urlscan.io logo urlscan.io
SecurityTrails logo

1d6cd659623.winsites.net Open in urlscan Pro
94.237.93.242  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq
Effective URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbH...
Submission: On August 06 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 5 countries across 10 domains to perform 16 HTTP transactions. The main IP is 94.237.93.242, located in Finland and belongs to UPCLOUD, FI. The main domain is 1d6cd659623.winsites.net.
TLS certificate: Issued by R3 on June 10th 2022. Valid for: 3 months.
This is the only time 1d6cd659623.winsites.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 1 81.128.197.53 2856 (BT-UK-AS ...)
1 162.210.173.249 46841 (FORKNETWO...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
4 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 34.147.12.223 396982 (GOOGLE-CL...)
1 94.237.99.118 202053 (UPCLOUD)
8 94.237.93.242 202053 (UPCLOUD)
1 178.63.30.218 24940 (HETZNER-AS)
16 6
1    2606:4700:10::6814:8a41 (United States)

ASN13335 (CLOUDFLARENET, US)
tinyurl.com
1    81.128.197.53 (Liss, United Kingdom)

ASN2856 (BT-UK-AS BTnet UK Regional network, GB)
PTR: yourseting.daemon.asia
frtppip.kkdgiant.com
1    162.210.173.249 (United States)

ASN46841 (FORKNETWORKING, US)
foretellretail.com
1    2606:4700:3031::ac43:92ee (United States)

ASN13335 (CLOUDFLARENET, US)
lynku.jukminung.com
4    2a06:98c1:3121::c (United States)

ASN13335 (CLOUDFLARENET, US)
www.tgiory.com
1    2606:4700:3033::6815:1446 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.addlnk.com
1    34.147.12.223 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 223.12.147.34.bc.googleusercontent.com
track.adclickbyte.com
1    94.237.99.118 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-99-118.de-fra1.upcloud.host
1d6cd5e0413.999traffic.com
8    94.237.93.242 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: 94-237-93-242.de-fra1.upcloud.host
1d6cd659623.winsites.net
1    178.63.30.218 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.218.30.63.178.clients.your-server.de
register.push.dog
Apex Domain
Subdomains		 Transfer
8 winsites.net
1d6cd659623.winsites.net
141 KB
4 tgiory.com
www.tgiory.com — Cisco Umbrella Rank: 872002
24 KB
1 push.dog
register.push.dog — Cisco Umbrella Rank: 209290
8 KB
1 999traffic.com
1d6cd5e0413.999traffic.com
2 KB
1 adclickbyte.com
track.adclickbyte.com — Cisco Umbrella Rank: 43635
309 B
1 addlnk.com
cdn.addlnk.com — Cisco Umbrella Rank: 312637
1 KB
1 jukminung.com
lynku.jukminung.com
891 B
1 foretellretail.com
foretellretail.com
450 B
1 kkdgiant.com
frtppip.kkdgiant.com
298 B
1 tinyurl.com
tinyurl.com — Cisco Umbrella Rank: 17894
458 B
16 10
Domain Requested by
8 1d6cd659623.winsites.net 1d6cd659623.winsites.net
4 www.tgiory.com foretellretail.com
www.tgiory.com
1 register.push.dog 1d6cd659623.winsites.net
1 1d6cd5e0413.999traffic.com www.tgiory.com
1 track.adclickbyte.com 1 redirects
1 cdn.addlnk.com www.tgiory.com
1 lynku.jukminung.com 1 redirects
1 foretellretail.com
1 frtppip.kkdgiant.com 1 redirects
1 tinyurl.com 1 redirects
16 10

This site contains no links.

