urlscan.io logo urlscan.io
SecurityTrails logo

hexrom.com Open in urlscan Pro
2606:4700:20::681a:267  Public Scan

Go To Rescan Add Verdict Report
URL: https://hexrom.com/halo-2/download/
Submission Tags: falconsandbox
Submission: On March 16 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 3 countries across 10 domains to perform 23 HTTP transactions. The main IP is 2606:4700:20::681a:267, located in United States and belongs to CLOUDFLARENET, US. The main domain is hexrom.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 26th 2023. Valid for: a year.
This is the only time hexrom.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:20:... 13335 (CLOUDFLAR...)
1 173.233.137.52 7979 (SERVERS-COM)
1 23.109.248.145 7979 (SERVERS-COM)
2 2600:9000:205... 16509 (AMAZON-02)
2 172.64.173.27 13335 (CLOUDFLAR...)
2 216.137.45.11 16509 (AMAZON-02)
2 188.114.96.3 13335 (CLOUDFLAR...)
1 2a03:2880:f11... 32934 (FACEBOOK)
4 6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
23 11
8    2606:4700:20::681a:267 (United States)

ASN13335 (CLOUDFLARENET, US)
hexrom.com
1    173.233.137.52 (United States)

ASN7979 (SERVERS-COM, US)
triumphantadvantage.com
1    23.109.248.145 (Netherlands)

ASN7979 (SERVERS-COM, US)
kerattogeist.com
2    2600:9000:2057:2e00:f:9fb4:2380:21 (United States)

ASN16509 (AMAZON-02, US)
dq06u9lt5akr2.cloudfront.net
2    172.64.173.27 (United States)

ASN13335 (CLOUDFLARENET, US)
pogothere.xyz
2    216.137.45.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-216-137-45-11.atl56.r.cloudfront.net
ydenknowled.com
2    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
denansgdfierc.com
1    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
6    2a00:1450:4001:829::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
2    2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Apex Domain
Subdomains		 Transfer
8 hexrom.com
hexrom.com
60 KB
6 google.com
accounts.google.com — Cisco Umbrella Rank: 73
3 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 25
20 KB
2 denansgdfierc.com
denansgdfierc.com
813 B
2 ydenknowled.com
ydenknowled.com
2 KB
2 pogothere.xyz
pogothere.xyz — Cisco Umbrella Rank: 27761
101 KB
2 cloudfront.net
dq06u9lt5akr2.cloudfront.net
48 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 108
1 kerattogeist.com
kerattogeist.com
1 triumphantadvantage.com
triumphantadvantage.com
23 10
Domain Requested by
8 hexrom.com hexrom.com
6 accounts.google.com 4 redirects hexrom.com
2 www.google-analytics.com hexrom.com
www.google-analytics.com
2 denansgdfierc.com hexrom.com
2 ydenknowled.com dq06u9lt5akr2.cloudfront.net
2 pogothere.xyz dq06u9lt5akr2.cloudfront.net
2 dq06u9lt5akr2.cloudfront.net hexrom.com
ydenknowled.com
1 www.facebook.com hexrom.com
1 kerattogeist.com hexrom.com
1 triumphantadvantage.com hexrom.com
23 10

This site contains links to these domains. Also see Links.

Domain
dl2.hexrom.com
www.facebook.com
www.youtube.com
t.me
www.pinterest.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-01-26 -
2024-01-26		 a year crt.sh
triumphantadvantage.com
R3		 2023-03-10 -
2023-06-08		 3 months crt.sh
kerattogeist.com
R3		 2023-02-14 -
2023-05-15		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2022-12-08 -
2023-12-07		 a year crt.sh
ydenknowled.com
Amazon RSA 2048 M02		 2023-03-09 -
2024-04-06		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-01-10 -
2023-03-24		 2 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-03-02 -
2023-05-25		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://hexrom.com/halo-2/download/
Frame ID: A179CA63682F26B28DF6E1DD42A55C5D
Requests: 26 HTTP requests in this frame

