tours.specia1.com Open in urlscan Pro
13.32.99.99 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lx2.in/4465
Effective URL:
https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=htt...
Submission: On October 01 via manual (October 1st 2022, 10:39:33 pm UTC) from SK — Scanned from GB

Summary HTTP 44 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 15 IPs in 5 countries across 16 domains to perform 44 HTTP transactions. The main IP is 13.32.99.99, located in United States and belongs to AMAZON-02, US. The main domain is tours.specia1.com. The Cisco Umbrella rank of the primary domain is 541574.
TLS certificate: Issued by Amazon on January 19th 2022. Valid for: a year.

This is the only time tours.specia1.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	77.72.0.102 77.72.0.102	12488 (KRYSTAL) (KRYSTAL)
6	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
2 2	52.19.101.114 52.19.101.114	16509 (AMAZON-02) (AMAZON-02)
1 1	64.188.52.46 64.188.52.46	30602 (ISPRIME) (ISPRIME)
9	13.32.99.99 13.32.99.99	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
2	18.66.147.100 18.66.147.100	16509 (AMAZON-02) (AMAZON-02)
2	13.32.99.86 13.32.99.86	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400a:808::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
7	68.169.87.223 68.169.87.223	30602 (ISPRIME) (ISPRIME)
44	15

2 77.72.0.102 (United Kingdom)

ASN12488 (KRYSTAL, GB)
PTR: oxygen.cloudhosting.co.uk

lx2.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.19.101.114 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-101-114.eu-west-1.compute.amazonaws.com

qgwwjx.lmpresivedate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.sexybltch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.188.52.46 (United States) 1 redirects

ASN30602 (ISPRIME, US)

go.moartraffic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 13.32.99.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-99.fra60.r.cloudfront.net

tours.specia1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.147.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-100.fra60.r.cloudfront.net

cdn.tours-78-94.wellhello.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-86.fra60.r.cloudfront.net

utl-1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400a:808::200a (Zurich, Switzerland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 68.169.87.223 (United States)

ASN30602 (ISPRIME, US)

secure.authbill.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	specia1.com tours.specia1.com — Cisco Umbrella Rank: 541574	963 KB
9	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 143	207 KB
7	authbill.com secure.authbill.com — Cisco Umbrella Rank: 504703	10 KB
3	gstatic.com fonts.gstatic.com	47 KB
3	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 707	33 KB
2	utl-1.com utl-1.com — Cisco Umbrella Rank: 560392	318 KB
2	wellhello.com cdn.tours-78-94.wellhello.com — Cisco Umbrella Rank: 767907	2 KB
2	google.com adservice.google.com — Cisco Umbrella Rank: 76 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42	10 KB
2	lx2.in lx2.in	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 41	1 KB
1	moartraffic.com 1 redirects go.moartraffic.com — Cisco Umbrella Rank: 369570	2 KB
1	sexybltch.net 1 redirects www.sexybltch.net — Cisco Umbrella Rank: 904111	608 B
1	lmpresivedate.com 1 redirects qgwwjx.lmpresivedate.com	641 B
1	google.co.uk adservice.google.co.uk — Cisco Umbrella Rank: 5343	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 862	641 B
44	16

	Domain	Requested by
9	tours.specia1.com	tours.specia1.com
7	secure.authbill.com	utl-1.com
6	pagead2.googlesyndication.com	lx2.in pagead2.googlesyndication.com tpc.googlesyndication.com
3	fonts.gstatic.com	fonts.googleapis.com
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
3	maxcdn.bootstrapcdn.com	lx2.in
2	utl-1.com	tours.specia1.com
2	cdn.tours-78-94.wellhello.com	tours.specia1.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	lx2.in	lx2.in
1	fonts.googleapis.com	tours.specia1.com
1	www.google.com	tpc.googlesyndication.com
1	go.moartraffic.com	1 redirects
1	www.sexybltch.net	1 redirects
1	qgwwjx.lmpresivedate.com	1 redirects
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.co.uk	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
44	18

This site contains links to these domains. Also see Links.

Domain
hushlove.com

Subject Issuer	Validity	Valid
lx2.in R3	`2022-08-22` - `2022-11-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.co.uk GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
specia1.com Amazon	`2022-01-19` - `2023-02-17`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
cdn.tours-78-94.wellhello.com Amazon	`2022-09-22` - `2023-10-20`	a year	crt.sh
utl-1.com Amazon	`2022-05-25` - `2023-06-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
secure.authbill.com R3	`2022-08-22` - `2022-11-20`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Frame ID: 139901821FE609008B6FC923F96D8D37
Requests: 37 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/zrt_lookup.html
Frame ID: 40E2D28710DA1227AFCC771BD241D798
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4160062110251030&output=html&adk=1812271804&adf=3025194257&lmt=1664663968&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Flx2.in%2F4465&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1664663968570&bpp=5&bdt=265&idt=259&shv=r20220928&mjsv=m202209280101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1910107904944&frm=20&pv=2&ga_vid=761686251.1664663969&ga_sid=1664663969&ga_hid=288487501&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C21066429%2C31070061%2C31067825&oid=2&pvsid=4309857172046759&tmod=321793756&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=274
Frame ID: D3CB8C4C7B0BE19D37BD5E10ADA6A8C9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3F9480532816A3FF5E10A15D17D5C32A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0DA38EC2B816C8AF3DE12CACB750AF3E
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