Subject Issuer Validity Valid
foretellretail.com
Sectigo RSA Domain Validation Secure Server CA		 2022-01-04 -
2023-01-04		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-03-11 -
2023-03-10		 a year crt.sh
*.999traffic.com
R3		 2022-07-06 -
2022-10-04		 3 months crt.sh
*.winsites.net
R3		 2022-06-10 -
2022-09-08		 3 months crt.sh
*.push.dog
R3		 2022-08-05 -
2022-11-03		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Frame ID: 658277280C2C591D06A9D716BAFD5892
Requests: 13 HTTP requests in this frame

Frame: https://www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1659787200
Frame ID: DB279977F93B8EAF14ECA1290ABFA4B7
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Win this Apple iPhone 13 Pro Max!

Page URL History Show full URLs

  1. http://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 307
    https://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 301
    http://frtppip.kkdgiant.com/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 302
    https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052 Page URL
  2. https://lynku.jukminung.com/rc/9e8aef8068?affclick=1277507593&pubid=690352 HTTP 302
    https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid Page URL
  3. https://track.adclickbyte.com/click?pid=943&offer_id=2261226&sub1=pub1a93c55d4c364f8995b2a2ab0c83a40d&sub2= HTTP 302
    https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943- Page URL
  4. https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

16
Requests

100 %
HTTPS

40 %
IPv6

10
Domains

10
Subdomains

6
IPs

5
Countries

176 kB
Transfer

442 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 307
    https://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 301
    http://frtppip.kkdgiant.com/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 302
    https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052 Page URL
  2. https://lynku.jukminung.com/rc/9e8aef8068?affclick=1277507593&pubid=690352 HTTP 302
    https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid Page URL
  3. https://track.adclickbyte.com/click?pid=943&offer_id=2261226&sub1=pub1a93c55d4c364f8995b2a2ab0c83a40d&sub2= HTTP 302
    https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943- Page URL
  4. https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 307
  • https://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 301
  • http://frtppip.kkdgiant.com/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq HTTP 302
  • https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
Request Chain 1
  • https://lynku.jukminung.com/rc/9e8aef8068?affclick=1277507593&pubid=690352 HTTP 302
  • https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
Request Chain 5
  • https://track.adclickbyte.com/click?pid=943&offer_id=2261226&sub1=pub1a93c55d4c364f8995b2a2ab0c83a40d&sub2= HTTP 302
  • https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943-

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
08052
foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/
Redirect Chain
  • http://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq
  • https://tinyurl.com/bdzfsrw3/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq
  • http://frtppip.kkdgiant.com/Gj?MjM2MzcxOG5WNjA1Njg0MVhuMGJzMEZjMmFBcjE0OTUxOGhq
  • https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
137 B
450 B 		Document
General
Check archive.org
Download Go to
Full URL
https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.210.173.249 , United States, ASN46841 (FORKNETWORKING, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
close
Content-Length
137
Content-Type
text/html; charset=UTF-8
Date
Sat, 06 Aug 2022 14:00:46 GMT
Server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sat, 06 Aug 2022 14:00:45 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.6 (CentOS)
location
https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
4fae28eb48
www.tgiory.com/rc/
Redirect Chain
  • https://lynku.jukminung.com/rc/9e8aef8068?affclick=1277507593&pubid=690352
  • https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
Requested by
Host: foretellretail.com
URL: https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cab40a3a723849bff7fdceeb5313680f54836f6dd040752baa5d50031c814895

Request headers

Referer
https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
73684cff1f829096-FRA
content-encoding
br
content-language
en-us
content-type
text/html; charset=utf-8
date
Sat, 06 Aug 2022 14:00:47 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dSZ1A7hai6Y1RgIWYTb7gXKMvopR8C7D4hshdST4Inj7nQRcUvvVgSTbOzopP%2FyH%2BBZf4gLc%2BcE%2BKhWmuicAQ256Rld7XPkrS6aGiIe3MF1uXa4zWiyHavYUepsdcWEroaXq8J6EiAEEYAUrmA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding, Accept-Language, Cookie

