://gestyy.com
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 01 Feb 2024 21:05:17 GMT
server: nginx

POST
H2 200 custom Show response
ptauxofi.net/ 39 B
327 B 641ms
638ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ptauxofi.net/custom

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: 0664d1503cd2dee41e98f20af71cb857
date: Thu, 01 Feb 2024 21:05:21 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 39

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
540 B 5056ms
88ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=1d6b1660289241fa8a135da7ab0f8e9e&zoneId=4157053&checkDuplicate=true&ymid=&var=

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

bf3bea94a4fbdba90f1df26db48e313ac9f3bbb22a3c29753ea54c86d6121a88

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:22 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/997869120/ 3 KB
2 KB 4916ms
86ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/997869120/?random=1706821517733&cv=11&fst=1706821517733&bg=ffffff&guid=ON&async=1&gtm=45be41v0za200&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=http%3A%2F%2Fgestyy.com%2Feh6vdw&hn=www.googleadservices.com&frm=0&tiba=Earn%20money%20on%20short%20links.%20Make%20short%20links%20and%20earn%20the%20biggest%20money%20-%20shorte.st&npa=0&pscdl=noapi&auid=1010588960.1706821518&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-997869120&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e9251cfb292d5b26149189f31a2d3241620df5621422b596bbb3952942ef7a66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 event Show response
amunfezanttor.com/ 94 B
350 B 168ms
74ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://amunfezanttor.com/event

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

d84230ddbff3abacba74706b861597f886c7dce9b3e340b43e2fd9169dab860d

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Feb 2024 21:05:22 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 94

GET
H2 200 defaultSkin.min.js Show response
ptauxofi.net/pfe/current/ 56 KB
19 KB 2953ms
2953ms Fetch
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/pfe/current/defaultSkin.min.js
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7b23e3a7155161323573e58616ff1bfdaffd0560483db31315d181f6b394ddd5

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:21 GMT
content-encoding: gzip
last-modified: Thu, 01 Feb 2024 15:33:35 GMT
server: nginx
etag: W/"65bbb9cf-df63"
content-type: application/javascript
access-control-allow-origin: http://gestyy.com
cache-control: no-cache
access-control-allow-credentials: true

OPTIONS
H2 200 event
amunfezanttor.com/ Frame 0
0 3070ms
82ms Preflight
text/plain 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amunfezanttor.com/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: http://gestyy.com
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 01 Feb 2024 21:05:22 GMT
server: nginx

GET
H2 200 er
xngqoc.com/ 0
0 3093ms
78ms Fetch 185.162.85.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://xngqoc.com/er?a=1
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.162.85.3 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 01 Feb 2024 21:05:25 GMT
access-control-allow-credentials: true
server: nginx/1.18.0
content-length: 0

GET
H2 204 cuload Show response
xngqoc.com/ 0
97 B 3090ms
79ms Fetch 185.162.85.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://xngqoc.com/cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0MzMzNDAsImQiOiIiLCJsaSI6MX0=&tz=1&if=0&u=aHR0cDovL2dlc3R5eS5jb20vZWg2dmR3
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.162.85.3 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 01 Feb 2024 21:05:25 GMT
accept-ch: Sec-CH-UA-Platform-Version
server: nginx/1.18.0

GET
BLOB 200
OK e4577bf4-8b12-4334-a38b-54625bbae575
http://gestyy.com/ 91 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://gestyy.com/e4577bf4-8b12-4334-a38b-54625bbae575
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d054b502d829accd15ff9cb78d1431df1c3ec2c67ca18d4008d2cbc973c6384

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/eh6vdw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 91
Content-Type: application/javascript

GET
H2 200 wnload Show response
prhzxq.com/ 664 B
600 B 2127ms
1035ms Fetch
application/javascript 185.162.85.14
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prhzxq.com/wnload?a=1&e=aeyJwaWQiOjExMDIzNjAsInNpZCI6MTE5NDYyMywid2lkIjo0Mzk2MzQsImQiOiIiLCJsaSI6Mn0=&tz=1&if=0&u=aHR0cDovL2dlc3R5eS5jb20vZWg2dmR3&inc=1
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.162.85.14 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 2e1ad64f1102717d65c190442c6b23e0c20a92bab56a569368e2e6db14341066

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:24 GMT
content-encoding: gzip
server: nginx/1.18.0
accept-ch: Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true

GET
BLOB 200
OK 8aef3c8b-0cad-441a-833b-3e9dfcdb650a
http://gestyy.com/ 91 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://gestyy.com/8aef3c8b-0cad-441a-833b-3e9dfcdb650a
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d054b502d829accd15ff9cb78d1431df1c3ec2c67ca18d4008d2cbc973c6384

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/eh6vdw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 91
Content-Type: application/javascript

OPTIONS
H/1.1 200
OK /
eveneraw.digital/cuid/ Frame 0
0 633ms
301ms Preflight 212.117.187.148
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://eveneraw.digital/cuid/?f=http%3A%2F%2Fgestyy.com

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

212.117.187.148 Luxembourg, Luxembourg, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Length: 0
Date: Thu, 01 Feb 2024 21:05:23 GMT
Keep-Alive: timeout=20
Server: nginx
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

OPTIONS
H/1.1 200
OK Bal53tThAasMx2p1rm8EzFeo1agiLXzubxQ67NdCjNXvjd_hOIU7p4Gk*s4LUdH7DGGIS8hMY2mr1oDmTQrlkAn06o17p28
siltagefutiley.top/ Frame 0
0 512ms
191ms Preflight
text/html 212.117.186.12
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://siltagefutiley.top/Bal53tThAasMx2p1rm8EzFeo1agiLXzubxQ67NdCjNXvjd_hOIU7p4Gk*s4LUdH7DGGIS8hMY2mr1oDmTQrlkAn06o17p28?ck9=weiEmI6EzN4IDLiMnI6ISM2ADM4FjMwAjIsIiYiojIxYDMwgXMyADMiwiIyJiOiICLiEnI6ICa0RHc68yLnV2c0lXeuM2bt9SZoZjdkdnIsICaioDO1IjNsICbiojIl5WLVNlIsICdioTL2ADLionI6ETNzkDLismI6ADLiUnI6IiIsIiZiojZhx2clxiI3hmI6IibvRHIp5GIpZmch1WZiwiIphmI6IibvRHIp5GIpZmch1WZiwiIlJiOi8mbiNzZtZGdqlmd5hTdhJCLi8mI6Qnc1VGLi0mI6EzNwYDOyETNyIDO2EDLicnI6ISJ3IUJyIDdpRHblViMyUyMBViMyUUYy5WJyATbv5WZ5ViMw8mblIDMzh2byRXJyADbp52az5SJyATThtWZlIDMzh2byRXJyADbp52azViMwEmbkViMwUWYlIjMlIzQlIjMrVWe39mckNXJyITJzEUJ1IUJ1QUJyMUJyIDdvB3dvJHZzViMyUyMBVSNCVSNEVyNEJCLiQ3cioDMsICcyJiOxwiIoNmI6QDLiIGbioTLxwiIiNmI6MDLiYndiojIJ5GdlxGIJ52YuICLiYnciojIJ5GdlxGIJJXazByTwVmbHxEIF52Zp5WZiwiIhNmI6ADLiMGdiojI152au92duJCLiMWZ0JiOiQzZiwiIjRGbtJiOtEDLiMGZsJiOxADLiMmc0RnI6ADLiQXbzJiOxwiIjVmI6Qnc1VGLiMGZiojM0wiIvJnI6ICbh5GZzNWYwVWLwJXatFmc5JSf

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

212.117.186.12 Luxembourg, Luxembourg, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:23 GMT
Keep-Alive: timeout=20
Server: nginx
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

POST
H/1.1 200
OK / Show response
eveneraw.digital/cuid/ 32 B
667 B 1531ms
41ms Fetch
application/json 212.117.187.148
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://eveneraw.digital/cuid/?f=http%3A%2F%2Fgestyy.com

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

212.117.187.148 Luxembourg, Luxembourg, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

4fe6866b4cbf1552cfe473623ab056359d62898e1d608b51f396d98e919f7bcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Server: nginx
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=20
Content-Length: 32
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for

POST
H/1.1 200
OK Bal53tThAasMx2p1rm8EzFeo1agiLXzubxQ67NdCjNXvjd_hOIU7p4Gk*s4LUdH7DGGIS8hMY2mr1oDmTQrlkAn06o17p28 Show response
siltagefutiley.top/ 935 B
2 KB 1661ms
52ms Fetch
application/json 212.117.186.12
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

212.117.186.12 Luxembourg, Luxembourg, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

d3f4cf8db2d8500f2c1e5c04888f2bb37cffb072567bcfe235a6debaafb4a24e

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: http://gestyy.com
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
217 B 43ms
42ms XHR
text/plain 172.217.16.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1716731922&t=pageview&_s=1&dl=http%3A%2F%2Fgestyy.com%2Feh6vdw&ul=en-us&de=UTF-8&dt=Earn%20money%20on%20short%20links.%20Make%20short%20links%20and%20earn%20the%20biggest%20money%20-%20shorte.st&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAAABAAAAAC~&jid=1630987070&gjid=1658203424&cid=1162476210.1706821516&uid=1&tid=UA-42296749-1&_gid=713762775.1706821516&_r=1&_slc=1&cd2=2022-06-29.0&cd7=1&cd5=0&z=2020853768

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f142.1e100.net

Software

Golfe2 /

Resource Hash

6acd8bce6481db9a9462ccbd6702dba686bb978e07d836648512a4c5563a1b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://gestyy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 96FA 255 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

