urlscan.io logo urlscan.io
SecurityTrails logo

wellatime.xyz Open in urlscan Pro
198.54.125.81  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://wellatime.xyz/nt/3/sp/s5.php
Effective URL: https://wellatime.xyz/nt/3/sp/s5.php
Submission: On December 04 via manual from MX — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 15 domains to perform 33 HTTP transactions. The main IP is 198.54.125.81, located in United States and belongs to NAMECHEAP-NET, US. The main domain is wellatime.xyz.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 10th 2021. Valid for: a year.
This is the only time wellatime.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 198.54.125.81 22612 (NAMECHEAP...)
5 192.243.59.12 39572 (ADVANCEDH...)
3 2a00:1450:400... 15169 (GOOGLE)
2 192.243.59.13 39572 (ADVANCEDH...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2 67.202.94.86 32748 (STEADFAST)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
2 35.190.41.116 15169 (GOOGLE)
3 104.21.36.241 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
33 14
2    198.54.125.81 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium100-2.web-hosting.com
wellatime.xyz
5    192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
accomplishplunderbreeches.com
www.variousformatscontent.com
3    2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    192.243.59.13 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
emeraldmistrust.com
2    2606:4700:3032::ac43:d85e (United States)

ASN13335 (CLOUDFLARENET, US)
sportsonline.to
4    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    2606:4700::6810:5b06 (United States)

ASN13335 (CLOUDFLARENET, US)
celeritascdn.com
2    67.202.94.86 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
2    2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)
widgets.amung.us
2    35.190.41.116 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 116.41.190.35.bc.googleusercontent.com
youradexchange.com
3    104.21.36.241 (None, )

ASN13335 (CLOUDFLARENET, US)
2wgq1wg7h37g0j.sastreaming.net
1    2606:4700:3034::ac43:b683 (United States)

ASN13335 (CLOUDFLARENET, US)
swarm.video
1    2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
1    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Domain Requested by
4 celeritascdn.com sportsonline.to
celeritascdn.com
2wgq1wg7h37g0j.sastreaming.net
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
4 www.variousformatscontent.com wellatime.xyz
3 2wgq1wg7h37g0j.sastreaming.net sportsonline.to
2wgq1wg7h37g0j.sastreaming.net
3 www.googletagmanager.com wellatime.xyz
sportsonline.to
2wgq1wg7h37g0j.sastreaming.net
2 fonts.gstatic.com fonts.googleapis.com
2 youradexchange.com celeritascdn.com
2 widgets.amung.us sportsonline.to
2wgq1wg7h37g0j.sastreaming.net
2 whos.amung.us 2 redirects
2 sportsonline.to wellatime.xyz
sportsonline.to
2 emeraldmistrust.com wellatime.xyz
2 wellatime.xyz 1 redirects
1 fonts.googleapis.com 2wgq1wg7h37g0j.sastreaming.net
1 cdn.jsdelivr.net 2wgq1wg7h37g0j.sastreaming.net
1 swarm.video 2wgq1wg7h37g0j.sastreaming.net
1 accomplishplunderbreeches.com wellatime.xyz
33 16

This site contains no links.

Subject Issuer Validity Valid
wellatime.xyz
Sectigo RSA Domain Validation Secure Server CA		 2021-08-10 -
2022-08-10		 a year crt.sh
accomplishplunderbreeches.com
R3		 2021-11-30 -
2022-02-28		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
emeraldmistrust.com
R3		 2021-11-19 -
2022-02-17		 3 months crt.sh
variousformatscontent.com
R3		 2021-11-10 -
2022-02-08		 3 months crt.sh
*.sportsonline.to
R3		 2021-11-10 -
2022-02-08		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-07 -
2022-07-06		 a year crt.sh
youradexchange.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-16 -
2022-07-01		 2 years crt.sh
*.sastreaming.net
R3		 2021-11-04 -
2022-02-02		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://wellatime.xyz/nt/3/sp/s5.php
Frame ID: AF7047103CD0C242CF6F905A9A1F076E
Requests: 11 HTTP requests in this frame

