urlscan.io logo urlscan.io
SecurityTrails logo

install.search-wizard.com Open in urlscan Pro
13.80.30.142  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4...
Effective URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Submission: On June 24 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 3 countries across 12 domains to perform 26 HTTP transactions. The main IP is 13.80.30.142, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is install.search-wizard.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 7th 2020. Valid for: 3 months.
This is the only time install.search-wizard.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 23.111.9.35 33438 (HIGHWINDS2)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 1 34.231.89.205 14618 (AMAZON-AES)
1 2 35.227.196.138 15169 (GOOGLE)
2 104.22.64.104 13335 (CLOUDFLAR...)
1 2 95.211.26.198 60781 (LEASEWEB-...)
6 13.80.30.142 8075 (MICROSOFT...)
3 2a00:1450:400... 15169 (GOOGLE)
5 69.16.175.42 20446 (HIGHWINDS3)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
26 12
2    2606:4700:3033::ac43:ad86 (United States)

ASN13335 (CLOUDFLARENET, US)
pushwelcome.com
2    23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)
use.fontawesome.com
1    2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)
stackpath.bootstrapcdn.com
1    34.231.89.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-231-89-205.compute-1.amazonaws.com
news-easy.com
2    35.227.196.138 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 138.196.227.35.bc.googleusercontent.com
www.performanceonclick.com
2    104.22.64.104 (United States)

ASN13335 (CLOUDFLARENET, US)
feed.r-tb.com
t.r-tb.com
2    95.211.26.198 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
mega-offer.xyz
6    13.80.30.142 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
install.search-wizard.com
3    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
5    69.16.175.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net
b6u2w2z4.ssl.hwcdn.net
2    2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Domain Requested by
6 install.search-wizard.com mega-offer.xyz
b6u2w2z4.ssl.hwcdn.net
5 b6u2w2z4.ssl.hwcdn.net install.search-wizard.com
b6u2w2z4.ssl.hwcdn.net
3 fonts.googleapis.com install.search-wizard.com
2 cdnjs.cloudflare.com install.search-wizard.com
2 mega-offer.xyz 1 redirects www.performanceonclick.com
2 www.performanceonclick.com 1 redirects pushwelcome.com
2 use.fontawesome.com pushwelcome.com
2 pushwelcome.com pushwelcome.com
1 fonts.gstatic.com install.search-wizard.com
1 t.r-tb.com pushwelcome.com
1 feed.r-tb.com pushwelcome.com
1 news-easy.com 1 redirects
1 stackpath.bootstrapcdn.com pushwelcome.com
26 13

This site contains links to these domains. Also see Links.

Domain
search-wizard.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-05-04 -
2020-10-09		 5 months crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA		 2019-10-28 -
2020-12-23		 a year crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
mega-offer.xyz
Let's Encrypt Authority X3		 2020-05-30 -
2020-08-28		 3 months crt.sh
*.search-wizard.com
Let's Encrypt Authority X3		 2020-06-07 -
2020-09-05		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.ssl.hwcdn.net
Sectigo RSA Domain Validation Secure Server CA		 2020-01-02 -
2022-01-19		 2 years crt.sh
cloudflare.com
CloudFlare Inc ECC CA-2		 2020-01-07 -
2020-10-09		 9 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Frame ID: 564E65245A8A24219F9024DD835DAB2A
Requests: 28 HTTP requests in this frame

Frame: https://b6u2w2z4.ssl.hwcdn.net/common/html/delay_page_1.html
Frame ID: 2D59F0BDB4459159EDD0FB3B6B639168
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=8371... Page URL
  2. https://news-easy.com/RU7WIP7-iPRAaN-ynfn6gV0zQ1FCmDJFhWduEvdBhFY?clck=UtOl790O0T3-jIKKI270m0yybIU... HTTP 302
    http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTL... Page URL
  3. http://www.performanceonclick.com/jump/next.php?stamat=m%7C%2C%2CgjYrdhYjoGU3B_-GH0dEdHP3xP.7ed%2Cp1G-PposueKQ... HTTP 302
    https://mega-offer.xyz/i/25702?cost=&cid=15930402743118050060214486098872741&var1=2575139-186103281... HTTP 302
    https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc... Page URL
  4. https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

