di2i.understandinglink.com Open in urlscan Pro
154.16.205.101  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 78aa2b7a-729d-11ee-bfde-799e80170392 Show response di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/	26 KB 6 KB	884ms 355ms	Document text/html	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Full URL https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash e671475c7d9d2a1ce5fd4f73c8d09e2cf8a849ddcaafd8b3220e8c5d44dc617b Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, private content-encoding br content-length 5843 content-type text/html; charset=UTF-8 date Tue, 24 Oct 2023 18:45:20 GMT server swoole-http-server strict-transport-security max-age=15768000 x-redir true
GET H2	200	style.css di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	14 KB 14 KB	110ms 110ms	Stylesheet text/css	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/style.css Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash d710e56c31f6e6697599766420b15dcef3fb328539f1381c1d2e2310db9b9e9a Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 1147275 32771 content-type text/css accept-ranges bytes content-length 14284
GET H2	200	slot-start.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	25 KB 26 KB	215ms 214ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/slot-start.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 690361 5 content-type image/png accept-ranges bytes content-length 26084
GET H2	200	slot-spin.gif di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	86 KB 86 KB	216ms 215ms	Image image/gif	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/slot-spin.gif Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 361365 294915 content-type image/gif accept-ranges bytes content-length 87599
GET H2	200	slot-result-1.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	20 KB 20 KB	319ms 313ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/slot-result-1.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 723643 196611 content-type image/png accept-ranges bytes content-length 20370
GET H2	200	slot-result-2.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	26 KB 26 KB	319ms 313ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/slot-result-2.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 361366 229379 content-type image/png accept-ranges bytes content-length 26733
GET H2	200	slot-win.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	14 KB 14 KB	320ms 314ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/slot-win.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 690362 262147 content-type image/png accept-ranges bytes content-length 14391
GET H2	200	red-arrow-left.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 1 KB	320ms 315ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/red-arrow-left.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 1147277 131075 content-type image/png accept-ranges bytes content-length 1334
GET H2	200	red-arrow-right.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 1 KB	321ms 316ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/red-arrow-right.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 133465 65539 content-type image/png accept-ranges bytes content-length 1362
GET H2	200	img1Female.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 1 KB	322ms 317ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img1Female.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7343 x-varnish 591991 163843 content-type image/jpeg accept-ranges bytes content-length 1315
GET H2	200	img2Male.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 1 KB	320ms 316ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img2Male.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 723644 196622 content-type image/jpeg accept-ranges bytes content-length 1297
GET H2	200	img3f.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	2 KB 2 KB	322ms 317ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img3f.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash a7c86ca5470f7d68b4c5f1c87f29f7daf816d1bd95353091bba8753341bb6f5f Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 853865 65557 content-type image/jpeg accept-ranges bytes content-length 2336
GET H2	200	img5m.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 1 KB	322ms 318ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img5m.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 886175 196624 content-type image/jpeg accept-ranges bytes content-length 1169
GET H2	200	img42.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	2 KB 2 KB	322ms 318ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img42.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 84d7f0648aeba8d80bb0f47e781cba8955b8fa7425748d9830c7a8c9bc35e5e9 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 493360 262153 content-type image/jpeg accept-ranges bytes content-length 2037
GET H2	200	img8m.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 2 KB	323ms 319ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img8m.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 493361 360456 content-type image/jpeg accept-ranges bytes content-length 1506
GET H2	200	img9m.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1017 B 1 KB	323ms 320ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img9m.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 9545948eefe774be5121de01ef9c14207891c35116bba14056471a59e4c212a1 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 886176 32773 content-type image/jpeg accept-ranges bytes content-length 1017