Frame: https://sportsonline.to/channels/hd/hd5.php
Frame ID: A170280F3C159EB7A3942D2D897ED8BD
Requests: 8 HTTP requests in this frame

Frame: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Frame ID: 968B0DDD6B83A042574358F21902167E
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://wellatime.xyz/nt/3/sp/s5.php HTTP 301
    https://wellatime.xyz/nt/3/sp/s5.php Page URL

Page Statistics

33
Requests

94 %
HTTPS

60 %
IPv6

15
Domains

16
Subdomains

14
IPs

3
Countries

550 kB
Transfer

1668 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://wellatime.xyz/nt/3/sp/s5.php HTTP 301
    https://wellatime.xyz/nt/3/sp/s5.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://whos.amung.us/cwidget/sportsonline/000000ffffff.png HTTP 307
  • https://widgets.amung.us/draw/?w=colored&n=38100&c=000000ffffff&p=
Request Chain 25
  • https://whos.amung.us/cwidget/y7opzyrraw/000000ffffff.png HTTP 307
  • https://widgets.amung.us/draw/?w=colored&n=123300&c=000000ffffff&p=

33 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request s5.php
wellatime.xyz/nt/3/sp/
Redirect Chain
  • http://wellatime.xyz/nt/3/sp/s5.php
  • https://wellatime.xyz/nt/3/sp/s5.php
6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.125.81 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium100-2.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
1c7919e8cefb9483584c83411720566b58f87ac4fc68e563447ad6e1e274f34e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

x-powered-by
PHP/7.2.34
content-type
text/html; charset=UTF-8
content-length
1907
content-encoding
br
vary
Accept-Encoding
date
Sat, 04 Dec 2021 19:13:06 GMT
server
LiteSpeed
x-turbo-charged-by
LiteSpeed

Redirect headers

keep-alive
timeout=5, max=100
content-type
text/html
content-length
707
date
Sat, 04 Dec 2021 19:13:05 GMT
server
LiteSpeed
location
https://wellatime.xyz/nt/3/sp/s5.php
x-turbo-charged-by
LiteSpeed
61f272b050a19f72dd8325e89da378a9.js
accomplishplunderbreeches.com/61/f2/72/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://accomplishplunderbreeches.com/61/f2/72/61f272b050a19f72dd8325e89da378a9.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://wellatime.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:06 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-173599570-1
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7b2b65d7940f07ee1c5cdca721adfa10782789be37b89981f9bc89b07fc42d75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://wellatime.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:06 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36169
x-xss-protection
0
last-modified
Sat, 04 Dec 2021 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 04 Dec 2021 19:13:06 GMT
invoke.js
emeraldmistrust.com/b92f87030cb4c109b366715576617fad/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://emeraldmistrust.com/b92f87030cb4c109b366715576617fad/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:07 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
invoke.js
www.variousformatscontent.com/ce09408bde9582fffab86cf5613c2976/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.variousformatscontent.com/ce09408bde9582fffab86cf5613c2976/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:07 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
invoke.js
www.variousformatscontent.com/39d744269a036563889334482f9ab59c/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.variousformatscontent.com/39d744269a036563889334482f9ab59c/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:07 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
hd5.php
sportsonline.to/channels/hd/ Frame A170 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sportsonline.to/channels/hd/hd5.php
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:d85e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.4.16
Resource Hash
75ff2a4a46e03c09b186f0ffdbedf2ae8b95899ba9a8538082453ce253499688

