work-preballoting.com Open in urlscan Pro
2606:4700:3037::ac43:8858  Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request new Show response work-preballoting.com/view/	5 KB 3 KB	305ms 204ms	Document text/html	2606:4700:3037::ac43:8858 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8858 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 192d683a271a6d7bd003b5e4c1f3bb1795b0f06a24e0de151e13833ad92250e5 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-headers Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Requested-With access-control-allow-methods GET,POST,PUT,DELETE,OPTIONS access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8918eee268c9a05e-FRA content-encoding br content-type text/html; charset=utf-8 date Mon, 10 Jun 2024 11:13:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uQI2HStU3Yi4EI5x%2FJ%2BXc67%2Br3YKHJd5HStJbE3AdMlAB3ENLevarjPHYC5%2FpAZU2LXCkG9GXNvE9qsa19TppJ3DhPwThaH269EtH4klz%2FsaknuV%2F0f8rqqLXFuarrhYUTwmeEucOE1BDQBHzDhYTiXhFvo%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x_domain work-preballoting.com x_theme outofwindow3-without-dmp2.desktop
GET H2	200	grid.min.css work-preballoting.com/static/outofwindow3-without-dmp2.desktop/css/	51 KB 7 KB	242ms 239ms	Stylesheet text/css	2606:4700:3037::ac43:8858 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/css/grid.min.css Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8858 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21226ae8892fd9920a89d1c1b2a1f17a93b600e6d88d7427a878fdd964340e8d Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip cf-cache-status DYNAMIC last-modified Wed, 05 Jun 2024 12:07:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"66605517-ca40" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jnx7R3oB7tqvXij%2FcOxDqLNtc785BH7YNidhFPSu74cBks1nVtCQW7NVK%2BgWiBGJRYhAeE%2F%2BoX1DCtY0SUfIxPVRe1PmxKhfay6eTivP5c7EBtj3dx1dXYQrDzs9e92Ggz71JnsjDbvr3%2FqNYlNXvVYB3uw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cf-ray 8918eee3badea05e-FRA alt-svc h3=":443"; ma=86400
GET H2	200	app.2527420c.js Show response work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/	61 KB 10 KB	180ms 177ms	Script application/javascript	2606:4700:3037::ac43:8858 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/app.2527420c.js Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8858 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7d127d4000500f32b4fa6ca369cd57a603b96ea47ae601fd7bdcda60aea603a Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip cf-cache-status DYNAMIC last-modified Wed, 05 Jun 2024 12:07:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"66605517-f43e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2BpruCjI3KHeEZJALvlTqsX7xaWOhXKqEA2WYBvmUuxO%2BTziPJvwWCZNYSuBNrglwNzu8bHGviGy9EhWnzM9yiHThT3UomGWMkeQYFnaXiAfH6H7QbtEDnXnZER6EDs6%2BhWVkqCXqP4WzRNOeSM%2Bp1qX3S0%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cf-ray 8918eee3bae4a05e-FRA alt-svc h3=":443"; ma=86400
GET H2	200	chunk-vendors.eee81080.js Show response work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/	280 KB 95 KB	232ms 232ms	Script application/javascript	2606:4700:3037::ac43:8858 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/chunk-vendors.eee81080.js Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8858 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 12c712ef0e6ad80c0308d00ef00e717035e05d4faa577aaf53e4ba425321c3cc Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip cf-cache-status DYNAMIC last-modified Wed, 05 Jun 2024 12:07:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"66605517-45efb" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZjxsCkys566%2Ba0thOuyJil4olz2t4bMb20cc54gLvqI78CNTIcf9I7SrvFiZqrhS7hloV0BYjorQXAgmdmxJNZ%2FcxRZAkozVUdzVU011OJQ2H4k1IHpdK4auJYpXePr4VHa8t1rTeh1I18sdSPJWkjQYjrI%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cf-ray 8918eee3bae7a05e-FRA alt-svc h3=":443"; ma=86400
GET H2	200	style.min.css work-preballoting.com/static/outofwindow3-without-dmp2.desktop/css/	10 KB 3 KB	91ms 91ms	Stylesheet text/css	2606:4700:3037::ac43:8858 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/css/style.min.css Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8858 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c19f3af00a3bddd2fff8453cb4279fdf8c01d37f8b41f3d05df174f6795b99c Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:37 GMT content-encoding gzip cf-cache-status DYNAMIC last-modified Wed, 05 Jun 2024 12:07:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"66605517-2832" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gsx57UahbSJ6NQeflzunEat%2BhkiZpXMmZmhd1Ky3NaBvqRtCi6jliiaAwL%2B3V%2Borrl3bo1qypoN4B7i2TQpxbgH5npggpkq7Cnyz1hoUilrQKuF3is7TqBQKYkVpEChB0cG36A8TBuoH4QVD8R9V44Mv%2F7Q%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cf-ray 8918eee3bae0a05e-FRA alt-svc h3=":443"; ma=86400