Frame: https://ydenknowled.com/b1dqTVYONQkgaQ5qCGsjHTtXaGQpclgLMh5nXDhvAyNfLD0dZUQuOgAiDiskADkeYzgKI09/EFYFBx9gNTsNIRUXBisXLCYZIiEiBzM8NRs5EAYqEgg8IAM8NQ0tNG4LGQ0iAzplUiUaKi88LAEuBisMHAMzAQQBLS0zJQE5IC4DPzkNOX0XWh4NFx46OV40EC0CJBcCJg8iOmZaGigADC4DMCoTPSMIAwUEMi86OV8dWgsfJhBbIgApbj8sEVsDLzoxVxw4ABw+ZRp/FQhiLiw4NQE5Jj4ADlsuYj5lGn8TFxojLzglFTkeBFYzLBwVOhASOwc6egIaGTsOPwsxIiEjOg89ExM1PDk9Ehk3XBEhHgAtbg4LBDwTPgwvLAUwCTcIASgeEDZnJjpuCQZYPWQuL1ILGxY7JBVnPTggHCEmFD4YPD4CDSo3NzM8GxA1ZQl8ECIBMhchOhFTGDcrAiwFFwwmJn0QJh4tfGc6ZjgbNAIWOB9nDHEAPjkBJ1csHyonBCNjWDAie2Ve
Frame ID: F0BE41A93D5C2FF3B37AE69E85202F32
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Halo 2 Microsoft Xbox, ROM Download (USA)

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

23
Requests

91 %
HTTPS

50 %
IPv6

10
Domains

10
Subdomains

11
IPs

3
Countries

232 kB
Transfer

410 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP 302
  • https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AWnogHel_SzrVk-msB9Z50Xr59HLiqZl28g7OOPmOuHH6XYPUR5hXFS5o_r_BFSKTkcjcua69ifvhQ HTTP 302
  • https://accounts.google.com/v3/signin/identifier?dsh=S1477441503%3A1678982704482032&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AWnogHef5YXCv5DWucEFddL5l1Au4SWWjdrTEUQsbIV9MHPwVr2VNOHogq3YxXAM3Fe23Yh8m_VfJw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
Request Chain 17
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP 302
  • https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AWnogHf8hGBPHKxpNmp_zC-eBXWaYSP_EtnYl1Z76VSui8PQnZ5Z172acGYFGbdowrdPn5vo-pm5FQ HTTP 302
  • https://accounts.google.com/v3/signin/identifier?dsh=S420029967%3A1678982704519434&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AWnogHdmOhhq-ycWUBp-WVMlwYJ797SWsuAqiLIdtwEJFbzAg5w1vdezGUPJ9DSeL6fYGXJIS8JSHw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
hexrom.com/halo-2/download/ 		33 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e056e1591b1a1e3b710d64140efd39c8211bf99936bfee557f3575b9cd60596b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-apo-via
origin,page-rules
cf-cache-status
BYPASS
cf-edge-cache
cache,platform=wordpress
cf-ray
7a8e3c4a1cf22bc2-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 16 Mar 2023 16:05:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hLrkh23a5TumNGgu2SspAZqa8MWrrvv7%2BUGWyIcoS80P0pcBeOebR3b08dN2gtPV4u1SlqI8S%2F60YIsLIo8q6%2FhGxDmtuTIlUIazgQ0sCc6IilTWahzln2xoS8oCYVWfiyt6oADQw3s%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-dns-prefetch-control
on
x-litespeed-cache
miss
x-litespeed-cache-control
public,max-age=604800
x-litespeed-tag
b62_HTTP.200,b62_post,b62_URL.d432e7cb69686b5d8d5510846e62ae61,b62_Po.249461,b62_,b62_MIN.35812e1121eec0deacfcee4ff45cb688.css
35812e1121eec0deacfcee4ff45cb688.css
hexrom.com/wp-content/litespeed/css/ 		39 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hexrom.com/wp-content/litespeed/css/35812e1121eec0deacfcee4ff45cb688.css?ver=74dfd
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db1bb59e98030689f3fdb8f0956ac6fd7edb79cb82eb79b660c5381d325df2f5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:03 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Thu, 16 Mar 2023 13:37:48 GMT
server
cloudflare
age
5627
cf-polished
origSize=40257
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dqogl0nbT15Zy3u8JD0jkNt8iQe7EmMaRtYuiu3t4eSHblscvz%2FjzEOn2cFLtdyysHZdhoZnMVI2TfdEu9GG35rTkPhPEmUS1J2%2F%2FfmHbp2I5uLIidLRcdVVedRhJOK3JsA%2BqsSTgMQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7a8e3c4bc80d2bc2-FRA
expires
