turf3615.1sturf.com Open in urlscan Pro
194.150.236.236 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://turf3615.1sturf.com/
Submission: On March 04 via manual (March 4th 2022, 9:11:18 pm UTC) from BF — Scanned from FR

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 16 domains to perform 27 HTTP transactions. The main IP is 194.150.236.236, located in France and belongs to HIWIT_AS, FR. The main domain is turf3615.1sturf.com.

This is the only time turf3615.1sturf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	194.150.236.236 194.150.236.236	44976 (HIWIT_AS) (HIWIT_AS)
9	194.150.236.165 194.150.236.165	44976 (HIWIT_AS) (HIWIT_AS)
2 5	188.114.97.7 188.114.97.7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	173.225.100.28 173.225.100.28	19318 (IS-AS-1) (IS-AS-1)
2 4	194.150.236.190 194.150.236.190	44976 (HIWIT_AS) (HIWIT_AS)
1	91.121.164.142 91.121.164.142	16276 (OVH) (OVH)
1	194.150.236.5 194.150.236.5	44976 (HIWIT_AS) (HIWIT_AS)
4	185.119.26.1 185.119.26.1	203544 (WEBDEVIIN-AS) (WEBDEVIIN-AS)
1	194.0.255.28 194.0.255.28	8218 (NEO-ASN l...) (NEO-ASN legacy Neotelecoms)
1	142.250.185.168 142.250.185.168	15169 (GOOGLE) (GOOGLE)
1	172.217.18.110 172.217.18.110	15169 (GOOGLE) (GOOGLE)
27	12

2 194.150.236.236 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns76.hiwit.net

turf3615.1sturf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.biltoturf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 194.150.236.165 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns5.hiwit.net

www.pronoscourse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.levainqueur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 188.114.97.7 (Medellín, Colombia) 2 redirects

ASN13335 (CLOUDFLARENET, US)

img.root-top.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.225.100.28 (United States)

ASN19318 (IS-AS-1, US)

turftriomphe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 194.150.236.190 (France) 2 redirects

ASN44976 (HIWIT_AS, FR)
PTR: ns30.hiwit.net

www.turfsur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zetop.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zetop.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.snprono.powa.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.121.164.142 (France)

ASN16276 (OVH, FR)
PTR: ns360576.ip-91-121-164.eu

nsm05.casimages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.150.236.5 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns.allo-heberge.com

ns.allo-heberge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.119.26.1 (France)

ASN203544 (WEBDEVIIN-AS, FR)
PTR: 1.26.119.185.in-addr.arpa

payment.allopass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.0.255.28 (France)

ASN8218 (NEO-ASN legacy Neotelecoms, FR)
PTR: srv28.bdmultimedia.fr

script.starpass.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.168 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.110 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f110.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pronoscourse.com www.pronoscourse.com	241 KB
5	root-top.com 2 redirects img.root-top.com	22 KB
4	allopass.com payment.allopass.com	11 KB
2	zetop.info 1 redirects zetop.info www.zetop.info	11 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	37 KB
1	starpass.fr script.starpass.fr	286 B
1	allo-heberge.com ns.allo-heberge.com
1	powa.fr 1 redirects www.snprono.powa.fr	282 B
1	casimages.com nsm05.casimages.com	9 KB
1	biltoturf.com www.biltoturf.com	6 KB
1	turfsur.com www.turfsur.com	12 KB
1	levainqueur.com www.levainqueur.com	28 KB
1	turftriomphe.com turftriomphe.com	77 KB
1	1sturf.com turf3615.1sturf.com	635 B
0	gambling-affiliation.com Failed www.gambling-affiliation.com Failed
27	16

	Domain	Requested by
8	www.pronoscourse.com	turf3615.1sturf.com www.pronoscourse.com
5	img.root-top.com	2 redirects www.pronoscourse.com
4	payment.allopass.com	www.pronoscourse.com payment.allopass.com
1	www.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	payment.allopass.com
1	script.starpass.fr	www.pronoscourse.com
1	ns.allo-heberge.com	www.pronoscourse.com
1	www.snprono.powa.fr	1 redirects
1	nsm05.casimages.com	www.pronoscourse.com
1	www.biltoturf.com	www.pronoscourse.com
1	www.zetop.info	www.pronoscourse.com
1	zetop.info	1 redirects
1	www.turfsur.com	www.pronoscourse.com
1	www.levainqueur.com	www.pronoscourse.com
1	turftriomphe.com	www.pronoscourse.com
1	turf3615.1sturf.com
0	www.gambling-affiliation.com Failed	www.pronoscourse.com
27	17

This site contains no links.