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://wellatime.xyz/

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-type
text/html
x-powered-by
PHP/5.4.16
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ORtXVZ0kfJaCGb9WUpz9vCG3hUClpLM5%2FMEEfHPk04AWEEvy4kFIZ2NwrewJUVIF6s7VUrmgKfttFNhfYkoT3OhalUgDWer98KGO8gy%2F3SGSEfmiYFycJMXq3oFcicepqv%2BQqAQbd%2FQmrRAuE8%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6b8759a76d140eb7-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
invoke.js
www.variousformatscontent.com/45ca3f7c83df14cc40adb839ddd4191e/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.variousformatscontent.com/45ca3f7c83df14cc40adb839ddd4191e/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:07 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
invoke.js
www.variousformatscontent.com/b25f431d046421abe9b1feb1913b6492/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.variousformatscontent.com/b25f431d046421abe9b1feb1913b6492/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:07 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
invoke.js
emeraldmistrust.com/d8705d47ff24dc2c75ca25b026812ec0/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://emeraldmistrust.com/d8705d47ff24dc2c75ca25b026812ec0/invoke.js
Requested by
Host: wellatime.xyz
URL: https://wellatime.xyz/nt/3/sp/s5.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:08 GMT
server
nginx/1.17.6
content-type
application/javascript
content-length
0
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-173599570-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://wellatime.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
721
date
Sat, 04 Dec 2021 19:01:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 04 Dec 2021 21:01:07 GMT
collect
www.google-analytics.com/j/ 		1 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1726002987&t=pageview&_s=1&dl=https%3A%2F%2Fwellatime.xyz%2Fnt%2F3%2Fsp%2Fs5.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=588529893&gjid=1652703310&cid=1279546050.1638645188&tid=UA-173599570-1&_gid=1061339740.1638645188&_r=1&gtm=2ouc10&z=1782681313
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://wellatime.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 19:13:08 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://wellatime.xyz
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
su.js
celeritascdn.com/script/ Frame A170 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://celeritascdn.com/script/su.js
Requested by
Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd5.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:5b06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0a97a9799bba7cbaca2ff35b43daaef3ac0c679ba39a90df166c39aad65bea3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1914
x-guploader-uploadid
ADPycdtJE5Y6ECWmNaYJu-C6QkOo7aKN-vdAVL5NboCN0_M__0jPwFaDo7StCUuZxKih5sl9cvJ2obxTULDmm0ckQVv1bZ802Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Thu, 28 Oct 2021 10:36:10 GMT
server
cloudflare
etag
W/"765a50e18db5bdc3badf43040834c22a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=ZIf5+A==, md5=dlpQ4Y21vcO630MECDTCKg==
x-goog-generation
1635417370397478
access-control-allow-origin
*
cache-control
public, max-age=14400
x-goog-stored-content-length
24244
cf-ray
6b8759ac8a7c4dca-FRA
expires
Sat, 04 Dec 2021 23:13:08 GMT
SCCfwxq.png
sportsonline.to/channels/hd/ Frame A170 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sportsonline.to/channels/hd/SCCfwxq.png
Requested by
Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd5.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:d85e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae0433ac5d000ac03daf9059492d0390e427b7461332f0f488bbc6f44b5107a7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/channels/hd/hd5.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2170
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1220
last-modified
Fri, 03 Sep 2021 00:38:37 GMT
server
cloudflare
etag
"61316e8d-4c4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7QRQDWUIQF4n9lW5UthzgNxjnc7%2B%2FOUr8VsDUUq19OyMjbENDSUN%2F1DVkU6uHCaOwxi6oIf2xxNfTSDkHLAeKTJhzhO8b5TjtbUP%2B%2FhsD1US1ag8XHfCXvFxWlJl00lxG9r9TEZnrLTC62GSqu8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6b8759accd10d6d5-FRA
/
widgets.amung.us/draw/ Frame A170
Redirect Chain
  • https://whos.amung.us/cwidget/sportsonline/000000ffffff.png
  • https://widgets.amung.us/draw/?w=colored&n=38100&c=000000ffffff&p=
1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.amung.us/draw/?w=colored&n=38100&c=000000ffffff&p=
Requested by
Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd5.php
Protocol
H2
Server
2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a6030664404cf8f8c76cffed6fe29186c8ca7f8acc74fe1f5deb702aff979e8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
cf-cache-status
HIT
last-modified
Thu, 02 Dec 2021 19:50:52 GMT
server
cloudflare
age
170536
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=432000
content-disposition
filename=wau-widget.png
cf-ray
6b8759ae6fea691f-FRA
expires
Fri, 03 Dec 2021 19:50:52 GMT

