urlscan.io logo urlscan.io
SecurityTrails logo

bawelteey.com Open in urlscan Pro
188.114.97.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nebswin87.xyz/#0.9816768137162077
Effective URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&...
Submission Tags: @phish_report
Submission: On March 26 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 3 countries across 12 domains to perform 30 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is bawelteey.com. The Cisco Umbrella rank of the primary domain is 69284.
TLS certificate: Issued by GTS CA 1P5 on January 31st 2024. Valid for: 3 months.
This is the only time bawelteey.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 162.0.209.252 22612 (NAMECHEAP...)
1 162.254.39.23 22612 (NAMECHEAP...)
1 172.67.8.141 13335 (CLOUDFLAR...)
2 2 64.227.23.114 14061 (DIGITALOC...)
1 4 139.45.197.239 9002 (RETN-AS)
1 188.114.96.3 13335 (CLOUDFLAR...)
2 37.48.68.71 60781 (LEASEWEB-...)
1 2 139.45.197.237 9002 (RETN-AS)
3 139.45.195.8 9002 (RETN-AS)
9 188.114.97.3 13335 (CLOUDFLAR...)
8 139.45.197.251 ()
30 11
1    162.0.209.252 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: business101-4.web-hosting.com
nebswin87.xyz
1    162.254.39.23 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium285-2.web-hosting.com
cdnconnect.site
1    172.67.8.141 (United States)

ASN13335 (CLOUDFLARENET, US)
whos.amung.us
2    64.227.23.114 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
cchcontent.com
nowcontentright.com
4    139.45.197.239 (United Kingdom)

ASN9002 (RETN-AS, GB)
gtoonfd.com
1    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
cdntechone.com
2    37.48.68.71 (Amsterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
datatechone.com
2    139.45.197.237 (United Kingdom)

ASN9002 (RETN-AS, GB)
thaudray.com
3    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
9    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
bawelteey.com
8    139.45.197.251 (None, )

ASN- ()
jouteetu.net
Apex Domain
Subdomains		 Transfer
9 bawelteey.com
bawelteey.com — Cisco Umbrella Rank: 69284
36 KB
8 jouteetu.net
jouteetu.net
4 gtoonfd.com
gtoonfd.com
15 KB
3 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 8136
2 KB
2 thaudray.com
thaudray.com — Cisco Umbrella Rank: 175397
1 KB
2 datatechone.com
datatechone.com — Cisco Umbrella Rank: 21413
931 B
1 cdntechone.com
cdntechone.com — Cisco Umbrella Rank: 63209
9 KB
1 nowcontentright.com
nowcontentright.com
267 B
1 cchcontent.com
cchcontent.com — Cisco Umbrella Rank: 964158
287 B
1 amung.us
whos.amung.us — Cisco Umbrella Rank: 12665
29 B
1 cdnconnect.site
cdnconnect.site — Cisco Umbrella Rank: 964313
392 B
1 nebswin87.xyz
nebswin87.xyz
2 KB
30 12
Domain Requested by
9 bawelteey.com bawelteey.com
8 jouteetu.net bawelteey.com
4 gtoonfd.com 1 redirects cdntechone.com
3 my.rtmark.net gtoonfd.com
bawelteey.com
2 thaudray.com 1 redirects gtoonfd.com
2 datatechone.com cdntechone.com
gtoonfd.com
1 cdntechone.com nebswin87.xyz
1 nowcontentright.com 1 redirects
1 cchcontent.com 1 redirects
1 whos.amung.us nebswin87.xyz
1 cdnconnect.site nebswin87.xyz
1 nebswin87.xyz
30 12

This site contains no links.