GET H2	200	css fonts.googleapis.com/	9 KB 1 KB	263ms 48ms	Stylesheet text/css	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&subset=cyrillic Requested by Host: work-preballoting.com URL: https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/css/style.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 10 Jun 2024 10:09:47 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 10 Jun 2024 11:13:38 GMT
GET DATA	200 OK	truncated /	70 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 76975ba315befd03dd68246f65598f13854cda92700123dd8a0635fd3baf2b65 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	121ms 37ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&subset=cyrillic Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://fonts.googleapis.com/ Origin https://work-preballoting.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 07 Jun 2024 03:17:52 GMT x-content-type-options nosniff age 287746 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 07 Jun 2025 03:17:52 GMT
GET H2	200	45e49f4106a03e252cc9665e791faa6b5f9f6063.js Show response wdhhsxghbr.com/1/	28 KB 7 KB	195ms 47ms	Script application/javascript	116.202.32.33 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://wdhhsxghbr.com/1/45e49f4106a03e252cc9665e791faa6b5f9f6063.js Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 116.202.32.33 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.33.32.202.116.clients.your-server.de Software nginx/1.18.0 / Resource Hash 4ede4fd448834576bbb26ded614459ebaa2c93521c6bc3a3d14483db7be09532 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip last-modified Tue, 14 May 2024 09:37:36 GMT server nginx/1.18.0 etag W/"664330e0-6ea1" vary Accept-Encoding content-type application/javascript
GET H3	200	get-n-item Show response work-preballoting.com/api/	3 KB 2 KB	192ms 192ms	XHR application/json	172.67.136.88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/api/get-n-item?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view&language=DE&blang=de-DE&hash=d0168209-536b-495f-8e87-a16bb5afcce3&project=5 Requested by Host: work-preballoting.com URL: https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/chunk-vendors.eee81080.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.136.88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f3ba01e2ee627c51002ba02ea789b3f0268368e7f93ff4425685019ddf76474 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept application/json, text/plain, */* Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding access-control-allow-methods GET,POST,PUT,DELETE,OPTIONS content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVYLLzV3dWCYP7JZKvIAtYVU9FG50QD7pYcPCLYxlVSTVY2QwNahBJVOKJKmjTMUIryioSWHVg4cdukCdl%2FbokE3h%2BpMOTCgei3YP1yBu71u3zKEDijV1a8QHz5tHTQGVfBFZ%2Bs7jlY%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8918eee7bc0b973c-FRA access-control-allow-headers Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Requested-With alt-svc h3=":443"; ma=86400
GET		image.gif mixer-press.com/	0 0
GET H3	200	get-items Show response work-preballoting.com/api/	20 KB 6 KB	211ms 210ms	XHR application/json	172.67.136.88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/api/get-items?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view&language=DE&blang=de-DE&hash=d0168209-536b-495f-8e87-a16bb5afcce3&project=5&boost=1&is_clear=0&count=8&offset=0&r=0.40683519889033093&theme=outofwindow3-without-dmp2&is_video=0&resolution_width=1600&resolution_height=1200&connection_speed=4g%2C10&article=d0168209-536b-495f-8e87-a16bb5afcce3 Requested by Host: work-preballoting.com URL: https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/chunk-vendors.eee81080.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.136.88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e9ac5a4578643e6d88af27334402e37d8d25ccca6dedc2a05b97c00b4f3b6e50 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept application/json, text/plain, */* Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT content-encoding gzip cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding access-control-allow-methods GET,POST,PUT,DELETE,OPTIONS content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NKYluQBudQIYIK%2F0Bziie%2BeBq4%2Fds570E0o5AEnFahj%2Bblj6rlAX0N5xKhOgCzcoM46yBCMwLN7ALDUPqvRAfZGxzqgIgWAR%2F4XSe8jRjfmY%2B%2BBuDb8dPGkFkmOOJsjy26PmNXsenV8%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8918eee8fdd4973c-FRA access-control-allow-headers Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Requested-With alt-svc h3=":443"; ma=86400
