totalfreshwords.com Open in urlscan Pro
172.64.129.32 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://liverblx.app/
Effective URL:
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&...
Submission Tags: phish.gg anti.fish automated Search All
Submission: On August 08 via api (August 8th 2023, 6:52:23 pm UTC) from DE — Scanned from DE

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 26 HTTP transactions. The main IP is 172.64.129.32, located in United States and belongs to CLOUDFLARENET, US. The main domain is totalfreshwords.com.
TLS certificate: Issued by E1 on July 22nd 2023. Valid for: 3 months.

This is the only time totalfreshwords.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3035::6815:35cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1 2	139.45.197.238 139.45.197.238	9002 (RETN-AS) (RETN-AS)
4	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	37.48.68.71 37.48.68.71	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
16	172.64.129.32 172.64.129.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	7

3 2606:4700:3035::6815:35cb (United States)

ASN13335 (CLOUDFLARENET, US)

liverblx.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.197.238 (United Kingdom) 1 redirects

ASN9002 (RETN-AS, GB)

whairtoa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.48.68.71 (Amsterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

datatechone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.64.129.32 (United States)

ASN13335 (CLOUDFLARENET, US)

totalfreshwords.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	totalfreshwords.com totalfreshwords.com	63 KB
4	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 10960	2 KB
3	liverblx.app liverblx.app	9 KB
2	whairtoa.com 1 redirects whairtoa.com — Cisco Umbrella Rank: 268414	13 KB
1	datatechone.com datatechone.com — Cisco Umbrella Rank: 33374	465 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	1 KB
26	6

	Domain	Requested by
16	totalfreshwords.com	totalfreshwords.com
4	my.rtmark.net	whairtoa.com totalfreshwords.com
3	liverblx.app	liverblx.app
2	whairtoa.com	1 redirects liverblx.app
1	datatechone.com	whairtoa.com
1	fonts.googleapis.com	liverblx.app
26	6

This site contains no links.

Subject Issuer	Validity	Valid
liverblx.app GTS CA 1P5	`2023-08-08` - `2023-11-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
whairtoa.com R3	`2023-07-16` - `2023-10-14`	3 months	crt.sh
rtmark.net R3	`2023-07-25` - `2023-10-23`	3 months	crt.sh
datatechone.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-18` - `2023-12-24`	a year	crt.sh
totalfreshwords.com E1	`2023-07-22` - `2023-10-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Frame ID: 3DFD082C95E1A18184EA795B6BA78D8B
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Zulassen drücken

Page URL History Show full URLs

http://liverblx.app/ HTTP 307
https://liverblx.app/ Page URL
https://whairtoa.com/4/4138880 Page URL
https://whairtoa.com/?z=4138880&syncedCookie=true&rhd=false HTTP 302
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z... Page URL
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z... Page URL

Page Statistics

26
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

88 kB
Transfer

211 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://liverblx.app/ HTTP 307
https://liverblx.app/ Page URL
https://whairtoa.com/4/4138880 Page URL
https://whairtoa.com/?z=4138880&syncedCookie=true&rhd=false HTTP 302
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb Page URL
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://liverblx.app/ HTTP 307
https://liverblx.app/

Request Chain 7

https://whairtoa.com/?z=4138880&syncedCookie=true&rhd=false HTTP 302
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

26 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
liverblx.app/
Redirect Chain

http://liverblx.app/
https://liverblx.app/

24 KB
8 KB

157ms
46ms

Document
text/html

2606:4700:3035::6815:35cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://liverblx.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:35cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

448a7726c117f135850b4d8c15c62245038ad9dcf1db2bbcb4dfd78436ccfa50

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f39f4a908035cb0-FRA
content-encoding: br
content-language: th-TH
content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline'
content-type: text/html;charset=UTF-8
date: Tue, 08 Aug 2023 18:52:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cyp6pkMjxncFXHRmJCOVYBbRP34qREE%2F3jaZJnCWHb%2FJLCg5MGmAVJlqAhuSbJuE6mNrGF6KQVQ9lPbO0BPbwsyrMUtXrGb2l7ked4WSL3CknTCyj86kCkUU57HU8CqtEn4qaiqEOBcEJMo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://liverblx.app/
Non-Authoritative-Reason: HSTS

