flirthere-andnow1.com Open in urlscan Pro
45.141.84.94  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://soo.gd/z0zZ Page URL
2. http://www.urcom.postedu.ru/ Page URL
3. https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	z0zZ Show response soo.gd/	3 KB 2 KB	485ms 462ms	Document text/html	2606:4700:3036::ac43:81fd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://soo.gd/z0zZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:81fd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cfe0593b5d803094bf2efffedc1c5031cb0d11cbdcc4286c529ac042e70e5f69 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; Request headers :method GET :authority soo.gd :scheme https :path /z0zZ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-type text/html; Charset=UTF-8;charset=UTF-8 set-cookie __cfduid=d52a89e7fc1be1410b9f6b62fd998150a1615130567; expires=Tue, 06-Apr-21 15:22:47 GMT; path=/; domain=.soo.gd; HttpOnly; SameSite=Lax; Secure vary Accept-Encoding cache-control no-cache, must-revalidate, max-age=0 pragma no-cache x-robots-tag noindex, nofollow i-am Alpha strict-transport-security max-age=31536000; includeSubdomains; cf-cache-status DYNAMIC cf-request-id 08aee1bc1e00002be95c3c4000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3Tz2ulUCXEEwaHarytGlDvCheXnKRcMjkoQX7%2FbhmWTcCGcBbEyaTYUdA8QllrcWRHOjoYy6NO6KLrZRKYqlwmcWsPlbbIryKUOLAbHWSS%2BBe78%3D"}],"max_age":604800,"group":"cf-nel"} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 62c4d2402f852be9-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	57 KB 20 KB	60ms 41ms	Script text/javascript	2a00:1450:4001:801::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: soo.gd URL: https://soo.gd/z0zZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e255ed96553f0c3d758a000b1ab28eeda20eebf9c0bc4d0061e95b0dc855cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "804 / 573 of 1000 / last-modified: 1614985959" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19736 x-xss-protection 0 expires Sun, 07 Mar 2021 15:22:48 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	98 KB 39 KB	19ms 19ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-31510493-2 Requested by Host: soo.gd URL: https://soo.gd/z0zZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cfd6a1f25399c6f6c272c6466f1feb8d1c87a414b6295caf1970f7fcffa8f545 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39447 x-xss-protection 0 last-modified Sun, 07 Mar 2021 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sun, 07 Mar 2021 15:22:48 GMT
GET H3-Q050	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-31510493-2 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Feb 2021 21:33:27 GMT server Golfe2 age 4812 date Sun, 07 Mar 2021 14:02:36 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18980 expires Sun, 07 Mar 2021 16:02:36 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	1 B 58 B	13ms 13ms	XHR text/plain	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1367852596&t=pageview&_s=1&dl=https%3A%2F%2Fsoo.gd%2Fz0zZ&ul=en-us&de=UTF-8&dt=z0zZ&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=929484497&gjid=1694856711&cid=1236257294.1615130568&tid=UA-31510493-2&_gid=39411473.1615130568&_r=1&gtm=2ou2o0&z=2109025364 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sun, 07 Mar 2021 15:22:48 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://soo.gd cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_2021030301.js Show response securepubads.g.doubleclick.net/gpt/	283 KB 100 KB	132ms 39ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software sffe / Resource Hash 29aec720e772d77058fbe8aa0081fc3f1474ab2ea2ecbe5b0df5eeb70ea5905f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 03 Mar 2021 09:40:10 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 101815 x-xss-protection 0 expires Sun, 07 Mar 2021 15:22:48 GMT
GET H2	200	integrator.js adservice.google.de/adsid/	107 B 313 B	15ms 15ms	Script application/javascript	2a00:1450:4001:829::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=soo.gd Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js adservice.google.com/adsid/	107 B 313 B	15ms 15ms	Script application/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=soo.gd Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3-Q050	200	ads securepubads.g.doubleclick.net/gampad/	435 B 935 B	109ms 71ms	XHR text/plain	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2478519936342596&correlator=2296006402307626&output=ldjh&impl=fif&eid=21068530%2C31060337%2C44733568&vrg=2021030301&ptt=17&sc=1&sfv=1-0-37&ecs=20210307&iu_parts=5837603%2CSGD_360&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x360&cookie_enabled=1&bc=31&abxe=1&lmt=1615130568&dt=1615130568465&dlt=1615130568173&idt=276&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=1216140633&ucis=1&ifi=1&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsoo.gd%2Fz0zZ&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x423&msz=0x0&ga_vid=1236257294.1615130568&ga_sid=1615130568&ga_hid=1367852596&ga_fc=false&fws=128&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 227 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://soo.gd cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html bff7584212ddb0a7a391d3d49eb0f06a.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	46ms 14ms	Other text/html	2a00:1450:4001:829::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://bff7584212ddb0a7a391d3d49eb0f06a.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	27ms 7ms	Other text/html	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	/ www.urcom.postedu.ru/	1 KB 1 KB	407ms 160ms	Document text/html	185.154.54.5 EUROBYTE Eurobyte...