InstantCheat

Page URL History Show full URLs

https://lx2.in/4465 Page URL
https://qgwwjx.lmpresivedate.com/c/da57dc555e50572d?s1=167233&s2=1573255&j5=1&j6=1 HTTP 302
https://www.sexybltch.net/c/4c8a669b83e6c2d3?&click_id=pfqtj6338c1a1000d8226&s1=167233&s2=1573255&s3=b... HTTP 302
https://go.moartraffic.com/go.php?t=42425&aid=115443&sid=167233_1573255&clickid=gjlxm6338c1a1000e8d97 HTTP 302
https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19c... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Page Statistics

44
Requests

100 %
HTTPS

59 %
IPv6

16
Domains

18
Subdomains

15
IPs

5
Countries

1596 kB
Transfer

2201 kB
Size

31
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://hushlove.com/terms
Title: Terms

Search URL Search Domain Scan URL

URL: https://hushlove.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://hushlove.com/DMCA
Title: DMCA

Search URL Search Domain Scan URL

URL: https://hushlove.com/site/contactus?from=footer
Title: Contact Us

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lx2.in/4465 Page URL
https://qgwwjx.lmpresivedate.com/c/da57dc555e50572d?s1=167233&s2=1573255&j5=1&j6=1 HTTP 302
https://www.sexybltch.net/c/4c8a669b83e6c2d3?&click_id=pfqtj6338c1a1000d8226&s1=167233&s2=1573255&s3=backuser&s5=&lp=MJ&j4=&j5=1&j6=1&j8=&j9= HTTP 302
https://go.moartraffic.com/go.php?t=42425&aid=115443&sid=167233_1573255&clickid=gjlxm6338c1a1000e8d97 HTTP 302
https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

44 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 4465 Show response
lx2.in/ 2 KB
1 KB 1423ms
1350ms Document
text/html 77.72.0.102
KRYSTAL

General

Check archive.org

Show headers Download Go to

Full URL: https://lx2.in/4465
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 77.72.0.102 , United Kingdom, ASN12488 (KRYSTAL, GB),
Reverse DNS: oxygen.cloudhosting.co.uk
Software: LiteSpeed /
Resource Hash: 050797beb2089e25a7d1cf1fda70e8474b1cee7697628458b5e183dbd78031de

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 923
content-type: text/html
date: Sat, 01 Oct 2022 22:39:28 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 163 KB
54 KB 184ms
68ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: lx2.in
URL: https://lx2.in/4465

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c764c3827f9bb219041feaccb5414aea78db95e105e71dba179b162e80ec1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54748
x-xss-protection: 0
server: cafe
etag: 5079499386362360309
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 01 Oct 2022 22:39:28 GMT

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 109ms
44ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: lx2.in
URL: https://lx2.in/4465

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 617, 617, 617
age: 2745645
cdn-cachedat: 2021-06-08 14:35:16
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: a25b3b26237dd55b5f417f26a9965dbb
timing-allow-origin: *
cdn-requestcountrycode: US
cf-ray: 7538b1ca78bddd78-LHR
cdn-requestpullsuccess: True

GET
H2 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 23 KB
3 KB 106ms
41ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css

Requested by

Host: lx2.in
URL: https://lx2.in/4465

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 674, 617, 617
age: 2649741
cdn-cachedat: 2021-04-13 11:04:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 113470564b093a987148d51e92935f4d
timing-allow-origin: *
cdn-requestcountrycode: US
cf-ray: 7538b1ca78c0dd78-LHR
cdn-requestpullsuccess: True

GET
H2 200 styles.css
lx2.in/ 2 KB
871 B 37ms
33ms Stylesheet
text/html 77.72.0.102
KRYSTAL

General

Check archive.org

Show headers Download Go to

Full URL: https://lx2.in/styles.css
Requested by: Host: lx2.in
URL: https://lx2.in/4465
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 77.72.0.102 , United Kingdom, ASN12488 (KRYSTAL, GB),
Reverse DNS: oxygen.cloudhosting.co.uk
Software: LiteSpeed /
Resource Hash: d3ccd37fe4593ed00698a5a925b251f225e83723e5f963b332eba648a8f04d3b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/4465
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: br
server: LiteSpeed
content-length: 833
vary: Accept-Encoding,User-Agent
content-type: text/html