GET
H2 200 css
fonts.googleapis.com/ 17 KB
1 KB 85ms
29ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,700italic,400,300,700&display=swap

Requested by

Host: liverblx.app
URL: https://liverblx.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

552a8aa61551f8e15d81f32a9711705954306d53dd1075a0e40d0542c31f3c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 08 Aug 2023 18:52:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 08 Aug 2023 18:43:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Aug 2023 18:52:18 GMT

GET
H2 200 head.js Show response
liverblx.app/ 1 KB
964 B 40ms
40ms Script
application/javascript 2606:4700:3035::6815:35cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://liverblx.app/head.js

Requested by

Host: liverblx.app
URL: https://liverblx.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:35cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7ce4b8dcf147e52783f68b73de6f982c92728abe42f66288a23db76ac2ecd21

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://liverblx.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:18 GMT
content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline'
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
x-cache: MISS
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3qHlws07eAUZEQotB%2BShzcfDgx7k8fFpYRHbhgFifjB4jPx2v8Uuk%2BAy7Umytw%2FAscx%2BHXm1V3w8pZb4Co84u1sc11k82SRmUfuQl5ddRIGU8K3LLyJzsE8EAOXBaC6j2gfxuXbdnfVgtg%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private
cf-ray: 7f39f4a9588c5cb0-FRA

PATCH
H2 403 head.js
liverblx.app/ 206 B
431 B 66ms
66ms XHR
application/javascript 2606:4700:3035::6815:35cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://liverblx.app/head.js?_6045494603232633

Requested by

Host: liverblx.app
URL: https://liverblx.app/head.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:35cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://liverblx.app/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 08 Aug 2023 18:52:18 GMT
content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline'
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XHcSV5rCJxz2uxLikm11436YshzZNo9KCCUKI2IedChR%2FzKBTAwG0TgODMotfMvjUBwmKWjBuVfLQdqspJNzTfexE8El%2FMIwtgCtTTGTh1kDlG4dmweEwdgwl99xtN0M8UoK5QRaSpQnqpc%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private
cf-ray: 7f39f4a9a8e25cb0-FRA

GET
H2 200 4138880 Show response
whairtoa.com/4/ 27 KB
12 KB 172ms
72ms Document
text/html 139.45.197.238
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://whairtoa.com/4/4138880
Requested by: Host: liverblx.app
URL: https://liverblx.app/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.238 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: dfcd542b1822414942fd05d7332a325d8823ed82bc9aca1c8ddbfa9ca6b9b104

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: * *
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0 no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf8
date: Tue, 08 Aug 2023 18:52:19 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT Mon, 26 Jul 1997 05:00:00 GMT
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma: no-cache no-cache
server: nginx
timing-allow-origin: *
x-trace-id: d37e24a11398aa97a41114f1131e07c4

GET
H2 200 img.gif
my.rtmark.net/ 43 B
492 B 133ms
39ms Image
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=39b6449284a74f2b9cf0b1d7cb482052

Requested by

Host: whairtoa.com
URL: https://whairtoa.com/4/4138880

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whairtoa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

POST
H/1.1 200
OK add
datatechone.com/log/ 2 B
465 B 123ms
36ms XHR
text/plain 37.48.68.71
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
Requested by: Host: whairtoa.com
URL: https://whairtoa.com/4/4138880
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

Referer: https://whairtoa.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 08 Aug 2023 18:52:19 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://whairtoa.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H2

200

/ Show response
totalfreshwords.com/
Redirect Chain

https://whairtoa.com/?z=4138880&syncedCookie=true&rhd=false
https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