Subject Issuer Validity Valid
nebswin87.xyz
Sectigo RSA Domain Validation Secure Server CA		 2024-03-12 -
2025-03-12		 a year crt.sh
cdnconnect.site
Sectigo RSA Domain Validation Secure Server CA		 2023-06-10 -
2024-06-10		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-06-11 -
2024-06-09		 a year crt.sh
cdntechone.com
GTS CA 1P5		 2024-02-23 -
2024-05-23		 3 months crt.sh
datatechone.com
Sectigo RSA Domain Validation Secure Server CA		 2023-12-10 -
2024-12-23		 a year crt.sh
gtoonfd.com
R3		 2024-01-23 -
2024-04-22		 3 months crt.sh
thaudray.com
R3		 2024-02-05 -
2024-05-05		 3 months crt.sh
rtmark.net
R3		 2024-03-02 -
2024-05-31		 3 months crt.sh
bawelteey.com
GTS CA 1P5		 2024-01-31 -
2024-04-30		 3 months crt.sh
jouteetu.net
R3		 2024-03-13 -
2024-06-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Frame ID: 527EAA4A09F5098B09F114EBB51F5FBF
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://nebswin87.xyz/ Page URL
  2. https://cchcontent.com/?k=803d9ba946dd26b8d3b3b639209a27ff&type=mainstream&subtype=global%20S HTTP 302
    https://nowcontentright.com/?k=af40c34f717ab940f7055db47c478ec4&type=mainstream&subtype=global&r=1&u=b HTTP 302
    https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4 HTTP 302
    https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14... Page URL
  3. http://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-sma... HTTP 307
    https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-sma... Page URL
  4. https://thaudray.com/?z=4677282&syncedCookie=true&rhd=false HTTP 302
    https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z... Page URL

Page Statistics

30
Requests

100 %
HTTPS

0 %
IPv6

12
Domains

12
Subdomains

11
IPs

3
Countries

65 kB
Transfer

146 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nebswin87.xyz/ Page URL
  2. https://cchcontent.com/?k=803d9ba946dd26b8d3b3b639209a27ff&type=mainstream&subtype=global%20S HTTP 302
    https://nowcontentright.com/?k=af40c34f717ab940f7055db47c478ec4&type=mainstream&subtype=global&r=1&u=b HTTP 302
    https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4 HTTP 302
    https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225 Page URL
  3. http://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225 HTTP 307
    https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225 Page URL
  4. https://thaudray.com/?z=4677282&syncedCookie=true&rhd=false HTTP 302
    https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://cchcontent.com/?k=803d9ba946dd26b8d3b3b639209a27ff&type=mainstream&subtype=global%20S HTTP 302
  • https://nowcontentright.com/?k=af40c34f717ab940f7055db47c478ec4&type=mainstream&subtype=global&r=1&u=b HTTP 302
  • https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4 HTTP 302
  • https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Request Chain 5
  • http://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225 HTTP 307
  • https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
nebswin87.xyz/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nebswin87.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business101-4.web-hosting.com
Software
LiteSpeed /
Resource Hash
00e50b95635d8901370fb573af83d39d6f73218a68535f99160e0fdf93ac9a25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
fi-FI,fi;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
br
content-length
2042
content-type
text/html; charset=UTF-8
date
Tue, 26 Mar 2024 13:10:33 GMT
etag
"91-1711386423;br"
link
<https://nebswin87.xyz/wp-json/>; rel="https://api.w.org/"
referrer-policy
no-referrer-when-downgrade
server
LiteSpeed
strict-transport-security
max-age=31536000; includeSubDomains; preload;
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-litespeed-cache
hit
x-turbo-charged-by
LiteSpeed
x-xss-protection
1; mode=block
/
cdnconnect.site/ 		284 B
392 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnconnect.site/?t=VG9ueXdn
Requested by
Host: nebswin87.xyz
URL: https://nebswin87.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.254.39.23 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium285-2.web-hosting.com
Software
LiteSpeed / PHP/8.0.30
Resource Hash
150752c6647071e5ac46b5ed1ee63e8e585b312bcc01a275adfb0c723c874cae

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://nebswin87.xyz/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 26 Mar 2024 13:10:33 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/8.0.30
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0,pre-check=0
x-turbo-charged-by
LiteSpeed
content-length
131
/
whos.amung.us/pingjs/ 		29 B
29 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://whos.amung.us/pingjs/?k=qdarkblade&t=PROTYPE&x=185.204.1.183
Requested by
Host: nebswin87.xyz
URL: https://nebswin87.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.8.141 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://nebswin87.xyz/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:34 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
86a761af1ad182be-ARN
alt-svc
h3=":443"; ma=86400
content-type
text/javascript;charset=UTF-8
r.html
cdntechone.com/
Redirect Chain
  • https://cchcontent.com/?k=803d9ba946dd26b8d3b3b639209a27ff&type=mainstream&subtype=global%20S
  • https://nowcontentright.com/?k=af40c34f717ab940f7055db47c478ec4&type=mainstream&subtype=global&r=1&u=b
  • https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4
  • https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71...
22 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Requested by
Host: nebswin87.xyz
URL: https://nebswin87.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
785c9ae55eb9710019f4b32060731514e6bf11d2fb96e0c5bc5dec7d2bfc9319