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
11 KB 101ms
38ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js

Requested by

Host: lx2.in
URL: https://lx2.in/4465

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 617, 617, 617, 617, 617, 617, 617, 617, 617
age: 2745908
cdn-cachedat: 2021-06-08 14:35:59
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: b078a1e046f360931b46757d100ff8d1
timing-allow-origin: *
cdn-requestcountrycode: US
cf-ray: 7538b1ca78c2dd78-LHR
cdn-requestpullsuccess: True

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209280101/ 349 KB
114 KB 163ms
78ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209280101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4160062110251030&plah=lx2.in&bust=31070061

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac729c8d0a6be76dcf4d3f5b7634530fca7196237ab9f3164f2e9c81e19c2525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117162
x-xss-protection: 0
server: cafe
etag: 3164460565399765014
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 01 Oct 2022 22:39:28 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/ Frame 40E2 10 KB
5 KB 144ms
40ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lx2.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 59842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 01 Oct 2022 06:02:06 GMT
etag: 9671129459699598864
expires: Sat, 15 Oct 2022 06:02:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 210 B
641 B 172ms
49ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=lx2.in&callback=_gfp_s_&client=ca-pub-4160062110251030

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209280101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4160062110251030&plah=lx2.in&bust=31070061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42d3fdffa68b4996b82c6b29ea64cde2a7fe115e7ba709fedddbd210749ab658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 147ms
51ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=lx2.in

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 160ms
50ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=lx2.in

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D3CB 14 KB
5 KB 242ms
157ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4160062110251030&output=html&adk=1812271804&adf=3025194257&lmt=1664663968&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Flx2.in%2F4465&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1664663968570&bpp=5&bdt=265&idt=259&shv=r20220928&mjsv=m202209280101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1910107904944&frm=20&pv=2&ga_vid=761686251.1664663969&ga_sid=1664663969&ga_hid=288487501&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C21066429%2C31070061%2C31067825&oid=2&pvsid=4309857172046759&tmod=321793756&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=274

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2be9dfefa2e18bb2857a7fd06621c89ad0539a1b4213fa68ad2350ea7dea815a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lx2.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 4868
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 01 Oct 2022 22:39:29 GMT
expires: Sat, 01 Oct 2022 22:39:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 144ms
58ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220928&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11200
x-xss-protection: 0

GET
H2

200

Primary Request / Show response
tours.specia1.com/t/888/hl/
Redirect Chain

https://qgwwjx.lmpresivedate.com/c/da57dc555e50572d?s1=167233&s2=1573255&j5=1&j6=1
https://www.sexybltch.net/c/4c8a669b83e6c2d3?&click_id=pfqtj6338c1a1000d8226&s1=167233&s2=1573255&s3=backuser&s5=&lp=MJ&j4=&j5=1&j6=1&j8=&j9=
https://go.moartraffic.com/go.php?t=42425&aid=115443&sid=167233_1573255&clickid=gjlxm6338c1a1000e8d97
https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D16...

25 KB
4 KB

146ms
44ms

Document
text/html

13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 66ef250a63e88e5092acdcb2380f23da0cbc7b1557abe067ab69d36e7a8820a6

Request headers

Referer: https://lx2.in/4465
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 252
content-encoding: gzip
content-type: text/html
date: Sat, 01 Oct 2022 22:36:30 GMT
etag: W/"444c28c03205ad0b822f2a43e8c75411"
last-modified: Fri, 30 Sep 2022 13:36:00 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
x-amz-cf-id: ELiYH4FwVmq7NI5lJ9yVHKmRUqKW4FKwn8eynyfSqwYFUths4vtInw==
x-amz-cf-pop: FRA60-P3
x-cache: Hit from cloudfront

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Sat, 01 Oct 2022 22:39:29 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
p3p: CP="NOI ADM DEV COM NAV OUR STP"
server: Apache
vary: Accept-Encoding
x-content-type-options: nosniff
x-robots-tag: otherbot: noindex, nofollow googlebot: noindex, nofollow

GET
H2 200 sodar2.js
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 156ms
59ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 01 Oct 2022 22:39:29 GMT