General Check archive.org Show headers Download Go to Full URL http://www.urcom.postedu.ru/ Requested by Host: soo.gd URL: https://soo.gd/z0zZ Protocol HTTP/1.1 Server 185.154.54.5 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU), Reverse DNS isp105.eurobyte.ru Software nginx/1.16.1 / Resource Hash Request headers Host www.urcom.postedu.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx/1.16.1 Date Sun, 07 Mar 2021 15:22:48 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive
GET H2	200	sodar pagead2.googlesyndication.com/getconfig/	8 KB 7 KB	36ms 17ms	XHR application/json	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021030301&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6562 x-xss-protection 0
GET H3-Q050	200	sodar2.js tpc.googlesyndication.com/sodar/	17 KB 7 KB	41ms 27ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030301.js?31060337 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 15:22:48 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1611170586013198" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6403 x-xss-protection 0 expires Sun, 07 Mar 2021 15:22:48 GMT
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/221/ Frame BDF0	12 KB 5 KB	7ms 6ms	Document text/html	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/221/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://soo.gd/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://soo.gd/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4984 date Sun, 07 Mar 2021 01:19:32 GMT expires Mon, 07 Mar 2022 01:19:32 GMT last-modified Tue, 08 Dec 2020 21:41:15 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 50596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3-Q050	200	cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js pagead2.googlesyndication.com/bg/ Frame BDF0	14 KB 6 KB	33ms 19ms	Script text/javascript	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 07 Mar 2021 07:17:22 GMT content-encoding br x-content-type-options nosniff last-modified Mon, 01 Mar 2021 10:45:00 GMT server sffe age 29126 vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5702 x-xss-protection 0 expires Mon, 07 Mar 2022 07:17:22 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 224 B	40ms 40ms	Image image/gif	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021030301&jk=2478519936342596&bg=!DwylDE_NAAWsVXnBrDsAKQB2-Dxa5-dYWU4Vsg3ZyktorrcbT6WmCQeFCTB4h4hjhoZEWNDcymMUAgAAAFpSAAAACmgBBwoAwcFM9-XqTeSyro55o9pqxbJqlNKnF0VhypCnq8v4gohh1ttTdQh-ZBN0A4jriTRa4rDIW3_JY9hc_bUaK1CsbLSz3gS2xEj7yp1VZjtE-HorFwScXUBAqGn9EZjWWIHcciRBfwgzGu_o4esOkQGABbw_A4Nt59_4oJBtIBwKgSUDryTtQeb74-g6gGMOCMQxFWze6M_c53UFQUPKfsBsUa2Ur0PEWgT5Q_MNQo5CVjOIXRtthAX89l1fa1Tcm7Yp0YWZAe31QQfY7aktOIWDBlKwwRxM4uUgOrUBvx-Abo0YE6dqoxkUt0Wpq_Y8mJdPKtNtaiqtQkuJCLgIjiodyFNGda3_kNv6J8xb_SBvzjtzipiVKIhbKcKrhas0sMfLUcygSi_xwc2PgWgb7Zqwr2zKJDIH6S5rgyE51FG5hmQNgKpbbZDPksJwoSPZ2aV3MorJ6a70C3ftJnbUnSa8TSQq7N4YKosOsxaPhXNIdXVKh8TNsn3BXr2jv5f6GTIBDKBp1eSSJ0ED25E1_KJ5pUiPzmfoWa3u3wqfFCfPF_3AM6rlqs1sYWZBUJBdLuKBQkjWLzzhxCmWKceH3ZqelEbHd6463f3g0MWPavtpbb0-8GFiSBBg56CLm66Ae_H_D5l8dC7C8pljdMqLurEyRI3-gLyqw8wAl6j-pPQSGGgYfWnKsf4lFPOEG_sS5mPm24mJEctc3AoUfsBbCU4r6xWNoDU1Qlwzkjzo2DRglK64KSA5W9_ORmlJfaEfKyPvjP3JsLxwFJCYHbqLaUrF7gXwz9UvOsHokbkbwrUzr0tIOxuywSe7_GOkYFJBlfswQuPp3Tj8kVB9O-U8D1mF8Ko-YjKPyThiIyotzWU5qN09GbT3WYkOa9xMs54jGuO4f7-HYyJ9BaBx4gMOt6ehA0E1 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://soo.gd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 07 Mar 2021 15:22:48 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	Primary Request Cookie set / Show response flirthere-andnow1.com/	7 KB 7 KB	1599ms 387ms	Document text/html	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Requested by Host: www.urcom.postedu.ru URL: http://www.urcom.postedu.ru/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 589c50e188cafcfe6d28a8e11a3f15cb734fc87de04cd69f618cb0ac1c2f40e2 Request headers Host flirthere-andnow1.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer http://www.urcom.postedu.ru/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://www.urcom.postedu.ru/ Response headers Server nginx Date Sun, 07 Mar 2021 15:22:50 GMT Content-Type text/html Content-Length 6813 Connection keep-alive Cache-Control private no-transform Set-Cookie sid=t4~pedvja2vnsraf0ywmsxrltc0; path=/