OPTIONS
H2 200 custom
ptauxofi.net/ Frame 0
0 40ms
40ms Preflight
text/plain 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/custom
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: http://gestyy.com
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 01 Feb 2024 21:05:22 GMT
server: nginx

POST
H2 200 custom Show response
ptauxofi.net/ 39 B
327 B 37ms
37ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ptauxofi.net/custom

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: 55d769a26659cca952639d63e1090333
date: Thu, 01 Feb 2024 21:05:22 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 39

GET
H2 200 /
www.google.com/pagead/1p-user-list/997869120/ 42 B
455 B 2064ms
182ms Image
image/gif 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/997869120/?random=1706821517733&cv=11&fst=1706821200000&bg=ffffff&guid=ON&async=1&gtm=45be41v0za200&u_w=1600&u_h=1200&url=http%3A%2F%2Fgestyy.com%2Feh6vdw&frm=0&tiba=Earn%20money%20on%20short%20links.%20Make%20short%20links%20and%20earn%20the%20biggest%20money%20-%20shorte.st&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_ARa5UUDSyJnHCc7YX4_QcRDzuIeeFw&random=3794751193&rmt_tld=0&ipr=y

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:24 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ch/pagead/1p-user-list/997869120/ 42 B
455 B 2063ms
182ms Image
image/gif 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ch/pagead/1p-user-list/997869120/?random=1706821517733&cv=11&fst=1706821200000&bg=ffffff&guid=ON&async=1&gtm=45be41v0za200&u_w=1600&u_h=1200&url=http%3A%2F%2Fgestyy.com%2Feh6vdw&frm=0&tiba=Earn%20money%20on%20short%20links.%20Make%20short%20links%20and%20earn%20the%20biggest%20money%20-%20shorte.st&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_ARa5UUDSyJnHCc7YX4_QcRDzuIeeFw&random=3794751193&rmt_tld=1&ipr=y

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:24 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 249 KB
85 KB 52ms
51ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7C6F2JT500&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1ef00b8b6337796c446ae1fab2ea26ba26c4f876ed8f9f68851fcffdb615d180

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87262
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 01 Feb 2024 21:05:22 GMT

POST
H/1.1 200
OK 46223 Show response
ja.rewashwudu.com/opf/ 1 KB
2 KB 1639ms
1636ms Fetch
application/javascript 23.109.170.60
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

http://ja.rewashwudu.com/opf/46223?md=snI0hmI6ICdoVWbl9VMfdjIsIyYvJiOiQWYytmIsISYioTOykTMsIyciojIxYDMwgXMyADMiwiIiJiOiEjNwADexIDMwICLiInI6IiIsISciojIoRHdwpzLvcWZzRXe55yYv12LlhmN2R2diwiIoJiOyUDMwwiIsJiOiUmbtU1UiwiI0JiOtYDMsIieioDN1gDNsIyaioDMsISdiojIiwiImJiOmFGbzVGLicHaiojIu9GdgkmbgkmZyFWblJCLikGaiojIu9GdgkmbgkmZyFWblJCLiUmI6Iid5gGdtNTemtmeldmMiRjIsIybioDdyVXZsISbioTM3AjN4ITM1IjM5QjMsIydiojIlcjQlIjM0lGdsVWJyITJzEUJyITRhJnblIDMt9mbllXJyAzbuViMwMHavJHdlIDMslmbrNnLlIDMNF2alViMwMHavJHdlIDMslmbrNXJyATYuRWJyATZhViMyUiMDViMysWZ5d3byR2clIjMlMTQlUjQlIjMzh2byRXZuMHdlIjMlIzQlIjMzh2byRXZzRXJyITJyMUJyIzco9mc0ViMwwWaut2clIjMlIzQlIjMslmbrViMwMHavJHdl5WZyViMyUiMDViMyIWa0xWelIjMlUDRlIzQlIjM09Gc39mckNXJyITJzEUJ1IUJyITaj9mblMTQ3UiMyUiMDViMyIXZmJXZzhWJzE0NlIjMlIzQlIjM0hWazVyMBZTJyITJyMUJyIzYsl2YrVyMBZTJyITJyMUJyIjYy92dzVmclMTQ2UiMyUSNEVyNEJCLiQ3cioDMsICcyJiOxwiIoNmI6QDLiIGbioTLxwiIiNmI6MDLiYndiojIJ5GdlxGIJ52YuICLiYnciojIJ5GdlxGIJJXazByTwVmbHxEIF52Zp5WZiwiIhNmI6ADLiMGdiojI152au92duJCLiMWZ0JiOiQzZiwiIjRGbtJiOtEDLiMGZsJiOxADLiMmc0RnI6ADLiQXbzJiOxwiIjVmI6Qnc1VGLiMGZiojM0wiIvJnI6ICbh5GZzNWYwVWLwJXatFmc5JSf

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

HTTP/1.1

Server

23.109.170.60 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

ac798e90b0015b3506a40c6b0e018143a6d64fe23d7e4d93af5dbc40e5983550

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 01 Feb 2024 21:05:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: http://gestyy.com
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

OPTIONS
H/1.1 200
OK 46223
ja.rewashwudu.com/opf/ Frame 0
0 195ms
188ms Preflight
text/html 23.109.170.60
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

HTTP/1.1

Server

23.109.170.60 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:23 GMT
Keep-Alive: timeout=20
Server: nginx
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

POST
H/1.1 200
OK UxyQLfQxHAHpVjR78_Kj2Mrdx2yrS3K36yoaDwO_8CYlSQGR8GENAeOUdJJY7_Z5V6YmOwNk6*tOT9YmZI*0_JE58wZgSQqMsjDUVo6uwr01t62u73v8 Show response
liberia.artertapirus.com/ 675 B
2 KB 677ms
670ms Fetch
application/javascript 23.109.87.223
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

http://liberia.artertapirus.com/UxyQLfQxHAHpVjR78_Kj2Mrdx2yrS3K36yoaDwO_8CYlSQGR8GENAeOUdJJY7_Z5V6YmOwNk6*tOT9YmZI*0_JE58wZgSQqMsjDUVo6uwr01t62u73v8?ck9=snI0Z3YioDMsISYiozN5AzNsIyciojIxYDMwgXMyADMiwiIiJiOiEjNwADexIDMwICLiInI6IiIsISciojIoRHdwpzLvcWZzRXe55yYv12LlhmN2R2diwiIoJiO0YDOywiIsJiOiUmbtU1UiwiI0JiOtYDMsIieiojN2czMsIyaioDMsISdiojIiwiImJiOmFGbzVGLicHaiojIu9GdgkmbgkmZyFWblJCLikGaiojIu9GdgkmbgkmZyFWblJCLiUmI6IyZ1ona2c3M4E2coJnYy8mIsIybioDdyVXZsISbioTM3AjN4ITM1IjM5QTNsIydiojIlcjQlIjM0lGdsVWJyITJzEUJyITRhJnblIDMt9mbllXJyAzbuViMwMHavJHdlIDMslmbrNnLlIDMNF2alViMwMHavJHdlIDMslmbrNXJyATYuRWJyATZhViMyUiMDViMysWZ5d3byR2clIjMlMTQlUjQlIjMzh2byRXZuMHdlIjMlIzQlIjMzh2byRXZzRXJyITJyMUJyIzco9mc0ViMwwWaut2clIjMlIzQlIjMslmbrViMwMHavJHdl5WZyViMyUiMDViMyIWa0xWelIjMlUDRlIzQlIjM09Gc39mckNXJyITJzEUJ1IUJyITaj9mblMTQ3UiMyUiMDViMyIXZmJXZzhWJzE0NlIjMlIzQlIjM0hWazVyMBZTJyITJyMUJyIzYsl2YrVyMBZTJyITJyMUJyIjYy92dzVmclMTQ2UiMyUSNEVyNEJCLiQ3cioDMsICcyJiOxwiIoNmI6QDLiIGbioTLxwiIiNmI6MDLiYndiojIJ5GdlxGIJ52YuICLiYnciojIJ5GdlxGIJJXazByTwVmbHxEIF52Zp5WZiwiIhNmI6ADLiMGdiojI152au92duJCLiMWZ0JiOiQzZiwiIjRGbtJiOtEDLiMGZsJiOxADLiMmc0RnI6ADLiQXbzJiOxwiIjVmI6Qnc1VGLiMGZiojM0wiIvJnI6ICbh5GZzNWYwVWLwJXatFmc5JSf

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

HTTP/1.1

Server

23.109.87.223 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

4517962831388a4b3dabe5df76fccd7372f46996ecc584e9db07a8326b1408d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 01 Feb 2024 21:05:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: http://gestyy.com
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

OPTIONS
H/1.1 200
OK UxyQLfQxHAHpVjR78_Kj2Mrdx2yrS3K36yoaDwO_8CYlSQGR8GENAeOUdJJY7_Z5V6YmOwNk6*tOT9YmZI*0_JE58wZgSQqMsjDUVo6uwr01t62u73v8
liberia.artertapirus.com/ Frame 0
0 219ms
84ms Preflight
text/html 23.109.87.223
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

HTTP/1.1

Server

23.109.87.223 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:23 GMT
Keep-Alive: timeout=20
Server: nginx
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK advertisers.js Show response
capaciousdrewreligion.com/ 0
329 B 1852ms
1684ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://capaciousdrewreligion.com/advertisers.js

Requested by

Host: endangersquarereducing.com
URL: http://endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js