38 KB
13 KB

171ms
100ms

Document
text/html

172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.27
Resource Hash: a6151cdec2e3289006515a437dab7b86011d3ec887c650dd15b1fea2424269a8

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://whairtoa.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f39f4acfc4a9122-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 08 Aug 2023 18:52:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CHkXcvnTK85zplbWqpGLy2KVGbZDIyLNe7GCRziITfU9tr7fz%2FEHp5zdRqD7CzTIF0y1klxBF9TnyCXoGWeZPmdR5VZcgikAm8PT7Ox%2BR3cqw0UOFP7lpBfN4kICQgXXXwu2wt7F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.27

Redirect headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://whairtoa.com
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length: 0
date: Tue, 08 Aug 2023 18:52:19 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://totalfreshwords.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
location: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
pragma: no-cache
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: * *
x-content-type-options: nosniff
x-trace-id: a4afc37407374f3ee4bec0a0b6a278ed

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
546 B 37ms
37ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?userId=488de828a25f6d40ec06e9d218fc33b6

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

c281d0bd40b7ceb40b70d26be1c714a2132cfcf82e245aef83f10ef7ea64fe70

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalfreshwords.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 micro.tag.min.js Show response
totalfreshwords.com/pfe/current/ 26 KB
10 KB 53ms
52ms Script
application/javascript 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bff789be40b8393590ce6ecf50acd90cb3000b36c75a748d64a05db3f4f84f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 04 Aug 2023 11:40:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64cce3ac-689b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JttE93Q6WHLPKLt%2Fr1yiOjZ1GsFYSoMU6dWG09kCF666oI%2Bsf8qvIXH4Mx8Iib4357PSnIbFN04GBYKn5cnr5SZpf6g%2F4GJPexxfqLAshiLoYacRukNckKi9to17CYxSNP7OSA7j"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 7f39f4adcd6d9122-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
totalfreshwords.com/19/4662728/ 3 KB
2 KB 39ms
38ms XHR
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/19/4662728/?abt_opts=1&var=4138880&var3=712852249629700491&ymid=&rhd=1

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6ad979f0c52831292368eb2b760e2ac61c8ea01c176dc5c8a697d55bd5f8dd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 82e844d327f44b4eb61001e9a7081155
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21MD1GNz%2FhKs4j20u3IuWg7u5v0%2FXKYh9a5HwTBztKzludT8DTyX%2F4Z9dNKuLlgitd0FaIk6DxkEZ8TeBKmsOJVvT0tXf6wvw%2FHYOTzB7SSZiiIQSo3AUejDyUy9A37pGJG6drzE"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7f39f4adcd799122-FRA
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H2 200 / Show response
totalfreshwords.com/ 2 B
413 B 60ms
60ms XHR
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&mprtr=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=valMIx78WCq9DhvFvuCy%2F0eaUK%2Ftg2XoobADhIVghvCbOOVZ9qVhb6SrfbTCDugaRlq45iqUHmYdKg9OGEpCWo5ngdhSnD91L%2FxMYk24i3CJrC%2BOf03Dw6tGDHRzXpXQYNRtULKD"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 7f39f4adcd7c9122-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 rhd
totalfreshwords.com/ 2 KB
3 KB 89ms
88ms Fetch
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/rhd?rb=kWXKoaBfFxzEeDW1EfZxHR5_Cnb7dxHuvIb7NsokiC3Ste3S7MB5jgcPnLHoaLir3xHNX9pfcWq3qZySCkxLVFmMv-FWRgS20Z_bmS1RFg8mUgMc62ECvhgtqKWDqNnmmK7xFbgLo2MuEJptcxzLbQMECRdPVnIqVOVxVfpKeGrts7wP01cbuw4YX1Kfs2IuP2a4UWYOPj5ahUrVi0NTvWYNVyhaG8pyfKr1d2ZyxBxNsYdT5UJss0I5_D1IjBP9b7uaSr2SRHEO33WWi6E4ZAxlm7kcEPR88awdXL2X63502Pb08XAEXR7-b8DUq_zpnPsdJlsBcCg7y8AYjn_zEq4pC7oxYT7-9PkdK-jp9uuI-Xf2zCIAGq4dcLTwMlB_f5TdDfEU_gPOmHi6XMZwMFkyUin_xdWWKQSdW5vSzeRbQaluE1XSuyBVqXNzDSHTz5p30XPWKQoPo7dem2HBHmlZjF31W2cqVV5M9czha3oGFwp4&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Ftotalfreshwords.com%2F%3Fs%3D712852249629700491%26ssk%3D4612c9d7db24b21fca9a50ceb2637a81%26svar%3D1691520739%26z%3D4138880%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=4138880&var3=712852249629700491&ymid=&rhd=1&m=link