Fri, 15 Mar 2024 19:37:48 GMT
invoke.js
triumphantadvantage.com/b624d9539dce8efd45d92d75bb17c4d0/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://triumphantadvantage.com/b624d9539dce8efd45d92d75bb17c4d0/invoke.js
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.233.137.52 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Thu, 16 Mar 2023 16:05:04 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
56669
kerattogeist.com/trNzG3CDv2oE/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://kerattogeist.com/trNzG3CDv2oE/56669
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_CBC
Server
23.109.248.145 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers
facebook.jpg
hexrom.com/wp-content/uploads/2021/08/ 		936 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/wp-content/uploads/2021/08/facebook.jpg
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b24518411ac442923f59fde93a95d401237ca1a1cdabc3e7764a20d831897ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:03 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1582071
cf-polished
origFmt=jpeg, origSize=1883
content-disposition
inline; filename="facebook.webp"
content-length
936
cf-bgj
imgq:100,h2pri
last-modified
Tue, 03 Aug 2021 20:27:56 GMT
server
cloudflare
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TVGu%2BarnCOGi8jGWAwim2cv7X4uKawef52E93T3HNmnFXXEAqZuWhHFq4J3h7KQd%2BrX26GaHTDn%2FITS%2FrHAefawIXM1U294fdsl4La03UfGJl3opdQl6pVo%2Fzg09v0mjo4Lp%2BiVtBK4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c4be84d2bc2-FRA
expires
Sat, 24 Feb 2024 23:54:31 GMT
youtube.jpg
hexrom.com/wp-content/uploads/2021/08/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/wp-content/uploads/2021/08/youtube.jpg
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31b1a3e93df2b7bb083443cff0b2ce51299eacdd0ddf4417dc19066d7ecc1ad4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:03 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1720642
cf-polished
origSize=2604, status=webp_bigger
content-length
1764
cf-bgj
imgq:100,h2pri
last-modified
Tue, 03 Aug 2021 20:27:54 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=75iCsMAYoFY3F6iDjB8llOc2rnam8AuiU9yu%2BCXiRw2D12IG4gu6LGQdexHXLOQy%2F%2BclvPhRhhLADepYGlBeYrTtlY7mHO2u5rUxyPzD7gZnr62PS2meE5t7D1zc9gYlD6b9OKDq%2Ftw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c4be8502bc2-FRA
expires
Sat, 24 Feb 2024 23:54:31 GMT
pintres.jpg
hexrom.com/wp-content/uploads/2021/08/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/wp-content/uploads/2021/08/pintres.jpg
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38e1a961a7a32b9b37f285bf39f983eeed249c252646a0196af58b63e648643d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:03 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1720642
cf-polished
origSize=2459, status=webp_bigger
content-length
1628
cf-bgj
imgq:100,h2pri
last-modified
Tue, 03 Aug 2021 20:27:53 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vrvCpMVNr%2FLLTOJBSt9qoAeMlVvxQcbFZJZv7knHIzu5cYAVRY7V71NCtubiuekdcq7RoZ%2BYwg5BAfNudeHnY8x2TVnvGD8CZyIHlGZbDnFRCfe1xW2ncLcJvcRjXcz2szii2rm85UI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c4be8522bc2-FRA
expires
Sat, 24 Feb 2024 23:54:31 GMT
/
dq06u9lt5akr2.cloudfront.net/ 		146 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dq06u9lt5akr2.cloudfront.net/?tluqd=938621
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:2e00:f:9fb4:2380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
39b3542ab7c9b9a4b7e9fa3426b7f28c6c9317d0b713928cfdf1b7923bbf6e19