26
Requests

96 %
HTTPS

42 %
IPv6

12
Domains

13
Subdomains

12
IPs

3
Countries

196 kB
Transfer

523 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19 Page URL
  2. https://news-easy.com/RU7WIP7-iPRAaN-ynfn6gV0zQ1FCmDJFhWduEvdBhFY?clck=UtOl790O0T3-jIKKI270m0yybIUPSB2kMH4xfFFJVV_EOkKnm16DHbhpQMIdRPlKAFQVTj-BlQA80XK0ZnBN6J__MsndYXVhlQLNN84qIBPMgppLGpfJLFsKJo3_U_iQYplkQRPbKwkIEdEX9Ke9nJEhE6WQhtmQ3AJhrOXrMKQbiZClZFMWPB67Fmk4hdXz&sid=mekito_w10_0306_us_ch HTTP 302
    http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch Page URL
  3. http://www.performanceonclick.com/jump/next.php?stamat=m%7C%2C%2CgjYrdhYjoGU3B_-GH0dEdHP3xP.7ed%2Cp1G-PposueKQVWF2fLhjhxchTp-Oh5uUkhjYPGtNipNm6upGNAirItLfpFHBLvhNoXKCMKFM5bWEvH7ttyJGFAgZl3iWh99ayxrG3-WGAZS1QhBkcGG1SqhMc2U1EKuQeomA6g4nuczDE7anjyz50OtiBcsVE0l7LxRMVPJp-EJ8F5Ay2uU708kEk2BIlb9FggTi5UKvJno7OhJFpaFegQpjg5IZDPe3kDUbhVmzfLrwJ3F1rDCLElkd9AStEP05jvOgb9tTAXTumfNoogmmCBf9uJpRDEsfyI6-h7nbDEPeM7OgnTd8p66RdunMdOwJqicghGHpSVMpCNPlevM4Wy6u7lIzzYxCSbgdBMAY9W9FIExzYCmGGiH2WVGboao6LUASou6LG97SmzzbjWHiKNeTbkgtf1zcpBIbnEzWZVJpqs3WgbJ5d6mkH3inb3UhFcI939s0s-6n65b0ZgxTOAcicLcVSNbEaz298VUI8PxVCTCI6EBoGFIGU-oUeXOEZIgooq_ROR5lBZJRWPhioSApsY82wUa8Ju33F_wbs5hYRM3eSykLKdogdunAjdeM&cbrandom=0.902664378837029&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref= HTTP 302
    https://mega-offer.xyz/i/25702?cost=&cid=15930402743118050060214486098872741&var1=2575139-1861032815-0&acsc=215256164 HTTP 302
    https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqhO8lhDBhcMKvp7C8g50fAfwRLVVEZH67z42LS8C_IWqXHyZGhtAm0NnDanK4YGkKN4vubIolOKBx80rhM2dln Page URL
  4. https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://news-easy.com/RU7WIP7-iPRAaN-ynfn6gV0zQ1FCmDJFhWduEvdBhFY?clck=UtOl790O0T3-jIKKI270m0yybIUPSB2kMH4xfFFJVV_EOkKnm16DHbhpQMIdRPlKAFQVTj-BlQA80XK0ZnBN6J__MsndYXVhlQLNN84qIBPMgppLGpfJLFsKJo3_U_iQYplkQRPbKwkIEdEX9Ke9nJEhE6WQhtmQ3AJhrOXrMKQbiZClZFMWPB67Fmk4hdXz&sid=mekito_w10_0306_us_ch HTTP 302
  • http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch
Request Chain 9
  • http://www.performanceonclick.com/jump/next.php?stamat=m%7C%2C%2CgjYrdhYjoGU3B_-GH0dEdHP3xP.7ed%2Cp1G-PposueKQVWF2fLhjhxchTp-Oh5uUkhjYPGtNipNm6upGNAirItLfpFHBLvhNoXKCMKFM5bWEvH7ttyJGFAgZl3iWh99ayxrG3-WGAZS1QhBkcGG1SqhMc2U1EKuQeomA6g4nuczDE7anjyz50OtiBcsVE0l7LxRMVPJp-EJ8F5Ay2uU708kEk2BIlb9FggTi5UKvJno7OhJFpaFegQpjg5IZDPe3kDUbhVmzfLrwJ3F1rDCLElkd9AStEP05jvOgb9tTAXTumfNoogmmCBf9uJpRDEsfyI6-h7nbDEPeM7OgnTd8p66RdunMdOwJqicghGHpSVMpCNPlevM4Wy6u7lIzzYxCSbgdBMAY9W9FIExzYCmGGiH2WVGboao6LUASou6LG97SmzzbjWHiKNeTbkgtf1zcpBIbnEzWZVJpqs3WgbJ5d6mkH3inb3UhFcI939s0s-6n65b0ZgxTOAcicLcVSNbEaz298VUI8PxVCTCI6EBoGFIGU-oUeXOEZIgooq_ROR5lBZJRWPhioSApsY82wUa8Ju33F_wbs5hYRM3eSykLKdogdunAjdeM&cbrandom=0.902664378837029&cbtitle=&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=&cbkeywords=&cbref= HTTP 302
  • https://mega-offer.xyz/i/25702?cost=&cid=15930402743118050060214486098872741&var1=2575139-1861032815-0&acsc=215256164 HTTP 302
  • https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqhO8lhDBhcMKvp7C8g50fAfwRLVVEZH67z42LS8C_IWqXHyZGhtAm0NnDanK4YGkKN4vubIolOKBx80rhM2dln