Request headers

Referer
https://nebswin87.xyz/#0.9816768137162077
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
fi-FI,fi;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86a761b95ca05b1b-VIE
content-encoding
br
content-type
text/html
date
Tue, 26 Mar 2024 13:10:35 GMT
last-modified
Wed, 07 Feb 2024 12:51:04 GMT
link
<https://datatechone.com/>; rel=preconnect; crossorigin, <https://datatechonert.com/>; rel=preconnect; crossorigin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3sOJRgutkZG7JaI7ZjTnJtdjWXuySyRX3GJCkwKcmi883BxxCy9ZSWPOARGGrQQ0RzuDxiDrISxjwN9Gd2Js7eHYv5opv5BbJjBKSOnKarfS75dtVpctp6uLvInQWeSkg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
cache-control
no-store, no-cache, must-revalidate, max-age=0
content-length
0
date
Tue, 26 Mar 2024 13:10:35 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://cdntechone.com>; rel="dns-prefetch preconnect"
location
https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
*
x-content-type-options
nosniff
add
datatechone.com/log/ 		2 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datatechone.com/log/add?cid=e7ddf874-40d2-43d7-b8fd-56541bff0853&ruid=694635f0-961c-4999-9ce0-a1a6f7b3bafb
Requested by
Host: cdntechone.com
URL: https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx/1.19.10 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://cdntechone.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 26 Mar 2024 13:10:35 GMT
Server
nginx/1.19.10
Access-Control-Allow-Methods
POST, GET, OPTIONS, PUT, DELETE
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://cdntechone.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length
2
link
gtoonfd.com/
Redirect Chain
  • http://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
  • https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
33 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Requested by
Host: cdntechone.com
URL: https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e7de21f0d518a0ee4faaffdaac09dbbc69ea8b2419baedf959b4333cbf56ea1a
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=4677281&axcusid1=14867&clid={ymid}&r=http%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D4677281%26var%3D14867%26ymid%3Dca4467e9c71e7c7cc2457c219bda3dd4%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf8
date
Tue, 26 Mar 2024 13:10:36 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
ee2d5613116adef4d2374c1e364ce746

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Non-Authoritative-Reason
HSTS
sftouch
thaudray.com/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://thaudray.com/sftouch?userId=04802be32ed148b2e4257b0d20385c68&z=4677282&p_rid=d72c24c4-c579-4605-907d-e6cf84c67632&p_src=sf&branchId=400701&rb=lkMpmgk3H69nkwbK79HK6odv5c5qqYe8DFoKKA43GzEovjWMjApdhHB86-XaDbxWinGDB6JOtlRcNEbT1NFHFoXko-ac29MGZqMy7OKyDAQXrKGp0nC-TELUjuv5iS7aEEMtxqHOlQqqKyUIHCNhvE9uqUBX10253g_D8f4t03JbdwNDxLg8Zs36-KZtwogdzYHRPeOW5STMoXkeJSRteevPuWHOhFkdxO5vA1GNMoDBt2vPVT5dWmt4fNskBYzunDu410EPpPTFRNXY5NuDEALmsIibAo38rpK_r4GrRlcvuirp6ylutweMa2_Pf7KrPOPPyJL4dct2YMcL
Requested by
Host: gtoonfd.com
URL: https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.237 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://gtoonfd.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers
img.gif
my.rtmark.net/ 		43 B
491 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=04802be32ed148b2e4257b0d20385c68&z=4677282&p_rid=d72c24c4-c579-4605-907d-e6cf84c67632&p_src=sf
Requested by
Host: gtoonfd.com
URL: https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://gtoonfd.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
add
datatechone.com/log/ 		2 B
464 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=d72c24c4-c579-4605-907d-e6cf84c67632
Requested by
Host: gtoonfd.com
URL: https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx/1.19.10 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://gtoonfd.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 26 Mar 2024 13:10:36 GMT
Server
nginx/1.19.10
Access-Control-Allow-Methods
POST, GET, OPTIONS, PUT, DELETE
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://gtoonfd.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length
2
favicon.ico
gtoonfd.com/ 		0
150 B 		Other
General
Check archive.org
Download Go to
Full URL
https://gtoonfd.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"123.0.6312.58"
Referer
https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Tue, 26 Mar 2024 13:10:36 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
Primary Request /
bawelteey.com/
Redirect Chain
  • https://thaudray.com/?z=4677282&syncedCookie=true&rhd=false
  • https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
42 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
2e8b6f1041383ad11fe9127b990ad5f08b2a631ebd010eec9f1c4455c5b415d8