Subject Issuer	Validity	Valid
pronoscourse.com R3	`2022-02-06` - `2022-05-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
turftriomphe.com cPanel, Inc. Certification Authority	`2021-09-08` - `2021-12-07`	3 months	crt.sh
levainqueur.com R3	`2022-02-06` - `2022-05-07`	3 months	crt.sh
turfsur.com R3	`2022-02-04` - `2022-05-05`	3 months	crt.sh
biltoturf.com R3	`2022-02-18` - `2022-05-19`	3 months	crt.sh
*.allopass.com Gandi Standard SSL CA 2	`2021-10-08` - `2022-10-08`	a year	crt.sh
*.starpass.fr Sectigo RSA Domain Validation Secure Server CA	`2021-05-06` - `2022-06-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://turf3615.1sturf.com/
Frame ID: D5A502F55444D5BE0D7258D7E1C52485
Requests: 1 HTTP requests in this frame

Frame: https://www.pronoscourse.com/turf/3615turf/
Frame ID: 0CF7482C010B911C8096C251285E26F2
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

3615 TURF

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Page Statistics

27
Requests

78 %
HTTPS

0 %
IPv6

16
Domains

17
Subdomains

12
IPs

3
Countries

474 kB
Transfer

563 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://zetop.info/img/logo_zetop.gif HTTP 301
https://www.zetop.info/img/logo_zetop.gif

Request Chain 9

https://img.root-top.com/topsite/ficebook/banner.gif HTTP 302
https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

Request Chain 12

https://img.root-top.com/topsite/secreturf/banner.gif HTTP 302
https://www.snprono.powa.fr/secreturf.gif HTTP 302
https://ns.allo-heberge.com/

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
turf3615.1sturf.com/ 414 B
635 B 120ms
85ms Document
text/html 194.150.236.236
HIWIT_AS

General

Check archive.org

Show headers Download Go to

Full URL: http://turf3615.1sturf.com/
Protocol: HTTP/1.1
Server: 194.150.236.236 , France, ASN44976 (HIWIT_AS, FR),
Reverse DNS: ns76.hiwit.net
Software: Apache /
Resource Hash: 67d41c1e688392df7aaee69f818bb4d002d27adb395ae422dff8cb901dd44e16

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Server: Apache
Vary: Host
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK / Show response
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 10 KB
11 KB 161ms
85ms Document
text/html 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pronoscourse.com/turf/3615turf/

Requested by

Host: turf3615.1sturf.com
URL: http://turf3615.1sturf.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

75b9554c10cc781f955ccee956d6dbedc25c73ce07f3bb1d0cd8dad019aa7738

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: http://turf3615.1sturf.com/

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Server: Apache
Strict-Transport-Security: max-age=15768000
Vary: Host
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK h1.png
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 38 KB
38 KB 18ms
18ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h1.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

1cd686935fd8522adbb341859df741b4284e46a532918d9d708867ccdc19e454

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:07 GMT
Server: Apache
ETag: "194d9cb-9681-55742b56f94c0"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 38529

GET
H/1.1 200
OK head.jpg
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 61 KB
61 KB 63ms
17ms Image
image/jpeg 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/head.jpg

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

09f5a6c9114102b27434d90a2d508df76a02d91edffcc3d94f6b4a85841ac00d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:18 GMT
Server: Apache
ETag: "194d9ce-f416-55742b6176d80"
Vary: Host
Content-Type: image/jpeg
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 62486

GET
H2 200 banner.gif
img.root-top.com/topsite/lavoyante/ Frame 0CF7 7 KB
7 KB 77ms
26ms Image
image/gif 188.114.97.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/lavoyante/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.97.7 Medellín, Colombia, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f717bd9627dd104c5feab3f891edc556bfce3174fda4ee81b0fbb0ff1d5b9963