GET H3	200	5181956bcc47f7e5f76883e52d99afe8.jpg work-preballoting.com/images/news/rectangular/	48 KB 48 KB	136ms 136ms	Image image/jpeg	172.67.136.88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://work-preballoting.com/images/news/rectangular/5181956bcc47f7e5f76883e52d99afe8.jpg Requested by Host: work-preballoting.com URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.136.88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c1b3811f35c384813cac7bdae91394f450f4c79798341ec163da31d92557583f Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Origin https://work-preballoting.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:38 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 content-length 49126 last-modified Thu, 07 Sep 2023 05:48:46 GMT server cloudflare etag "64f9643e-bfe6" access-control-allow-methods GET content-type image/jpeg access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vxfOPD2Wn1%2BtKVghr%2FNz2k%2BPMHz2NPe1jthx1XOocFSpa7b4kPqKGKshJPhW2Yn2Zcvm5dN4ojZTv90QPmB%2Ffjw77K%2BLVxT3UMufP%2BQ0bG%2FC7gxnKNBQBI29OL8tqMCicxrGU8ERKTA%3D"}],"group":"cf-nel","max_age":604800} access-control-expose-headers * cache-control max-age=315360000 accept-ranges bytes cf-ray 8918eee8fdd7973c-FRA access-control-allow-headers * expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2 fonts.gstatic.com/s/roboto/v30/	10 KB 10 KB	61ms 60ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&subset=cyrillic Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3728fbdd191d75bad5b83a838dfe2fc15f84c2aaa36ffa573321275847db31a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://fonts.googleapis.com/ Origin https://work-preballoting.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 07 Jun 2024 05:08:18 GMT x-content-type-options nosniff age 281120 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 9840 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:39 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 07 Jun 2025 05:08:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	39ms 39ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&subset=cyrillic Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://fonts.googleapis.com/ Origin https://work-preballoting.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 03 Jun 2024 18:30:08 GMT x-content-type-options nosniff age 578610 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 03 Jun 2025 18:30:08 GMT
GET H2	200	KFOmCnqEu92Fr1Mu5mxKOzY.woff2 fonts.gstatic.com/s/roboto/v30/	9 KB 10 KB	52ms 51ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&subset=cyrillic Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://fonts.googleapis.com/ Origin https://work-preballoting.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 07 Jun 2024 18:45:28 GMT x-content-type-options nosniff age 232090 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 9628 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 07 Jun 2025 18:45:28 GMT
GET		e4794750-015d-4526-a01e-d0effa26e49b.jpg t6v3rsx2yq.com/images/e4/79/	0 0
GET		a67814d3-3eb3-498b-8d24-6344ec9eba40.jpg t6v3rsx2yq.com/images/a6/78/	0 0
GET		caa3445e-c289-46c4-ab17-9938880c8bc7.jpg t6v3rsx2yq.com/images/ca/a3/	0 0
GET		ff6005a0-86d0-49c1-9bd8-b86cbf607545.jpg t6v3rsx2yq.com/images/ff/60/	0 0
GET		acacdccc-8c0e-4ca8-bc92-207dbd8f0788.jpg t6v3rsx2yq.com/images/ac/ac/	0 0
GET		5df35aad-566e-4ddf-89ba-d7b85f948c66.jpg t6v3rsx2yq.com/images/5d/f3/	0 0
GET		268a1c7b-6589-46b1-86df-04cc1862d50e.jpg t6v3rsx2yq.com/images/26/8a/	0 0
GET		c9e83514-7c83-449e-8dcc-9de5284f6129.jpg t6v3rsx2yq.com/images/c9/e8/	0 0
POST H3	200	set-view Show response work-preballoting.com/api/	34 B 555 B	121ms 120ms	XHR application/json	172.67.136.88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://work-preballoting.com/api/set-view Requested by Host: work-preballoting.com URL: https://work-preballoting.com/static/outofwindow3-without-dmp2.desktop/js/chunk-vendors.eee81080.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.136.88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d11a7da52bb89f362ad17ee9f250103db4e4f1eba2e7ac362e04e0a0438fcc1 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Content-Type application/json Accept application/json, text/plain, */* Referer https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view sec-ch-ua-platform "Win32" Response headers date Mon, 10 Jun 2024 11:13:39 GMT content-encoding gzip cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding access-control-allow-methods GET,POST,PUT,DELETE,OPTIONS content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cypYUy1%2FRmi8Py3M7wnSdb0PDW05HzmPWOZP%2Bhy7g1FIA46BkyUC0Pfx0YM4pcVq4oWbVSoSlnx4ZWzs6lD5mTmU9QpuLcYEydyAKCTNkeOQ1PmI%2Bn4GuvdGYYoFe2a0dNgYEgtB5%2BM%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8918eeed6c79973c-FRA access-control-allow-headers Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Requested-With alt-svc h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