GET
H3 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3F94 13 KB
5 KB 134ms
41ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lx2.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 5290
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 01 Oct 2022 21:11:19 GMT
expires: Sun, 01 Oct 2023 21:11:19 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe
www.google.com/recaptcha/api2/ Frame 0DA3 783 B
1 KB 175ms
51ms Document
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bK9zq4z7Y0N5t26k-9SXhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://lx2.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-bK9zq4z7Y0N5t26k-9SXhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 01 Oct 2022 22:39:29 GMT
expires: Sat, 01 Oct 2022 22:39:29 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js
pagead2.googlesyndication.com/bg/ Frame 3F94 36 KB
16 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 19:40:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Sep 2023 19:40:32 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0DA3 0
0 75ms
74ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220928&jk=4309857172046759&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3F94 0
10 B 40ms
40ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?4IF43Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:39:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 80ms
79ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220928&jk=4309857172046759&bg=!OjmlOX3NAAYQgTJdMIE7ACkAdvg8Wj8-vO7icU3fkSUoVuzn8iXGlQwC7UNxfWFFyuI5e1NeEF59ewIAAABJUgAAAAdoAQcKAC0b5c1K5_aRAcyG8dyfCzxVzeAJvFozwXrm5H-RfzJVSB9mooAKBvO3U_YlmVaZAqj6R0pLhGusZSroU6vE1Ju4SNAo58gBjobrv1h2rg_K0mnKofIXWmVGeNkS6B9nuyKpw54NmhaWGbrl6nz3pjCShDhM-e0N5ObvJPql0MpkMmCBXIlQc_WdWHEokdsv-DJECOmoAZB6Y3PzHBjSc4ESnJH9hJ1ktvhjUXaX0PH5ne-EQ_4Q_csgjDZcUdvi97sVGfA3QPC46o1GBsDDLSNbijQurMxFLst3VZlT3BFNeiugMDKvFcBMeUC-erBp_bKDLNYBhDIMjxyxnNdDLBk9Otlu6WHnudL7UAkgW1gXCKhbjzc5wkBfZ82mqDAx8PI1Xg_QzM4CPGphN1DX0sXma1Wm0omcbpe6LtebQDe3RLMHFqqwbJ0f8LEGHouAGKEboJetKYk5nTVXOt8AB2ERLOaSrDSesQ2lu2WueT80X6oTXYuXd20SlfvLfmYnUqxx9KtNit8_Grj3edZq4OyHdegjad23QSysBMg9RRzcL0LWr8kigncVXYvJFMADyBn-d7WkD4_jAZHrQOsQebbrnF7UBJPuPU8Ms6KFARxktXHF9asBC52S7qzqU9kAxpivCUtfM8jCW66WcOzqfi6iWQ-ceatBEFX82ZCHgJUQ1AKiVlz9w-H00uHHyyWDlUZ9kafeXaUOsqb8f7I42qy0Evf1Hp3Z1IKmmlVAALSbJMq1PXInxeBmrw8QEurEXfmHlTmWZZOLRfT88dcg0kawWzNGx5sOTR5xRaOODev29H5hKbxppaI6_RBQ-WTKjBPvsEEkXpTiuhzSg7pUJsNV01mxASBXQGXUQXjgi6MgSDoN0fsrzROL8AANEOfYjOZE7di6AknnRAzXZXTVaSCbyxpL3OCcPdx8DI8LnPtPrnBRCMqR-JPP36v0yKOAp0rqX818giuBrQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://lx2.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H2 200 style.css
tours.specia1.com/t/872/v1/css/ 29 KB
6 KB 46ms
45ms Stylesheet
text/css 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tours.specia1.com/t/872/v1/css/style.css
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7ca980eb4a0150c4bdaaeb53fd229a50f4c345cf2b6295cdd3a042bd6a94904d

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:35:51 GMT
content-encoding: gzip
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 13:35:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 220
etag: W/"f78e76123c478e466af7fac5b71c40f0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: Gl8ZhzsaQfeyMzkUCHCuEmXEvunXWpwa2K-UH4kMCA2Q2WUJvxucmA==

GET
H2 200 logo_white.png
tours.specia1.com/t/872/v1/images/ 25 KB
25 KB 46ms
45ms Image
image/png 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tours.specia1.com/t/872/v1/images/logo_white.png
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ef897169496fdd94fbe5bec6875fd140d7b362d4cf4293ad3f7f1895ea19e773

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:35:08 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 13:35:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 272
etag: "18b79c1f332877218cbc64f02756b001"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
content-length: 25108
x-amz-cf-id: Zr06HOUjVCoi3do2cetsHNfLYjlnE5FAEJD3kv-JTl9KUWGPod8w5Q==

GET
H2 200 logo_black.png
tours.specia1.com/t/872/v1/images/ 25 KB
25 KB 65ms
62ms Image
image/png 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tours.specia1.com/t/872/v1/images/logo_black.png
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c7c60d2f491dc5f2cdcc7288c8c7f70e5e55cb22d00001ea8dbeae895edf13fc

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:35:39 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 13:35:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 246
etag: "36ef95442672cd2ec77bda692c3bc2a1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
content-length: 25128
x-amz-cf-id: rxEtKvjw_wo5fEV7L0E_VO2jqPuJ2CRFpHFsXJsAVf4aWj--Bv_Ebw==

GET
H2 200 address.png
tours.specia1.com/t/872/v1/images/ 1 KB
2 KB 61ms
59ms Image
image/png 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tours.specia1.com/t/872/v1/images/address.png
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d56035b1871d7689d1a95dd4b9d38ab9ebf0bc2e0a0b59f474fe2f39816c690