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 21:11:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 30040
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7252
last-modified: Fri, 04 Mar 2022 12:50:34 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sGEzofrmg2b3kTJpeEQU%2Bo1xc3MhU6r%2FbyCw3%2BgpP9LojVl92q0i%2BJIkwvaqNWjuj%2B5VyH0f0JjJP5OKZ151G2OwvmGaCdztefBe1i2IfyLgIy46PyradX0ZxC%2BFkoGGvbh2"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 6e6d9a6b1c3b3b31-CDG
expires: Mon, 07 Mar 2022 12:50:34 GMT

GET
H2 200 logo2.gif
turftriomphe.com/lien/ Frame 0CF7 77 KB
77 KB 649ms
179ms Image
image/gif 173.225.100.28
IS-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turftriomphe.com/lien/logo2.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.225.100.28 , United States, ASN19318 (IS-AS-1, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 7adb98959fb28df7c99082b45bbf1f1f75b818282b220ea5c86b667912aa402d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 21:11:14 GMT
last-modified: Tue, 03 Nov 2015 11:59:38 GMT
server: LiteSpeed
content-type: image/gif
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 78622
expires: Fri, 11 Mar 2022 21:11:14 GMT

GET
H/1.1 200
OK logo.gif
www.levainqueur.com/ Frame 0CF7 28 KB
28 KB 93ms
19ms Image
image/gif 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.levainqueur.com/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

6270f4fc23be1ddceb334705172b0470d61d28d201fcc23402dbdc8bac85bdc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Tue, 13 Oct 2015 12:36:31 GMT
Server: Apache
ETag: "e76ccd-70a5-521fbb20911c0"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 28837

GET
H/1.1 200
OK logo.gif
www.turfsur.com/img/ Frame 0CF7 11 KB
12 KB 88ms
17ms Image
image/gif 194.150.236.190
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.turfsur.com/img/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.190 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns30.hiwit.net

Software

Apache /

Resource Hash

9bd0c1e96f9d3b63b53ba8c355ada916479d8815034cab0aad1540c3c602d896

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 05 Mar 2018 05:51:23 GMT
Server: Apache
ETag: "878aad-2cb9-566a3ea782cc0"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Content-Length: 11449

GET
H/1.1

200
OK

logo_zetop.gif
www.zetop.info/img/ Frame 0CF7
Redirect Chain

https://zetop.info/img/logo_zetop.gif
https://www.zetop.info/img/logo_zetop.gif

11 KB
11 KB

89ms
18ms

Image
image/gif

194.150.236.190
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zetop.info/img/logo_zetop.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Server

194.150.236.190 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns30.hiwit.net

Software

Apache /

Resource Hash

7c9a501ff24c88a1c67c41a92315b5c7b94e19bed6381da81631f691e501a8be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Thu, 06 Jun 2013 09:17:28 GMT
Server: Apache
ETag: "64570c-2ac9-4de78c87e3a00"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Content-Length: 10953

Redirect headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html; charset=iso-8859-1
Location: https://www.zetop.info/img/logo_zetop.gif
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 249

GET
H/1.1 200
OK logo.gif
www.biltoturf.com/ Frame 0CF7 6 KB
6 KB 93ms
18ms Image
image/gif 194.150.236.236
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.biltoturf.com/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.236 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns76.hiwit.net

Software

Apache /

Resource Hash

ead7dff95228a235e92f3cc50bcd67d3e448ccb40cee683514504e8a59aa8f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Sat, 24 Apr 2021 03:49:26 GMT
Server: Apache
ETag: "2563ddd-165f-5c0afcc7b5d80"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 5727

GET
H/1.1

200
OK

1110070340161338798861456.gif
nsm05.casimages.com/img/2011/10/07/ Frame 0CF7
Redirect Chain

https://img.root-top.com/topsite/ficebook/banner.gif
https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

8 KB
9 KB

142ms
20ms

Image
image/gif

91.121.164.142
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Server

91.121.164.142 , France, ASN16276 (OVH, FR),

Reverse DNS

ns360576.ip-91-121-164.eu

Software

Apache /

Resource Hash

c208d77e0e089f3e3b6e76a7811758dc5fe21725e55e37d22d54a878cefec06c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:13:41 GMT
Last-Modified: Thu, 14 Jan 2016 06:35:23 GMT
Server: Apache
ETag: "9c6610d-219d-529457dc380c0"
Strict-Transport-Security: max-age=31556926
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.casimages.com
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8605
Expires: Sat, 04 Mar 2023 21:13:41 GMT