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 496f893ed56be839c73f2b1d4d18b7ea
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zXFPypq%2FLe4dPYBBVPH8By5E1jB0s%2F9EhZf0nV4q21vJ7tpNu3orhyj63FQePz2IXl7wKiB3b2oEa%2BcqerjoJcMpJbI6Io0slNMetIpkjQ6btAhiA0ncQOWf6irIQcipWuC61Z2f"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7f39f4ae0d295c80-FRA
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H3 200 4662709
totalfreshwords.com/sw-check-permissions/ 0
948 B 49ms
48ms Other
application/javascript 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/sw-check-permissions/4662709?var=4138880&ymid=712852249629700491&uhd=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.26
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.26
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=srixldDDuxYak4d23g%2FbjInXjaw103r9wRyKGHTNGzoI5QOtuSUXgxCPYd19dTj7SjJf2ajshEvjFBrJG8x0aqcDSWVirida3aYszS2FM16Un74HCBkDdOEJMtRgyI7G3hWKFC1T"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 7f39f4ae2d495c80-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
totalfreshwords.com/ 0
522 B 39ms
39ms Ping
text/plain 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalfreshwords.com&var=4138880&ymid=712852249629700491&var_3=&var_4=&dsig=&action=prerequest

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-trace-id: 9602a4895cb0b3573da10bba0b3cb899
date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FgkcLenvzHmNg1fg8ZzGDNCqPCNAxJgRzPQgB7erZTY5XLzgL3JBC91Q7uzYHXZCnPusbcSGGTQ1NkLnmcRxLX20gHWYQvjSx08eLRbR1Up0eckFI%2BVdKwr4NIn%2BIn5zRPQb8EJ6"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://totalfreshwords.com
access-control-allow-credentials: true
cf-ray: 7f39f4ae2d4b5c80-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 gid.js
my.rtmark.net/ 65 B
546 B 45ms
44ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=712852249629700491&var=4138880

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalfreshwords.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone Show response
totalfreshwords.com/ 905 B
1 KB 38ms
38ms Fetch
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalfreshwords.com&var=4138880&ymid=712852249629700491&var_3=&var_4=&dsig=&action=settings

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff6544956874d81ffb64304fbb7c0d07aad3efd4b49d071f1b35d87514ee8c07

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: 482d17af05aba2c150270a8019601d2a
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ywdXvjot%2FimLZP302oiI%2B6C8bqF7omw58NVaCo%2FOdM9SDFZlXFZpKfwU2uCP09dIh%2BNOOB1VHwbyTF4vgytjr6ZYsqGnDRxZCwBGmes0F4Or6iqPIRXSKQRpUZaGdngu8qkLOmF%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7f39f4ae3d665c80-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 Primary Request / Show response
totalfreshwords.com/ 38 KB
13 KB 116ms
115ms Document
text/html 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.24
Resource Hash: 82a9b060b82696775a1fc66306e54d2f22e0ecdd32c3b81063f739da81c47231