GET H/1.1	200 OK	animate.min.css flirthere-andnow1.com/media/dating/toon2/css/	52 KB 4 KB	202ms 201ms	Stylesheet text/css	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/media/dating/toon2/css/animate.min.css Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:50 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 11:05:32 GMT Server nginx ETag W/"5def7bfc-ce35" Vary Accept-Encoding Content-Type text/css Cache-Control no-transform Connection close
GET H/1.1	200 OK	style.css flirthere-andnow1.com/media/dating/toon2/css/	8 KB 2 KB	293ms 95ms	Stylesheet text/css	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/media/dating/toon2/css/style.css Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash b28722475035fc8fdc751034c2df8f49d66eb25cf28cf031c4e7357414a131da Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:50 GMT Content-Encoding gzip Last-Modified Wed, 26 Aug 2020 09:41:02 GMT Server nginx ETag W/"5f462e2e-21a0" Vary Accept-Encoding Content-Type text/css Cache-Control no-transform Connection close
GET H/1.1	200 OK	js.cookie.js Show response flirthere-andnow1.com/cookie/	4 KB 2 KB	307ms 102ms	Script application/javascript	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/cookie/js.cookie.js Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:50 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 11:04:42 GMT Server nginx ETag W/"5def7bca-10a8" Vary Accept-Encoding Content-Type application/javascript Cache-Control no-transform Connection close
GET H/1.1	200 OK	utils.js Show response flirthere-andnow1.com/util/	7 KB 3 KB	308ms 100ms	Script application/javascript	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/util/utils.js Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 503312e31b11fb61dca3114879dfd3476106627f021e5b9fc858b5fa4bd64254 Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:50 GMT Content-Encoding gzip Last-Modified Thu, 25 Feb 2021 17:54:28 GMT Server nginx ETag W/"6037e454-1dca" Vary Accept-Encoding Content-Type application/javascript Cache-Control no-transform Connection close
GET H/1.1	200 OK	123.jpg flirthere-andnow1.com/media/dating/toon2/images/	175 KB 166 KB	410ms 111ms	Image image/jpeg	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Show image Full URL https://flirthere-andnow1.com/media/dating/toon2/images/123.jpg Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash f6113b1f6bdd279404fd53c920f6ba411b66a897db4c67e16d2129af22370a57 Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:51 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 11:05:32 GMT Server nginx ETag W/"5def7bfc-2bbe8" Vary Accept-Encoding Content-Type image/jpeg Cache-Control no-transform Connection close
GET H/1.1	200 OK	jquery-2.2.4.min.js Show response flirthere-andnow1.com/media/dating/toon2/js/	84 KB 29 KB	329ms 112ms	Script application/javascript	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/media/dating/toon2/js/jquery-2.2.4.min.js Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:51 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 11:05:32 GMT Server nginx ETag W/"5def7bfc-14e4a" Vary Accept-Encoding Content-Type application/javascript Cache-Control no-transform Connection close