Redirect headers

location
https://widgets.amung.us/draw/?w=colored&n=38100&c=000000ffffff&p=
date
Sat, 04 Dec 2021 19:13:08 GMT
cache-control
max-age=295
content-type
text/html; charset=UTF-8
js
www.googletagmanager.com/gtag/ Frame A170 		90 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-202511892-1
Requested by
Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd5.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4de99c7c789726a281386a80720e1d312145ef98bb994de8ceebf28cb1360b62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36167
x-xss-protection
0
last-modified
Sat, 04 Dec 2021 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 04 Dec 2021 19:13:08 GMT
ut.js
celeritascdn.com/script/ Frame A170 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://celeritascdn.com/script/ut.js?cb=1638645188596
Requested by
Host: celeritascdn.com
URL: https://celeritascdn.com/script/su.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:5b06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e2778d4aa6e69d5502e588c3ee022d8b4fcd5be1c43321e8b0d7d7d70353d25

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
gzip
cf-cache-status
HIT
age
2216
x-guploader-uploadid
ADPycdvZfI9bYKiYl3VYwzhGziHeGmg3V8xKQB6ZPk27iz9TUrc7rKJrFgBIs5iGwfdOpkB4cAe5oRcrp3KgzKHtGNM
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Thu, 28 Oct 2021 10:36:11 GMT
server
cloudflare
etag
W/"920480645047c2b282a048acb85f9df3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=pSNYBg==, md5=kgSAZFBHwrKCoEisuF+d8w==
x-goog-generation
1635417371100027
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=14400
x-goog-stored-content-length
15242
cf-ray
6b8759acbb2b4dca-FRA
expires
Sat, 04 Dec 2021 23:13:08 GMT
suurl4.php
youradexchange.com/script/ Frame A170 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/script/suurl4.php?r=4827899&cbur=0.39099554369547485&cbiframe=1&cbWidth=728&cbHeight=428&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=celeritascdn.com&aggr=0
Requested by
Host: celeritascdn.com
URL: https://celeritascdn.com/script/su.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.41.116 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
116.41.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:08 GMT
via
1.1 google
server
openresty
alt-svc
clear
rmfhl85k
2wgq1wg7h37g0j.sastreaming.net/embed/ Frame 968B 		9 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Requested by
Host: sportsonline.to
URL: https://sportsonline.to/channels/hd/hd5.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.36.241 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd2122b9bda8a345fbc1a3de34f63485c68d24a8a63542b4399dc22b8f7aaa1f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OtLLBU%2BbmufGgyReCM5TNdaQvoNSO8CqUsBxhqMfrUS0ecH84CS63YXotL4nEOAhyDCqPJgTtPMNCopi%2F17JHP1KmUVHuWd73odqsup5WnTQBwewUTarVlWzuLLKX0CnKmKPMMD43iV%2Fn3BHeHMQxbE%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6b8759acee9adfef-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
analytics.js
www.google-analytics.com/ Frame A170 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-202511892-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sportsonline.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
721
date
Sat, 04 Dec 2021 19:01:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 04 Dec 2021 21:01:07 GMT
embed.min.css
2wgq1wg7h37g0j.sastreaming.net/css/ Frame 968B 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://2wgq1wg7h37g0j.sastreaming.net/css/embed.min.css?v=0.3
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.36.241 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d2556e6fe39f0adea7f7b90515e482645f702c89ff7206bae2514daed52b397