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
73684cfe4fce9c06-FRA
content-language
en-us
content-type
text/html; charset=utf-8
date
Sat, 06 Aug 2022 14:00:47 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tGXrnjsZFxpZ%2FMSVm9UE7jiS0DEsUXkpARdCs4Gwf0sVZWqB1y%2BkhS6kBm7deVg%2B8GUqtAubOrGfGLkPpTU0ZnqA3jbEVK%2BgG5HYwoW7mCiT3FRrky8nZoMJ4ljQGT7HVNrK2QPaym%2F%2BLLOdODueBc5m"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Language, Cookie
redirect.css
cdn.addlnk.com/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.addlnk.com/redirect.css
Requested by
Host: www.tgiory.com
URL: https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:1446 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7817748dc7354950bf4943388276db534474269c0cd0ed6a629841ca3d7b81a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2763
cf-polished
origSize=1680
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
KPYPMKR87WVDDR5G
x-amz-id-2
sdyeyOjO4qADE8twISrwU7928cky8WpEvqOoYxcGfmLM5QiMKH15++pL4Vm7UxnFSSwxMSTIZIo=
last-modified
Wed, 13 Mar 2019 00:03:12 GMT
server
cloudflare
etag
W/"3ae56d32551602b41f9046c14d1cfde2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WXqVEtEVbraMoK4MIq3ymL4Wmksx5TzAqwdXKGwwwIOC4jJaVI%2BuEvWsbxZpxazGSJ4RCUapMQTu9RugLug1HfltHgtZQco9cLVnIkZLXDir93Snypsw7AD%2Fonvnu3WMOqc7i%2FmJWQ3%2BaqEhHw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cf-ray
73684d004be1698b-FRA
cf-bgj
minify
invisible.js
www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame DB27 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1659787200
Requested by
Host: foretellretail.com
URL: https://foretellretail.com/1763da059c464d8b800/4b-2363718-6056841-149518-0-/08052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b89cfc642f1f4718fbd591b68ad1dd2ebcfb24004ab976bc1c20c064c4a3d7e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gP9zb1UgyuVWKwIHMYM7agEK8B3lAjj1mnMo5YLofePKPSEdTpVjFSSihgNqxIqS7M5BFmMARZc%2Bb5GXYNJGnrkEmIXPWwxNJJmceAzd5JgUiVIoF8FJBlMZq%2Fjoatgc6ZHlWg03TZnouqGk4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
73684d0078dc9096-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame DB27 		22 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4cccc7ea6cbb0121dffd10b712492a40acbe2ef91b1cc3e6ff48e5e99c6ac566

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xGUZ7XoR%2FETamagPu7n1iH4If390bIS3HD6qd2b7COBpgDLpMHKN9VmbQQlkwN7hrESl%2FsUB4NDkEJywMHyRq1FKJvsEHz6GjSmJizAwxsyt316s4jFb8ALBnBbhTFLW6JNlydkMzz0jsIcbKw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
73684d00ba6f8ff4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
1d6cd5e0413.999traffic.com/
Redirect Chain
  • https://track.adclickbyte.com/click?pid=943&offer_id=2261226&sub1=pub1a93c55d4c364f8995b2a2ab0c83a40d&sub2=
  • https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943-
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943-
Requested by
Host: www.tgiory.com
URL: https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.99.118 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-99-118.de-fra1.upcloud.host
Software
/
Resource Hash
94bb4756aa92c371c0fd9f1db43712dd92a561a5262d305f885d2b24ffa1d2a0

Request headers

Referer
https://www.tgiory.com/rc/4fae28eb48?af5=pubid-not-valid
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 06 Aug 2022 14:00:47 GMT
expires
Sat, 6 Aug 2022 14:00:47 GMT
last-modified
Sat, 6 Aug 2022 14:00:47 GMT
pragma
no-cache
vary
Accept-Encoding
x-robots-tag
noindex, nofollow