26 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80
pushwelcome.com/ 		18 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:ad86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
pushwelcome.com
:scheme
https
:path
/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 24 Jun 2020 23:11:13 GMT
content-type
text/html
set-cookie
__cfduid=d96eae8fab6d31c9f9bc3e46f74817d241593040271; expires=Fri, 24-Jul-20 23:11:11 GMT; path=/; domain=.pushwelcome.com; HttpOnly; SameSite=Lax session=ebae433e-1072-4120-8226-4e21a85adc08
cf-cache-status
DYNAMIC
cf-request-id
038a328f7e00000ebb7c132200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5a8a205f3f630ebb-FRA
content-encoding
br
all.css
use.fontawesome.com/releases/v5.4.2/css/ 		49 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.4.2/css/all.css
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
d3db3a07cd01a325326de52822be97f34e9977ea6d2d3b90ae318f87c3daf374

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Origin
https://pushwelcome.com

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
content-encoding
gzip
last-modified
Thu, 25 Oct 2018 22:14:30 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"b4d08b13c5d88326fe4bea239e050253"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.1.0/css/ 		137 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/css/bootstrap.min.css
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Origin
https://pushwelcome.com

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:34:10 GMT
status
200
etag
"1544639650"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
21024
domains.js
pushwelcome.com/ 		10 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pushwelcome.com/domains.js
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:ad86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d1cbea88bb97549fd52ba1c7f0cdb7e15a8884339d1bbff76e4bc70d4a2ab99

Request headers

Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 24 Jun 2020 21:37:22 GMT
server
cloudflare
age
5123
etag
W/"5ef3c792-288e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
5a8a206b4f540ebb-FRA
cf-request-id
038a32970800000ebb7c193200000001
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
fa-solid-900.woff2
use.fontawesome.com/releases/v5.4.2/webfonts/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.4.2/webfonts/fa-solid-900.woff2
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
ac1a655367b02648fe8217ee11d1b272786605b78989ff614cb0beab5f6f547c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://use.fontawesome.com/releases/v5.4.2/css/all.css
Origin
https://pushwelcome.com

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
last-modified
Thu, 25 Oct 2018 22:15:24 GMT
server
NetDNA-cache/2.2
status
200
etag
"fd531d212b567d6049f400165473589f"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
accept-ranges
bytes
content-length
71952
next.php
www.performanceonclick.com/jump/
Redirect Chain
  • https://news-easy.com/RU7WIP7-iPRAaN-ynfn6gV0zQ1FCmDJFhWduEvdBhFY?clck=UtOl790O0T3-jIKKI270m0yybIUPSB2kMH4xfFFJVV_EOkKnm16DHbhpQMIdRPlKAFQVTj-BlQA80XK0ZnBN6J__MsndYXVhlQLNN84qIBPMgppLGpfJLFsKJo3_U_...
  • http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxv...
6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
HTTP/1.1
Server
35.227.196.138 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
138.196.227.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
352c794d20242fb6b2d05ef65ecc599e4dae99ed0974d9351868edba28d9a07a

Request headers

Host
www.performanceonclick.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19#utm_source=mekito_w10_0306_us_ch&utm_click=UtOl790O0T3-jIKKI270m0yybIUPSB2kMH4xfFFJVV_EOkKnm16DHbhpQMIdRPlKAFQVTj-BlQA80XK0ZnBN6J__MsndYXVhlQLNN84qIBPMgppLGpfJLFsKJo3_U_iQYplkQRPbKwkIEdEX9Ke9nJEhE6WQhtmQ3AJhrOXrMKQbiZClZFMWPB67Fmk4hdXz