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://gtoonfd.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
fi-FI,fi;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods
GET, POST, OPTIONS, HEAD
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86a761bf98425bbe-VIE
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 26 Mar 2024 13:10:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hT8k1Ilzcy6%2BgAYosDhL2%2BjzGe1MRprAnxIwGYkGF5Bil5HcuG1OrbTLMzRwpzMrnZTJurCvu9zF1ESZE38GPWPe0GpnUooUepWFd8HXfhsb5QgclsbWeYAJQ898kAOi"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://gtoonfd.com
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length
0
date
Tue, 26 Mar 2024 13:10:36 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://bawelteey.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
pragma
no-cache
referrer-policy
no-referrer
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
7758734d32af2e98ba16aa9b7530bc6e
favicon.ico
gtoonfd.com/ 		0
150 B 		Other
General
Check archive.org
Download Go to
Full URL
https://gtoonfd.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"123.0.6312.58"
Referer
https://gtoonfd.com/afu.php?zoneid=4677282&var=4677282&rid=ksX-wKK1z8yLZCaWKyzJyw%3D%3D&rhd=false&ab2r=400701&sf=1&os=win32&os_version=10.0.0&is_mobile=false&browser_version=123.0.6312.58
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version-list
"Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Tue, 26 Mar 2024 13:10:36 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
gid.js
my.rtmark.net/ 		65 B
542 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?userId=7a5698ae0457b262b01eec546661146f
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
3e7b356332511e9bdf006a117f916340edb0898a0869e30b2cfeed15e5bbc353
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://bawelteey.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
micro.tag.min.js
bawelteey.com/pfe/current/ 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
955a7f7e7a9158b178d2ca39513763b297bbec13f6083c534c099af7876c1c8c