Request headers

Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f39f4ae8dca5c80-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 08 Aug 2023 18:52:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jqsnOzepAZWYbrf2wT1nNyE8F32HpUsCzP6TP%2Bt7mpjfANE0hZ9MnnET4FuI2bOAmm70bsozN9AwV6GgamlGIA7NxBCKNxncO2IbDZiXuIF%2BNhldBWveR50BbTpPkKHUnUIsF%2BPn"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.24

GET
H3 200 micro.tag.min.js Show response
totalfreshwords.com/pfe/current/ 26 KB
11 KB 49ms
49ms Script
application/javascript 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bff789be40b8393590ce6ecf50acd90cb3000b36c75a748d64a05db3f4f84f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 04 Aug 2023 11:40:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64cce3ac-689b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gE%2BUPURtAKbE%2F9JpS%2F%2B0kIpMs%2FlXCXyCyO5%2B3pTNraNHzhlozIuRP67DX5tZlhBYo9CoU2vEtjKgS2U3iMEmJZTl0Z0FDEmFt74uh6JckAb%2BIw81BOspLVdZJqs9a9Cd7nCEMxzn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 7f39f4afaf205c80-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 / Show response
totalfreshwords.com/19/4662728/ 3 KB
3 KB 47ms
46ms XHR
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/19/4662728/?abt_opts=1&var=4138880&var3=712852249629700491&ymid=&rhd=1

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b468c5d22431c34b6c800bf1e6de867a6401bded4f34d32c0794c43b561f612

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 81c71ede4109b7ad3340d5ee175500ee
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iq3bbNcLzlO0RCimP0HL9%2Fcss4GR392Qu33leDJWc3uwCKivIhi5iTmJec6IoT8D0AmlUa9YFChzkkARcvBFWBpoCbCfj3PCdf1GjXPVjAZw8VswQ3FNkAoQJZAEKXT5TJn1kVHP"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7f39f4afaf295c80-FRA
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H3 200 / Show response
totalfreshwords.com/ 2 B
530 B 55ms
55ms XHR
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2&mprtr=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZddQWwDMkZbKvkPY7cfCYKk8Zu7u6BFBHWDuKrQirSj8%2FuXuKrCSBSu2RfJAPcUGoBLwiNwb9pMMX2TDSGNiMfkecs6zyvAVQwq%2B%2BzDleLjg5eNoxntWziHALWq00jyvLKZYSgTI"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 7f39f4afaf2d5c80-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 rhd Show response
totalfreshwords.com/ 2 KB
3 KB 51ms
50ms Fetch
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/rhd?rb=2rP6p3OMhriRBRUGeyoDZEs59c7OqEy_3qhLWlwjr6LOYsEiBAQSttjmJ4-VIj42ofPIantRmE99wJkJ9ryJTUUKOFmmgBEGOI-sLmfm93wZEhSjDLymNsWOUDxTtPTl6qxxePq1lSSOEUBcfpsuk5RFX1n16BkotTa_C1em5gE3bzqkUlITc6XY-A1R0yupnqk-QJqAKSLt_sicA2g1dwlAT4i8g5kaHSlCE-NGfncSI0WPlAOLzIJXC6WRF5Whz8penuSJK9UFgvBRMXhOxoPWHRxoKTj4s_4G0i7EbW7D4Dg6rZ65Rplwss2b8QXlLhPoReRXWNHxHh51jSTnHKKoS4xZUEhVQYTsS4wofuonj0e0OFnkwgiWuUZzkyLnTzBsbqHupU8i0gUoIORmxyjKoSQ5Mx1hKrVenS92MJq5Nk1h67YaP3phtpz1_oGpnrK9bUfx1qvH30kDsh4beGEx3uqWKC7Vnib-kxBOF6skWrFiNmTqvA%3D%3D&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Ftotalfreshwords.com%2F%3Fs%3D712852249629700491%26ssk%3D4612c9d7db24b21fca9a50ceb2637a81%26svar%3D1691520739%26z%3D4138880%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26rdc%3D2&drf=https%3A%2F%2Ftotalfreshwords.com%2F%3Fs%3D712852249629700491%26ssk%3D4612c9d7db24b21fca9a50ceb2637a81%26svar%3D1691520739%26z%3D4138880%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=4138880&var3=712852249629700491&ymid=&rhd=1&m=link