Response headers

Server
openresty
Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Access-Control-Allow-Origin
*
Referrer-Policy
no-referrer
Link
<//www.performanceonclick.com>; rel=dns-prefetch,<//www.performanceonclick.com>; rel=preconnect
Content-Encoding
gzip
Via
1.1 google

Redirect headers

Date
Wed, 24 Jun 2020 23:11:13 GMT
Content-Type
text/html
Content-Length
158
Connection
keep-alive
Location
http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch
Set-Cookie
session=7999ea8f-ec40-4447-8fe9-ec2e1635c46d
Server
nginx
AFU1kAAPaBk
feed.r-tb.com/v1/native/ 		1 KB
918 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://feed.r-tb.com/v1/native/AFU1kAAPaBk?subid=mekito_w10_0306_us_ch&uid=f660efd1-eca1-45c9-8e5f-1f7e4d8ab3ba
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.64.104 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
cf-request-id
038a3297c30000071aef030200000001
cf-ray
5a8a206c6b60071a-LHR
krcc
NL
imp
t.r-tb.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://t.r-tb.com/imp?l=lPBVsR4Lekj7WOj2CZJRBBnzi2H7BuRw6UHC7ejpajcM3dyJvT8GGtopbefdFJ9OJK57ix3we4w2Q1uiUhBwcdZwJcr0_lk09GsxGzeDh-f95w_65WevOclFbk4WWIFFKJKAKfFeFdJQllf7VX3sXp5j4-N_GhlyvaekoYH9hPNeTJlDYXUMZEqqRPCyku8D_w8O-jTEAdF__3md8jXFsoN0x8Xp4LJHN2QS984jNaAHt38ERQvV4GU8hREbqoEqHAbKI8xBaciY_Mr9Ntf1slewXDB79tliQfXwKt0xps3hDre5bKGS5NY0dXYHsj6einkw44zcCzQRzNQNZrlHpJv2XnB_ik7h00yXQhpk3r-tLcnSTxp0P6IDid4o2Ryp
Requested by
Host: pushwelcome.com
URL: https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.64.104 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://pushwelcome.com/0XYNIQMwB4qDwgclOmA2tze9LnDcWT7FmYrFvtFmM80?cid=7041533224133121838&sid=837193&utm_campaign=NTY4ZwSkMwRD2uWtdA0xO3xgMjE0Np19
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Jun 2020 23:11:13 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
204
access-control-allow-origin
*
cache-control
no-cache
cf-ray
5a8a206e3e8c071a-LHR
cf-request-id
038a3298e00000071aef03b200000001
csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqhO8lhDBhcMKvp7C8g50fAfwRLV...
mega-offer.xyz/h/
Redirect Chain
  • http://www.performanceonclick.com/jump/next.php?stamat=m%7C%2C%2CgjYrdhYjoGU3B_-GH0dEdHP3xP.7ed%2Cp1G-PposueKQVWF2fLhjhxchTp-Oh5uUkhjYPGtNipNm6upGNAirItLfpFHBLvhNoXKCMKFM5bWEvH7ttyJGFAgZl3iWh99ayxr...
  • https://mega-offer.xyz/i/25702?cost=&cid=15930402743118050060214486098872741&var1=2575139-1861032815-0&acsc=215256164
  • https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqh...
934 B
693 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqhO8lhDBhcMKvp7C8g50fAfwRLVVEZH67z42LS8C_IWqXHyZGhtAm0NnDanK4YGkKN4vubIolOKBx80rhM2dln
Requested by
Host: www.performanceonclick.com
URL: http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
95.211.26.198 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
d96306cd953307af2d49947a977a6fcd8d61d4c1b8b34cf0e801d2b365098b49