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 16 Mar 2023 16:05:04 GMT
content-encoding
gzip
via
1.1 89c822bb1ce1445a7be6d1057088cfbe.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-length
47982
x-amz-cf-id
iDFFu_KRJ_41UQ2j8rKsKRm1Nr30NJZuXPfuo-bdC3au3xPVrTEmLA==
truncated
/ 		142 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
551c87f5b41fec34a473d110b383281966d288b1d931c5b043d7ebbcb42ede65

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		138 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8cae95c8c71b46c5672b15a8faac557c0706ce38b1132535c4509492cbe2308

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		142 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0067822d555f43b78beaad36e9bfbcc923f0b445a05fc23c89c48b58fca18b23

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
asd100.bin
pogothere.xyz/ 		100 KB
101 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pogothere.xyz/asd100.bin
Requested by
Host: dq06u9lt5akr2.cloudfront.net
URL: https://dq06u9lt5akr2.cloudfront.net/?tluqd=938621
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.173.27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
107
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 16 Mar 2023 16:03:17 GMT
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
https://hexrom.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yBG34%2BiCSb2Xpz4x21Y%2BYO6Sg0tip08b4zxTY2Y8skpd%2BKiNQrNRwtrTQnBHMx3c0dE2eIjUHFt3xsCGcodLt7Wi4JBg7mAIG0a4KcbiDnuZYBG7gzkxaHaM9lmDX2Co"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
access-control-allow-credentials
true
cf-ray
7a8e3c4dbe399bf4-FRA
access-control-allow-headers
X-Requested-With, content-type
/
pogothere.xyz/ 		26 B
377 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pogothere.xyz/
Requested by
Host: dq06u9lt5akr2.cloudfront.net
URL: https://dq06u9lt5akr2.cloudfront.net/?tluqd=938621
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.173.27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ff521a948580c10109cb6f84e8424f49431c9a1bfbc46df62d9b275df6b9d61