GET H/1.1	200 OK	bb.js Show response flirthere-andnow1.com/media/	639 B 676 B	398ms 109ms	Script application/javascript	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/media/bb.js Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68 Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:51 GMT Content-Encoding gzip Last-Modified Thu, 06 Aug 2020 12:54:34 GMT Server nginx ETag W/"5f2bfd8a-27f" Vary Accept-Encoding Content-Type application/javascript Cache-Control no-transform Connection close
GET H/1.1	200 OK	exit1.js Show response flirthere-andnow1.com/media/exit-new/	3 KB 2 KB	411ms 111ms	Script application/javascript	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Full URL https://flirthere-andnow1.com/media/exit-new/exit1.js Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 6f094676c46dee819cb999b333cbf70077c5c141ae968e963e341d754e41d6fe Request headers Referer https://flirthere-andnow1.com/?u=4r8k60a&o=83tpt9v&m=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:51 GMT Content-Encoding gzip Last-Modified Wed, 14 Oct 2020 16:13:02 GMT Server nginx ETag W/"5f87238e-d09" Vary Accept-Encoding Content-Type application/javascript Cache-Control no-transform Connection close
GET H2	200	css fonts.googleapis.com/	30 KB 1 KB	21ms 21ms	Stylesheet text/css	2a00:1450:400c:c07::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i|Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&subset=cyrillic,cyrillic-ext,latin-ext Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/media/dating/toon2/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::5f Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d686cad08503d1a240419c8c0cfc9461da9127475ffed992184384e6d97ee1c2 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://flirthere-andnow1.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 07 Mar 2021 15:22:50 GMT server ESF date Sun, 07 Mar 2021 15:22:50 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 07 Mar 2021 15:22:50 GMT
GET H/1.1	200 OK	bg.jpg flirthere-andnow1.com/media/dating/toon2/images/	117 KB 107 KB	448ms 134ms	Image image/jpeg	45.141.84.94 MEDIALAND-AS
General Check archive.org Show headers Download Go to Show image Full URL https://flirthere-andnow1.com/media/dating/toon2/images/bg.jpg Requested by Host: flirthere-andnow1.com URL: https://flirthere-andnow1.com/media/dating/toon2/css/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.141.84.94 , Russian Federation, ASN206728 (MEDIALAND-AS, RU), Reverse DNS Software nginx / Resource Hash 1c7361fcec43aecb4c517914dde9ecbf1fe1aaa0969411a7a383391236f335f4 Request headers Referer https://flirthere-andnow1.com/media/dating/toon2/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 07 Mar 2021 15:22:51 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 11:05:32 GMT Server nginx ETag W/"5def7bfc-1d3ca" Vary Accept-Encoding Content-Type image/jpeg Cache-Control no-transform Connection close
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwiPGQ.woff2 fonts.gstatic.com/s/lato/v17/	22 KB 23 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i|Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&subset=cyrillic,cyrillic-ext,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://flirthere-andnow1.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 03 Mar 2021 06:05:55 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:12 GMT server sffe age 379015 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22992 x-xss-protection 0 expires Thu, 03 Mar 2022 06:05:55 GMT
GET H3-Q050	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v17/	23 KB 23 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i|Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&subset=cyrillic,cyrillic-ext,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://flirthere-andnow1.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 04 Mar 2021 04:06:34 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:10:46 GMT server sffe age 299776 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 23484 x-xss-protection 0 expires Fri, 04 Mar 2022 04:06:34 GMT