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 26 Mar 2024 13:10:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 20 Mar 2024 09:50:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65fab17e-8def"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gslaFwd7akEg5OwPoZ2mnoDp1McOnn4R2iyRIJeydSxcprWRBvlBmFti3a028KdbOLNrOKr9HltfCgweGx9oasFy%2But6i7mbDbLz5ijOoPGNmgvf3SFBBLQTrHT0YhzB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
access-control-allow-credentials
true
cf-ray
86a761c0a9f85bbe-VIE
alt-svc
h3=":443"; ma=86400
truncated
/ 		327 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
bawelteey.com/19/4662728/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/19/4662728/?abt_opts=1&var=4677282&var3=796477848004337920&ymid=&rhd=1&os=win32&os_version=10.0.0
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c34a9e06ef57962b9172bdbfe06c744a40cc594ccb902607d6d7aef4880d04c5
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
89cc77a15cde4c85bd99c8f84b086646
pragma
no-cache
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rg4gGE3Om%2FwTkRx3ILTj3fuj4U8M6jFn2KZKn2hiYvGvhA2AIqp3Nzta01KHyJrKoSv7kfSh2epPac8F3G%2FprZEwJzHugBvmxpFdcd6NtEsmi1qpfv2pDL0rHQkGIh9t"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
link
<https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
cf-ray
86a761c0ba065bbe-VIE
expires
Tue, 11 Jan 1994 10:00:00 GMT
/
bawelteey.com/ 		2 B
524 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120&mprtr=1&os_version=10.0.0
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:36 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=72qO0gHvj%2BSxuXFLtVLa3htU00BVaXmc9PwPOUGxQq5WorNcS326RNMP%2F0YxWbQElFw6fYc0naZ0S50QVO4hW%2BDc91%2BKruSz4dOgdum4QgYdQd%2ButjkZ6hnUDFcV36GK"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
86a761c0fab25bbe-VIE
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc
h3=":443"; ma=86400
rhd
bawelteey.com/ 		3 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/rhd?rb=LL3pEnTXwwdk90U_ZrZpnIeVgQHAZILtxaWJLThH1lf0wNc5Y5eVNLWdoUkQJJozH5eLHd9y-h2DofCZ4uO6JeSS1EXFgBi69O2Hc378rX88BZOzEeZdyQ1ZUnxEbcUm4btg8UePe5Iv136GEgZfzGbjuT0XT62FljydtE4kAWB48qbTXzclEVUvsESAfBT5dqkeEV39lMdyOOOOfuutQNjJtGenV5z_S1fEIJWBFxVstxgYME4nW5aXFoJGO60_09mQ2vlb9MaR7RysUHv1EfG2WiAD8_-nhi7UenJq5zjYVLInDFmu9r_cn5zPtAawZsNUDQbdExQkXyMvwXgadxajeqORI_BYUsKsorjO9--6b7B9ThKQMQsjVhHyUwTDM_k3DQcmBI9YGmOaBwRkYoiNeRMkVpFrV_LVURjmUSfqCjIinb9015NGP9WNgtC2wpfQcxOv3Jdq4Q4CiDSwtWXhhAIDi1ogTl1w96fs6ajysKEiQZj7LSUYdJp-qthvujWajRDXWx8u1zYpZh8eO-tQr-GAUrSj6nwSrsbwZM-xkvO1_T6NEA%3D%3D&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=800&sh=600&sah=600&wx=30&wy=30&ww=1600&wh=1198&cw=1600&wih=1113&wiw=1600&wfc=0&pl=https%3A%2F%2Fbawelteey.com%2F%3Fs%3D796477848004337920%26ssk%3D0e050f3c261af2373a29715d65ab749f%26svar%3D1711458636%26z%3D4677282%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3DEurope%2FHelsinki%26bto%3D-120&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=4677282&var3=796477848004337920&ymid=&rhd=1&os=win32&os_version=10.0.0&m=link
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d786c095491d75e47c55ce94a86237405cb485f9a35c46c52f232585fa2f429
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-trace-id
25f5ecbe8b82a6d3cee7c68dee6b6206
pragma
no-cache
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xXPrCJt4f6%2F001o7n0f2blDGIBHHbqF%2BLFEU527EgZDvAyxDFd0cTh2U26CtTZxk4vxTkq%2Ff%2Bus3ZXf0s0BHW3LxpIlOoLf7bBgY4FBe17UahH76tiC4XYm9nzQbo7TU"}],"group":"cf-nel","max_age":604800}
access-control-max-age
86400
access-control-allow-credentials
true
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
cf-ray
86a761c15b875bbe-VIE
expires
Tue, 11 Jan 1994 10:00:00 GMT
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
4662709
bawelteey.com/sw-check-permissions/ 		0
994 B 		Other
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/sw-check-permissions/4662709?var=4677282&ymid=796477848004337920&uhd=1&zoneId=4662709
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0CUnj%2B6tpULnpESdL%2B7GBKiRsH2xAGeIPQZcmkKCi0wkGWz3PEO1XzV4qodlw5vn%2BlI7yp9uXesH4avdRkqfENJYdqna9wYlkngwWqhgMS9a3SDWBiVpxuO%2B0iPpvA4"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray
86a761c17be15bbe-VIE
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc
h3=":443"; ma=86400
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
zone
bawelteey.com/ 		0
588 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=bawelteey.com&var=4677282&ymid=796477848004337920&var_3=&var_4=&dsig=&tg=1&sw=3.1.497&trace_id=67be1f1b-bfb4-4035-a115-7f050a79b4fa&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjMifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJHb29nbGUgQ2hyb21lIiwidmVyc2lvbiI6IjEyMy4wLjYzMTIuNTgifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOC4wLjAuMCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMuMC42MzEyLjU4In1dLCJtb2JpbGUiOmZhbHNlLCJtb2RlbCI6IiIsInBsYXRmb3JtIjoiV2luMzIiLCJwbGF0Zm9ybVZlcnNpb24iOiIxMC4wLjAiLCJ3b3c2NCI6ZmFsc2V9
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-trace-id
1f2c8807dc337ec03b3cf93dd536e4a6
date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bmt2Gm35AFtCQmPQS1k3mQXFVwtEKDm185iehwXZ%2BsMeczOHUf4ztehBvpVLgXzArG5KRC4WliimfUpx%2BCiuE31FkLf8chkoFttorIFaqu%2FE61SgNiSLny849Lez1dA7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://bawelteey.com
access-control-allow-credentials
true
cf-ray
86a761c17be45bbe-VIE
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=86400
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
gid.js
my.rtmark.net/ 		65 B
541 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=796477848004337920&var=4677282
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
3e7b356332511e9bdf006a117f916340edb0898a0869e30b2cfeed15e5bbc353
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://bawelteey.com
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
favicon.ico
bawelteey.com/ 		0
421 B 		Other
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axq2MoT2UgTY%2BUBLx%2BVK%2FGAjqkL5QinHnobe8njrNF2%2FZwSwV8a6ni6qhZQAe%2B%2Fl88F%2BVnlTe4%2Fwo9Vi%2FymniU6LNR%2F%2FI8r%2FxAeRqihXTQICmIcvfiZa00zHRkTOgWl2"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
86a761c18bfb5bbe-VIE
alt-svc
h3=":443"; ma=86400
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
zone
bawelteey.com/ 		796 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://bawelteey.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=bawelteey.com&var=4677282&ymid=796477848004337920&var_3=&var_4=&dsig=&tg=1&sw=3.1.497&trace_id=67be1f1b-bfb4-4035-a115-7f050a79b4fa&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjMifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJHb29nbGUgQ2hyb21lIiwidmVyc2lvbiI6IjEyMy4wLjYzMTIuNTgifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOC4wLjAuMCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMuMC42MzEyLjU4In1dLCJtb2JpbGUiOmZhbHNlLCJtb2RlbCI6IiIsInBsYXRmb3JtIjoiV2luMzIiLCJwbGF0Zm9ybVZlcnNpb24iOiIxMC4wLjAiLCJ3b3c2NCI6ZmFsc2V9
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cb055d2fdc3a9c9410db12b6fe0ec373a67c3be37f4d23d42babbc3f542735e
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 13:10:37 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-trace-id
c039d7ac606be1d7dc4a3eb9d7a69b0d
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YtYm9%2BttW%2BRAZG8TuvgXAEtgo8BIgFInkSYKqwCbcuErGpyzcbqr2Xq%2FWl0QIViwjaCEiOYqLDe9Kq5XRmHiyFz64h%2FdkWMgUosjIE1mWGVH%2FXCm1M72pt2eS0Dpstn"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
86a761c19c0a5bbe-VIE
access-control-allow-headers
Origin, X-Requested-With, X-Oaid, Content-Type, Accept
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
custom
jouteetu.net/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://jouteetu.net/custom
Requested by
Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796477848004337920&var=4677282&sw=/sw-check-permissions/4662709&uhd=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://bawelteey.com/
accept-language
fi-FI,fi;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious task.domain
Submitted on March 26th 2024, 1:21:28 pm UTC — From United States