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vIYj%2Bu7eHQblU53BeuLXOd1Iq4fI6xWOEeIr0jQgE6VdYGqOudchemHnRNcOPZslNrYUNmrxwup8ZV9yF7bl0cgzsD9jsuZwIlnpBLRx%2BTJPJsje%2Fn6dir5QwOhJ3uk8"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET
access-control-allow-origin
https://hexrom.com
content-type
text/plain
access-control-allow-credentials
true
cf-ray
7a8e3c4dbe3b9bf4-FRA
access-control-allow-headers
X-Requested-With, content-type
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
utx
ydenknowled.com/ 		0
535 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ydenknowled.com/utx?cb=GdxRDmAFGSPg&top=hexrom.com&tid=938621
Requested by
Host: dq06u9lt5akr2.cloudfront.net
URL: https://dq06u9lt5akr2.cloudfront.net/?tluqd=938621
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.137.45.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-216-137-45-11.atl56.r.cloudfront.net
Software
openresty/1.17.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 16 Mar 2023 16:05:04 GMT
via
1.1 c54903daf21f7fbf61850130aa9704ca.cloudfront.net (CloudFront)
server
openresty/1.17.8.2
accept-ch
DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-amz-cf-pop
ATL56-C2
x-cache
Miss from cloudfront
p3p
CP="NID DSP ALL COR"
access-control-allow-origin
https://hexrom.com
cache-control
no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials
true
x-amz-cf-id
OdjbJ9J4U-poSR9jJqqWYF0Zsvj-9gBx7Pgoczdy8nVMCFPolbG4Ig==
FQhiLiw4NQE5Jj4ADlsuYj5lGn8TFxojLzglFTkeBFYzLBwVOhASOwc6egIaGTsOPwsxIiEjOg89ExM1PDk9Ehk3XBEhHgAtbg4LBDwTPgwvLAUwCTcIASgeEDZnJjpuCQZYPWQuL1ILGxY7JBVnPTggHCEmFD4YPD4CDSo3NzM8GxA1ZQl8ECIBMhchOhFTGDcrA...
ydenknowled.com/b1dqTVYONQkgaQ5qCGsjHTtXaGQpclgLMh5nXDhvAyNfLD0dZUQuOgAiDiskADkeYzgKI09/EFYFBx9gNTsNIRUXBisXLCYZIiEiBzM8NRs5EAYqEgg8IAM8NQ0tNG4LGQ0iAzplUiUaKi88LAEuBisMHAMzAQQBLS0zJQE5IC4DPzkNOX0XW... Frame F0BE 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ydenknowled.com/b1dqTVYONQkgaQ5qCGsjHTtXaGQpclgLMh5nXDhvAyNfLD0dZUQuOgAiDiskADkeYzgKI09/EFYFBx9gNTsNIRUXBisXLCYZIiEiBzM8NRs5EAYqEgg8IAM8NQ0tNG4LGQ0iAzplUiUaKi88LAEuBisMHAMzAQQBLS0zJQE5IC4DPzkNOX0XWh4NFx46OV40EC0CJBcCJg8iOmZaGigADC4DMCoTPSMIAwUEMi86OV8dWgsfJhBbIgApbj8sEVsDLzoxVxw4ABw+ZRp/FQhiLiw4NQE5Jj4ADlsuYj5lGn8TFxojLzglFTkeBFYzLBwVOhASOwc6egIaGTsOPwsxIiEjOg89ExM1PDk9Ehk3XBEhHgAtbg4LBDwTPgwvLAUwCTcIASgeEDZnJjpuCQZYPWQuL1ILGxY7JBVnPTggHCEmFD4YPD4CDSo3NzM8GxA1ZQl8ECIBMhchOhFTGDcrAiwFFwwmJn0QJh4tfGc6ZjgbNAIWOB9nDHEAPjkBJ1csHyonBCNjWDAie2Ve
Requested by
Host: dq06u9lt5akr2.cloudfront.net
URL: https://dq06u9lt5akr2.cloudfront.net/?tluqd=938621
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.137.45.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-216-137-45-11.atl56.r.cloudfront.net
Software
openresty/1.17.8.2 /
Resource Hash
527ef1fa25c83829d98830647b396f3089c5060b4e9be0b148008215be50a23f