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:36:16 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 13:35:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 214
etag: "bd9476d9f407e290f817f77a0bf37674"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
content-length: 1384
x-amz-cf-id: MYejbrug7G8itw0RYex3bwaUMhRuyWEE2KVHuYnNyNgK95_pxxwmAw==

GET
H2 200 no.png
tours.specia1.com/t/872/v1/images/ 2 KB
3 KB 56ms
54ms Image
image/png 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tours.specia1.com/t/872/v1/images/no.png
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 24d772537dc40a1048cdf09f8ee61cfbbd8317b8f0dd3bb2154f96e1b8d31def

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:36:16 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 13:35:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 214
etag: "f4c850c3599943476c895e408d566458"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
content-length: 2369
x-amz-cf-id: VSLtCh_phriBVnI2Koa3BomMZK2C_SzeuT4sHBup16bZRZWZLPa2RA==

GET
H2 200 ok.png
tours.specia1.com/t/872/v1/images/ 6 KB
6 KB 58ms
56ms Image
image/png 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tours.specia1.com/t/872/v1/images/ok.png
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1cb5bb6aa110033f4c0178ace377811d87ec6f64b5a0aa6d1ddf477342e7dddd

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:36:16 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 09:39:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 202
etag: "7550af9d46dd32ea5d0d5834425368db"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
content-length: 6092
x-amz-cf-id: A8O53jk9y1_u1ZlA_RnEZrotPzOjJGgM1DHLFTfwOB_BIN_TdZzpZA==

GET
H2 200 arrow.svg
cdn.tours-78-94.wellhello.com/snapcheat/img/svg/ 867 B
1 KB 156ms
42ms Image
image/svg+xml 18.66.147.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.tours-78-94.wellhello.com/snapcheat/img/svg/arrow.svg
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-100.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 6efee9ca3dd0b249814e53fab132821a3c1b5370fdb02c704947399485ec43b9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 09:42:37 GMT
via: 1.1 78280b924a7a9f0f018abcebd8ad82d0.cloudfront.net (CloudFront)
last-modified: Wed, 08 Dec 2021 15:30:13 GMT
server: nginx
x-amz-cf-pop: FRA60-P4
age: 9550613
etag: "61b0cf85-363"
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 867
x-amz-cf-id: z6CBuzLOiKVGqt8phcbUYRrfxXYVwAcpK0oPUroZ5E2GNnpNKaHq5g==

GET
H2 200 arrow.svg
cdn.tours-78-94.wellhello.com/instantcheat/imgs/ 867 B
1 KB 157ms
44ms Image
image/svg+xml 18.66.147.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.tours-78-94.wellhello.com/instantcheat/imgs/arrow.svg
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-100.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 6efee9ca3dd0b249814e53fab132821a3c1b5370fdb02c704947399485ec43b9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 03:28:36 GMT
via: 1.1 78280b924a7a9f0f018abcebd8ad82d0.cloudfront.net (CloudFront)
last-modified: Wed, 08 Dec 2021 15:30:12 GMT
server: nginx
x-amz-cf-pop: FRA60-P4
age: 11214654
etag: "61b0cf84-363"
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 867
x-amz-cf-id: biq_12zZc7Ucq2tHgp1hu1rIssBmP2kBl-E38ZjzGc0R9fPkjaEgxA==

GET
H2 200 utl.min.js Show response
utl-1.com/1.6.20/ 300 KB
301 KB 150ms
50ms Script
application/javascript 13.32.99.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://utl-1.com/1.6.20/utl.min.js
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-86.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d2edbef8944e5e94cd67c37b0a6960841eacb87327c493790313ca2870feac34

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:14:00 GMT
via: 1.1 74c5b19a4695b76162adbf07ed9ef370.cloudfront.net (CloudFront)
last-modified: Mon, 06 Apr 2020 12:48:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 2967931
etag: "16abec94a42aa716dd831a52bca3b1b7"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 307271
x-amz-cf-id: EcMqeQmj9j6FHtn6p5hYYUamonGaD3Ztj_iyzDntCd_8DjvmHidF_g==

GET
H2 200 mst2.min.js Show response
utl-1.com/1.6.20/ 17 KB
18 KB 346ms
246ms Script
application/javascript 13.32.99.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://utl-1.com/1.6.20/mst2.min.js
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-86.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 863efe6006e4a42f8b6312fc39d79c2aa4c22ce3d1fc845122a064779a26a74e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 03 Sep 2022 08:59:11 GMT
via: 1.1 74c5b19a4695b76162adbf07ed9ef370.cloudfront.net (CloudFront)
last-modified: Mon, 06 Apr 2020 12:48:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 2468420
etag: "1ce673324943ed678ec7908cf7815cab"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 17707
x-amz-cf-id: k3sLSQ2xSuhEWGd37KpDEBSyAZFRyawB32qCzCZpmdbCjbr2eVG_vw==