Threats: Phishing
Brands: Facebook US
Comment: May only be viewable from Facebook app internal browser. Facebook login phishing site.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| getCookie function| rtrDebugLog function| getGid function| addURLParams string| osVerUrlParam string| osVerNum object| osVerPromise function| redirectLocker function| openLink function| Prefetcher string| tbPrefLog string| mtPushZone string| mtS string| mtZ string| tbZone string| tbADZone string| mtTargetUrl string| mtDebug string| mtRDC string| mtSameDomain string| pushTagDomain string| pushTagMicroName string| wvrdParam function| redirect object| mtScript function| updateURLParameter object| _0xd6c1 object| reverseConfig object| zfgformats

11 Cookies

Domain/Path Name / Value
gtoonfd.com/ Name: OAID
Value: 04802be32ed148b2e4257b0d20385c68
gtoonfd.com/ Name: oaidts
Value: 1711458635
gtoonfd.com/ Name: phpckd4677281
Value: true
gtoonfd.com/ Name: allcnt
Value: 1
my.rtmark.net/ Name: ID
Value: 04802be32ed148b2e4257b0d20385c68
thaudray.com/ Name: OAID
Value: 00802b2616294807f8cfcfe29a9f70c7
thaudray.com/ Name: oaidts
Value: 1711458636
bawelteey.com/ Name: reverse
Value: jNLSIIjT0n0YyCPOUZB9aP1mc-PQSDmD1HzJYJ8Izj0
bawelteey.com/ Name: OAID
Value: 7a5698ae0457b262b01eec546661146f
bawelteey.com/ Name: oaidts
Value: 1711458636
bawelteey.com/ Name: prefetchAd_4662728
Value: true

5 Console Messages

Source Level URL
Text
other warning URL: https://gtoonfd.com/link?z=4677281&var=14867&ymid=ca4467e9c71e7c7cc2457c219bda3dd4&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=4225
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://bawelteey.com/?s=796477848004337920&ssk=0e050f3c261af2373a29715d65ab749f&svar=1711458636&z=4677282&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/Helsinki&bto=-120
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block