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwaPGR_p.woff2 fonts.gstatic.com/s/lato/v17/	5 KB 5 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwaPGR_p.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i|Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&subset=cyrillic,cyrillic-ext,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 28927518b5750f500f8d606b8629cd40092c7f19d8d2e32c865c4902cd489543 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://flirthere-andnow1.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 04 Mar 2021 01:50:29 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:17 GMT server sffe age 307941 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5360 x-xss-protection 0 expires Fri, 04 Mar 2022 01:50:29 GMT
GET H3-Q050	200	S6uyw4BMUTPHjxAwXjeu.woff2 fonts.gstatic.com/s/lato/v17/	5 KB 5 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjxAwXjeu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i|Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&subset=cyrillic,cyrillic-ext,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b7ad361cce9dbab34c8fd714b379707d7aa40199bf90b90f9f19c7c1db5171b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://flirthere-andnow1.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 03 Mar 2021 08:43:26 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:10:46 GMT server sffe age 369564 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5480 x-xss-protection 0 expires Thu, 03 Mar 2022 08:43:26 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| requestLink number| exDays boolean| validNavigation function| wireUpEvents function| Cookies function| docReady function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId undefined| randomNumber function| $ function| jQuery boolean| PreventBb function| getUrlParameter function| getUrlWithParam boolean| PreventExitSplash string| exitsplashpage function| DisplayExitSplash function| addLoadEvent function| addClickEvent function| disablelinksfunc function| disableformsfunc

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			flirthere-andnow1.com/	1969-12-31 23:59:59	Name: sid Value: t4~pedvja2vnsraf0ywmsxrltc0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
bff7584212ddb0a7a391d3d49eb0f06a.safeframe.googlesyndication.com
flirthere-andnow1.com
fonts.googleapis.com
fonts.gstatic.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
soo.gd
tpc.googlesyndication.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.urcom.postedu.ru
142.250.186.66
185.154.54.5
2606:4700:3036::ac43:81fd
2a00:1450:4001:800::2003
2a00:1450:4001:801::2002
2a00:1450:4001:809::2008
2a00:1450:4001:811::2002
2a00:1450:4001:813::200e
2a00:1450:4001:828::2001
2a00:1450:4001:829::2001
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2002
2a00:1450:400c:c07::5f
45.141.84.94
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68
1c7361fcec43aecb4c517914dde9ecbf1fe1aaa0969411a7a383391236f335f4
28927518b5750f500f8d606b8629cd40092c7f19d8d2e32c865c4902cd489543
29aec720e772d77058fbe8aa0081fc3f1474ab2ea2ecbe5b0df5eeb70ea5905f
2b7ad361cce9dbab34c8fd714b379707d7aa40199bf90b90f9f19c7c1db5171b
503312e31b11fb61dca3114879dfd3476106627f021e5b9fc858b5fa4bd64254
589c50e188cafcfe6d28a8e11a3f15cb734fc87de04cd69f618cb0ac1c2f40e2
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f094676c46dee819cb999b333cbf70077c5c141ae968e963e341d754e41d6fe
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c
9e255ed96553f0c3d758a000b1ab28eeda20eebf9c0bc4d0061e95b0dc855cfa
b28722475035fc8fdc751034c2df8f49d66eb25cf28cf031c4e7357414a131da
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
cfd6a1f25399c6f6c272c6466f1feb8d1c87a414b6295caf1970f7fcffa8f545
cfe0593b5d803094bf2efffedc1c5031cb0d11cbdcc4286c529ac042e70e5f69
d686cad08503d1a240419c8c0cfc9461da9127475ffed992184384e6d97ee1c2
f6113b1f6bdd279404fd53c920f6ba411b66a897db4c67e16d2129af22370a57