Request headers

Host
mega-offer.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
TRK_TRG=eJxjYGBgEmEXZMosEOQztDDVMzI01zM0N9QzNBJkTk%2FNF2Ty8xHkLkpNz8zPi0%2FOT0kVZPXz0Q0NEeRMziyphIhwgURKilKTM0oEmTOLCwT5Q1KLihJDihLzijNLFBzdBfnyUkviiwtSU1PAOtgYBTkyi%2BMLivIrKtkYASU6JBA%3D; TRK_TRU2=eJxjYGBgEuEQZC5NNBVUMDdMSzM1SU1KSUkyTDWwNEhLSjM0N06xNEs1MjYxSrYQZE0qSsxL4RVkzc1PSc3hFeRKKsovL04tis9MYWMU5IfxylKLijPz83gcQg4wgIAga34xSAm7IBeQAZdVcV8nUvXQQ5A7JbUsMzk1vqSyIJWNEQAB7ymP; trk_cpa_pixel=00451a40-b670-11ea-ac55-3d68ee945c87
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://www.performanceonclick.com/jump/next.php?r=2575139&pub_clickid=46lINlbliVCXA43xGBNOnsGyPCvkh5lUBNdwfcTLy8TTi5Jgb87NYKYF8R4Yao1NnbW05tAbkIK-cPiJSCQWf99OvgTCfAcGwCuHaSIkdleLU3qO3kksMCMYArCpMxvh6X4kGrzYhzAkfNOXSkzMvdL_weOgld7Op86BPYpQVyOKvBsEB1jqi-PNcuKqeQqZYPXjCY6pqajQqad9WqfOU8MWCiLF3ipndUN5ZZEOFmrINjQO6g--_Ayh3gHE9P4wW-JlGHjrZwyNWUj5cdaT0nQAkmO_wxoZdxSsGC3ch-dMDq8ItZLvrToi9uC844WJNJ2fMq2CX2Ta-Hf2V3TdexbfCzLw1NM9YpcFNVnh3YyXJF0HbGfTXQyElOs6LDTClkflmwlw1H-ZzRjLyxD1QShY-O0LT5u3TJeleI0Vdb7AauF-eWmDF76PCLIVNLGj&sub1=mekito_w10_0306_us_ch

Response headers

Server
nginx
Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=20
Content-Encoding
gzip
Vary
Accept-Encoding

Redirect headers

Server
nginx
Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=20
Set-Cookie
TRK_TRG=eJxjYGBgEmEXZMosEOQztDDVMzI01zM0N9QzNBJkTk%2FNF2Ty8xHkLkpNz8zPi0%2FOT0kVZPXz0Q0NEeRMziyphIhwgURKilKTM0oEmTOLCwT5Q1KLihJDihLzijNLFBzdBfnyUkviiwtSU1PAOtgYBTkyi%2BMLivIrKtkYASU6JBA%3D; expires=Thu, 25-Jun-2020 23:11:14 GMT; Max-Age=86400; path=/ TRK_TRU2=eJxjYGBgEuEQZC5NNBVUMDdMSzM1SU1KSUkyTDWwNEhLSjM0N06xNEs1MjYxSrYQZE0qSsxL4RVkzc1PSc3hFeRKKsovL04tis9MYWMU5IfxylKLijPz83gcQg4wgIAga34xSAm7IBeQAZdVcV8nUvXQQ5A7JbUsMzk1vqSyIJWNEQAB7ymP; expires=Thu, 25-Jun-2020 23:11:14 GMT; Max-Age=86400; path=/ trk_cpa_pixel=00451a40-b670-11ea-ac55-3d68ee945c87; expires=Sun, 23-Aug-2020 23:11:14 GMT; Max-Age=5184000; path=/
Location
https://mega-offer.xyz/h/csJJVHbYQR0edCQgYKjIF9okSTer.cSkGBkNHO9yRZXb8aDsiMW2peOiofTqhhVqAkaWE_S8Cc1VzKNI04gS9rDoT.CQ6BFPH4T5_jKW.eJSE5lNfTlVVLQQEeJLc2TtJqU8q1uNMKGEzpQzd6LlPEd1yIzo9nlGHuJle0X4tvqhO8lhDBhcMKvp7C8g50fAfwRLVVEZH67z42LS8C_IWqXHyZGhtAm0NnDanK4YGkKN4vubIolOKBx80rhM2dln
Content-Encoding
gzip
Vary
Accept-Encoding
Primary Request /
install.search-wizard.com/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Requested by
Host: mega-offer.xyz
URL: https://mega-offer.xyz/i/25026
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
83a78cbff1280315e2723fb72dcde615b3064ea469443d915ec96d14cd7c5faa
Security Headers
Name Value
Content-Security-Policy default-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com maps.googleapis.com; img-src * data:; media-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com maps.googleapis.com data:; connect-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com *.fontawesome.com sqs.us-west-2.amazonaws.com *.notify-service.com; script-src 'self' 'nonce-pgican2qzz' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com *.google-analytics.com maps.googleapis.com code.jquery.com cdnjs.cloudflare.com script.crazyegg.com *.fontawesome.com d3owq2fdwtdp2j.cloudfront.net *.googlesyndication.com *.googletagmanager.com; style-src i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net fonts.gstatic.com fonts.googleapis.com code.jquery.com *.fontawesome.com 'unsafe-inline'; font-src fonts.gstatic.com fonts.googleapis.com i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.fontawesome.com; frame-src i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.search-wizard.com