GET
H2 200 custom.js Show response
tours.specia1.com/t/872/v1/ 6 KB
2 KB 58ms
55ms Script
application/javascript 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tours.specia1.com/t/872/v1/custom.js
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf1771721f082182eabbb93914ed99be2e16f8d734970ff89b511ebba3f7385c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 22:37:54 GMT
content-encoding: gzip
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 09:39:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 113
etag: W/"da60e0f1788c52dfee34da8042b8720a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: EsmDHotEzz8azquZzDCu2w05JnQonZXkFu_tW-pLVoaBkI-R78neMA==

GET
H2 206 VID_20181217_154147.mp4
tours.specia1.com/t/872/v1/ 889 KB
890 KB 72ms
71ms Media
video/mp4 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tours.specia1.com/t/872/v1/VID_20181217_154147.mp4
Requested by: Host: tours.specia1.com
URL: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6c4da9313a074bbb5524ed46f2050ace1b7b5b9985e41c947d223b6637f2743

Request headers

Referer: https://tours.specia1.com/t/888/hl/?t=42425&aid=115443&sid=167233_1573255&xk=706120d1b39ca5c3ca852b19ca621cc1&bn=38&gu=http%3A%2F%2Fgo.moartraffic.com%2Fgo.php%3Ft%3D42425%26aid%3D115443%26sid%3D167233_1573255%26clickid%3Dgjlxm6338c1a1000e8d97%26hts_id%3D969a3971-c300-4248-9d74-a7a0a7ab8371&clickid=gjlxm6338c1a1000e8d97&i18n_country=GB&hts_id=969a3971-c300-4248-9d74-a7a0a7ab8371
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Range: bytes=0-

Response headers

date: Sat, 01 Oct 2022 22:37:54 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 09:39:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 100
etag: "6c3a32bd8094df4abad02ce4c96ccaf2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 0-910055/910056
x-amz-cf-id: c30M3Z2u-BdCM1TbGMWioOkuhNvBTnID00KBis9c78bf7MNu7nsY7w==
Content-Length: 910056

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 176ms
61ms Stylesheet
text/css 2a00:1450:400a:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Requested by

Host: tours.specia1.com
URL: https://tours.specia1.com/t/872/v1/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400a:808::200a Zurich, Switzerland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a0ae09929605e6f45470f62f9ec51e9ec846c70ba08947c673728468044ca1f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tours.specia1.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 01 Oct 2022 22:39:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 21:33:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 01 Oct 2022 22:39:30 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 146ms
53ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tours.specia1.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 13:27:29 GMT
x-content-type-options: nosniff
age: 119521
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Sep 2023 13:27:29 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 134ms
41ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tours.specia1.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 16:44:52 GMT
x-content-type-options: nosniff
age: 453278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 16:44:52 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 177ms
84ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tours.specia1.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 12:56:05 GMT
x-content-type-options: nosniff
age: 467005
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 12:56:05 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 36 B
636 B 503ms
147ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

9f16b1762b34efc24d91d4743f97f285bf977ef0caa3c540d83c0e7c8c81340e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 56
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 804 B
966 B 513ms
156ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

a1e3faf2c39efe278d1fbf640b833680842d2d71f275cd5ddda345793badf629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 385
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 20 KB
5 KB 509ms
152ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

78f9153b97d7ffc7cb808144a600ace9cbe92a0208cbf348d55280c40db65d70

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 4820
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 1 B
601 B 517ms
158ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 21
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 266 B
795 B 540ms
181ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

bec67b67f469999d4f8a973879fb65135d2b003f60969982334ee5dd930b39ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 214
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 266 B
795 B 555ms
194ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

bec67b67f469999d4f8a973879fb65135d2b003f60969982334ee5dd930b39ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 214
expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H/1.1 200
OK api.php Show response
secure.authbill.com/tour/ 0
708 B 715ms
211ms XHR
text/html 68.169.87.223
ISPRIME

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.authbill.com/tour/api.php

Requested by

Host: utl-1.com
URL: https://utl-1.com/1.6.20/utl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

