www.winsim.de Open in urlscan Pro
212.227.177.21 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.duoconsulting.com/
Effective URL:
https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
Submission: On November 08 via api (November 8th 2022, 1:16:51 am UTC) from US — Scanned from DE

Summary HTTP 33 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 12 IPs in 2 countries across 9 domains to perform 33 HTTP transactions. The main IP is 212.227.177.21, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is www.winsim.de.
TLS certificate: Issued by Sectigo ECC Domain Validation Secure ... on January 24th 2022. Valid for: a year.

This is the only time www.winsim.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	69.16.230.227 69.16.230.227	32244 (LIQUIDWEB) (LIQUIDWEB)
1 2	108.168.193.189 108.168.193.189	36351 (SOFTLAYER) (SOFTLAYER)
2	3.125.239.17 3.125.239.17	16509 (AMAZON-02) (AMAZON-02)
2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6813:a860	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a01:488:42:1... 2a01:488:42:1000:b24d:7590:ff6e:e399	20773 (GODADDY) (GODADDY)
4	212.227.177.21 212.227.177.21	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
15	193.227.192.204 193.227.192.204	29037 (TELIKO-AS) (TELIKO-AS)
3	104.75.88.194 104.75.88.194	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.29.0.249 52.29.0.249	16509 (AMAZON-02) (AMAZON-02)
1	18.197.246.176 18.197.246.176	16509 (AMAZON-02) (AMAZON-02)
1	35.158.248.117 35.158.248.117	16509 (AMAZON-02) (AMAZON-02)
33	12

2 69.16.230.227 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb05.parklogic.com

www.duoconsulting.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.168.193.189 (Dallas, United States) 1 redirects

ASN36351 (SOFTLAYER, US)
PTR: bd.c1.a86c.ip4.static.sl-reverse.com

mybettermb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p237996.mybettermb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.125.239.17 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-239-17.eu-central-1.compute.amazonaws.com

mghnhfvz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

vipestores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:a860 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

r.srvtrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:488:42:1000:b24d:7590:ff6e:e399 (Germany) 1 redirects

ASN20773 (GODADDY, DE)

www.communicationads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 212.227.177.21 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: 212-227-177-21-customer.elastic-ssl.ui-r.com

www.winsim.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 193.227.192.204 (Germany)

ASN29037 (TELIKO-AS, DE)
PTR: imagepool.winsim.de

imagepool.winsim.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.75.88.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-194.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.29.0.249 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-0-249.eu-central-1.compute.amazonaws.com

collect.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.197.246.176 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-246-176.eu-central-1.compute.amazonaws.com

collect-eu-central-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.248.117 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-248-117.eu-central-1.compute.amazonaws.com

visitor-service-eu-central-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	winsim.de www.winsim.de imagepool.winsim.de — Cisco Umbrella Rank: 959899	1017 KB
3	tealiumiq.com collect.tealiumiq.com — Cisco Umbrella Rank: 3063 collect-eu-central-1.tealiumiq.com — Cisco Umbrella Rank: 30276 visitor-service-eu-central-1.tealiumiq.com — Cisco Umbrella Rank: 57772	2 KB
3	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1058	57 KB
2	srvtrck.com 1 redirects r.srvtrck.com — Cisco Umbrella Rank: 76594	1 KB
2	vipestores.com vipestores.com	3 KB
2	mghnhfvz.com mghnhfvz.com	4 KB
2	mybettermb.com 1 redirects mybettermb.com p237996.mybettermb.com	1 KB
2	duoconsulting.com www.duoconsulting.com	12 KB
1	communicationads.net 1 redirects www.communicationads.net — Cisco Umbrella Rank: 233742	599 B
33	9

	Domain	Requested by
15	imagepool.winsim.de	www.winsim.de
4	www.winsim.de	r.srvtrck.com www.winsim.de www.duoconsulting.com
3	tags.tiqcdn.com	www.winsim.de tags.tiqcdn.com
2	r.srvtrck.com	1 redirects vipestores.com
2	vipestores.com	vipestores.com
2	mghnhfvz.com	p237996.mybettermb.com
2	www.duoconsulting.com	www.duoconsulting.com
1	visitor-service-eu-central-1.tealiumiq.com	tags.tiqcdn.com
1	collect-eu-central-1.tealiumiq.com	tags.tiqcdn.com
1	collect.tealiumiq.com	www.duoconsulting.com
1	www.communicationads.net	1 redirects
1	p237996.mybettermb.com	www.duoconsulting.com
1	mybettermb.com	1 redirects
33	13

This site contains links to these domains. Also see Links.