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 09 Nov 2020 18:05:02 GMT
server
cloudflare
age
101
etag
W/"5fa984ce-484"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2XAYvA8IjTAXzZ81XgBkGuwfGa9fcPdz07zI4TqtzTonJSs4aAzhDzzdR4I2ls8c%2B0sJyH%2BZDYKf7kSDOyJhwuYzc5hF%2BIeKd0HTLFZu6S8X7kGz%2B1foiDdIveJcqE%2FraAS3e4wxmbtiegzzXjwfZ0w%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6b8759aebdf24345-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
jquery.min.js
2wgq1wg7h37g0j.sastreaming.net/js/ Frame 968B 		85 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://2wgq1wg7h37g0j.sastreaming.net/js/jquery.min.js
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.36.241 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 09 Nov 2020 18:05:02 GMT
server
cloudflare
age
101
etag
W/"5fa984ce-15283"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ug%2FndkWB149ddCn8Plw%2FzKqlrT0s2uQouJhr7u4Y1gACLRZu9e1kyVZ5vsJLLb4oXfLhkfm04ayuP4VwewEtZgY5dxERTwm2IOCn%2BhnwgXfHxZgXQGYypx85iREMQbdli%2BIBoqXgCzn7kbltRdmNWY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6b8759aebdec4345-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
wigistream.js
swarm.video/ Frame 968B 		506 KB
128 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://swarm.video/wigistream.js?version=0.0.80
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b683 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
0e8714e1c7ce6159f6bff5085163212294c59e411ed4b10ad956ae0b2800d03d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2651333
x-powered-by
Express
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Mon, 28 Jun 2021 22:53:29 GMT
server
cloudflare
etag
W/"7ee26-17a54d3e20c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LeuUF6C8%2BNxSZJEWAoGTcaVbRSRiLNFX5UR96IRXlePjHYdWtygYl%2BUbn%2F%2FQtXT7L28zA%2Bvt%2BCLRf1zvATK%2BBupNv2ex33Yi5E%2F0Sap76SGwfn9EUkqNcRk2NDDRXvtpUAaZpgMk2FfEmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
cf-polished
origSize=519718
cf-ray
6b8759aebf805c02-FRA
cf-bgj
minify
clappr.min.js
cdn.jsdelivr.net/npm/clappr@latest/dist/ Frame 968B 		513 KB
139 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/clappr@latest/dist/clappr.min.js
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7ce4b1edd2c3701c3f2585f7cbd70857173195489a99703ab39de16fa45b6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:09 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
37478
x-jsd-version
0.3.13
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by
cache-fra19154-FRA
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"80319-k2KF+cjIWnSaHvjPxNXoS36ivIk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
6b8759aec95b698b-FRA
su.js
celeritascdn.com/script/ Frame 968B 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://celeritascdn.com/script/su.js
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:5b06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0a97a9799bba7cbaca2ff35b43daaef3ac0c679ba39a90df166c39aad65bea3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1914
x-guploader-uploadid
ADPycdtJE5Y6ECWmNaYJu-C6QkOo7aKN-vdAVL5NboCN0_M__0jPwFaDo7StCUuZxKih5sl9cvJ2obxTULDmm0ckQVv1bZ802Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Thu, 28 Oct 2021 10:36:10 GMT
server
cloudflare
etag
W/"765a50e18db5bdc3badf43040834c22a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=ZIf5+A==, md5=dlpQ4Y21vcO630MECDTCKg==
x-goog-generation
1635417370397478
access-control-allow-origin
*
cache-control
public, max-age=14400
x-goog-stored-content-length
24244
cf-ray
6b8759ae98394dca-FRA
expires
Sat, 04 Dec 2021 23:13:08 GMT
js
www.googletagmanager.com/gtag/ Frame 968B 		90 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-184968220-1
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
65aa0d30366a2216a62872ab5d88a1345f2cc546047e652573cc13e44501e5e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36168
x-xss-protection
0
last-modified
Sat, 04 Dec 2021 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 04 Dec 2021 19:13:08 GMT
/
widgets.amung.us/draw/ Frame 968B
Redirect Chain
  • https://whos.amung.us/cwidget/y7opzyrraw/000000ffffff.png
  • https://widgets.amung.us/draw/?w=colored&n=123300&c=000000ffffff&p=
2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.amung.us/draw/?w=colored&n=123300&c=000000ffffff&p=
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k
Protocol
H2
Server
2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
824953bff7e8d91d23065110af90abe8b75cd94cc7a5b4f80ace1e970fa299c0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:09 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Dec 2021 14:23:53 GMT
server
cloudflare
age
17356
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=432000
content-disposition
filename=wau-widget.png
cf-ray
6b8759af4a73691f-FRA
expires
Sun, 05 Dec 2021 14:23:53 GMT