GET H2	200	img7m.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	2 KB 2 KB	323ms 319ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img7m.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash ba858c8ecc8f498253509a9251e5070ce3b3ad9950b704a22a9a1fb1efc62541 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 853866 131079 content-type image/jpeg accept-ranges bytes content-length 2264
GET H2	200	img62.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	2 KB 2 KB	324ms 321ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/img62.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 388e1eb0cb648490ea1c4913f4ea3128f3fbfbda0608bf85e471d947db905302 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 591992 327685 content-type image/jpeg accept-ranges bytes content-length 2143
GET H2	200	c7.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	885 B 1 KB	323ms 320ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/c7.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash dee106bfd25bef41d50df51bf68521a5846e6f59e68f7494df98fcf8454d5ebc Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:01 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7339 x-varnish 723645 98313 content-type image/jpeg accept-ranges bytes content-length 885
GET H2	200	c3.jpg di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	1 KB 2 KB	324ms 321ms	Image image/jpeg	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/c3.jpg Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash cf1ec1a6ce1e4bf8ec7d58bc85d1f166d36646d05c65ea72697b12d1d001747c Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:43:02 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7338 x-varnish 690363 458762 content-type image/jpeg accept-ranges bytes content-length 1457
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.0/	84 KB 30 KB	73ms 20ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Fri, 20 Oct 2023 10:14:50 GMT content-encoding gzip x-content-type-options nosniff age 376231 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30089 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 19 Oct 2024 10:14:50 GMT
GET H2	200	oldw7nlgzn Show response trk-consulatu.com/scripts/push/script/	7 KB 3 KB	93ms 28ms	Script application/javascript	2606:4700:e0::ac40:640c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:640c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0956218009fe6721f2afb9728dada5de28059cc6301b34b06fce2824a6321ac Security Headers Name Value Content-Security-Policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 18:45:21 GMT content-security-policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6549 content-encoding br alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block pragma no-cache referrer-policy strict-origin-when-cross-origin last-modified Tue, 24 Oct 2023 16:56:12 GMT server cloudflare x-frame-options SAMEORIGIN vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers content-type application/javascript;charset=UTF-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YAsGV%2Fi5kW7oAZ47pLQPGTyonPMDzRcVVmqwT%2BwsKzC0tQSe8XUHJ6sQ6qzHnkJooROiQZTuCvI0uzXxK%2BoAaQXlZFLm3VigAw7dRAulXTt2aqxuIqK8%2FuVs4VyyGuwmJiLlXhHMHctu%2Fki5H7r9pg%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=14400, must-revalidate permissions-policy camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-ray 81b460566fca03ac-FRA expires 0
GET H2	200	arrow.png di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/	154 B 322 B	324ms 322ms	Image image/png	154.16.205.101 NEXEON
General Check archive.org Show headers Download Go to Show image Full URL https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/arrow.png Requested by Host: di2i.understandinglink.com URL: https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.16.205.101 Los Angeles, United States, ASN20278 (NEXEON, US), Reverse DNS Software swoole-http-server / Resource Hash 5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://di2i.understandinglink.com/templates/templates/SPIN_casino-survey/src/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 16:42:57 GMT via 1.1 varnish (Varnish/7.3) strict-transport-security max-age=15768000 server swoole-http-server age 7344 x-varnish 361367 98307 content-type image/png accept-ranges bytes content-length 154
OPTIONS H2	200	lmdzxr03ek event.trk-consulatu.com/register/event_log/	0 0	145ms 106ms	Preflight	2606:4700:e0::ac40:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://event.trk-consulatu.com/register/event_log/lmdzxr03ek Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://di2i.understandinglink.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-expose-headers Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params access-control-max-age 1800 alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, max-age=0, must-revalidate cf-cache-status DYNAMIC cf-ray 81b46058deea9b63-FRA content-length 0 content-security-policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: date Tue, 24 Oct 2023 18:45:21 GMT expires 0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} permissions-policy camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A6TgNb%2Bs2pyHfoo0Ur2AgXpW4aTQ6DSVGTjnAaQ5gq1yFgsUyF2zyUuP2DAVUtRFILS9rSodGY9DYAHh1AVDj7Pa2LJTIyBvuPfMRmfN1TroNq0d263KXisVhKwq6FisoHz93fVF9%2B0DxGZzIQ83v8odoEfBNQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Origin Access-Control-Request-Method Access-Control-Request-Headers x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