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef2be4bc3b7a28b0f35339204a0dbfcd5990e8cf4cbed1e4d7c42803c0f3af9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 25b1687d3c391fae54bc1c27f39cd72c
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J1fZK7siKZuWUUA1zK8Zf9CXG1HXqUEGTa18uwMnagc3Ze9ildo6urK4iT90HuzDIp9EaWw7fiCAB%2Bahb2n1qiAd7E5GQs60%2FS0V86e7%2B3Y3lHcBOEvdlz41Z1jgH7R1jnipA1ej"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7f39f4afffad5c80-FRA
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H3 200 4662709
totalfreshwords.com/sw-check-permissions/ 0
954 B 45ms
44ms Other
application/javascript 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://totalfreshwords.com/sw-check-permissions/4662709?var=4138880&ymid=712852249629700491&uhd=1
Requested by: Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.24
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:19 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.24
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wunsSFIoXiNe1Dxc40YO%2Fp8odHko8YeqYeSCZ36%2FFv9hj6VZrTcSS%2FAXCs4je7F1H6aP2hY2fMfXGj37uPY14RXHNnN7Kkw8yPgF4AJ4GJk%2BvOy%2FVuNuLPD7WF1vA2nFIdwA8OJf"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 7f39f4b00fba5c80-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
totalfreshwords.com/ 0
490 B 52ms
51ms Ping
text/plain 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalfreshwords.com&var=4138880&ymid=712852249629700491&var_3=&var_4=&dsig=&action=prerequest

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-trace-id: 260890f71ba235350d57f88f92b7e367
date: Tue, 08 Aug 2023 18:52:19 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PiDSOg0AGQgFNZaFRTzYlCfpghLuo%2FZOyZfwSZdKqu45JntppaqZZ6jU5%2Fn44%2Fsjh%2BJamHW1vOkuqWGb8EHyAF6RSpfIL9TgXpEBwHFJ7ZSd8HUwFXOI1JMa%2Bct5qaJ5PrpUSBIt"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://totalfreshwords.com
access-control-allow-credentials: true
cf-ray: 7f39f4b00fb95c80-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
546 B 3574ms
3573ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=712852249629700491&var=4138880

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

c281d0bd40b7ceb40b70d26be1c714a2132cfcf82e245aef83f10ef7ea64fe70

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:23 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://totalfreshwords.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone Show response
totalfreshwords.com/ 905 B
1 KB 3575ms
3574ms Fetch
application/json 172.64.129.32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://totalfreshwords.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=totalfreshwords.com&var=4138880&ymid=712852249629700491&var_3=&var_4=&dsig=&action=settings

Requested by

Host: totalfreshwords.com
URL: https://totalfreshwords.com/pfe/current/micro.tag.min.js?z=4662709&ymid=712852249629700491&var=4138880&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.129.32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff6544956874d81ffb64304fbb7c0d07aad3efd4b49d071f1b35d87514ee8c07