Redirect headers

date: Fri, 04 Mar 2022 21:11:14 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GYCd8PtYxPwO0qFfhAVvi9xb25YSoYx5N7AHfooSHtGPapT%2F1PA3RysT2gV8syvqmXfWFhLS2P%2B3smPZGvkN6DMu26FhKonHCid4S8oDJ4IPlvOqD3o3ycRlxpVzYvKBJf0U"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: http://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif
cf-ray: 6e6d9a6b1c3d3b31-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 banner.gif
img.root-top.com/topsite/turfistes/ Frame 0CF7 10 KB
10 KB 52ms
24ms Image
image/gif 188.114.97.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/turfistes/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.97.7 Medellín, Colombia, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6049bb33ca3a57d6ef6368c2bf253e98a7fba1c45f173450806fc9fc187d06d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 21:11:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 65188
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9830
last-modified: Fri, 04 Mar 2022 03:04:46 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aVIBV8dOUiXaKsB4o3TadA%2Fb%2B39cUkmfc43KryJ2%2BbA0x3fhpn8M17axpHGU8Y8Hm46gfPh53WVf98l6TXxma22daTTKIeEL0kOh9QAKtX4GxL24OEVPzRoxYBGG5g6xJsLn"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 6e6d9a6b1c3a3b31-CDG
expires: Mon, 07 Mar 2022 03:04:46 GMT

GET
H2 200 banner.gif
img.root-top.com/topsite/turfplus/ Frame 0CF7 4 KB
4 KB 55ms
27ms Image
image/png 188.114.97.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/turfplus/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.97.7 Medellín, Colombia, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c89138fe4d60f677872fa14679dd7d6807b9f614bd62beb3ffc112f082442b8d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 21:11:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4718
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3872
last-modified: Wed, 14 Sep 2011 18:49:04 GMT
server: cloudflare
etag: "510718442"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gmMLt9uufQE%2FKk9maSp97%2F3Cy57oTQciLuN3ogVP3WU7KidISmi%2Fchk5uqr%2FKFEVsz47%2Bu06a6lVFQtWNOfltIAOIE72K%2B67531xV0VYqBZH2opGAnKiaWioN9eTqmXwd5cM"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6e6d9a6b1c3c3b31-CDG
expires: Mon, 16 Aug 2021 22:46:50 GMT

GET
H/1.1

200
OK

/
ns.allo-heberge.com/ Frame 0CF7
Redirect Chain

https://img.root-top.com/topsite/secreturf/banner.gif
https://www.snprono.powa.fr/secreturf.gif
https://ns.allo-heberge.com/

0
0

93ms
18ms

Image
text/html

194.150.236.5
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ns.allo-heberge.com/
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Server: 194.150.236.5 , France, ASN44976 (HIWIT_AS, FR),
Reverse DNS: ns.allo-heberge.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html; charset=iso-8859-1
Location: http://ns.allo-heberge.com/
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 211

GET
H/1.1 200
OK checkout.apu Show response
payment.allopass.com/buy/ Frame 0CF7 11 KB
4 KB 345ms
263ms Script
text/html 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: ea65817ee06d4a23cc99815ee02ada0b64769285ef8757d24931d1ffd9378fc6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 04 Mar 2022 21:11:14 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP='NON NID OTPa OUR NOR' policy-ref='http://payment.allopass.com/info/p3p/policy-references.xml'
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html
Content-Length: 2961
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK script.php Show response
script.starpass.fr/ Frame 0CF7 20 B
286 B 137ms
42ms Script
text/html 194.0.255.28
NEO-ASN legacy Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://script.starpass.fr/script.php?idd=433566&datas=
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.0.255.28 , France, ASN8218 (NEO-ASN legacy Neotelecoms, FR),
Reverse DNS: srv28.bdmultimedia.fr
Software: Apache /
Resource Hash: 65e35c6ae1f74e16cbe663763323963eec7c6a22512042ab0758bd68151934a1

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:10:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 40

GET
H/1.1 200
OK victoire.jpg
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 27 KB
27 KB 53ms
18ms Image
image/jpeg 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/victoire.jpg