Redirect headers

access-control-allow-origin
*
content-length
0
date
Sat, 06 Aug 2022 14:00:47 GMT
location
https://1d6cd5e0413.999traffic.com/?p=5971&media_type=mainstream&click_id=62ee740ff6065c000111c5d2&pi=943-
server
nginx
73684cff1f829096
www.tgiory.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame DB27 		2 B
720 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.tgiory.com/cdn-cgi/challenge-platform/h/g/cv/result/73684cff1f829096
Requested by
Host: www.tgiory.com
URL: https://www.tgiory.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1659787200
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
application/json

Response headers

date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dedqgkEAyiIGvhQydbaVXwScO0duVhIf5O3xRygYOp%2BFlenDlXdwgp1CswsRfI5UUAuwBKIlqxlLRx%2F5RplODh2IkMMcmbBVePcROCsKDjPqkw17Mxgqvnmu55Wd7DTsHNYdSoZvBT0kMKrEPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
73684d029cca8ff4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Primary Request push-win
1d6cd659623.winsites.net/ 		3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
0c6a608e0b612909de35b986c37e5b20b3ab5fdaa3bb2db8af4e38af2c6e5b9d

Request headers

Referer
https://1d6cd5e0413.999traffic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 06 Aug 2022 14:00:47 GMT
vary
Accept-Encoding
app.css
1d6cd659623.winsites.net/css/ 		69 B
329 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/css/app.css?id=2fbe2d9a9a40ca9b2489
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
94d8599586a5ee9c62dc15b45ca083b69d060d0c12bf2be3673b19a9820216ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-45"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sun, 06 Aug 2023 14:00:47 GMT
app.css
1d6cd659623.winsites.net/css/landers/push-win/ 		780 B
681 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/css/landers/push-win/app.css?id=f7b4762fa5748dd37913
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
aef82b1b79183e681d7ec8889c4bd700eb8e4788f78a960cfeaf1e4269cad75c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:47 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-30c"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Sun, 06 Aug 2023 14:00:47 GMT
default@0.5x.png
1d6cd659623.winsites.net/img/prizes/iphone-13-pro-max/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1d6cd659623.winsites.net/img/prizes/iphone-13-pro-max/default@0.5x.png
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
3f353422651766fc84c1be953bead3b92e7c7bfbf794f8277bff2cd12d0d1ebd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:48 GMT
last-modified
Tue, 26 Jul 2022 07:27:17 GMT
etag
"62df9755-18b1"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
6321
expires
Sun, 06 Aug 2023 14:00:48 GMT
pub.min.js
register.push.dog/js/ 		17 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://register.push.dog/js/pub.min.js
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.63.30.218 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.218.30.63.178.clients.your-server.de
Software
/
Resource Hash
0fae184b05c145876e11a7587d50f92fae229195e319f5aec70db8b1f0c1c5c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Sat, 06 Aug 2022 14:00:48 GMT
cache-control
no-cache, private
content-encoding
gzip
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
app.js
1d6cd659623.winsites.net/js/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/js/app.js?id=d75b4cfe9b4f0f2f3a56
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
0a9b16afee4ee7fa81b369cfe3d69c3a6d4ff580726b9d9c10f398deb2fc3c22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:48 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-4891"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sun, 06 Aug 2023 14:00:48 GMT
private.js
1d6cd659623.winsites.net/js/ 		187 KB
62 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/js/private.js?id=283bbb9239a516ffb8f5
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
69993bddaa120d79d2dd15ffe476c21c88f93cf13319a2ea925695e3da73fad7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:48 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-2ec57"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sun, 06 Aug 2023 14:00:48 GMT
app.js
1d6cd659623.winsites.net/js/landers/push-win/ 		134 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1d6cd659623.winsites.net/js/landers/push-win/app.js?id=67bf27b1cad5ae49729a
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
45f1d2720d19fe2bb39c826d7281b9dda2c28be1275b450b16fb1258ce1a9868