Protocol

HTTP/1.1

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:24 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
X-Request-ID: 779063048cac36f7024b04f08d1baa53
Expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
250 B 1856ms
69ms Ping
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-7C6F2JT500&gtm=45je41v0v9136374260za200&_p=1706821516218&gcd=11l1l1l1l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=1162476210.1706821516&pscdl=noapi&_eu=ABAI&_s=1&dl=http%3A%2F%2Fgestyy.com%2Feh6vdw&dt=Earn%20money%20on%20short%20links.%20Make%20short%20links%20and%20earn%20the%20biggest%20money%20-%20shorte.st&uid=1&sid=1706821523&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_2=2022-06-29.0&ep.ua_dimension_7=1&ep.ua_dimension_5=0&tfd=9874
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7C6F2JT500&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Feb 2024 21:05:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://gestyy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK sbar.json Show response
jestinquire.com/ 15 KB
12 KB 2033ms
444ms XHR
text/plain 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://jestinquire.com/sbar.json?key=0826667673c6afa9f85340ed4fc8ef57&uuid=8ce248ea-e4bb-43da-9224-54a41066abc5%3A3%3A1

Requested by

Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

9f941704da7e95bf77706c98fb4e671fcc01ab7c7ce9e85f0adf2f0d057deee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Custom-Referer: http://gestyy.com
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: http://gestyy.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: 6e2f344f93c05a98a3ab7abadee07e33
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1

200
OK

fe142d03180e3e0d33be4f8198b8e46bd249be94.png
intendrebend.top/g/fe/14/ Frame C1A3
Redirect Chain

https://koronaararao.guru/tsk/pDHGGoK8gcBDOGiyDw_5q5jMs2C283_16I2BqEWCWwe_ewH09b127blZTPB8pfbIWvsmt3KyBrNVGp2v2zbiPuNYpXG3XzIe5ilzE8lCSdk
https://intendrebend.top/g/fe/14/fe142d03180e3e0d33be4f8198b8e46bd249be94.png

9 KB
9 KB

312ms
52ms

Image
image/png

162.19.19.14
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://intendrebend.top/g/fe/14/fe142d03180e3e0d33be4f8198b8e46bd249be94.png
Protocol: HTTP/1.1
Server: 162.19.19.14 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3220861.ip-162-19-19.eu
Software: nginx /
Resource Hash: 53f0d240c7e313de251a919a3e126f9d466b13f5518191d532b360244a1040d9

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Last-Modified: Thu, 17 Sep 2020 10:57:12 GMT
Server: nginx
ETag: "5f634108-2224"
Content-Type: image/png
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 8740
Expires: Sun, 11 Feb 2024 21:05:25 GMT

Redirect headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Referrer-Policy: no-referrer
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Location: https://intendrebend.top/g/fe/14/fe142d03180e3e0d33be4f8198b8e46bd249be94.png
Vary: Accept-Encoding
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

POST
H/1.1 200
OK update-ads-events Show response
gestyy.com/shortener/ 16 B
1 KB 1066ms
1066ms XHR
application/json 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://gestyy.com/shortener/update-ads-events
Requested by: Host: static.sh.st
URL: http://static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
Protocol: HTTP/1.1
Server: 172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.6.40-0+deb8u16
Resource Hash: c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Request headers

Accept: text/javascript, text/html, application/xml, text/xml, */*
Referer: http://gestyy.com/eh6vdw
X-Requested-With: XMLHttpRequest
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 01 Feb 2024 21:05:23 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
X-Powered-By: PHP/5.6.40-0+deb8u16
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kr9l1zjK%2BbRXKFQePtWyKG6dNQPPIhMXvH5AFw9r7vOWpD3%2BbUFmydjybegwXTCtXD0hjgWnOdKHbTWcCOihVBeE3ED0fxhO8%2FDk0NWk0d3wBTwhVs5zWi3LzsU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/json
Access-Control-Allow-Origin: *
X-Server-ID: shn03
Cache-Control: no-cache
Connection: keep-alive
CF-RAY: 84ed26fc3b040c53-MRS
X-UA-Compatible: IE=Edge

GET
H2

200

7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png
i.wmgtr.com/cic/ Frame 924A
Redirect Chain

https://viewyentreat.guru/tsk/HngjoDBPr_xz7ZUFDuSESiimFjjKRZLc6xddVqpm0EXEtvZWvxryrRRWQzsDb6VpxvEoqQQ1*n4VcPZRZVT7_7bhfyKaKKOnObcpb2IrDSQ4nmEX_8TKFtYcUDq5a8hW
https://yyyjqi.xyz/dsp/ph/icm?aid=16407396100160243140&mid=0&sid=1746&t=1706821523&subid=46223
https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png

10 KB
10 KB

169ms
89ms

Image
image/png

45.133.44.33
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png

Protocol

Server

45.133.44.33 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.0 /

Resource Hash

f03721e28b098535a7b43f33eb5728c2ebde7e38f8193a1448a6322e6b37b6f3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Fri, 02 Feb 2024 20:05:25 GMT
date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: gzip
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=82800
x-content-type-option: nosniff
x-xss-protection: 1; mode=block
x-proxy-cache: HIT

Redirect headers

location: https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png
date: Thu, 01 Feb 2024 21:05:25 GMT
accept-ch: Sec-CH-UA-Platform-Version
server: nginx/1.18.0
content-length: 0

POST
H/1.1 200
OK update-ads-events Show response
gestyy.com/shortener/ 17 B
1 KB 165ms
165ms XHR
application/json 172.67.68.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://gestyy.com/shortener/update-ads-events
Requested by: Host: static.sh.st
URL: http://static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
Protocol: HTTP/1.1
Server: 172.67.68.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.6.40-0+deb8u16
Resource Hash: 06e5f7e2d702e0110271dd33c198e1f312a785bcf41ca4fbed2fa6d67722dc03

Request headers

Accept: text/javascript, text/html, application/xml, text/xml, */*
Referer: http://gestyy.com/eh6vdw
X-Requested-With: XMLHttpRequest
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 01 Feb 2024 21:05:24 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
X-Powered-By: PHP/5.6.40-0+deb8u16
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DbdBq5EQJc5Nu7NQ4MpWP89aP%2Bo69VCQA5Z92YZw4nA5oPFHmyS53z%2BCZNly6UFIXEci8dF3Mu10UZcOvm%2FOccn%2FREeDqPTYpv%2FeRSHM2IC3gq7AcCfwmplUkGU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/json
Access-Control-Allow-Origin: *
X-Server-ID: shn09
Cache-Control: no-cache
Connection: keep-alive
CF-RAY: 84ed27021d2b18ab-MRS
X-UA-Compatible: IE=Edge

GET
H2 200 livechat2.html Show response
xdiwbc.com/template/ 5 KB
2 KB 727ms
299ms Fetch
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xdiwbc.com/template/livechat2.html
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9cb7b4e80387407092855d2562b9bf5ffd703de33f8de158729051271181aa6

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 01 Feb 2024 19:07:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7073
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eX0BG9HANn8MtuQDoxzUfJryTMLMMT5rWictKJrhWNLRqvaJM966EP%2FMpj%2FLfmUXNYheWQ5LJyilxY4EaqahI4fCGZ0l4P4Z2Hj0%2FrfqXf8x5lrir8FTTwHfgNpv"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
access-control-allow-origin: http://gestyy.com
cache-control: max-age=14400
cf-ray: 84ed2705de36f860-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 social.html Show response
xdiwbc.com/template/ 4 KB
2 KB 728ms
301ms Fetch
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xdiwbc.com/template/social.html
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4aaa8b864033f10089ecbbc1023817b1968fe72fb17398564429c7f07796c80

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 01 Feb 2024 20:04:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3661
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BvsZZQiSmvnWmiDHI3WgHXK%2B4OJ5qeWV9IK9%2BLViA07OeX1S%2BK3XMfnfwZ9EdiryihOiRlwq0PXjR8veV5%2FGSC3Mk4D4w8UeO4kCD1uTNfzG4WOTYLaP8XKszS38"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
access-control-allow-origin: http://gestyy.com
cache-control: max-age=14400
cf-ray: 84ed2705de38f860-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 nr-rum-1.251.1.min.js Show response
js-agent.newrelic.com/ 45 KB
16 KB 142ms
43ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.251.1.min.js

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f121cf1df97627fbe5ea62afd38f47a9db948b87c4d0a1a4a841d849b006cd0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: http://gestyy.com/
Origin: http://gestyy.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: buLfX9A7mQXpuLHozq55E4VjWIqJuIHo
content-encoding: br
via: 1.1 varnish
date: Thu, 01 Feb 2024 21:05:25 GMT
strict-transport-security: max-age=300
x-amz-request-id: XPFTGYHVHNGW3NH7
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15811
x-amz-id-2: iOOQ2DBy6PloS548EEu9/TlWpBW8TTEEQ1SZWzzMxxHiKaVm+bwwqqF2puWRsLpI7JW3cf2nYx0=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Mon, 29 Jan 2024 21:25:17 GMT
server: AmazonS3
x-timer: S1706821525.088604,VS0,VE0
etag: "c466cf97c933f9844290e9463a553cc4"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 20305

GET
H2

403

afu.php Show response
shorteh.com/ Frame 8DE4
Redirect Chain

http://ads.shorte.st/ads.php?key=2ea5b261f06ca771033a5fa9e22493f1&width=1024&height=768&ch=1&cp.dest_domain=hightimescentre.com&cp.oid=1&cp.referrer=&cp.locked=0&cp.proxy=0&cp.quarantine_status=1&c...
https://shorteh.com/afu.php?zoneid=1241630

7 B
514 B

228ms
88ms

Document
text/plain

139.45.197.238
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shorteh.com/afu.php?zoneid=1241630
Requested by: Host: static.sh.st
URL: http://static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.238 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 00e3fbbf542561da72fdc5ea89cfd1405c17739dd49210252e611c3122018efe

