demonwallet.improve.dk Open in urlscan Pro
2606:50c0:8002::153  Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response demonwallet.improve.dk/	28 KB 7 KB	498ms 159ms	Document text/html	2606:50c0:8002::153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:50c0:8002::153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash 2487209f87b9e71eceb87dc240338931d5bbc4532c18eea5698c83ff716a41e1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers accept-ranges bytes access-control-allow-origin * age 0 cache-control max-age=600 content-encoding gzip content-length 6628 content-type text/html; charset=utf-8 date Thu, 24 Aug 2023 07:58:22 GMT etag W/"64e70d66-7048" expires Thu, 24 Aug 2023 08:08:22 GMT last-modified Thu, 24 Aug 2023 07:57:26 GMT server GitHub.com vary Accept-Encoding via 1.1 varnish x-cache MISS x-cache-hits 0 x-fastly-request-id 3b441c04020e34274fa0e96ad5195024bcda54e7 x-github-request-id F084:B33A:172064F:17A9521:64E70D9E x-proxy-cache MISS x-served-by cache-bma1668-BMA x-timer S1692863902.390903,VS0,VE119
GET H2	200	v0.js Show response cdn.ampproject.org/	277 KB 72 KB	242ms 71ms	Script text/javascript	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/v0.js Requested by Host: demonwallet.improve.dk URL: https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 414b99d0b12ace50c7f9564dc1312dc8dd402eee7f4e21a09c8eb985bae52e80 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language da-DK,da;q=0.9 Referer https://demonwallet.improve.dk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff date Thu, 24 Aug 2023 07:58:22 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 72910 x-xss-protection 0 server sffe etag "2a2204830152c287" vary Accept-Encoding report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=3000, stale-while-revalidate=1206600 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Thu, 24 Aug 2023 07:58:22 GMT
GET H2	200	1690884553434271178G30Fz147Ne.webp d3v6iwqdidgccc.cloudfront.net/WHYRAAI789/LOGO_WEB_/	123 KB 123 KB	410ms 52ms	Image image/webp	2600:9000:20eb:fa00:e:d1a9:df00:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d3v6iwqdidgccc.cloudfront.net/WHYRAAI789/LOGO_WEB_/1690884553434271178G30Fz147Ne.webp?auto=compress Requested by Host: demonwallet.improve.dk URL: https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:fa00:e:d1a9:df00:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 795f3f2aec75b1e16f9f3a5225165999b667e9994c1e2675f8f3d4e250f4fabb Request headers accept-language da-DK,da;q=0.9 Referer https://demonwallet.improve.dk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Wed, 23 Aug 2023 11:59:33 GMT via 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront) last-modified Tue, 01 Aug 2023 10:09:17 GMT server AmazonS3 x-amz-cf-pop FRA2-C1 age 71930 etag "b1e56619df35a1d8cdee149fe6b99e49" x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-type image accept-ranges bytes content-length 125548 x-amz-cf-id R2qXqKbKBf18a62qSRLeqkKk1rdRo-PipEpsSvJeaUJKvh8YqPSX5Q==
GET H2	200	%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%84%E0%B8%8B%E0%B8%95%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95_0.jpg.webp lnwza168.com/wp-content/uploads/2023/08/	129 KB 129 KB	640ms 509ms	Image image/webp	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lnwza168.com/wp-content/uploads/2023/08/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%84%E0%B8%8B%E0%B8%95%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95_0.jpg.webp Requested by Host: demonwallet.improve.dk URL: https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44f8292e2abab98858565eddca38ba87c6d817f3c38c92114e53672ccad07df9 Request headers accept-language da-DK,da;q=0.9 Referer https://demonwallet.improve.dk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 07:58:23 GMT cf-cache-status HIT last-modified Wed, 16 Aug 2023 08:56:27 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "203a8-64dc8f3b-d75;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mvdPdQkSt2sECSWDCiJuOXWWXnQLzw35SlTucz%2FhdCEUF%2F1OnVnlOseg1swtVf%2Fe78YIUjEVvgNjMK7DTlbJOMIKkGC%2BjBZfHKq3Mu937%2FUFr1YgfOJ7hEb0ncu%2BNfR9qYqlbX08BmipASk%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp cache-control public, max-age=604800 accept-ranges bytes cf-ray 7fba0cbff837b517-OSL alt-svc h3=":443"; ma=86400 content-length 132008 expires Wed, 30 Aug 2023 19:19:54 GMT