68.169.87.223 , United States, ASN30602 (ISPRIME, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://tours.specia1.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 01 Oct 2022 22:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-headers: X-Requested-With, content-type
content-length: 20
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.lx2.in/	1970-01-20 15:45:59	Name: __gads Value: ID=d2cccaefeda5545f-225e9be038ce00e2:T=1664663968:RT=1664663968:S=ALNI_MY8aHYgxfDWlAbsZWZGfgWzeUT-Ug
.doubleclick.net/	1970-01-20 06:24:24	Name: test_cookie Value: CheckForPermission
qgwwjx.lmpresivedate.com/	1970-01-20 07:50:47	Name: unique_id Value: 6338c0ed000f6c2e
qgwwjx.lmpresivedate.com/	1970-01-20 08:33:59	Name: unique_id2 Value: 6338c0ed0001761e
qgwwjx.lmpresivedate.com/	1970-01-20 08:33:59	Name: 6338c0ed0001761e_c Value: 1
qgwwjx.lmpresivedate.com/	1970-01-20 07:07:35	Name: ref_token Value: 167233
qgwwjx.lmpresivedate.com/	1970-01-20 16:00:23	Name: tid Value: pfqtj6338c1a1000d8226
www.sexybltch.net/	1970-01-20 07:50:47	Name: unique_id Value: 6338c0ed00090238
www.sexybltch.net/	1970-01-20 08:33:59	Name: unique_id2 Value: 6338c0ed000ac8f0
www.sexybltch.net/	1970-01-20 08:33:59	Name: 6338c0ed000ac8f0_c Value: 1
www.sexybltch.net/	1970-01-20 07:07:35	Name: ref_token Value: 167233
www.sexybltch.net/	1970-01-20 16:00:23	Name: tid Value: gjlxm6338c1a1000e8d97
.moartraffic.com/	1970-01-20 06:25:50	Name: bd_ovtu Value: 1
.moartraffic.com/	1970-01-20 10:43:35	Name: bdreff Value: https%3A%2F%2Flx2.in%2F
.moartraffic.com/	1970-01-20 10:43:35	Name: tour Value: 42425
.moartraffic.com/	1970-01-20 10:43:35	Name: affsubid Value: 115443-167233_1573255
.moartraffic.com/	1970-01-20 06:25:50	Name: bdvisit Value: 115443
.moartraffic.com/	1970-01-20 06:25:50	Name: bdcounter Value: 1
.moartraffic.com/	1970-01-20 10:43:35	Name: xk Value: 706120d1b39ca5c3ca852b19ca621cc1
.specia1.com/	1970-01-20 10:43:35	Name: tour Value: 42425
.specia1.com/	1970-01-20 10:43:35	Name: affsubid Value: 115443-167233_1573255
.specia1.com/	1970-01-20 06:25:50	Name: reff Value: https%3A%2F%2Flx2.in%2F
.specia1.com/	1970-01-20 10:43:35	Name: upgrade_tour Value: 42425
.specia1.com/	1970-01-20 06:25:50	Name: guid Value: B1846436-48FD-47AE-A563-2430A7001589
.specia1.com/	1970-01-20 10:43:35	Name: custom_tracking Value: %5B%22address%22%2C%22ad_type%22%2C%22app_id%22%2C%22app_name%22%2C%22auth_token%22%2C%22a_aid%22%2C%22a_bid%22%2C%22banner%22%2C%22banner_id%22%2C%22banner_size%22%2C%22bn%22%2C%22c%22%2C%22cid%22%2C%22city%22%2C%22clickid%22%2C%22click_id%22%2C%22click_url%22%2C%22cmp_bo%22%2C%22cmp_member_id%22%2C%22consent%22%2C%22dx%22%2C%22email%22%2C%22exotracker%22%2C%22f%22%2C%22fbclid%22%2C%22fbid%22%2C%22first_name%22%2C%22gclid%22%2C%22gdpr%22%2C%22h%22%2C%22hts_id%22%2C%22hx%22%2C%22keyword%22%2C%22landerid%22%2C%22lander_id%22%2C%22last_name%22%2C%22misc_tour_info%22%2C%22niche%22%2C%22np%22%2C%22offer%22%2C%22origin%22%2C%22phone_number%22%2C%22placement%22%2C%22product%22%2C%22product_id%22%2C%22profile_visited%22%2C%22publisher%22%2C%22rcid%22%2C%22referer%22%2C%22reqid%22%2C%22rgc%22%2C%22rgh%22%2C%22rgm%22%2C%22schedule%22%2C%22sdaf%22%2C%22sdfsadf%22%2C%22session_initiated_by%22%2C%22sl%22%2C%22smoochy_user_id%22%2C%22snapchat_username%22%2C%22source%22%2C%22state%22%2C%22street%22%2C%22sv_cheating_mon%22%2C%22template%22%2C%22thumb_id%22%2C%22tracker_id%22%2C%22upgrade_uuid%22%2C%22upg_reason%22%2C%22userage%22%2C%22useremail%22%2C%22userzip%22%2C%22user_id%22%2C%22wellhello_profile_id%22%2C%22wellhello_upgrade_tour%22%2C%22xk%22%2C%22zip%22%5D
.specia1.com/	1970-01-20 06:25:50	Name: prop_bn Value: 38
.specia1.com/	1970-01-20 06:25:50	Name: prop_clickid Value: gjlxm6338c1a1000e8d97