Request headers

Referer: http://gestyy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length: 7
content-type: text/plain; charset=utf-8
date: Thu, 01 Feb 2024 21:05:25 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 84ed27056f941222-MRS
Cache-Control: max-age=0, must-revalidate, no-store, private, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:25 GMT
Location: https://shorteh.com/afu.php?zoneid=1241630
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oIBng9Int%2BaHEYBEu4gS8URoqO%2BZ80UK7bIl1tcdGm%2Bx11DSEGXLu1%2FVZgxViDXe9o0HnFYnhv9XMU5r3hdlK41acqOMZGSPuxHrTfjEZFM1xe5snvOCfLuyqXyMQWw%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-Powered-By: PHP/5.6.40-0+deb8u16
X-Server-ID: shn09
X-UA-Compatible: IE=Edge

OPTIONS
H2 200 custom
ptauxofi.net/ Frame 0
0 42ms
42ms Preflight
text/plain 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ptauxofi.net/custom
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: http://gestyy.com
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 01 Feb 2024 21:05:24 GMT
server: nginx

POST
H2 200 custom Show response
ptauxofi.net/ 39 B
327 B 50ms
50ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ptauxofi.net/custom

Requested by

Host: gestyy.com
URL: http://gestyy.com/eh6vdw

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: cd1fe8ead5443f33aed1dee5a5bb830d
date: Thu, 01 Feb 2024 21:05:25 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 39

GET
H/1.1 200
OK pxf.gif
unseenreport.com/ 1 B
425 B 608ms
438ms Image
image/gif 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://unseenreport.com/pxf.gif?uuid=8ce248ea-e4bb-43da-9224-54a41066abc5&eb=bf36da4155aea2ae42a66b5374e9eb62&te=4ebcaa357b2108119c752c7f19e0e93c&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&dev=r&res=14.29&b_frame=0&pk=34c6b37755370ea4318f4ff4946df449&bl=en-US&sr=1200x1600&sz=1200x1600&hjs=22

Protocol

HTTP/1.1

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1
X-Request-ID: b8dabb7abd743fc9ac39bf8238b217a1
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK pxf.gif
unseenreport.com/ 1 B
425 B 608ms
439ms Image
image/gif 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://unseenreport.com/pxf.gif?uuid=8ce248ea-e4bb-43da-9224-54a41066abc5&eb=bf36da4155aea2ae42a66b5374e9eb62&te=4ebcaa357b2108119c752c7f19e0e93c&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&dev=r&res=14.29&b_frame=0&pk=0826667673c6afa9f85340ed4fc8ef57&bl=en-US&sr=1200x1600&sz=1200x1600&hjs=22

Protocol

HTTP/1.1

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1
X-Request-ID: 811604c113e6618fd4259df4403c8abc
Expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H/1.1 200 a2f5b84c90 Show response
bam.nr-data.net/1/ 40 B
397 B 685ms
517ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/a2f5b84c90?a=3488588&v=1.251.1&to=Y1EHNhMDChIDBxILW1obJAEVCwsPTRcODUZAURYWTwMAFwcWEgtHUVkADBVMFwkNFhIHR0BrEBANTA0PFgEUEUBdQAwDDT0UAAUB&rst=11852&ck=0&s=9bec82bb1dda1d8d&ref=http://gestyy.com/eh6vdw&hr=0&ap=75&be=1940&fe=9766&dc=7653&at=TxYEQFsZGRw%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706821513281,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:11,%22c%22:11,%22ce%22:318,%22rq%22:318,%22rp%22:1940,%22rpe%22:1996,%22di%22:9581,%22ds%22:9589,%22de%22:9593,%22dc%22:11687,%22l%22:11692,%22le%22:11706%7D,%22navigation%22:%7B%7D%7D&fp=2951&fcp=2951
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.251.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f

Request headers

Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: text/plain

Response headers

date: Thu, 01 Feb 2024 21:05:25 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: http://gestyy.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220100-FRA

GET
H2 200 index.html Show response
cdn.yourwebbars.com/sb/notifications/vpn/default/multi/action_centre_windows/1/ 3 KB
1 KB 515ms
68ms XHR
text/html 104.26.6.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.yourwebbars.com/sb/notifications/vpn/default/multi/action_centre_windows/1/index.html
Requested by: Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.6.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6da342536f5c91a6a4564b1da209f5e0e659cf8dc208a1134e5b4da4dfd1c8da

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 19 Jan 2024 14:19:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 36819
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2FLSU%2BDiQOfmZ7DLy6wAIx0vO9WYxSJX0JyupWHcGIrDORVyRNRF5WrnWDJOiBBRv5QZWzDyPRGCZoHQr%2B0Sc3AhyAN6qT67TghDP5WjBI3lUGiSvtdhpir7%2BQWPrruOAZKSND4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed2708cdaa70f2-MRS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK ren.gif
jestinquire.com/ 7 B
641 B 390ms
390ms Image
image/gif 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jestinquire.com/ren.gif?sid=H4sIAAAAAAAC%2F1xSzW8cxRPt3fin342P3BBCGiEODoo3szOzOzvKIUocQiI7EMVBFtx6pnvsxj3do%2B6eHceniEgoF6QVEh8Kl%2FHbJCYERLhxAGGtuVlCYjn54n8BuHNAa1uyRF2q6tUrqd%2Br%2Fni7OiRdVPTA3NRbQkp6odfxvflVoZiurffOHa%2Frd%2FyL3qpQ%2Feiit9mPznmXy1LyVZ4uCXehF8adsO%2FNL12%2Fc3P5vCfFBvfe5tmGPuctrhtd8AuDpON3onCQdOLAW6E5NeJkC6L8bhB24rjT7cadwO9h0%2FwHsFULlrbAhofkLASbztG%2Fn0NkE6ji%2BVVuN5wuz79VVJI6bTBkO%2B%2BpDaVrheK0zE0Ludo5YUPbKSFftqHVzolK6OGjmUqkYkpaO%2B8jVU%2BOH490iEGCVIJxpOxF1MMJuJxA0AkyfR%2BCnUfGsHgdqni2Ugu3xY2kih0T6IwwJW3zAUR9nFXx9UotrM10gc28gdicQKxNUFZ7cFstiHoPmfsIgv1G5j9%2FOOMv08pSpTgEO3hjkPEgGnC6wKM0XYhCRheSIIgWehGNun6%2FT9Osd%2BSPEBOIfALJR6D2DCrbQiVaqPI2qrKNgh14aRalSZaEvX6edDkPmN%2FNaTfKwzAPQ570UGUzBSO4coRMjpCZeyjNPWyIEUy1C7vewLIWrCMYsgY1J6gtQU0JakFQO4J62Dxm0ga2ecKkrdLuSQ5OctiMtVvbpo%2B1W%2BOKgJrRdnlIXp5Z15p76GODH3j%2BIOj3%2B3E%2FDrM%2BzWmSD3ph5HMW5dmA570YVjQQtg1qW9gSU%2FLKeBelmJL%2F%2FfgPUroHK%2FeQiddBq9dA63Ec%2BKDr42jgY0s9tevaON6xDkw3KN0c3N3Wtjwkrx7db8nNg2f7l6a798%2BqLz5BZhqUpsGH4leCNflgfFvX5NFtXVvyw7ulE4XYok5oteKo43PfLPG7tTbsxlU7eno5mw1m5bd3uHXLVDGh1ix5dkUwxs01bTJOfr5hV3l6q7LrVyqjqnL51uK1G0VpuLVCqwmo%2BF0NkYkpeeH7ztGnffOlryDMBKZqUFT75CQg9B6y8h5seYpZTWDkaZ%2BWLdRVMzZBegpKQSD5aU%2FTBpafWpDy%2FV%2F%2BOp6NDZ1tU9Fs2wdYM21Qdx%2BqaDA0DYayAZUj2OrM2JVm%2F9If4VEgle1xKk37USqN%2FPTI5ClZHP8JKw48RpPZkdPYj7pJ7PeSvNuN%2FDyI44BFQRDD2Sn%2F6f%2Bf%2FQsAAP%2F%2FAQAA%2F%2F9yt1uUvwQAAA%3D%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:25 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 7
X-Request-ID: b240f67f9e04a2bd1ac87a67b355ee73
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 wnrw
prhzxq.com/ 0
0 38ms
37ms Fetch 185.162.85.14
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prhzxq.com/wnrw?aid=18020723820076615810&a=1
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.162.85.14 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: http://gestyy.com
date: Thu, 01 Feb 2024 21:05:25 GMT
server: nginx/1.18.0
content-length: 0

GET
H2 200 OJBQYZwCURPd6BF8btuONpjIM-VxdxF2.png
i.wmgtr.com/cic/ Frame 92EE 20 KB
19 KB 245ms
41ms Image
image/png 45.133.44.33
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.wmgtr.com/cic/OJBQYZwCURPd6BF8btuONpjIM-VxdxF2.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

45.133.44.33 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.0 /

Resource Hash

65115362e6682b6bc57a92bd70788b57884fb764eb4ff63c0e0ea120a696998e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Fri, 02 Feb 2024 20:05:25 GMT
date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: gzip
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=82800
x-content-type-option: nosniff
x-xss-protection: 1; mode=block
x-proxy-cache: HIT

GET
H2 200 7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png
i.wmgtr.com/cic/ Frame 9AB2 10 KB
10 KB 279ms
98ms Image
image/png 45.133.44.33
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.wmgtr.com/cic/7v_XoB3sDIEPeup2qM3yIF_-PmHb_meU.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

45.133.44.33 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.0 /

Resource Hash

f03721e28b098535a7b43f33eb5728c2ebde7e38f8193a1448a6322e6b37b6f3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Fri, 02 Feb 2024 20:05:25 GMT
date: Thu, 01 Feb 2024 21:05:25 GMT
content-encoding: gzip
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=82800
x-content-type-option: nosniff
x-xss-protection: 1; mode=block
x-proxy-cache: HIT