Request headers

Referer
https://hexrom.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
cache-control
no-store, no-cache, must-revalidate, no-transform
content-encoding
gzip
content-length
1235
content-type
text/html
date
Thu, 16 Mar 2023 16:05:04 GMT
p3p
CP="NID DSP ALL COR"
pragma
no-cache
server
openresty/1.17.8.2
via
1.1 c54903daf21f7fbf61850130aa9704ca.cloudfront.net (CloudFront)
x-amz-cf-id
A76_DJ0VQCWuj8nkY9L9geNj2-UdZ8LKQ_9-aRYb3y33DUDroz_byw==
x-amz-cf-pop
ATL56-C2
x-cache
Miss from cloudfront
R2ljR2poVgA0VxMuVigIdBlXEVt2MzAPPB8+D34kIT85JDwsGkUzAyNUWnRScVtSYRouDV52TDQdAjMfNFRSYQMpDwx6TDFUUmlZc0dQdUR1TxZ6W2EdEyYNelhFNx4zBV52XHBRWn9YcFlXdV52
denansgdfierc.com/ 		0
416 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://denansgdfierc.com/R2ljR2poVgA0VxMuVigIdBlXEVt2MzAPPB8+D34kIT85JDwsGkUzAyNUWnRScVtSYRouDV52TDQdAjMfNFRSYQMpDwx6TDFUUmlZc0dQdUR1TxZ6W2EdEyYNelhFNx4zBV52XHBRWn9YcFlXdV52
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sbyupg%2BVkqAZDyGPP33rugk2XXHvTxCchZUadQ%2ButXYTIqpe2p3WuhQOqsm7szp%2B9oISelJwt6STAK1R5hK9s34pb2CKPijoTXutf5ZGVuuhX19VPXwX2%2FhrwVrM0SZDPhzg%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
7a8e3c4dfa323aa3-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
login.php
www.facebook.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers
identifier
accounts.google.com/v3/signin/
Redirect Chain
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
  • https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AWnogHel_SzrVk-msB9Z50Xr59HLiqZl28g7OOPmOuHH6XYPUR5hXFS5o_r_BFS...
  • https://accounts.google.com/v3/signin/identifier?dsh=S1477441503%3A1678982704482032&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AWnogHef5YXCv5DWucEFddL5l1Au4SWWjdrTEUQsbIV9MHPwVr...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://accounts.google.com/v3/signin/identifier?dsh=S1477441503%3A1678982704482032&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AWnogHef5YXCv5DWucEFddL5l1Au4SWWjdrTEUQsbIV9MHPwVr2VNOHogq3YxXAM3Fe23Yh8m_VfJw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Server
2a00:1450:4001:829::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Redirect headers

date
Thu, 16 Mar 2023 16:05:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-KeeqGzclTqtGp0pkwVFd9w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
392
x-xss-protection
1; mode=block
pragma
no-cache
server
GSE
x-frame-options
DENY
report-to
{"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type
text/html; charset=UTF-8
location
https://accounts.google.com/v3/signin/identifier?dsh=S1477441503%3A1678982704482032&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AWnogHef5YXCv5DWucEFddL5l1Au4SWWjdrTEUQsbIV9MHPwVr2VNOHogq3YxXAM3Fe23Yh8m_VfJw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only
same-origin; report-to="coop_gse_qebhlk"
expires
Mon, 01 Jan 1990 00:00:00 GMT
identifier
accounts.google.com/v3/signin/
Redirect Chain
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
  • https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AWnogHf8hGBPHKxpNmp_zC-eBXWaYSP_EtnYl1Z76VSui8PQnZ5Z172acGY...
  • https://accounts.google.com/v3/signin/identifier?dsh=S420029967%3A1678982704519434&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AWnogHdmOhhq-ycWUBp-WVMlwYJ797SWsuAqiLIdtwEJFbzAg5...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://accounts.google.com/v3/signin/identifier?dsh=S420029967%3A1678982704519434&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AWnogHdmOhhq-ycWUBp-WVMlwYJ797SWsuAqiLIdtwEJFbzAg5w1vdezGUPJ9DSeL6fYGXJIS8JSHw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H3
Server
2a00:1450:4001:829::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Redirect headers