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:48 GMT
content-encoding
gzip
last-modified
Tue, 26 Jul 2022 07:30:22 GMT
etag
W/"62df980e-217cb"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Sun, 06 Aug 2023 14:00:48 GMT
background.jpg
1d6cd659623.winsites.net/img/prizes/iphone-13-pro-max/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1d6cd659623.winsites.net/img/prizes/iphone-13-pro-max/background.jpg
Requested by
Host: 1d6cd659623.winsites.net
URL: https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.237.93.242 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
94-237-93-242.de-fra1.upcloud.host
Software
/
Resource Hash
a09d3ee1b6d0abdc486199a3c27af0072b49f1997c8fd53719c75902bfce940a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1d6cd659623.winsites.net/push-win?ctrack=1659794447.3765207950&traffic=eyJpdiI6Inl4dUNWcVBiNVoyNm5FV1R3Zjg0OWc9PSIsInZhbHVlIjoiaEdXcjhOTmFkXC9WNk8yMVFuNUxzYUxucVUybGE0dFdDN0dic096SVk2Tk9hKzkwNkdoeGV3VW81T1dEbkk1ZlMiLCJtYWMiOiI4M2ZmZjM5ZDJjMDhjY2E5MWM4ZmFmZWIwZmExY2U4MWQwMDVhOWEwZDI5OWE1OWUzMmY2MmI0MmVkMzBkOWQ1In0%3D&out=eyJpdiI6ImhRNjF2d3JZajQwR0txWWZWK1dzdHc9PSIsInZhbHVlIjoiaEIxOWhMMEM2Q1haSFh0aHYrQmdiSFFmMkFtNFBWZTJtV3pucjBDUU1lY0k3WnpBeStMTFBuSGR2QnhvcGQ0MU84TDdNUFwvSEdVbG9RdDlzMlVlU2Z6WG1FS2Zqb1JlWU9uSURzXC9hWDJvaGxnakc1TkREaENQZ1lSbGxySWNjZ2I0aXNnUmcydVNIZ1Q3Z0dsMkxIVlczaEhreTZcL0dpQWF3SzJjWXo4SVVySnc0MFhUWWZPQWpVbFc3RXhCdnErIiwibWFjIjoiMGVjOWUwMTgzZmJiMDc2NDFhNjA5ZWUxZGVhNzQ2YzIwMTMzZjA2N2Q4ZDY3NzNhYTdiMzEwNmNkNzdlNzg1MyJ9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
public
date
Sat, 06 Aug 2022 14:00:48 GMT
last-modified
Tue, 26 Jul 2022 07:27:17 GMT
etag
"62df9755-2c0e"
content-type
image/jpeg
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
11278
expires
Sun, 06 Aug 2023 14:00:48 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| view object| pd_options object| __SENTRY__ object| DeviceAtlas object| subscriber