GET
H2 200 trt
xngqoc.com/ 0
0 136ms
136ms Fetch 185.162.85.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://xngqoc.com/trt?a=1&t=3095
Requested by: Host: ubbfpm.com
URL: https://ubbfpm.com/ms/1102360/inpage.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.162.85.3 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 01 Feb 2024 21:05:25 GMT
access-control-allow-credentials: true
server: nginx/1.18.0
content-length: 0

GET
H2 200 main.css Show response
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/css/ 2 KB
1 KB 1188ms
542ms XHR
text/css 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/css/main.css
Requested by: Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56e7afac159c4bf8a3236a8f36c7a42da55faeb28da5e51292dc42db4c1595d8

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 19 Jan 2024 14:19:59 GMT
server: cloudflare
etag: W/"65aa850f-91e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GozvMMOoMi9uh8cUnwPyyoQqvDNyK067%2BQppFFpctuqkPY5FiG9f9gDXhS%2FSW95%2FMeIiB0tYOn9d3kwjbhSeaQ67MnLVi5dDEq4FfDaZkarupGwqhiswdzenNRRbZkSHo%2F%2Bn3eIro88R"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed270d6e9237e0-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 animate.css Show response
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/css/ 77 KB
5 KB 845ms
199ms XHR
text/css 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/css/animate.css
Requested by: Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe7c1db14999b9d111bfbae82515777c019c4a050beb4c0d8e53e46c40b5369f

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 19 Jan 2024 14:19:59 GMT
server: cloudflare
etag: W/"65aa850f-13369"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hIgsNc4aC6aEwOujqznqWLZjOAT2jolucj31tpq66%2F2yAZ4hNvXtH7Ul2lzkDWYBvlRwrZJ3T%2F5yvab%2FjwPDrEz8LQdlcYHBtuM5VyXsRz%2Fv%2BV8QG5wd2%2B7EoxIUdIdxtuizs74%2FcfYu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed270d6e9337e0-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
jestinquire.com/pixel/ 0
469 B 260ms
252ms Image
text/plain 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jestinquire.com/pixel/sbls?bv=24.4.2063&tmpl=482&u=https%3A%2F%2Fcdn.yourwebbars.com%2Fsb%2Fnotifications%2Fvpn%2Fdefault%2Fmulti%2Faction_centre_windows%2F1%2Findex.html&l=3539&fd=516.3000030517578
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:26 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2

200

css2
fonts.googleapis.com/ Frame E223
Redirect Chain

http://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap
https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap

15 KB
1 KB

51ms
49ms

Stylesheet
text/css

142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

ESF /

Resource Hash

2b0e499fab2cb58721f9b00dd921736ad8173df46f3297d92465cab70f29743d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Feb 2024 21:05:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Feb 2024 21:05:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Feb 2024 21:05:26 GMT

Redirect headers

Location: https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 close.svg
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 1 KB
1 KB 648ms
79ms Image
image/svg+xml 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/close.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4796366
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 31 Oct 2023 13:14:40 GMT
server: cloudflare
etag: W/"6540fdc0-4ff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tKIsOTJYl19GYWWB4bAXdGAzCTS9voPzIV9t7QD37T98Zk7iS0fNdmwmQ6Tm4yz6TPMU7DWzlPJLON1xuX49v5wFFH9mvBwDduy2fFRtYPP7NruM5W13gS9LSlr9U8CZbOcYsXshfbZV"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed270db93ff10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 08_arrow.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 1 KB
2 KB 648ms
81ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/08_arrow.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 003bac8c0b175b20c5eda00e914590a4da80c65938c50f05288efa77f0c805f1

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5662453
alt-svc: h3=":443"; ma=86400
content-length: 1503
last-modified: Tue, 31 Oct 2023 13:14:41 GMT
server: cloudflare
etag: "6540fdc1-5df"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qjihCrtf8hyCBXyfjsEQcGH6Jye4GxxXOt81wpwaFeQkfCMNYoI8R2Q0RGhODtxm5IWQ4IHK9cD0W8kOqTN5EFlO2HnAJCerAOPjH5m6SrnnaCOLlmnW457FJXWqzMytGRU94vsOqrja"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270db946f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 01_tabletmode.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 2 KB
3 KB 646ms
80ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/01_tabletmode.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e46985f812059a7a0ffe472868d64e7cf74706f92af72f33e324b3947641a92a

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5662453
alt-svc: h3=":443"; ma=86400
content-length: 2220
last-modified: Tue, 31 Oct 2023 13:14:39 GMT
server: cloudflare
etag: "6540fdbf-8ac"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HfBNy8dW8gysx8nENEjL3VNBoxJ29ikZzmIjntBBtfardgIjaHemqc3B49phGRhNPgRTGpUQ397B0mUB%2FuSynH4i%2FmmS95QLrKKoVvB5Y%2BUqK%2Fu4MbKP7mhq%2BAl7j5gOSZXw0lfZCu0j"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270db943f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 02_connect.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 2 KB
2 KB 648ms
83ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/02_connect.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02e47afe7001d63bdae3d6b1b2dbdf8229371ec80f438e7f8494a60887965062

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5915704
alt-svc: h3=":443"; ma=86400
content-length: 1807
last-modified: Tue, 31 Oct 2023 13:14:39 GMT
server: cloudflare
etag: "6540fdbf-70f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8CF1HvNi03wj%2Bh%2FJFuWeKf5PW4jtIQj3rTeY7D5%2BW%2FBZ8bPq9pTIohTnb50YCIt13GLDvWgFtosuOFimuVaX4LTu1hcTvvsMDHR75qhXWA03it59YSRrGevwkUGQd3ZdTqqOWPY13L%2B2"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270db945f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 03_note.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 1 KB
2 KB 216ms
212ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/03_note.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 940f511c89615c5967510d8c0a5b5579826708711ae68a4b6bd17e4741db38bf

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5670867
alt-svc: h3=":443"; ma=86400
content-length: 1471
last-modified: Tue, 31 Oct 2023 13:14:39 GMT
server: cloudflare
etag: "6540fdbf-5bf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=igmKgM2iiQ%2BTunrU2B5HcZhicqnmBE3jZoX5uIz7g2Kuvq2iBaCY0K7oXewrJXD9fOeKzLeTvU%2BdlkHpBsD2drmy5nlcuI5KiYqeYMEFhtdu3XubNGqu0IHKMMCRD2BQRTC%2BTqPg9hiq"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270e4a20f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 04_settings.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 3 KB
4 KB 215ms
212ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/04_settings.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dac3d99ca0de7d18a524ea1fd7976cb13a306555c0bf482a2e19099c5351a96

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5409309
alt-svc: h3=":443"; ma=86400
content-length: 3292
last-modified: Tue, 31 Oct 2023 13:14:38 GMT
server: cloudflare
etag: "6540fdbe-cdc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xbN1DVISdaqhafp6RtJqQNAQbQJKfb1VfvNO4SqzlV0EaRaoE3yJmbgv99eCVndA%2BxBO52M9wQg%2FvkbgL52FaT6WaDuyvSGCgJ5uXRvJwaNxqMZirM3RXoV3P7Co1HW10D1JpJra0946"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270e4a22f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 05_vpn.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 2 KB
3 KB 251ms
249ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/05_vpn.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3caf8557e03ac003652b61e25ab80ed243e1c74cef47ed2dabb5fb63b285f974

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5496325
alt-svc: h3=":443"; ma=86400
content-length: 2447
last-modified: Tue, 31 Oct 2023 13:14:40 GMT
server: cloudflare
etag: "6540fdc0-98f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WG%2FSaVljCLy%2BMzYGE%2FRP%2FWxDGsqx7m7ZDbBBP31JPF8r9pYn0%2BGcLBkZR9ou6OgDb1RHBaaPwh%2Fa8Yhxg6OPi2xMWHvFIh4u25Mn0jUeDmojyxO3XwQUxU0Vg6VpSO1k%2Fy3KZ9iQj7pi"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270e4a24f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 06_quiethours.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 2 KB
3 KB 251ms
248ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/06_quiethours.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46d9848979b2d46b7884c06e3e7601a8599988dd48a5a04d92a82757808032df

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5415256
alt-svc: h3=":443"; ma=86400
content-length: 2517
last-modified: Tue, 31 Oct 2023 13:14:40 GMT
server: cloudflare
etag: "6540fdc0-9d5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4VPdJ5ZpkmHXkVjqIJfatGVmDuGDxbMPHNNsJZES39qtWowvpNrKrHN8qwAQsYgqF9MafTBVSWHK5aaqQaMROKQ%2BR21566K6Bp5lbOKdJXDuXOp4rVxAuHdL7yygkXcU91LNkN0MSRJ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270e4a26f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 07_location.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 2 KB
3 KB 216ms
213ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/07_location.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3beb1e55bd47b2627ec87c37993f37b56175b41576127057503ecc878655678

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5915704
alt-svc: h3=":443"; ma=86400
content-length: 2363
last-modified: Tue, 31 Oct 2023 13:14:40 GMT
server: cloudflare
etag: "6540fdc0-93b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09iZZzppBgncNfmJt2mZ3YXW4%2FyjPlgscImpyQnLzASc24luJKb2QLCkRfpiOSPoNgl3kTwH9FBlAHaIIep6xvX5QkI63BtyX15n9bSybHGWvwW6MgR4f5M7YEbP%2BJu%2Ftl0JkIxGr7h0"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed270e4a27f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/js/ Frame E223 82 KB
30 KB 255ms
252ms Script
application/javascript 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/js/jquery.min.js
Requested by: Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df34524351c5fabc921a89183b5da5667aebd7b9e9a1c52255c76ff722935ea3