Redirect headers

location
https://widgets.amung.us/draw/?w=colored&n=123300&c=000000ffffff&p=
date
Sat, 04 Dec 2021 19:13:08 GMT
cache-control
max-age=295
content-type
text/html; charset=UTF-8
css
fonts.googleapis.com/ Frame 968B 		1 KB
898 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:400,700
Requested by
Host: 2wgq1wg7h37g0j.sastreaming.net
URL: https://2wgq1wg7h37g0j.sastreaming.net/css/embed.min.css?v=0.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c15171fcd5929135b805d4b4dbf845248179064899580dec8a1de845da08c489
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 04 Dec 2021 17:41:06 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 04 Dec 2021 19:13:08 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 04 Dec 2021 19:13:08 GMT
ut.js
celeritascdn.com/script/ Frame 968B 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://celeritascdn.com/script/ut.js?cb=1638645189076
Requested by
Host: celeritascdn.com
URL: https://celeritascdn.com/script/su.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:5b06 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e2778d4aa6e69d5502e588c3ee022d8b4fcd5be1c43321e8b0d7d7d70353d25

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:13:09 GMT
content-encoding
gzip
cf-cache-status
HIT
age
2217
x-guploader-uploadid
ADPycdvZfI9bYKiYl3VYwzhGziHeGmg3V8xKQB6ZPk27iz9TUrc7rKJrFgBIs5iGwfdOpkB4cAe5oRcrp3KgzKHtGNM
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/javascript
last-modified
Thu, 28 Oct 2021 10:36:11 GMT
server
cloudflare
etag
W/"920480645047c2b282a048acb85f9df3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=pSNYBg==, md5=kgSAZFBHwrKCoEisuF+d8w==
x-goog-generation
1635417371100027
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=14400
x-goog-stored-content-length
15242
cf-ray
6b8759afbad74dca-FRA
expires
Sat, 04 Dec 2021 23:13:09 GMT
suurl4.php
youradexchange.com/script/ Frame 968B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/script/suurl4.php?r=3939411&cbur=0.04260557076124738&cbiframe=1&cbWidth=728&cbHeight=428&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=celeritascdn.com&aggr=0
Requested by
Host: celeritascdn.com
URL: https://celeritascdn.com/script/su.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.41.116 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
116.41.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 04 Dec 2021 19:13:09 GMT
via
1.1 google
server
openresty
alt-svc
clear
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ Frame 968B 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2wgq1wg7h37g0j.sastreaming.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 20:12:20 GMT
x-content-type-options
nosniff
age
342049
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22992
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:18:57 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Nov 2022 20:12:20 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ Frame 968B 		23 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2wgq1wg7h37g0j.sastreaming.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 20:12:18 GMT
x-content-type-options
nosniff
age
255651
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23484
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:19:01 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 20:12:18 GMT
analytics.js
www.google-analytics.com/ Frame 968B 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-184968220-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://2wgq1wg7h37g0j.sastreaming.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
722
date
Sat, 04 Dec 2021 19:01:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 04 Dec 2021 21:01:07 GMT

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| atOptions function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.wellatime.xyz/ Name: _ga
Value: GA1.2.1279546050.1638645188
.wellatime.xyz/ Name: _gid
Value: GA1.2.1061339740.1638645188
.wellatime.xyz/ Name: _gat_gtag_UA_173599570_1
Value: 1