13 Cookies

Domain/Path Name / Value
foretellretail.com/ Name: uid15295
Value: 1277507593-20220806100046-fa4c1d2eead0a140f0e412297823f189-
lynku.jukminung.com/ Name: AWSALB
Value: YbSgVGv9HO3/j6jaJsTyrjhAxBM0KEItAtRxy6HhktC9h5yjgs02B3eOBNW84ybzuaET6hUCaFLtWiqDmkGK1Q6G6X9UMujeLmeYcrGpFQLw7MQvZ94Yv/MF/93w
www.tgiory.com/ Name: AWSALB
Value: NySjJNiZ74g0sNWrk5IYYT8m81ZDjeoI/AbWcNowTW0O+GQojV4jkbjGfQGHZH32y6gR45B0EDSIWEvGyUY7kbCCnr7MFDMJKnS9URYnrArpMYOIs7zTw8WsT9dg
.tgiory.com/ Name: __cf_bm
Value: CArUg7gr6tC.SsGGtXrCKTe6.TSqDaDy5cPBIdkQIow-1659794447-0-AcJRT9Bzrg2umCl7pULDqRps5WJNJNMIk46edFOkZifNsu1pQpJ72CcwjAfe+ejKPNtnYRT9eiM537zAeh5Ivo0DnVrkmPwlezgbAdqf6wHICAtFlp929lGhtlXZbSGALQ==
track.adclickbyte.com/ Name: afclick
Value: 62ee740ff6065c000111c5d2
track.adclickbyte.com/ Name: afoffers
Value: {"2261226":1659794447}
.1d6cd5e0413.999traffic.com/ Name: rts-trck
Value: 1
.999traffic.com/ Name: t-uuid
Value: l6hyrciv6wh6tvtvyjs488so8
.999traffic.com/ Name: traffic-visited-offers
Value: %7C%7C163685%7Cunspecified
.999traffic.com/ Name: traffic-back
Value: ok
1d6cd659623.winsites.net/ Name: XSRF-TOKEN
Value: eyJpdiI6IlNpNjNOdm0wUitNUENNa0NSbWdqVWc9PSIsInZhbHVlIjoiWDdCclM0T0dEd05vNi9rNHR0Q2dIb0RHOThrNVZHbDgyWUVhNXJhbnJlSFVXTEhpTzE3aWZoeFg0RTk3TFZ4elZ1SlIvbTA0L29rYTdTRmF6Ym1vQmxqOFlQeGVtTFo5ek9mOGZXNGlUaDBsdGlrdzVUNXlsSElwcFB5UWpadWEiLCJtYWMiOiJkZTMwM2IxYzg5YTViYjNmMjM4YzU3N2Q1OGEwODAxNTJhMjFkYzhkNGQyNmJkNDQ5Y2VjZjEwYzIwZDM0MDQ2IiwidGFnIjoiIn0%3D
1d6cd659623.winsites.net/ Name: traffic_prelanders_session
Value: eyJpdiI6Ii93bi9JanlUS3NXSlZsNHFpTU9RdXc9PSIsInZhbHVlIjoiWEU0MjM0MGVJdkFlYVFkYUxKWU1aWlVDRzhIcWRDSFNxUlA3eVlnZEkxM0hWbGNRMXBJTGpUVDZtdVJJMFpVRTJWYWh2RTFZRWY1SzJGa0hZZDFuMkNHbVNBdEdFc1JHblV1SjBlRmpUdUZyUFRDaUdFS0N2MjZ4K1RHSUt3RGQiLCJtYWMiOiJiYTMyNWUzM2I4ZTVlZDE2YmE0ZjQyNzkyMDQ3N2Q3NDA4M2ZmNzJkMDlhMGY4ZDNmNmM2ZWIwYjEzOWI5MDA0IiwidGFnIjoiIn0%3D
1d6cd659623.winsites.net/ Name: J7voJWjpPNzMbY6cix3l8EBgWs4r1Df913U65Tog