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:26 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5915704
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 31 Oct 2023 13:14:38 GMT
server: cloudflare
etag: W/"6540fdbe-149a0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UXmfvr%2FX0eCNCTByDE1XwEtf%2BTsXhWne4ZLZZ%2BBkSJ8t1wO4YWsUK%2BMx1AaH2cVNB2eyPAYdP%2Fz2k%2F0w0ZFAM98ZOnAoN9pWYC%2FApNuh2mGsDw8nIfXBfy6Ags0rt7yH2Ro7KTCBkul2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed270e4a28f10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
jestinquire.com/pixel/ 0
469 B 389ms
389ms Image
text/plain 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jestinquire.com/pixel/sbls?bv=24.4.2063&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fvpn%2Fdefault%2Fmulti%2Faction_centre_windows%2F1%2Fcss%2Fanimate.css&l=78697&fd=847.9000015258789
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:26 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

OPTIONS
H/1.1 200
OK qYMov6Il9OomvfdmjU1o_fzOqxuSTiHepfz9_kXlnHzMiRRXOUGOZmxPGakZXnMvrUlMVxMmTuitWXRoIhhJXwnFGoGHpHI
gripy.swaggydestroy.com/ Frame 0
0 457ms
344ms Preflight
text/html 23.109.87.223
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

http://gripy.swaggydestroy.com/qYMov6Il9OomvfdmjU1o_fzOqxuSTiHepfz9_kXlnHzMiRRXOUGOZmxPGakZXnMvrUlMVxMmTuitWXRoIhhJXwnFGoGHpHI?ck9=weiEmI6kjN4QDLiMnI6ISM2ADM4FjMwAjIsIiYiojIxYDMwgXMyADMiwiIyJiOiICLiEnI6ICa0RHc68yLnV2c0lXeuM2bt9SZoZjdkdnIsICaioTO2UzNsICbiojIl5WLVNlIsICdioTL2ADLionI6MTO3gDLismI6QDLiUnI6IiN3YWOyMGZwUWZyITNkNzM0UjZ1UGOiwiImJiOmFGbzVGLicHaiojIu9GdgkmbgkmZyFWblJCLikGaiojIu9GdgkmbgkmZyFWblJCLiUmI6ISZtJHepFHa3dWY2ImMwwmIsIybioDdyVXZsISbioTM3AjN4ITM1IjN5MzMsIydiojIlcjQlIjM0lGdsVWJyITJzEUJyITRhJnblIDMt9mbllXJyAzbuViMwMHavJHdlIDMslmbrNnLlIDMNF2alViMwMHavJHdlIDMslmbrNXJyATYuRWJyATZhViMyUiMDViMysWZ5d3byR2clIjMlMTQlUjQlIjMzh2byRXZuMHdlIjMlIzQlIjMzh2byRXZzRXJyITJyMUJyIzco9mc0ViMwwWaut2clIjMlIzQlIjMslmbrViMwMHavJHdl5WZyViMyUiMDViMyIWa0xWelIjMlUDRlIzQlIjM09Gc39mckNXJyITJzEUJ1IUJyITaj9mblMTQ3UiMyUiMDViMyIXZmJXZzhWJzE0NlIjMlIzQlIjM0hWazVyMBZTJyITJyMUJyIzYsl2YrVyMBZTJyITJyMUJyIjYy92dzVmclMTQ2UiMyUSNEVyNEJCLiQ3cioDMsICcyJiOxwiIoNmI6QDLiIGbioTLxwiIiNmI6MDLiYndiojIJ5GdlxGIJ52YuICLiYnciojIJ5GdlxGIJJXazByTwVmbHxEIF52Zp5WZiwiIhNmI6ADLiMGdiojI152au92duJCLiMWZ0JiOiQzZiwiIjRGbtJiOtEDLiMGZsJiOxADLiMmc0RnI6ADLiQXbzJiOxwiIjVmI6Qnc1VGLiMGZiojM0wiIvJnI6ICbh5GZzNWYwVWLwJXatFmc5JSf

Protocol

HTTP/1.1

Server

23.109.87.223 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://gestyy.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://gestyy.com
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2024 21:05:27 GMT
Keep-Alive: timeout=20
Server: nginx
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

POST
H/1.1 200
OK qYMov6Il9OomvfdmjU1o_fzOqxuSTiHepfz9_kXlnHzMiRRXOUGOZmxPGakZXnMvrUlMVxMmTuitWXRoIhhJXwnFGoGHpHI Show response
gripy.swaggydestroy.com/ 4 KB
3 KB 265ms
258ms Fetch
application/json 23.109.87.223
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

HTTP/1.1

Server

23.109.87.223 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

bbbc63c2511c820fda0ac783d535551e6ffc5a087e4e9a02906f7de86dbd7e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: http://gestyy.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 01 Feb 2024 21:05:27 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: http://gestyy.com
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

GET
H2 200 script.js Show response
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/js/ 9 KB
3 KB 319ms
309ms XHR
application/javascript 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/js/script.js
Requested by: Host: divergeimperfect.com
URL: http://divergeimperfect.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5bbe337dc4275f85d80ff3eb2998838d028a63c13cece9b1271702368b43f60

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:27 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 19 Jan 2024 14:19:59 GMT
server: cloudflare
etag: W/"65aa850f-256d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ulhoa2LanRoMcCItdA%2FBnkEs3JW7wnnH6dOBaS3WzzZr7KFo4mBsM9wFYd5gIzfSM1%2BvG%2BRbq8LZbmN6C9KGN2GWXkNAk%2BRInirZtkImM4w7ngbj1a8EXJWEN9ia75Od2bxM5I60N58j"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
cf-ray: 84ed2710caea37e0-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
jestinquire.com/pixel/ 0
469 B 348ms
340ms Image
text/plain 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jestinquire.com/pixel/sbls?bv=24.4.2063&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fvpn%2Fdefault%2Fmulti%2Faction_centre_windows%2F1%2Fcss%2Fmain.css&l=2334&fd=1189.2999954223633
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:27 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 08_arrow.png
cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/ Frame E223 1 KB
2 KB 96ms
96ms Image
image/png 172.64.108.10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.creative-bars1.com/sb/notifications/vpn/default/multi/action_centre_windows/1/img/08_arrow.png
Requested by: Host: gestyy.com
URL: http://gestyy.com/eh6vdw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.108.10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 003bac8c0b175b20c5eda00e914590a4da80c65938c50f05288efa77f0c805f1

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 21:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5662454
alt-svc: h3=":443"; ma=86400
content-length: 1503
last-modified: Tue, 31 Oct 2023 13:14:41 GMT
server: cloudflare
etag: "6540fdc1-5df"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2U8OrwbhFwfF4syoupxSGnt7szCSKY%2BpgbQHwcDM%2BlSuXK9u3kAMZcc4GD0afRhEzPvPZ76yLwywiNTYIuc5dvlBhX8iugEO2x50UgU4Vhgzb8kWaM23kN7srAhNpFayPzIVZyRyth6Q"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Date
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 84ed2712af6cf10c-CDG
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sbls
jestinquire.com/pixel/ 0
469 B 137ms
137ms Image
text/plain 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jestinquire.com/pixel/sbls?bv=24.4.2063&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fvpn%2Fdefault%2Fmulti%2Faction_centre_windows%2F1%2Fjs%2Fscript.js&l=8052&fd=320
Protocol: HTTP/1.1
Server: 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:27 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK impr.gif
jestinquire.com/ 7 B
641 B 135ms
134ms Image
image/gif 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jestinquire.com/impr.gif?sid=H4sIAAAAAAAC%2F1xSzW8cxRfs3fin342P3BBCGiEODoo3szsfu6scosQhJLIDURxkwa17usdu3Ns96u7ZcXyKiIRyQVoh8aFwGdcmMSEgwo0DCGvNzRISy8kX%2FwvAnQNa25Il3qXeq1dPmqrpj7fLQ9JGSQ%2FsTbMllaIXklYYzK9KzU3lgnfuBO2wFV4MVqVO44vBZhqfCy4XhRKrgi1JfyGJuq0oDeaXrt%2B5uXw%2BUHJDBG%2BLbMOcCxbXrRmIC71%2BK2zFUa%2Ff6naCFZpTK0%2BuIIvvelGr2221291WJ0ywaf9DuLIBRxvgw0NyFpJP5%2BjfzyGzCfTg%2BVXhNrwpzr81KBX1xmLId97TG9pUGoPTNrcN5HrnRA3jpoR82YTROycuYYaPZi7B5JQ0dt4H00%2BOPx5siF4fTIELMP4iquEEQk0g6QSZuQ%2FJzyPjWLwOPXi2Ukm%2FJayimh8L6EwwJU37AWR1jHrw9UolncvMAJt5Dbk5gVyboCj34LcakNUeMv8RJP%2BNzH%2F%2BcKZfpqWjWgtIfvBGLxOduCfogogZW4gjThf6nU68kMQ0bodpSlmWHOUj5QQyn0CJEag7g9I1UMoGyryJsmhiwA8ClsWsn%2FWjJM37bSE6PGzntB3nUZRHkegnKLOZgxF8MUKmRsjsPRT2HjbkCLbchVuv4XgDzhMMeY1KEFSOoKIElSSoPEE1rB9z5TqufsKVK1n7BDsnGNVj49e26WPj14QmoHa0XRySl2fRNeYehtgQB0HY66Rp2k27UZbSnPbzXhLFoeBxnvVEnnThZA3pmqCugS05Ja%2BMd1HIKfnfj%2F%2BA0T04tYdMvg5avgZajbudEHR9HPdCbOmnbt1YL1rOg5sahZ%2BDv9vYVofk1aP%2Ft%2BTnIbL9S9Pd%2B2f1F58gszUKW%2BND%2BSvBmnowvm0q8ui2qRz54d3Cy4Hcol4aveKpF3PfLIm7lbH8xlU3eno5my1m7bd3hPPLVHOp1xx5dkVyLuw1YzNBfr7hVgW7Vbr1K6XVZbF8a%2FHajUFhhXPS6Amo%2FF0PkckpeeH71tGjffOlryDtBLasMSj3yUlBmj1kxT244pRzhsCq05kVDVRlPbYddkoqSaDE6UxZDSdOI2Bi%2F5e%2FjndjS2fXVNbb7gHWbBPU34ce1BjaGkNVg6oRXHlm7Au7f%2BmP6KjAVHPMlG0%2BYsqqT49CnpLF8Z9w8iDg%2FaTHRD8MOe2F3ZRxnvOs3adJnohOwlJ4NxU%2F%2Ff%2BzfwEAAP%2F%2FAQAA%2F%2F9U0PDIvwQAAA%3D%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:27 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 7
X-Request-ID: 70ee5a886fb15e62c85a2206932df6ac
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK sbs
jestinquire.com/pixel/ 0
469 B 504ms
368ms Image
text/plain 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jestinquire.com/pixel/sbs?c=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.19.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Feb 2024 21:05:27 GMT
Server: nginx/1.19.5
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame E223 15 KB
15 KB 110ms
109ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://gestyy.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:55:04 GMT
x-content-type-options: nosniff
age: 180623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:55:04 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame E223 15 KB
15 KB 100ms
100ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:wght@400;700&family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://gestyy.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:50:29 GMT
x-content-type-options: nosniff
age: 180898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:50:29 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame FA9A 22 KB
2 KB 282ms
282ms Stylesheet
text/css 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600,700,800