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

3860e27e99358de8ad6acb927762f09f6900304d7140042c23d7586e9565d7ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:51 GMT
Server: Apache
ETag: "194d9d4-6bb9-55742b80ef7c0"
Vary: Host
Content-Type: image/jpeg
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 27577

GET
H/1.1 200
OK h3.png
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 38 KB
38 KB 51ms
17ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h3.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

02efc6cd18465bb07e5ae600e17b189ff274e97d1ce2ca95694a6268f84ac3a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:16 GMT
Server: Apache
ETag: "194d9cd-96a6-55742b5f8e900"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 38566

GET
H/1.1 200
OK /
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 1 KB
1 KB 126ms
85ms Image
text/html 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Vary: Host
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=15, max=97

GET
H/1.1 200
OK h2.png
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 27 KB
28 KB 27ms
18ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h2.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

dcde21057bf448c3ce030ee91d5ed7e8b32ff3f4e2760bce988d17164441153b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:13 GMT
Server: Apache
ETag: "194d9cc-6d5b-55742b5cb2240"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 27995

GET
H/1.1 200
OK date.png
www.pronoscourse.com/turf/3615turf/ Frame 0CF7 36 KB
37 KB 27ms
17ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/date.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

5bebe6f273dbd0db76f40e3533f48d3c3dbf0f5ef1a3df861447a580d35c145b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:04 GMT
Server: Apache
ETag: "194d9ca-90d5-55742b541ce00"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 37077

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 0CF7 95 KB
37 KB 97ms
35ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NHFGDSD

Requested by

Host: payment.allopass.com
URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fbe5d0fab6f290ed842cfcceb0a60c636d192aba40721a5a667b667bb360dd5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 21:11:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37549
x-xss-protection: 0
expires: Fri, 04 Mar 2022 21:11:14 GMT

GET
H/1.1 200
OK buy-button.css
payment.allopass.com/static/css/ Frame 0CF7 2 KB
830 B 51ms
17ms Stylesheet
text/css 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.allopass.com/static/css/buy-button.css?1
Requested by: Host: payment.allopass.com
URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: 95eb15e76b752a9c78d6281cd3b7c43a8fbc2931783edf3bf3703af55eff06e2

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Nov 2021 13:36:55 GMT
Server: Apache
ETag: "24bbe-69a-5d0e804cbabc0"
Vary: Accept-Encoding
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 546

GET
H/1.1 200
OK 162x56.png
payment.allopass.com/static/buy/button/fr/ Frame 0CF7 6 KB
6 KB 52ms
18ms Image
image/png 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://payment.allopass.com/static/buy/button/fr/162x56.png
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: 7dd9659e56e92abc376e04d427903b2cfca1d52d854d38e35fefa4cf9e7fd9db

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Tue, 16 Nov 2021 13:36:55 GMT
Server: Apache
ETag: "218f3-1688-5d0e804cbabc0"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 5768

GET v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s=
www.gambling-affiliation.com/cpm/ Frame 0CF7 0
0

GET
H/1.1 200
OK bt_ok.gif
payment.allopass.com/imgweb/common/ Frame 0CF7 753 B
991 B 51ms
18ms Image
image/gif 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://payment.allopass.com/imgweb/common/bt_ok.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: d1d6b5efe0d6c2540778435a8f7873cbec1eb76a2b107370388a8806cb5dda6a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 21:11:14 GMT
Last-Modified: Tue, 26 Nov 2019 14:39:46 GMT
Server: Apache
ETag: "22a09-2f1-59840d9fb3080"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 753

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 0CF7 49 KB
20 KB 89ms
26ms Script
text/javascript 172.217.18.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NHFGDSD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f110.1e100.net

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5781
date: Fri, 04 Mar 2022 19:34:53 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 04 Mar 2022 21:34:53 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.gambling-affiliation.com
URL: http://www.gambling-affiliation.com/cpm/v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s=

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			payment.allopass.com/	1969-12-31 23:59:59	Name: ShopSessionId Value: 3a4c8ed8-0cb8-49aa-9bb3-9c3c8701af6c
			.allopass.com/	1970-01-20 10:06:04	Name: AP_CUSK Value: 3558039632