20 Console Messages

Source Level URL
Text
network error URL: https://accomplishplunderbreeches.com/61/f2/72/61f272b050a19f72dd8325e89da378a9.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://emeraldmistrust.com/b92f87030cb4c109b366715576617fad/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://emeraldmistrust.com/b92f87030cb4c109b366715576617fad/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://emeraldmistrust.com/b92f87030cb4c109b366715576617fad/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 27)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/ce09408bde9582fffab86cf5613c2976/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 27)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/ce09408bde9582fffab86cf5613c2976/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.variousformatscontent.com/ce09408bde9582fffab86cf5613c2976/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 41)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/39d744269a036563889334482f9ab59c/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 41)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/39d744269a036563889334482f9ab59c/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.variousformatscontent.com/39d744269a036563889334482f9ab59c/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 58)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/45ca3f7c83df14cc40adb839ddd4191e/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 58)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/45ca3f7c83df14cc40adb839ddd4191e/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.variousformatscontent.com/45ca3f7c83df14cc40adb839ddd4191e/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 72)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/b25f431d046421abe9b1feb1913b6492/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 72)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.variousformatscontent.com/b25f431d046421abe9b1feb1913b6492/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.variousformatscontent.com/b25f431d046421abe9b1feb1913b6492/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 84)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://emeraldmistrust.com/d8705d47ff24dc2c75ca25b026812ec0/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wellatime.xyz/nt/3/sp/s5.php(Line 84)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://emeraldmistrust.com/d8705d47ff24dc2c75ca25b026812ec0/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://emeraldmistrust.com/d8705d47ff24dc2c75ca25b026812ec0/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 ()
rendering warning URL: https://2wgq1wg7h37g0j.sastreaming.net/embed/rmfhl85k(Line 5)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2wgq1wg7h37g0j.sastreaming.net
accomplishplunderbreeches.com
cdn.jsdelivr.net
celeritascdn.com
emeraldmistrust.com
fonts.googleapis.com
fonts.gstatic.com
sportsonline.to
swarm.video
wellatime.xyz
whos.amung.us
widgets.amung.us
www.google-analytics.com
www.googletagmanager.com
www.variousformatscontent.com
youradexchange.com
104.21.36.241
192.243.59.12
192.243.59.13
198.54.125.81
2606:4700:10::6816:4bab
2606:4700:3032::ac43:d85e
2606:4700:3034::ac43:b683
2606:4700::6810:5514
2606:4700::6810:5b06
2a00:1450:4001:80e::2008
2a00:1450:4001:80f::2003
2a00:1450:4001:810::200a
2a00:1450:4001:82a::200e
35.190.41.116
67.202.94.86
0d2556e6fe39f0adea7f7b90515e482645f702c89ff7206bae2514daed52b397
0e8714e1c7ce6159f6bff5085163212294c59e411ed4b10ad956ae0b2800d03d
1c7919e8cefb9483584c83411720566b58f87ac4fc68e563447ad6e1e274f34e
4de99c7c789726a281386a80720e1d312145ef98bb994de8ceebf28cb1360b62
5e2778d4aa6e69d5502e588c3ee022d8b4fcd5be1c43321e8b0d7d7d70353d25
65aa0d30366a2216a62872ab5d88a1345f2cc546047e652573cc13e44501e5e3
6a6030664404cf8f8c76cffed6fe29186c8ca7f8acc74fe1f5deb702aff979e8
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
75ff2a4a46e03c09b186f0ffdbedf2ae8b95899ba9a8538082453ce253499688
7b2b65d7940f07ee1c5cdca721adfa10782789be37b89981f9bc89b07fc42d75
824953bff7e8d91d23065110af90abe8b75cd94cc7a5b4f80ace1e970fa299c0
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
ae0433ac5d000ac03daf9059492d0390e427b7461332f0f488bbc6f44b5107a7
c0a97a9799bba7cbaca2ff35b43daaef3ac0c679ba39a90df166c39aad65bea3
c15171fcd5929135b805d4b4dbf845248179064899580dec8a1de845da08c489
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
db7ce4b1edd2c3701c3f2585f7cbd70857173195489a99703ab39de16fa45b6c
fd2122b9bda8a345fbc1a3de34f63485c68d24a8a63542b4399dc22b8f7aaa1f