mixer-press.com

URL

https://mixer-press.com/image.gif?sid9=view&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_source=345501&utm_medium=3471&client_id=c1486c84-04ac-4ed3-9800-67a1a8462acf&cost=0&ip=&DEBUG=&sid6=3040705&category=0&resolution_width=1600&resolution_height=1200&connection_speed=4g,10

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/e4/79/e4794750-015d-4526-a01e-d0effa26e49b.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/a6/78/a67814d3-3eb3-498b-8d24-6344ec9eba40.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/ca/a3/caa3445e-c289-46c4-ab17-9938880c8bc7.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/ff/60/ff6005a0-86d0-49c1-9bd8-b86cbf607545.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/ac/ac/acacdccc-8c0e-4ca8-bc92-207dbd8f0788.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/5d/f3/5df35aad-566e-4ddf-89ba-d7b85f948c66.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/26/8a/268a1c7b-6589-46b1-86df-04cc1862d50e.jpg

Domain

t6v3rsx2yq.com

URL

https://t6v3rsx2yq.com/images/c9/e8/c9e83514-7c83-449e-8dcc-9de5284f6129.jpg

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| config object| webpackJsonp number| pinterNewsInfinite number| pinter number| offsetForTest string| uid object| scrollHistory object| vueApp function| GdknTY1er7GWZ7bwN object| ic4ca4

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			work-preballoting.com/	1970-01-20 21:56:50	Name: templates_show_id Value: 111

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://work-preballoting.com/view/new?d=mixer-press.com&sid6=3040705&utm_campaign=17061&utm_content=d0168209-536b-495f-8e87-a16bb5afcce3&utm_medium=3471&utm_source=345501&uid=c1486c84-04ac-4ed3-9800-67a1a8462acf&rnd=0.03246238840392013&sid9=view Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
mixer-press.com
t6v3rsx2yq.com
wdhhsxghbr.com
work-preballoting.com
mixer-press.com
t6v3rsx2yq.com
116.202.32.33
172.67.136.88
2606:4700:3037::ac43:8858
2a00:1450:4001:801::2003
2a00:1450:4001:811::200a
12c712ef0e6ad80c0308d00ef00e717035e05d4faa577aaf53e4ba425321c3cc
192d683a271a6d7bd003b5e4c1f3bb1795b0f06a24e0de151e13833ad92250e5
21226ae8892fd9920a89d1c1b2a1f17a93b600e6d88d7427a878fdd964340e8d
2c19f3af00a3bddd2fff8453cb4279fdf8c01d37f8b41f3d05df174f6795b99c
3728fbdd191d75bad5b83a838dfe2fc15f84c2aaa36ffa573321275847db31a9
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
4ede4fd448834576bbb26ded614459ebaa2c93521c6bc3a3d14483db7be09532
5d11a7da52bb89f362ad17ee9f250103db4e4f1eba2e7ac362e04e0a0438fcc1
76975ba315befd03dd68246f65598f13854cda92700123dd8a0635fd3baf2b65
9f3ba01e2ee627c51002ba02ea789b3f0268368e7f93ff4425685019ddf76474
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
c1b3811f35c384813cac7bdae91394f450f4c79798341ec163da31d92557583f
d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82
e9ac5a4578643e6d88af27334402e37d8d25ccca6dedc2a05b97c00b4f3b6e50
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7d127d4000500f32b4fa6ca369cd57a603b96ea47ae601fd7bdcda60aea603a