GET H2	200	%E0%B8%9D%E0%B8%B2%E0%B8%81-%E0%B8%96%E0%B8%AD%E0%B8%99-Auto-1.png.webp lnwza168.com/wp-content/uploads/2023/08/	316 KB 317 KB	576ms 446ms	Image image/webp	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lnwza168.com/wp-content/uploads/2023/08/%E0%B8%9D%E0%B8%B2%E0%B8%81-%E0%B8%96%E0%B8%AD%E0%B8%99-Auto-1.png.webp Requested by Host: demonwallet.improve.dk URL: https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11ae3c8967dab42c283c12c30dd59ccb4f25080e81b4ebeebea909cac3081436 Request headers accept-language da-DK,da;q=0.9 Referer https://demonwallet.improve.dk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 07:58:23 GMT cf-cache-status HIT last-modified Sun, 13 Aug 2023 14:24:03 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "4f17e-64d8e783-813bc;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3wKIbSLTdOJRcKfcBtbGBk4Pvn9nWbeBkrFT0jYbsvtENRepVeBi%2Bf5BzGXbw96wABnYFu46WwyMWzJTgKzO42YbFfRBdYKBmk9AsAizXbubwjD%2BTOPZpwcA%2BiLAhxR6xrLxuM2kWY7kbJA%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp cache-control public, max-age=604800 accept-ranges bytes cf-ray 7fba0cbff839b517-OSL alt-svc h3=":443"; ma=86400 content-length 323966 expires Wed, 30 Aug 2023 19:19:54 GMT
GET H2	200	446813fd1b664917b8521945929c7e8e.jpg heylink.me/cdn-cgi/image/f=auto,q=85,fit=crop,w=800,h=800/https://cdn-b.heylink.me/media/users/avatars/	143 KB 143 KB	1756ms 1147ms	Image image/avif	104.22.12.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://heylink.me/cdn-cgi/image/f=auto,q=85,fit=crop,w=800,h=800/https://cdn-b.heylink.me/media/users/avatars/446813fd1b664917b8521945929c7e8e.jpg Requested by Host: demonwallet.improve.dk URL: https://demonwallet.improve.dk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.22.12.166 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b0eac8cd08d06ae2e9e9cc31d2c77df22991f33b5336e2a8126ef18c9c61b94b Security Headers Name Value Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none' X-Content-Type-Options nosniff Request headers accept-language da-DK,da;q=0.9 Referer https://demonwallet.improve.dk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 07:58:24 GMT content-security-policy default-src 'none'; navigate-to 'none'; form-action 'none' x-content-type-options nosniff cf-cache-status HIT alt-svc h3=":443"; ma=86400 content-length 145973 cf-resized internal=ok/h q=0 n=10+230 c=16+524 v=2023.8.1 l=145973 last-modified Sun, 11 Jun 2023 02:25:27 GMT cf-bgj imgq:85,h2pri server cloudflare etag "cfpi7m4ylRKFWmU5oXeMUcgHZhIrKas6sPkLemKc-KDQ:5335a001e61ba2cd28965f414962df19" vary Accept, Accept-Encoding content-type image/avif cache-control max-age=86400 accept-ranges bytes cf-ray 7fba0cc57e89251a-LHR
GET H2	200	amp-auto-lightbox-0.1.js Show response cdn.ampproject.org/rtv/012308112021001/v0/	8 KB 4 KB	679ms 58ms	Script text/javascript	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012308112021001/v0/amp-auto-lightbox-0.1.js Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 050ec4d92c5b1d288dca8a55a237020fd146e01868b332e0b0e9daa490d79868 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://demonwallet.improve.dk/ Origin https://demonwallet.improve.dk accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 22 Aug 2023 16:47:34 GMT age 141049 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2981 x-xss-protection 0 server sffe etag "e2313e89a5a42311" vary Accept-Encoding report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 21 Aug 2024 16:47:34 GMT
GET H2	200	amp-loader-0.1.js Show response cdn.ampproject.org/rtv/012308112021001/v0/	12 KB 4 KB	683ms 64ms	Script text/javascript	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012308112021001/v0/amp-loader-0.1.js Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61bd61275d0bcb32c94307af4841ef25ed29edd6b3c01928c6d4f3e72023edd1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://demonwallet.improve.dk/ Origin https://demonwallet.improve.dk accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 22 Aug 2023 19:05:27 GMT age 132776 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3937 x-xss-protection 0 server sffe etag "2b86e8be3366a913" vary Accept-Encoding report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 21 Aug 2024 19:05:27 GMT

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| AMP_CONFIG object| AMP_EXP object| AMP object| __AMP_LOG function| HTMLElementOrig object| __AMP_ERRORS object| __AMP_MODE function| __AMP_REPORT_ERROR object| __AMP_TOP object| __AMP_SERVICES object| __AMP_URL_CACHE object| __AMP__EXPERIMENT_TOGGLES boolean| __AMP_TAG object| __AMP_EXTENDED_ELEMENTS function| __AMP_BASE_CE_CLASS

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
d3v6iwqdidgccc.cloudfront.net
demonwallet.improve.dk
heylink.me
lnwza168.com
104.22.12.166
2600:9000:20eb:fa00:e:d1a9:df00:21
2606:50c0:8002::153
2a00:1450:4001:80b::2001
2a06:98c1:3121::3
050ec4d92c5b1d288dca8a55a237020fd146e01868b332e0b0e9daa490d79868
11ae3c8967dab42c283c12c30dd59ccb4f25080e81b4ebeebea909cac3081436
2487209f87b9e71eceb87dc240338931d5bbc4532c18eea5698c83ff716a41e1
414b99d0b12ace50c7f9564dc1312dc8dd402eee7f4e21a09c8eb985bae52e80
44f8292e2abab98858565eddca38ba87c6d817f3c38c92114e53672ccad07df9
61bd61275d0bcb32c94307af4841ef25ed29edd6b3c01928c6d4f3e72023edd1
795f3f2aec75b1e16f9f3a5225165999b667e9994c1e2675f8f3d4e250f4fabb
b0eac8cd08d06ae2e9e9cc31d2c77df22991f33b5336e2a8126ef18c9c61b94b