Value: eyJpdiI6Ik5mdkJsK0xaQ3ErdlJKZzJuR0pnd2c9PSIsInZhbHVlIjoiTWNnR3hTUitBRW4rdCtkUllnRTdZMEEzeTYxMWVJaDFZSG5ZUmtOSGFicktqMHRWUlQwbUY2Tng3YXNvdVhhWmdWVXZaN0ZzM1R0TGtGbkozR3M2ZkFqblAwRUtpNGxNYnp3dFFUTTM3OThtWEUyZzdKSVRKV3h5ZGZ1MkF1dUk0aFFXVjRhSDA1NGtmTzIyc3JFZnY4K0M1Wmh0RzlsTGEzaWJPWjBabkZ6cjJoMjYvdy9sRytOTlBBRnFmOUxnNGo3ZjZBSGxUOHlEeGdKV3NNQTNZVmFKZnJob1ppR0hNN0hqMzEzT3RqOVdLS3YxUTZJU3ROYk9PbWF5cEo3VWdPZ0FjbmdmYWYwNFFiKzE5R1Bpb1JTaVFZK0FYWWhuN2RiUHMrOUY4NzROQitlTFhnUmhmdFl1WFpVWGRPUXlQa0VJSGZaQ2o3UGE1ZkVUMjk3SGhWZk5WcjVCa1R1MHJ6cTRqNUFJMTRmS2hoc1BUSWQ1a0ZhY0ovUStudHlGK0FtQ0l5dVhLZnRJTkVZTTFud1czcDBSZENWNzRxMGRpU2xrL3M3K2ZjOE1yUURCQjcycjhjVHpXb3pINEZhTDVIZEhKVlhNd1pNYldLcTVvcTFDWkxQNXhUaGp3K2kzam9BVy9hTTVlSzNxd3djejVZbXVCR21hQ1lQR3d0eWczak1ONXJnVUZxcVA5NDh1OFN0ZVNHYjFlRVY1cHVpOFZFTTBJa0pIOEVGOG4wOENlUGVLRWxlejZ1QUx0allkRGN2a2lSNzdkNjdQN01HdGNkWk5CekhMdGRqRk4rTVd6QUdFQ0J2YWhlWm5RUDhGNHo2c2dqOU5RVWlKSjdVVlBaZS9lNFFJYTh2dW1MZmkwU2xFUnE1VnROSjM2NWtZZ0NoZVNmY2lycWkrR0paNCt4Qk0xUFo3Q3VSQmRxeHFSVWRPcVU3WFhpRC94cUpta2luS3duWkNFbVBQdUdDckdHcngwd2VhV0Y0c2JOc0NPYmdLa2lybGZYT25uQ3VkU045KzhzVFZON0RGb2xTVmJpU09MekZKa25rR0w1aVorYzhiQitJTCtkUGFvaDIvRWEzaGlhckhVNWhUR3VRRHBydHdmRGplcTlwOW1BMDRubVBmS0N5UERoa29HM2lTZEpBbFRsT0R1dmZMSFFBTVNBdWhnbmxtMjBoVGxRelNiVTZwbUVkTGRCejFQS3Y3Mjh0SEVXMUVRYUtaTkRMQkgzTzNOWFJzcFZjUVZjUmpvbmZ1TnBFdEtZMkw3RDhpMzZMOUdCK0t4N3c0cDFWb3YrcGV1M3hzbm1HSXJiQXkraG1zU2Z3RDF1dkJYeWYyWkpGU2lkU0tSRzJ5OW1WVkNBRGVqOFB2dGx0OHl6aWRGajZPVHROOE55NGhvQWlnODE5OFYzYzhNazZkR09uclRjMmptK2xxanRSdnM0ZDlkZlVjRTNMTTl3T0VmcU1VNTQrNmh4VUxhcGdlSktrZTQvcGZ2OURRMDhsWGk3TmhJRU1IMjdqWFZJYjhOQTUrS0VObW5IOThTWHA5RzYrOU01TVlnK1NHMnBoVXBVNXA0R2lXbUVFMzdxS29WazVMOHlJTE9VbFFoODdYNVNmVW9lOC9MWDEvd1JrZysyeVZoSWlwSk8rcEJxMnpaRzlUMlprc3k2aitTSW1ZYUwyYldjU3hyaVFyK28zOVYrenJsUWNzU0lkTVpqbmFGOEdldklZelRTWVBHQlVnN3JSb0xHV2dVUTJFV0FQa0xBdERFRTFvNDI2WjlUWVhRMndhIiwibWFjIjoiYjVkOTg0MmE5OTdiMTNiNWIwYWZkYTBkYWEzNjk1NWFiY2ZlZTQxZGNjNGIzMDc2MDI3YzNmMjAxMTcxOTNiYSIsInRhZyI6IiJ9