Requested by

Host: ja.rewashwudu.com
URL: http://ja.rewashwudu.com/fmwhVStpL4dxap/46223

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

ESF /

Resource Hash

dc3c4c34f1c916215ae21ba914db548ec6ff95f69e0c4360ce1e8d84245bc1c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: http://gestyy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Feb 2024 21:05:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Feb 2024 21:05:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Feb 2024 21:05:27 GMT

GET icon
cdnid.net/b2/c/i/ Frame FA9A 0
0

GET 6b0c955046cc3909ef347f7c95ec7cd9a3672503.png
scarpeweevily.top/g/6b/0c/ Frame FA9A 0
0

GET memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ Frame FA9A 0
0

GET memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ Frame FA9A 0
0

POST update-ads-events
gestyy.com/shortener/ 0
0

GET end-adsession
gestyy.com/shortest-url/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: analytics.shorte.st
URL: http://analytics.shorte.st/displayed

Domain: cdnid.net
URL: https://cdnid.net/b2/c/i/icon?cid=1&did=RnxFalg&eid=622&nid=1&sid=3293135273suwNuCcZ&ts=1706821527&ttl=43200&v=v5.9.17.2

Domain: scarpeweevily.top
URL: http://scarpeweevily.top/g/6b/0c/6b0c955046cc3909ef347f7c95ec7cd9a3672503.png

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2

Domain: gestyy.com
URL: http://gestyy.com/shortener/update-ads-events

Domain: gestyy.com
URL: http://gestyy.com/shortest-url/end-adsession?adSessionId=bd49df19d0b8154e5c4889332542679baa353e6f&adbd=0&callback=reqwest_1706821516421

Verdicts & Comments Add Verdict or Comment

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gestyy.com/	1970-01-21 02:52:37	Name: hl Value: en
gestyy.com/	1969-12-31 23:59:59	Name: cookies-enable Value: 1
.gestyy.com/	1970-01-21 03:43:01	Name: _ga Value: GA1.2.1162476210.1706821516
.gestyy.com/	1970-01-20 18:08:27	Name: _gid Value: GA1.2.713762775.1706821516
proftrafficcounter.com/	1970-01-21 03:43:01	Name: uid_id2 Value: 8ce248ea-e4bb-43da-9224-54a41066abc5:3:1
gestyy.com/	1969-12-31 23:59:59	Name: dom3ic8zudi28v8lr6fgphwffqoz0j6c Value: 8ce248ea-e4bb-43da-9224-54a41066abc5%3A3%3A1
gestyy.com/	1970-01-20 18:07:05	Name: pp_main_34c6b37755370ea4318f4ff4946df449 Value: 1
.gestyy.com/	1970-01-20 20:16:37	Name: _gcl_au Value: 1.1.1010588960.1706821518
gestyy.com/	1970-01-20 18:07:03	Name: sb_main_0826667673c6afa9f85340ed4fc8ef57 Value: 1
my.rtmark.net/	1970-01-21 02:52:37	Name: ID Value: 1d6b1660289241fa8a135da7ab0f8e9e
.doubleclick.net/	1970-01-20 18:07:02	Name: test_cookie Value: CheckForPermission
.gestyy.com/	1970-01-20 18:07:01	Name: _gat Value: 1
.gestyy.com/	1970-01-21 03:43:01	Name: _ga_7C6F2JT500 Value: GS1.2.1706821523.1.0.1706821523.0.0.0
gestyy.com/	1970-01-20 18:07:03	Name: sb_count_0826667673c6afa9f85340ed4fc8ef57 Value: 1
gestyy.com/	1970-01-20 18:08:27	Name: referrer_url Value: http%3A%2F%2Fgestyy.com%2Feh6vdw
.eveneraw.digital/	1970-01-21 03:43:01	Name: a97fa794a0f9 Value: 67f92cd0ee225d3345f5e8
siltagefutiley.top/	1970-01-20 18:08:27	Name: GL_UI4 Value: eJw9jd1OhDAYRPkHdRedhAfwEUDELJfGh9hLUtqvbF1oN6VCfHsbE72ak8mZTBAEUfWIcMsKxF%2Bsw7NsX6l%2F6%2FtOCNlK2dHYjFJQ0564pJee406tg2PjTC5BsS7MusFtCQ4TabKKD9wIOuLJW3%2FNVZtdJ0hHy7Q4Il28MR%2BRj9bsK9kqRqLZQsg%2BLtb4TBf2aSyiU%2B9RaY9hjcisVVzeIz8rLfyuPCBq6rLMAjzcZuakscugRBYinSwThPAdBWeOJmO%2FkQtar87cADOL4d%2F%2FvY33pkYmaFPcfxt3IfsD96VPPw%3D%3D
siltagefutiley.top/	1970-01-20 18:08:27	Name: GL_GI10 Value: eJwNy0sKwjAUBdC8Nyh%2B6uBit2G0itSxVXAgnXQFMQ0aiGlJooLLcStuTM%2F8CCG4yMF2wGy3kVUly7KS69UWdAXXJ7D2mLYvm94mOOU7UAA3R3DwmDTmoW%2FfTzIOpJG3yvq02DtlowFZjP4vRt3fwT5iXKuLM8tDewYNmQCnPiNw7AoBembzH9FLIVg%3D
koronaararao.guru/	1970-01-20 18:08:27	Name: GL_UI4 Value: eJw9jd1OhDAYRPkHdRedhAfwEUDELJfGh9hLUtqvbF1oN6VCfHsbE72ak8mZTBAEUfWIcMsKxF%2Bsw7NsX6l%2F6%2FtOCNlK2dHYjFJQ0564pJee406tg2PjTC5BsS7MusFtCQ4TabKKD9wIOuLJW3%2FNVZtdJ0hHy7Q4Il28MR%2BRj9bsK9kqRqLZQsg%2BLtb4TBf2aSyiU%2B9RaY9hjcisVVzeIz8rLfyuPCBq6rLMAjzcZuakscugRBYinSwThPAdBWeOJmO%2FkQtar87cADOL4d%2F%2FvY33pkYmaFPcfxt3IfsD96VPPw%3D%3D
koronaararao.guru/	1970-01-20 18:08:27	Name: GL_GI10 Value: eJwNy0sKwjAUBdC8Nyh%2B6uBit2G0itSxVXAgnXQFMQ0aiGlJooLLcStuTM%2F8CCG4yMF2wGy3kVUly7KS69UWdAXXJ7D2mLYvm94mOOU7UAA3R3DwmDTmoW%2FfTzIOpJG3yvq02DtlowFZjP4vRt3fwT5iXKuLM8tDewYNmQCnPiNw7AoBembzH9FLIVg%3D
viewyentreat.guru/	1970-01-20 18:08:27	Name: GL_UI4 Value: eJw9jd1OhDAYRPkHdRedhAfwEUDELJfGh9hLUtqvbF1oN6VCfHsbE72ak8mZTBAEUfWIcMsKxF%2Bsw7NsX6l%2F6%2FtOCNlK2dHYjFJQ0564pJee406tg2PjTC5BsS7MusFtCQ4TabKKD9wIOuLJW3%2FNVZtdJ0hHy7Q4Il28MR%2BRj9bsK9kqRqLZQsg%2BLtb4TBf2aSyiU%2B9RaY9hjcisVVzeIz8rLfyuPCBq6rLMAjzcZuakscugRBYinSwThPAdBWeOJmO%2FkQtar87cADOL4d%2F%2FvY33pkYmaFPcfxt3IfsD96VPPw%3D%3D
viewyentreat.guru/	1970-01-20 18:08:27	Name: GL_GI10 Value: eJwNy0sKwjAUBdC8Nyh%2B6uBit2G0itSxVXAgnXQFMQ0aiGlJooLLcStuTM%2F8CCG4yMF2wGy3kVUly7KS69UWdAXXJ7D2mLYvm94mOOU7UAA3R3DwmDTmoW%2FfTzIOpJG3yvq02DtlowFZjP4vRt3fwT5iXKuLM8tDewYNmQCnPiNw7AoBembzH9FLIVg%3D
jestinquire.com/	1970-01-20 18:08:27	Name: u_pl Value: 17078832
jestinquire.com/	1970-01-20 18:17:06	Name: uid_id2 Value: 8ce248ea-e4bb-43da-9224-54a41066abc5:3:1
jestinquire.com/	1970-01-20 18:08:27	Name: pdhtkv Value: true
jestinquire.com/	1970-01-20 18:08:27	Name: uncs Value: 1
jestinquire.com/	1970-01-20 18:08:27	Name: pdhtkv29 Value: true
jestinquire.com/	1970-01-20 18:08:27	Name: uncs29 Value: 1
jestinquire.com/	1970-01-20 18:07:01	Name: slec0826667673c6afa9f85340ed4fc8ef57 Value: [4944936,4432879]
gestyy.com/	1970-01-20 18:07:01	Name: pbpr0tpuw4isk85t8yg3jb2lj5vqf Value: jestinquire.com