19 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://turftriomphe.com/lien/logo2.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.levainqueur.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.turfsur.com/img/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://zetop.info/img/logo_zetop.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.biltoturf.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/ficebook/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfistes/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfplus/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/secreturf/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://turftriomphe.com/lien/logo2.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.levainqueur.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.turfsur.com/img/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://zetop.info/img/logo_zetop.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.biltoturf.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/ficebook/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfistes/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfplus/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/secreturf/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure script 'http://www.gambling-affiliation.com/cpm/v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s='. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img.root-top.com
ns.allo-heberge.com
nsm05.casimages.com
payment.allopass.com
script.starpass.fr
turf3615.1sturf.com
turftriomphe.com
www.biltoturf.com
www.gambling-affiliation.com
www.google-analytics.com
www.googletagmanager.com
www.levainqueur.com
www.pronoscourse.com
www.snprono.powa.fr
www.turfsur.com
www.zetop.info
zetop.info
www.gambling-affiliation.com
142.250.185.168
172.217.18.110
173.225.100.28
185.119.26.1
188.114.97.7
194.0.255.28
194.150.236.165
194.150.236.190
194.150.236.236
194.150.236.5
91.121.164.142
02efc6cd18465bb07e5ae600e17b189ff274e97d1ce2ca95694a6268f84ac3a5
09f5a6c9114102b27434d90a2d508df76a02d91edffcc3d94f6b4a85841ac00d
1cd686935fd8522adbb341859df741b4284e46a532918d9d708867ccdc19e454
3860e27e99358de8ad6acb927762f09f6900304d7140042c23d7586e9565d7ef
5bebe6f273dbd0db76f40e3533f48d3c3dbf0f5ef1a3df861447a580d35c145b
6270f4fc23be1ddceb334705172b0470d61d28d201fcc23402dbdc8bac85bdc7
65e35c6ae1f74e16cbe663763323963eec7c6a22512042ab0758bd68151934a1
67d41c1e688392df7aaee69f818bb4d002d27adb395ae422dff8cb901dd44e16
75b9554c10cc781f955ccee956d6dbedc25c73ce07f3bb1d0cd8dad019aa7738
7adb98959fb28df7c99082b45bbf1f1f75b818282b220ea5c86b667912aa402d
7c9a501ff24c88a1c67c41a92315b5c7b94e19bed6381da81631f691e501a8be
7dd9659e56e92abc376e04d427903b2cfca1d52d854d38e35fefa4cf9e7fd9db
95eb15e76b752a9c78d6281cd3b7c43a8fbc2931783edf3bf3703af55eff06e2
9bd0c1e96f9d3b63b53ba8c355ada916479d8815034cab0aad1540c3c602d896
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
b6049bb33ca3a57d6ef6368c2bf253e98a7fba1c45f173450806fc9fc187d06d
c208d77e0e089f3e3b6e76a7811758dc5fe21725e55e37d22d54a878cefec06c
c89138fe4d60f677872fa14679dd7d6807b9f614bd62beb3ffc112f082442b8d
d1d6b5efe0d6c2540778435a8f7873cbec1eb76a2b107370388a8806cb5dda6a
dcde21057bf448c3ce030ee91d5ed7e8b32ff3f4e2760bce988d17164441153b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea65817ee06d4a23cc99815ee02ada0b64769285ef8757d24931d1ffd9378fc6
ead7dff95228a235e92f3cc50bcd67d3e448ccb40cee683514504e8a59aa8f30
f717bd9627dd104c5feab3f891edc556bfce3174fda4ee81b0fbb0ff1d5b9963
fbe5d0fab6f290ed842cfcceb0a60c636d192aba40721a5a667b667bb360dd5e

turf3615.1sturf.com Open in urlscan Pro 194.150.236.236 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

78 %HTTPS

0 %IPv6

16 Domains

17 Subdomains

12 IPs

3 Countries

474 kBTransfer

563 kBSize

2 Cookies

0 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

2 Cookies

turf3615.1sturf.com Open in urlscan Pro
194.150.236.236 Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

78 %
HTTPS

0 %
IPv6

16
Domains

17
Subdomains

12
IPs

3
Countries

474 kB
Transfer

563 kB
Size

2
Cookies

27 HTTP transactions
0 data transactions