date
Thu, 16 Mar 2023 16:05:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-QLxVtIXHBh-cgEhvyJX-AA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
395
x-xss-protection
1; mode=block
pragma
no-cache
server
GSE
x-frame-options
DENY
report-to
{"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type
text/html; charset=UTF-8
location
https://accounts.google.com/v3/signin/identifier?dsh=S420029967%3A1678982704519434&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AWnogHdmOhhq-ycWUBp-WVMlwYJ797SWsuAqiLIdtwEJFbzAg5w1vdezGUPJ9DSeL6fYGXJIS8JSHw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only
same-origin; report-to="coop_gse_qebhlk"
expires
Mon, 01 Jan 1990 00:00:00 GMT
truncated
/ 		801 B
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aca8211af375263aa2a1996114b6db1fd614963aeb2ac751c48f83790a8b707f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
text/javascript
truncated
/ 		370 B
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
acbd52aa4a04901d08c184a0d5175246bd10cd5c05e168aaa5f48ff6e1eca4b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
text/javascript
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 16 Mar 2023 15:19:33 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
2731
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Thu, 16 Mar 2023 17:19:33 GMT
collect
www.google-analytics.com/j/ 		3 B
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=975204296&t=pageview&_s=1&dl=https%3A%2F%2Fhexrom.com%2Fhalo-2%2Fdownload%2F&ul=en-us&de=UTF-8&dt=Halo%202%20Microsoft%20Xbox%2C%20ROM%20Download%20(USA)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1611377866&gjid=1428789937&cid=1535486160.1678982704&tid=UA-196799283-1&_gid=99583995.1678982704&_r=1&_slc=1&z=1446585196
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://hexrom.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 16 Mar 2023 16:05:04 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://hexrom.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
9RmR6ZlglCxQAZzINHlthdVxMVGlgDgkJNjZZGy8dNgoUU28hLExVaWAQAAJldkIWBzYhWVwDNiVZS0A5IgZHUn4yFBUNZTIXHw05MBMZATZgERtbNSkeEwo0J0FIIG1oVF9UaG4TEwg8KRMJQ2p2Cg5DanZVSkhoY1c4Q2p2ExMIbnJBSSR9dFQCUGxvQU-hWOTY...
dq06u9lt5akr2.cloudfront.net/ Frame F0BE 		825 B
877 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dq06u9lt5akr2.cloudfront.net/9RmR6ZlglCxQAZzINHlthdVxMVGlgDgkJNjZZGy8dNgoUU28hLExVaWAQAAJldkIWBzYhWVwDNiVZS0A5IgZHUn4yFBUNZTIXHw05MBMZATZgERtbNSkeEwo0J0FIIG1oVF9UaG4TEwg8KRMJQ2p2Cg5DanZVSkhoY1c4Q2p2ExMIbnJBSSR9dFQCUGxvQU-hWOTYUFgMvIwYRDyxjVjxTa3FKSVB9dFRSDTAyCRZDagVBSFY0Lw8fQ2p2Ax8FMylNX1RoJQwICTUjQUggaXdVVFZ2c1FMVXZwUF9UaDUFHAcqL0FIIG11U1RVbmARR1c
Requested by
Host: ydenknowled.com
URL: https://ydenknowled.com/b1dqTVYONQkgaQ5qCGsjHTtXaGQpclgLMh5nXDhvAyNfLD0dZUQuOgAiDiskADkeYzgKI09/EFYFBx9gNTsNIRUXBisXLCYZIiEiBzM8NRs5EAYqEgg8IAM8NQ0tNG4LGQ0iAzplUiUaKi88LAEuBisMHAMzAQQBLS0zJQE5IC4DPzkNOX0XWh4NFx46OV40EC0CJBcCJg8iOmZaGigADC4DMCoTPSMIAwUEMi86OV8dWgsfJhBbIgApbj8sEVsDLzoxVxw4ABw+ZRp/FQhiLiw4NQE5Jj4ADlsuYj5lGn8TFxojLzglFTkeBFYzLBwVOhASOwc6egIaGTsOPwsxIiEjOg89ExM1PDk9Ehk3XBEhHgAtbg4LBDwTPgwvLAUwCTcIASgeEDZnJjpuCQZYPWQuL1ILGxY7JBVnPTggHCEmFD4YPD4CDSo3NzM8GxA1ZQl8ECIBMhchOhFTGDcrAiwFFwwmJn0QJh4tfGc6ZjgbNAIWOB9nDHEAPjkBJ1csHyonBCNjWDAie2Ve
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:2e00:f:9fb4:2380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
512013e01aa2c89c425ccee22b4c404b3314b599965bd65275e51fc9447468e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ydenknowled.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
content-encoding
gzip
via
1.1 89c822bb1ce1445a7be6d1057088cfbe.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
max-age=31556926
content-length
601
x-amz-cf-id
HwDb7m03FIzxbjfz8Tm2Mo7FgixO8_BIfiO2JyUgjqhsE8i5mS9MCQ==
popunder.gif
denansgdfierc.com/ 		35 B
397 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://denansgdfierc.com/popunder.gif
Requested by
Host: hexrom.com
URL: https://hexrom.com/halo-2/download/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
public
date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 23:30:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
59701
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1xrfIX28zJhjNCRSHvRwt6WSivPsBdo6STV7tl86Kyx%2FhpxbR3NaZH4FksVqDldUQyvfAQbDAVYBpzK2Xh4GpuRz4VPBD1S9OA2WXBykfJe241HEDsdnxJIc13mNcQI2R60qDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800, immutable
cf-ray
7a8e3c501dfe3aa3-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Halo%202.jpg
hexrom.com/images/icon/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/images/icon/Halo%202.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f2d2cbbd0eabe57450a0a76c495f1d3d8aef64f647d88e90d60cd488ae5bb28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
HIT
cf-bgj
imgq:100,h2pri
last-modified
Tue, 29 Dec 2020 15:17:05 GMT
server
cloudflare
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origSize=16091, status=webp_bigger
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QsM3bUhJK8LwSTU5Rs621%2Begg8utRt80mt55rVnMK3ZMlcqyUrNJ3GCpJB4PImUFJ3YPytWTo4%2FhjYxi5cfCsHkDXtX80Gp19UxUCiTicgsq%2F6PPp1KplkNAFLiquVsxXb4mLukboIw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c518bdd2bc2-FRA
content-length
14542
expires
Sat, 09 Mar 2024 07:04:25 GMT
telegram.jpg
hexrom.com/wp-content/uploads/2021/08/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/wp-content/uploads/2021/08/telegram.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1fe061cc0fa590e5c191305bea72207662f1a0353485794a6b5a42c77bef00d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1720633
cf-polished
origSize=1939, status=webp_bigger
content-length
1107
cf-bgj
imgq:100,h2pri
last-modified
Tue, 03 Aug 2021 20:27:54 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BS3YzFzCyI5N2eW%2Fo8e65%2BgO8TqVR7sXB4KamYY83uaWmsC%2BXpR%2FGHNSmfsbOzNOi1r4N9ELxKMv0d5KhLGp2S4%2BoFbA4Yiqgj9PuCeUme%2BYS%2Bo69DPrk%2FBcb67%2F6shJnrr2q1nrrDY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c518be12bc2-FRA
expires
Sat, 24 Feb 2024 23:54:34 GMT
Halo%20-%20Combat%20Evolved.jpg
hexrom.com/images/icon/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hexrom.com/images/icon/Halo%20-%20Combat%20Evolved.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:267 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20246d470c6038055362d2a58ae28f88d60c2bb70343e8d1c7ae0eb9211ade56