POST H2	200	lmdzxr03ek event.trk-consulatu.com/register/event_log/	0 0	110ms 109ms	Fetch	2606:4700:e0::ac40:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://event.trk-consulatu.com/register/event_log/lmdzxr03ek Requested by Host: trk-consulatu.com URL: https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://di2i.understandinglink.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Content-type application/json Response headers expires 0 date Tue, 24 Oct 2023 18:45:21 GMT content-security-policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-pushplatformapp-alert pushPlatformApp.pushSubscription.deleted alt-svc h3=":443"; ma=86400 content-length 0 x-xss-protection 1; mode=block pragma no-cache referrer-policy strict-origin-when-cross-origin server cloudflare x-frame-options SAMEORIGIN vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iCbUkgfhkkKmeYAZGWt9FvW%2BbA67Bt2uhXi3UPJtPg%2BMPU7YCha6w3wV10cXbkbopBqV4Yq1%2BPHt3M4eyIGdg5lYqLbAdv8rcObOFAVLSqIvupl1WxKZ3B0e%2B3UKY5MmRpHm%2BFgBVPykDEUCc4HNh2sl1SUERQ%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-origin * access-control-expose-headers Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params cache-control no-cache, no-store, max-age=0, must-revalidate permissions-policy camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-ray 81b46059780c9b63-FRA x-pushplatformapp-params
POST H3	200	lmdzxr03ek event.trk-consulatu.com/register/event_log/	0 0	127ms 127ms	Fetch	2606:4700:e0::ac40:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://event.trk-consulatu.com/register/event_log/lmdzxr03ek Requested by Host: trk-consulatu.com URL: https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:e0::ac40:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://di2i.understandinglink.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Content-type application/json Response headers expires 0 date Tue, 24 Oct 2023 18:45:21 GMT content-security-policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-pushplatformapp-alert pushPlatformApp.pushSubscription.deleted alt-svc h3=":443"; ma=86400 content-length 0 x-xss-protection 1; mode=block pragma no-cache referrer-policy strict-origin-when-cross-origin server cloudflare x-frame-options SAMEORIGIN vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SX%2Bd9AkrZUi2kns32VKsl50cQMBUD1f4AAvJee5oPcrtpcX%2Bmanu3wkCbtuhiP5FFxD33AZv8fGccDdva0wIW7aux7AT%2FB2ACFY2ZBSB%2BdPJz1RDC6CPElxTZBGfwFAGkljVTS%2FpQUoVBjCaLJhnltpuftXv0w%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-origin * access-control-expose-headers Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params cache-control no-cache, no-store, max-age=0, must-revalidate permissions-policy camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-ray 81b4605a1ae465c1-FRA x-pushplatformapp-params
OPTIONS H2	200	lmdzxr03ek event.trk-consulatu.com/register/event_log/	0 0	233ms 196ms	Preflight	2606:4700:e0::ac40:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://event.trk-consulatu.com/register/event_log/lmdzxr03ek Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://di2i.understandinglink.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-expose-headers Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params access-control-max-age 1800 alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, max-age=0, must-revalidate cf-cache-status DYNAMIC cf-ray 81b46058dee89b63-FRA content-length 0 content-security-policy default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: date Tue, 24 Oct 2023 18:45:21 GMT expires 0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} permissions-policy camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=19dS2ffpVqwuE%2BjSByc0DecGAPzVUIjKmO%2FUDPvkI7U4MNcqwxm4kZzXTp6LRK29lXttHvlua5Y2f4Ai%2FcKoFlj%2FIjk3%2BlugLMzoEzAa5M91nCBnU4O0mCXKSpR1oFTaYEV1vf2WdDYRWj5Pk6qATAQRP92xYw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Origin Access-Control-Request-Method Access-Control-Request-Headers x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| clickMe function| injectPrizeString function| cleanAs function| countdown number| x object| momentOfTime number| myTimeSpan function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore number| value

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			di2i.understandinglink.com/	1970-01-20 15:43:00	Name: yredir_session Value: eyJpdiI6ImRHYW00QzkzK0llV0JkOWVaZC9Oc0E9PSIsInZhbHVlIjoiL0p6aXpMRGtaMlRoS0ZWUDZjL1RwMjRaVUZ6N2wvTXZ0bUZ6Y0hOVm9Vc09RWThUUGJ1ek9wUGZZa25tTGRRVGhPUGdIRzZHZUI2eUlmN3V3dk1YaGFPRUNVK2UrYUVrOXVYUnhiS1UvYXlHRi9rUGQvRGpvUEx4WnQ5RWswTGUiLCJtYWMiOiI1MDU0ZDQxMGE4NDdhYzNkMTg1MWJjNWVmZjhjMzE5MjVhMWY4ZGFiYmVlMzdkMTllNDc0MDI2YmMwMDZkZWYzIiwidGFnIjoiIn0%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://di2i.understandinglink.com/t/fe312738ec36/78a1e438-729d-11ee-a94e-2ffa84ebc396/78aa2b7a-729d-11ee-bfde-799e80170392 Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
di2i.understandinglink.com
event.trk-consulatu.com
trk-consulatu.com
154.16.205.101
2606:4700:e0::ac40:640c
2606:4700:e0::ac40:650c
2a00:1450:4001:812::200a
388e1eb0cb648490ea1c4913f4ea3128f3fbfbda0608bf85e471d947db905302
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e
84d7f0648aeba8d80bb0f47e781cba8955b8fa7425748d9830c7a8c9bc35e5e9
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
9545948eefe774be5121de01ef9c14207891c35116bba14056471a59e4c212a1
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f
a7c86ca5470f7d68b4c5f1c87f29f7daf816d1bd95353091bba8753341bb6f5f
aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9
aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837
ba858c8ecc8f498253509a9251e5070ce3b3ad9950b704a22a9a1fb1efc62541
c0956218009fe6721f2afb9728dada5de28059cc6301b34b06fce2824a6321ac
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963
cf1ec1a6ce1e4bf8ec7d58bc85d1f166d36646d05c65ea72697b12d1d001747c
d710e56c31f6e6697599766420b15dcef3fb328539f1381c1d2e2310db9b9e9a
dee106bfd25bef41d50df51bf68521a5846e6f59e68f7494df98fcf8454d5ebc
e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393
e671475c7d9d2a1ce5fd4f73c8d09e2cf8a849ddcaafd8b3220e8c5d44dc617b
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d
fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205