Request headers

:method
GET
:authority
install.search-wizard.com
:scheme
https
:path
/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://mega-offer.xyz/i/25026
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://mega-offer.xyz/i/25026

Response headers

status
200
cache-control
private
pragma
no-cache
content-type
text/html; charset=utf-8
content-encoding
gzip
expires
0
vary
Accept-Encoding
server
Microsoft-IIS/10.0
x-aspnetmvc-version
5.2
content-security-policy
default-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com maps.googleapis.com; img-src * data:; media-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com maps.googleapis.com data:; connect-src 'self' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com *.fontawesome.com sqs.us-west-2.amazonaws.com *.notify-service.com; script-src 'self' 'nonce-pgican2qzz' i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.sendmepixel.com *.keepmypixel.com *.pxcollect.com *.google-analytics.com maps.googleapis.com code.jquery.com cdnjs.cloudflare.com script.crazyegg.com *.fontawesome.com d3owq2fdwtdp2j.cloudfront.net *.googlesyndication.com *.googletagmanager.com; style-src i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net fonts.gstatic.com fonts.googleapis.com code.jquery.com *.fontawesome.com 'unsafe-inline'; font-src fonts.gstatic.com fonts.googleapis.com i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.fontawesome.com; frame-src i3j3u3u9.ssl.hwcdn.net b6u2w2z4.ssl.hwcdn.net *.search-wizard.com
x-aspnet-version
4.0.30319
set-cookie
uid=9460b3e8-429b-4b0b-baaa-f030c03ea961; domain=.search-wizard.com; expires=Sun, 24-Jun-2040 23:11:14 GMT; path=/ __lpval=pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87&pagename=m; expires=Wed, 24-Jun-2020 23:16:14 GMT; path=/
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086
access-control-expose-headers
Request-Context
x-powered-by
ASP.NET
date
Wed, 24 Jun 2020 23:11:14 GMT
content-length
2560
css
fonts.googleapis.com/ 		10 KB
890 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Ubuntu:300,400,400i,700,700i
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c5ea621b522d6df0ee556b5870dfe5edf0cfad979bdafeb2083e234f9877999
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Jun 2020 23:11:14 GMT
server
ESF
date
Wed, 24 Jun 2020 23:11:14 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Jun 2020 23:11:14 GMT
css
fonts.googleapis.com/ 		2 KB
625 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Nunito
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9c662b6e3fb429681775f998db8d262428035930052ec2940864c06d567e4dc2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Jun 2020 22:33:14 GMT
server
ESF
date
Wed, 24 Jun 2020 23:11:14 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Jun 2020 23:11:14 GMT
css
fonts.googleapis.com/ 		2 KB
647 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a8252492db56de6a43a1e52010746aa4b09c216f522dfaa82a62169a811e3405
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Jun 2020 22:28:05 GMT
server
ESF
date
Wed, 24 Jun 2020 23:11:14 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Jun 2020 23:11:14 GMT
user-action-elements.css
b6u2w2z4.ssl.hwcdn.net/common/styles/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://b6u2w2z4.ssl.hwcdn.net/common/styles/user-action-elements.css?v=4.81
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
fd6d7d8c896480587169a9f2b9c2c0cc7c414ba64f0ef2f160081c824c0e3dbf

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 23 Jun 2020 08:29:07 GMT
ETag
"1592900947"
X-HW
1593040274.dop014.am5.t,1593040274.cds208.am5.shn,1593040274.dop014.am5.t,1593040274.cds154.am5.c
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4231
style.css
b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/styles/m/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/styles/m/style.css?v=5.72
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
d522ccb95d1e8977f6c4227eda061533dc4dd959aafc36c588f984e4d2b41e6f