42 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://gestyy.com/eh6vdw Message: Access to XMLHttpRequest at 'http://analytics.shorte.st/displayed' from origin 'http://gestyy.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: http://analytics.shorte.st/displayed Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw(Line 1072) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw(Line 1072) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	warning	Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://shorteh.com/afu.php?zoneid=1241630 Message: Failed to load resource: the server responded with a status of 403 ()
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: http://gestyy.com/eh6vdw Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.shorte.st
amunfezanttor.com
analytics.shorte.st
bam.nr-data.net
capaciousdrewreligion.com
cdn.creative-bars1.com
cdn.yourwebbars.com
cdnid.net
divergeimperfect.com
endangersquarereducing.com
eveneraw.digital
fonts.googleapis.com
fonts.gstatic.com
friendshipmale.com
gestyy.com
googleads.g.doubleclick.net
gripy.swaggydestroy.com
i.wmgtr.com
intendrebend.top
ja.rewashwudu.com
jestinquire.com
js-agent.newrelic.com
koronaararao.guru
liberia.artertapirus.com
my.rtmark.net
prhzxq.com
proftrafficcounter.com
ptauxofi.net
region1.google-analytics.com
scarpeweevily.top
shorteh.com
siltagefutiley.top
static.sh.st
ubbfpm.com
unseenreport.com
viewyentreat.guru
www.google-analytics.com
www.google.ch
www.google.com
www.googletagmanager.com
xdiwbc.com
xngqoc.com
yyyjqi.xyz
analytics.shorte.st
cdnid.net
fonts.gstatic.com
gestyy.com
scarpeweevily.top
104.26.5.107
104.26.6.19
104.26.6.218
139.45.195.8
139.45.197.238
139.45.197.250
142.250.181.227
142.250.185.106
142.250.186.163
142.250.186.34
151.101.130.137
162.19.19.14
162.247.243.29
172.217.16.142
172.217.18.4
172.217.18.8
172.64.108.10
172.64.196.8
172.67.68.51
172.67.74.33
185.162.85.14
185.162.85.3
185.162.87.203
188.114.96.3
192.243.59.13
192.243.59.20
192.243.61.227
212.117.186.12
212.117.186.124
212.117.186.20
212.117.187.148
216.239.34.36
23.109.170.60
23.109.87.223
3.64.223.139
45.133.44.33
95.216.206.230
003bac8c0b175b20c5eda00e914590a4da80c65938c50f05288efa77f0c805f1
00e3fbbf542561da72fdc5ea89cfd1405c17739dd49210252e611c3122018efe
02e47afe7001d63bdae3d6b1b2dbdf8229371ec80f438e7f8494a60887965062
06e5f7e2d702e0110271dd33c198e1f312a785bcf41ca4fbed2fa6d67722dc03
1a98a26399a133e045bed1aeb54f50e537d213a9b04424d4bb7c228b6e276e61
1ef00b8b6337796c446ae1fab2ea26ba26c4f876ed8f9f68851fcffdb615d180
213a97b33eded6d9201319e09d858b07367120ff7d0154efe91414493a291e29
2727119946bcb058e297c8e666051ecce7542220d0ac8776e3054beb8208d338
2b0e499fab2cb58721f9b00dd921736ad8173df46f3297d92465cab70f29743d
2d054b502d829accd15ff9cb78d1431df1c3ec2c67ca18d4008d2cbc973c6384
2e1ad64f1102717d65c190442c6b23e0c20a92bab56a569368e2e6db14341066
355ebedca9bc730fd25abc43fd3a7bd49dd0ed64aa1adf247e2aaa578cb5364c
37800f9f2bb9d6543c17667dca9695da535d5b01fcf095db9d20d9782f1d22d0
3caf8557e03ac003652b61e25ab80ed243e1c74cef47ed2dabb5fb63b285f974
4517962831388a4b3dabe5df76fccd7372f46996ecc584e9db07a8326b1408d3
46d9848979b2d46b7884c06e3e7601a8599988dd48a5a04d92a82757808032df
4fe6866b4cbf1552cfe473623ab056359d62898e1d608b51f396d98e919f7bcf
53f0d240c7e313de251a919a3e126f9d466b13f5518191d532b360244a1040d9
56e7afac159c4bf8a3236a8f36c7a42da55faeb28da5e51292dc42db4c1595d8
60dc15960085ad22a80319abc704c34dc18de284538f90f68a08e839db53fc59
65115362e6682b6bc57a92bd70788b57884fb764eb4ff63c0e0ea120a696998e
6acd8bce6481db9a9462ccbd6702dba686bb978e07d836648512a4c5563a1b49
6bf4cc8a7de60cff486afc2a187456f30a2b67195062f5cbb4d8d67ed45de857
6da342536f5c91a6a4564b1da209f5e0e659cf8dc208a1134e5b4da4dfd1c8da
6dac3d99ca0de7d18a524ea1fd7976cb13a306555c0bf482a2e19099c5351a96
7b23e3a7155161323573e58616ff1bfdaffd0560483db31315d181f6b394ddd5
8146dfca511f063c33c05e13e151ed3d3456441590a4b1358bbc99b320a02b8d
88bb3be0111402f5ca81aaa36cbf7c4a2755099c5d0446831331e1d1d8e7a1ef
8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808
940f511c89615c5967510d8c0a5b5579826708711ae68a4b6bd17e4741db38bf
9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21
975a1175bf7ad4db4c493ba3945217dd4fcd10845c83f1aae485999f5444baf7
9f941704da7e95bf77706c98fb4e671fcc01ab7c7ce9e85f0adf2f0d057deee6
ac798e90b0015b3506a40c6b0e018143a6d64fe23d7e4d93af5dbc40e5983550
ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95
ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24
b9cb7b4e80387407092855d2562b9bf5ffd703de33f8de158729051271181aa6
bbbc63c2511c820fda0ac783d535551e6ffc5a087e4e9a02906f7de86dbd7e78
bf3bea94a4fbdba90f1df26db48e313ac9f3bbb22a3c29753ea54c86d6121a88
c3c736b80c318c7323b9f2b6a3b2ddd6e78e5aeeed7e9d648c6b1d7e97691024
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1d989de4d11ec845ebcb9edecd3841ba0f5d546ce88d223d97c2d490e76426e
d3f4cf8db2d8500f2c1e5c04888f2bb37cffb072567bcfe235a6debaafb4a24e
d84230ddbff3abacba74706b861597f886c7dce9b3e340b43e2fd9169dab860d
dc3c4c34f1c916215ae21ba914db548ec6ff95f69e0c4360ce1e8d84245bc1c4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df34524351c5fabc921a89183b5da5667aebd7b9e9a1c52255c76ff722935ea3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3beb1e55bd47b2627ec87c37993f37b56175b41576127057503ecc878655678
e46985f812059a7a0ffe472868d64e7cf74706f92af72f33e324b3947641a92a
e4aaa8b864033f10089ecbbc1023817b1968fe72fb17398564429c7f07796c80
e5bbe337dc4275f85d80ff3eb2998838d028a63c13cece9b1271702368b43f60
e9251cfb292d5b26149189f31a2d3241620df5621422b596bbb3952942ef7a66
ee6861e9f4ceed823b402ba9e36ecd77663367d08f7e27895f6c89348c631a37
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f03721e28b098535a7b43f33eb5728c2ebde7e38f8193a1448a6322e6b37b6f3
f121cf1df97627fbe5ea62afd38f47a9db948b87c4d0a1a4a841d849b006cd0d
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f8cdb6c9c3134ebb5141b8ccc649c79bdf3ad6cfcfe4672912f5e3503b9e0156
fd7607ab554a8c5af9aed32593ae99aaf0682198dbbd277372e8b663bd98b001
fe7c1db14999b9d111bfbae82515777c019c4a050beb4c0d8e53e46c40b5369f
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

gestyy.com Open in urlscan Pro 172.67.68.51 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

104 Requests

58 %HTTPS

0 %IPv6

41 Domains

43 Subdomains

34 IPs

8 Countries

1114 kBTransfer

2389 kBSize

30 Cookies

3 Outgoing links

Redirected requests

104 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

gestyy.com Open in urlscan Pro
172.67.68.51 Public Scan

Screenshot
Live screenshot

Full Image

104
Requests

58 %
HTTPS

0 %
IPv6

41
Domains

43
Subdomains

34
IPs

8
Countries

1114 kB
Transfer

2389 kB
Size

30
Cookies

104 HTTP transactions
1 data transactions