.specia1.com/	1970-01-20 06:25:50	Name: prop_hts_id Value: 969a3971-c300-4248-9d74-a7a0a7ab8371
.specia1.com/	1970-01-20 06:25:50	Name: prop_xk Value: 706120d1b39ca5c3ca852b19ca621cc1
.specia1.com/	1970-01-20 10:43:35	Name: affiliate_115443_is_terminated Value: 0
.tours.specia1.com/	1970-01-20 10:43:35	Name: geoip Value: %7B%22country_code%22%3A%22GB%22%2C%22country_name%22%3A%22United%20Kingdom%20of%20Great%20Britain%20and%20Northern%20Ireland%22%2C%22region%22%3A%22England%22%2C%22city%22%3A%22Manchester%22%2C%22latitude%22%3A53.4809494019%2C%22longitude%22%3A-2.23743009567%2C%22zipcode%22%3A%22M1%22%2C%22isp_name%22%3A%22Venus%20Business%20Communications%20Limited%22%2C%22mobile_brand%22%3A%22%22%7D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.co.uk
adservice.google.com
cdn.tours-78-94.wellhello.com
fonts.googleapis.com
fonts.gstatic.com
go.moartraffic.com
googleads.g.doubleclick.net
lx2.in
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
partner.googleadservices.com
qgwwjx.lmpresivedate.com
secure.authbill.com
tours.specia1.com
tpc.googlesyndication.com
utl-1.com
www.google.com
www.sexybltch.net
13.32.99.86
13.32.99.99
18.66.147.100
2606:4700::6812:acf
2a00:1450:4001:802::2002
2a00:1450:4001:806::2002
2a00:1450:4001:806::2004
2a00:1450:4001:809::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:400a:808::200a
52.19.101.114
64.188.52.46
68.169.87.223
77.72.0.102
050797beb2089e25a7d1cf1fda70e8474b1cee7697628458b5e183dbd78031de
1cb5bb6aa110033f4c0178ace377811d87ec6f64b5a0aa6d1ddf477342e7dddd
24d772537dc40a1048cdf09f8ee61cfbbd8317b8f0dd3bb2154f96e1b8d31def
2be9dfefa2e18bb2857a7fd06621c89ad0539a1b4213fa68ad2350ea7dea815a
2d56035b1871d7689d1a95dd4b9d38ab9ebf0bc2e0a0b59f474fe2f39816c690
42d3fdffa68b4996b82c6b29ea64cde2a7fe115e7ba709fedddbd210749ab658
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
66ef250a63e88e5092acdcb2380f23da0cbc7b1557abe067ab69d36e7a8820a6
6c764c3827f9bb219041feaccb5414aea78db95e105e71dba179b162e80ec1e4
6efee9ca3dd0b249814e53fab132821a3c1b5370fdb02c704947399485ec43b9
78f9153b97d7ffc7cb808144a600ace9cbe92a0208cbf348d55280c40db65d70
7ca980eb4a0150c4bdaaeb53fd229a50f4c345cf2b6295cdd3a042bd6a94904d
863efe6006e4a42f8b6312fc39d79c2aa4c22ce3d1fc845122a064779a26a74e
9f16b1762b34efc24d91d4743f97f285bf977ef0caa3c540d83c0e7c8c81340e
a0ae09929605e6f45470f62f9ec51e9ec846c70ba08947c673728468044ca1f0
a1e3faf2c39efe278d1fbf640b833680842d2d71f275cd5ddda345793badf629
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ac729c8d0a6be76dcf4d3f5b7634530fca7196237ab9f3164f2e9c81e19c2525
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
bec67b67f469999d4f8a973879fb65135d2b003f60969982334ee5dd930b39ae
c6c4da9313a074bbb5524ed46f2050ace1b7b5b9985e41c947d223b6637f2743
c7c60d2f491dc5f2cdcc7288c8c7f70e5e55cb22d00001ea8dbeae895edf13fc
cf1771721f082182eabbb93914ed99be2e16f8d734970ff89b511ebba3f7385c
d2edbef8944e5e94cd67c37b0a6960841eacb87327c493790313ca2870feac34
d3ccd37fe4593ed00698a5a925b251f225e83723e5f963b332eba648a8f04d3b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef897169496fdd94fbe5bec6875fd140d7b362d4cf4293ad3f7f1895ea19e773
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

tours.specia1.com Open in urlscan Pro 13.32.99.99 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

44 Requests

100 %HTTPS

59 %IPv6

16 Domains

18 Subdomains

15 IPs

5 Countries

1596 kBTransfer

2201 kBSize

31 Cookies

4 Outgoing links

Page URL History

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

tours.specia1.com Open in urlscan Pro
13.32.99.99 Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

100 %
HTTPS

59 %
IPv6

16
Domains

18
Subdomains

15
IPs

5
Countries

1596 kB
Transfer

2201 kB
Size

31
Cookies

44 HTTP transactions
0 data transactions