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Encoding
gzip
Last-Modified
Mon, 22 Jun 2020 09:50:19 GMT
ETag
"1592819419"
X-HW
1593040274.dop132.am5.t,1593040274.cds143.am5.shn,1593040274.dop132.am5.t,1593040274.cds156.am5.c
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1441
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
5344324
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
038a329d13000096c2e20e3200000001
served-in-seconds
0.003
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:21:00 GMT
server
cloudflare
etag
W/"5afd497c-1538f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5a8a2074e96c96c2-FRA
expires
Mon, 14 Jun 2021 23:11:14 GMT
js.cookie.min.js
cdnjs.cloudflare.com/ajax/libs/js-cookie/2.1.3/ 		2 KB
970 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/js-cookie/2.1.3/js.cookie.min.js
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
20621620
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
038a329d13000096c2e20e4200000001
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:21:01 GMT
server
cloudflare
etag
W/"5afd497d-6d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5a8a2074e96d96c2-FRA
expires
Mon, 14 Jun 2021 23:11:14 GMT
main.6F8F57715090DA2632453988D9A1501B.js
b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/ 		87 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
3dfd5af7246141ae84e9a4c1683e721886ef0ebf3c1dc177d9c59c3828b0963a

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Jun 2020 23:11:14 GMT
Content-Encoding
gzip
Last-Modified
Mon, 22 Jun 2020 09:50:19 GMT
ETag
"1592819419"
X-HW
1593040274.dop132.am5.t,1593040274.cds029.am5.shn,1593040274.dop132.am5.t,1593040274.cds140.am5.c
Content-Type
application/unknown
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
20609
truncated
/ 		544 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5edc99996d04888432ff40494a8dd8c2b13f710f321d73ede1c8d29212a8503f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		173 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
chrome-store-logo.png
b6u2w2z4.ssl.hwcdn.net/pages/common/images/ 		215 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b6u2w2z4.ssl.hwcdn.net/pages/common/images/chrome-store-logo.png
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
d1371b413288fc131742d6d73f528d543a7d5835586978b59528209af0e99347

Request headers

Referer
https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/styles/m/style.css?v=5.72
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Jun 2020 23:11:14 GMT
X-HW
1593040274.dop132.am5.t,1593040274.cds029.am5.shn,1593040274.dop132.am5.t,1593040274.cds118.am5.c
Content-Type
application/xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=36
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
215
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: install.search-wizard.com
URL: https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans
Origin
https://install.search-wizard.com

Response headers

date
Tue, 09 Jun 2020 22:05:52 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
1299922
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Wed, 09 Jun 2021 22:05:52 GMT
delay_page_1.html
b6u2w2z4.ssl.hwcdn.net/common/html/ Frame 2D59 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://b6u2w2z4.ssl.hwcdn.net/common/html/delay_page_1.html
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash

Request headers

Host
b6u2w2z4.ssl.hwcdn.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87

Response headers

Date
Wed, 24 Jun 2020 23:11:14 GMT
Connection
Keep-Alive
ETag
"1574955449"
Cache-Control
max-age=31536000
Content-Length
2197
Content-Type
text/html
Last-Modified
Thu, 28 Nov 2019 15:37:29 GMT
Accept-Ranges
bytes
X-HW
1593040274.dop132.am5.t,1593040274.cds029.am5.shn,1593040274.dop132.am5.t,1593040274.cds151.am5.c
Access-Control-Allow-Origin
*
log
install.search-wizard.com/ 		6 B
123 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/log
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://install.search-wizard.com
access-control-expose-headers
Request-Context
cache-control
private
access-control-allow-credentials
true
content-length
6
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086
log
install.search-wizard.com/ 		6 B
46 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/log
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://install.search-wizard.com
access-control-expose-headers
Request-Context
cache-control
private
access-control-allow-credentials
true
content-length
6
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086
log
install.search-wizard.com/ 		6 B
46 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/log
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://install.search-wizard.com
access-control-expose-headers
Request-Context
cache-control
private
access-control-allow-credentials
true
content-length
6
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086
log
install.search-wizard.com/ 		6 B
46 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/log
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://install.search-wizard.com
access-control-expose-headers
Request-Context
cache-control
private
access-control-allow-credentials
true
content-length
6
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086
log
install.search-wizard.com/ 		6 B
46 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://install.search-wizard.com/log
Requested by
Host: b6u2w2z4.ssl.hwcdn.net
URL: https://b6u2w2z4.ssl.hwcdn.net/pages/SearchWizard/resources/scripts/minified/main.6F8F57715090DA2632453988D9A1501B.js?v=1592818471
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.80.30.142 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee