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hexrom.com/halo-2/download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Thu, 16 Mar 2023 16:05:04 GMT
cf-cache-status
HIT
cf-bgj
imgq:100,h2pri
last-modified
Sat, 04 Jul 2020 10:04:29 GMT
server
cloudflare
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origSize=19637, status=webp_bigger
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=81ubmC68Hdhx%2BfM3TFdJ5zGrHPic8DkBDVPch%2Bjg%2B54O4J6FLV4aX8q%2FJcATbMXziNXoFWTKrcvyzJdPcOCNe7bQrgaD6gAyfRr2FXWPR7uXKuGwqFoLWSHpekJzHDiTiw7V0feCr1Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7a8e3c518be32bc2-FRA
content-length
17900
expires
Sun, 25 Feb 2024 03:44:40 GMT

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless number| LAST_CORRECT_EVENT_TIME object| utr_938621 number| userTrackingInterval number| _2573563148 function| LazyLoad function| like_post object| button object| htmlCode string| a string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData number| iinf

6 Cookies

Domain/Path Name / Value
pogothere.xyz/ Name: csu
Value: 720672758048872@1@1678982704
.hexrom.com/ Name: _ga
Value: GA1.2.1535486160.1678982704
.hexrom.com/ Name: _gid
Value: GA1.2.99583995.1678982704
.hexrom.com/ Name: _gat
Value: 1
kerattogeist.com/ Name: GL_UI4
Value: eJw9TVlugzAUhJilUQrqSBwgR8ARVMln1UP0E3l5EDdgR8YN6u1rVWrnZ0azaJIk2TU10kfBwL5Ej2PbndWousspgkR7HmXL%2B4uS3auQ%2FUkp7M06BCFnChmeJ7LkjRqU01ThJUZ%2Fzs26zWbIpRdWV8iX2JgrlNK7bSXfMGRWLITi%2Fepd5HwRn86Dcc6jNjbqtMXOrQ2r9yg%2FjNVxWB%2Bw421dFQkO91mE0fllMLpIkU9eaEL6hiclAk3Of6PUtN6CuwNu1sN%2F%2F%2FeXbbxFoelhVDx34Ur%2BB7aESuI%3D
kerattogeist.com/ Name: GL_GI10
Value: eJxljE1qwzAUhB25cWNaEgZyAF8gBtU17TZtnGbTVQ8ghPMcRLGekJQQ9%2FTND5RAd8M3802SJGI%2BhTAOM%2Flal0%2ByKmVdl7J6Rrojhlg1eGx5b6MflNU94f6DfK%2FtgMzTzrCF2DR4uGbV8pYwXjWLG3axxhsKgXDXmjgAa6%2Ftd7f3sdB98amNRX4urvr8pP8fpCY4oJLypSq%2ByB9MS6FYviG3FFVwRFvk7%2Bwdex0J0z96%2BcxSTExQzvNxyEaYRdPTD1tS3HWB4gmNDpn4BeBuT8k%3D

3 Console Messages

Source Level URL
Text
network error URL: https://accounts.google.com/v3/signin/identifier?dsh=S1477441503%3A1678982704482032&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AWnogHef5YXCv5DWucEFddL5l1Au4SWWjdrTEUQsbIV9MHPwVr2VNOHogq3YxXAM3Fe23Yh8m_VfJw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://accounts.google.com/v3/signin/identifier?dsh=S420029967%3A1678982704519434&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AWnogHdmOhhq-ycWUBp-WVMlwYJ797SWsuAqiLIdtwEJFbzAg5w1vdezGUPJ9DSeL6fYGXJIS8JSHw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://triumphantadvantage.com/b624d9539dce8efd45d92d75bb17c4d0/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
denansgdfierc.com
dq06u9lt5akr2.cloudfront.net
hexrom.com
kerattogeist.com
pogothere.xyz
triumphantadvantage.com
www.facebook.com
www.google-analytics.com
ydenknowled.com
172.64.173.27
173.233.137.52
188.114.96.3
216.137.45.11
23.109.248.145
2600:9000:2057:2e00:f:9fb4:2380:21
2606:4700:20::681a:267
2a00:1450:4001:829::200d
2a00:1450:4001:831::200e
2a03:2880:f11c:8183:face:b00c:0:25de
0067822d555f43b78beaad36e9bfbcc923f0b445a05fc23c89c48b58fca18b23
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20246d470c6038055362d2a58ae28f88d60c2bb70343e8d1c7ae0eb9211ade56
31b1a3e93df2b7bb083443cff0b2ce51299eacdd0ddf4417dc19066d7ecc1ad4
38e1a961a7a32b9b37f285bf39f983eeed249c252646a0196af58b63e648643d
39b3542ab7c9b9a4b7e9fa3426b7f28c6c9317d0b713928cfdf1b7923bbf6e19
3f2d2cbbd0eabe57450a0a76c495f1d3d8aef64f647d88e90d60cd488ae5bb28
4b24518411ac442923f59fde93a95d401237ca1a1cdabc3e7764a20d831897ee
4ff521a948580c10109cb6f84e8424f49431c9a1bfbc46df62d9b275df6b9d61
512013e01aa2c89c425ccee22b4c404b3314b599965bd65275e51fc9447468e4
527ef1fa25c83829d98830647b396f3089c5060b4e9be0b148008215be50a23f
551c87f5b41fec34a473d110b383281966d288b1d931c5b043d7ebbcb42ede65
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
aca8211af375263aa2a1996114b6db1fd614963aeb2ac751c48f83790a8b707f
acbd52aa4a04901d08c184a0d5175246bd10cd5c05e168aaa5f48ff6e1eca4b1
b1fe061cc0fa590e5c191305bea72207662f1a0353485794a6b5a42c77bef00d
d8cae95c8c71b46c5672b15a8faac557c0706ce38b1132535c4509492cbe2308
db1bb59e98030689f3fdb8f0956ac6fd7edb79cb82eb79b660c5381d325df2f5
e056e1591b1a1e3b710d64140efd39c8211bf99936bfee557f3575b9cd60596b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16