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://totalfreshwords.com/?s=712852249629700491&ssk=4612c9d7db24b21fca9a50ceb2637a81&svar=1691520739&z=4138880&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 18:52:23 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: ac9efd7d76b909ae6b1c3e3a057cc231
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IWLEi0QI3ioSX5eaxXT%2B4h9rjwZxn7NViQF7dxfdp9Cpqy3bVzDi5SCQe8x6oB6LcpDSyhmB7uXw1eqA%2BlGqJs8ckjj2cC%2BlcVXvwbVOKf7fkDBr7X1dbjsD7fjryNtm%2FXpo2OaR"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7f39f4c798475c80-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
liverblx.app/	1970-01-20 22:37:36	Name: zov_gaqohsmbp Value: JUUwJUI5JTgzJUUwJUI4JTlBJUUwJUI4JTg3JUUwJUI4JUIyJUUwJUI4JTk5JUUwJUI4JTk3JUUwJUI4JUI1JUUwJUI5JTg4NS4xJTIwJUUwJUI5JTgwJUUwJUI4JTgxJUUwJUI4JTkzJUUwJUI4JTkxJUUwJUI5JThDJUUwJUI4JUFBJUUwJUI4JUExJUUwJUI4JUEzJUUwJUI4JUEzJUUwJUI4JTk2JUUwJUI4JUEwJUUwJUI4JUIyJUUwJUI4JTlFJUUwJUI4JTk3JUUwJUI4JUIyJUUwJUI4JTg3JUUwJUI4JTgxJUUwJUI4JUIyJUUwJUI4JUEyJTIwV29ya3NoZWV0
whairtoa.com/	1970-01-20 22:37:36	Name: OAID Value: 39b6449284a74f2b9cf0b1d7cb482052
whairtoa.com/	1970-01-20 22:37:36	Name: oaidts Value: 1691520739
my.rtmark.net/	1970-01-20 22:37:36	Name: ID Value: 39b6449284a74f2b9cf0b1d7cb482052
whairtoa.com/	1970-01-20 14:02:05	Name: syncedCookie Value: true
totalfreshwords.com/	1970-01-20 22:37:36	Name: oaidts Value: 1691520739
totalfreshwords.com/	1970-01-20 23:28:00	Name: syncedCookie Value: true
totalfreshwords.com/	1970-01-20 22:37:36	Name: OAID Value: 488de828a25f6d40ec06e9d218fc33b6
totalfreshwords.com/	1970-01-20 13:52:00	Name: prefetchAd_4662728 Value: true
totalfreshwords.com/	1970-01-20 13:52:04	Name: reverse Value: bEWdhOZkprPrC-oYoGf009WRfDq0aW_GIRCU2rVIz_w

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://liverblx.app/head.js?_6045494603232633 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

datatechone.com
fonts.googleapis.com
liverblx.app
my.rtmark.net
totalfreshwords.com
whairtoa.com
139.45.195.8
139.45.197.238
172.64.129.32
2606:4700:3035::6815:35cb
2a00:1450:4001:813::200a
37.48.68.71
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
448a7726c117f135850b4d8c15c62245038ad9dcf1db2bbcb4dfd78436ccfa50
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
552a8aa61551f8e15d81f32a9711705954306d53dd1075a0e40d0542c31f3c5a
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc
82a9b060b82696775a1fc66306e54d2f22e0ecdd32c3b81063f739da81c47231
8b468c5d22431c34b6c800bf1e6de867a6401bded4f34d32c0794c43b561f612
8bff789be40b8393590ce6ecf50acd90cb3000b36c75a748d64a05db3f4f84f6
a6151cdec2e3289006515a437dab7b86011d3ec887c650dd15b1fea2424269a8
a6ad979f0c52831292368eb2b760e2ac61c8ea01c176dc5c8a697d55bd5f8dd3
c281d0bd40b7ceb40b70d26be1c714a2132cfcf82e245aef83f10ef7ea64fe70
dfcd542b1822414942fd05d7332a325d8823ed82bc9aca1c8ddbfa9ca6b9b104
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef2be4bc3b7a28b0f35339204a0dbfcd5990e8cf4cbed1e4d7c42803c0f3af9f
f7ce4b8dcf147e52783f68b73de6f982c92728abe42f66288a23db76ac2ecd21
ff6544956874d81ffb64304fbb7c0d07aad3efd4b49d071f1b35d87514ee8c07

totalfreshwords.com Open in urlscan Pro 172.64.129.32 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

26 Requests

100 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

7 IPs

4 Countries

88 kBTransfer

211 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

totalfreshwords.com Open in urlscan Pro
172.64.129.32 Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

88 kB
Transfer

211 kB
Size

10
Cookies

26 HTTP transactions
2 data transactions