Request headers

Referer
https://install.search-wizard.com/?pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Wed, 24 Jun 2020 23:11:14 GMT
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://install.search-wizard.com
access-control-expose-headers
Request-Context
cache-control
private
access-control-allow-credentials
true
content-length
6
request-context
appId=cid-v1:45a9d489-fc29-42c9-bc96-fa13e1413086

Verdicts & Comments Add Verdict or Comment

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| Cookies string| creativenumber string| extensionid string| xpiUrl string| safariUrl string| edgeExtensionId string| co string| ip string| currentBrowser string| pgSegment string| pgSTO string| pgSTT string| soDomain string| pgData boolean| opn string| psu string| fai string| _pfl object| conf function| _typeof function| _possibleConstructorReturn function| _assertThisInitialized function| _getPrototypeOf function| _inherits function| _setPrototypeOf function| _classCallCheck function| _defineProperties function| _createClass function| Utils function| MouseDetector function| TestRunner function| Test function| UserAgentTest function| EnvironmentTest function| PluginsTest function| BindMethodTest function| StackTraceTest function| ViewPortTest function| RatioTest function| WebGLTest function| WebAudioTest function| WebSocketTest function| FileTest function| GB object| Base boolean| narrowMiddle boolean| yellowArrow boolean| playStoreSound function| installInterrupt

2 Cookies

Domain/Path Name / Value
install.search-wizard.com/ Name: __lpval
Value: pid=57300&subid=zen228_ab2f8756&clickid=00451a40-b670-11ea-ac55-3d68ee945c87&pagename=m
.search-wizard.com/ Name: uid
Value: 9460b3e8-429b-4b0b-baaa-f030c03ea961

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b6u2w2z4.ssl.hwcdn.net
cdnjs.cloudflare.com
feed.r-tb.com
fonts.googleapis.com
fonts.gstatic.com
install.search-wizard.com
mega-offer.xyz
news-easy.com
pushwelcome.com
stackpath.bootstrapcdn.com
t.r-tb.com
use.fontawesome.com
www.performanceonclick.com
104.22.64.104
13.80.30.142
2001:4de0:ac19::1:b:1a
23.111.9.35
2606:4700:3033::ac43:ad86
2606:4700::6810:85e5
2a00:1450:4001:808::200a
2a00:1450:4001:81d::2003
34.231.89.205
35.227.196.138
69.16.175.42
95.211.26.198
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
18d10c7d2b4b04aaf04254d1ae5d655a5dc0407cbcdd5a8c3986e985370f36ee
1c5ea621b522d6df0ee556b5870dfe5edf0cfad979bdafeb2083e234f9877999
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
352c794d20242fb6b2d05ef65ecc599e4dae99ed0974d9351868edba28d9a07a
3dfd5af7246141ae84e9a4c1683e721886ef0ebf3c1dc177d9c59c3828b0963a
4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5edc99996d04888432ff40494a8dd8c2b13f710f321d73ede1c8d29212a8503f
83a78cbff1280315e2723fb72dcde615b3064ea469443d915ec96d14cd7c5faa
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b
9c662b6e3fb429681775f998db8d262428035930052ec2940864c06d567e4dc2
9d1cbea88bb97549fd52ba1c7f0cdb7e15a8884339d1bbff76e4bc70d4a2ab99
a8252492db56de6a43a1e52010746aa4b09c216f522dfaa82a62169a811e3405
ac1a655367b02648fe8217ee11d1b272786605b78989ff614cb0beab5f6f547c
d1371b413288fc131742d6d73f528d543a7d5835586978b59528209af0e99347
d3db3a07cd01a325326de52822be97f34e9977ea6d2d3b90ae318f87c3daf374
d522ccb95d1e8977f6c4227eda061533dc4dd959aafc36c588f984e4d2b41e6f
d96306cd953307af2d49947a977a6fcd8d61d4c1b8b34cf0e801d2b365098b49
ee3df69641a083faeda162fce068aef31075856f15c43c74eada446496b865f2
fd6d7d8c896480587169a9f2b9c2c0cc7c414ba64f0ef2f160081c824c0e3dbf