Domain
service.winsim.de
www.facebook.com
control-center.1und1.de
www.smartmobil.de
www.simplytel.de

Subject Issuer	Validity	Valid
*.mybettermb.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-02` - `2023-11-02`	a year	crt.sh
mghnhfvz.com R3	`2022-09-27` - `2022-12-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-10-05` - `2023-10-05`	a year	crt.sh
*.srvtrck.com Go Daddy Secure Certificate Authority - G2	`2021-12-23` - `2023-01-24`	a year	crt.sh
*.winsim.de Sectigo ECC Domain Validation Secure Server CA	`2022-01-24` - `2023-02-24`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.tealiumiq.com Amazon	`2022-08-25` - `2023-09-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
Frame ID: 10C0758988D8D2D995D4033D639FAF1C
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

winSIM Handytarife | Günstige Handyverträge & Allnet Flat

Page URL History Show full URLs

http://www.duoconsulting.com/ Page URL
http://www.duoconsulting.com/page/bouncy.php?&bpae=GbhGc7Hawip7jnPX9QxEkj7DaGupYVx6tyO%2FBs1H1LGSGvini%2F... Page URL
https://mybettermb.com/aS/feedclick?s=eHtFB03dVeGmMPd-4tN4aUWut6U4gTSnsGnkh5YdYpvFWIcgvNCIfjZTiQMvA... HTTP 302
https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8... Page URL
https://mghnhfvz.com/click?trvid=31499&clickid=89596505556&bid=0.0006&keyword=duoconsulting.com&g... Page URL
https://mghnhfvz.com/double?t=2&d=eyJVUkwiOiJodHRwczovL3ZpcGVzdG9yZXMuY29tL2xpbmtzP2lkdz01ODY3XHU... Page URL
https://vipestores.com/links?idw=5867&subid=b9a2t3ohm26p Page URL
https://vipestores.com/de/shopping-malls/winsim-de Page URL
https://r.srvtrck.com/v1/redirect?type=linkId&id=b94652c2ff4d4791a21abaad296140a0&api_key=8848fddd... HTTP 302
https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%26... Page URL
https://www.communicationads.net/tc.php?t=10874C12023200T&subid=v03040001444117a8aceec4d94a8894b79b6f9790619a HTTP 302
https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874 Page URL

Page Statistics

33
Requests

94 %
HTTPS

25 %
IPv6

9
Domains

13
Subdomains

12
IPs

2
Countries

1096 kB
Transfer

2141 kB
Size

17
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://service.winsim.de/
Title: Zur Servicewelt

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WinSIM-219908278039155/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://service.winsim.de/public/contract/termination
Title: Mobilfunk-Vertrag kündigen

Search URL Search Domain Scan URL

URL: https://control-center.1und1.de/kuendigung
Title: DSL-Vertrag kündigen

Search URL Search Domain Scan URL

URL: https://www.smartmobil.de/
Title: smartmobil.de

Search URL Search Domain Scan URL

URL: https://www.simplytel.de/
Title: simplytel

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.duoconsulting.com/ Page URL
http://www.duoconsulting.com/page/bouncy.php?&bpae=GbhGc7Hawip7jnPX9QxEkj7DaGupYVx6tyO%2FBs1H1LGSGvini%2FmC%2FtVQ2g3ENRRR7tJv52kVlxBYuIGEQs5JdioR0HhiY8%2FzTVKn5B95pNHHdsZa8QU%2Fc9LbeDnxxwInhTzVjT8HiYtlAmq4veo3MBc3wU1cgj16OnvsmSy5epYWqU8%2Fcyfldj%2BHX9ol4i9QoDSZc%2FMs%2B2JadiUCABTOoMLRqlmA1YzOBLM82TFYSWv6I76m4OHUcSJ5exFF%2Bres9XpKOH2TDT7nszCvsIZj3JDP7XWyZqDiDceCjiAbFCnTvmMAZl3o7ZA1D5CNZfL2R2ypnhuG0s3JFxvTtFjkxhl%2Fo3AWfr0Qu%2FcoT69jXEkyrtTdBp9YaHJuToOLUXRXgguXRRLXlcI7eE%2FXsFDbNQk3FLx0cSqBuWO7afUcHOxLPjO9riLVFgBoBa6j02v0ZQfg70OMIDVQc0A0%2BsA6QmLWUt9vwZ%2B%2F9SNSIta%2ByEZ%2F190qoEDTpNnCMhuwbB3hVYf5iAkrvGyA9AvPTUSNBvTxdTIposfDtygYibb05Na2EsGLuKBI%2Fqxy4N4l6W%2FBoHUag%2FbvoiIgIB9xENXI%2BplikjCOXSUcS%2BHXxM%2FnqvIK3Q6PcpaV7v9Uxz6F3RJ2cP3xLM0YOBlbH99RTepeeOLo9zKcQHkiaePjwlGFegbFyGnGeiZfgkLF7ToPa7ezW2Uo04yepf%2FZoGHTRNfkCIG1670SA3hnCMmXjIc4RemindW6l%2BGfgTha8OgcpogHW%2FsGZwNGFNryHMhpnYK14wQ%2Bca2e0yCEHw5hLuzqosbwJsm%2BG3r96LZSBUrC6JAnKKeFAhmYJAOZlbwXL724LQsvP7M5MhSiS0NTVjq%2FkHwMO4CvexsdB8uwqz5dGAsL60Y8vYUZwYGUslkEQaFZMd9k6wDSUHkNXSqiBQGE5oonIb%2BDM9KMr3LFTphFQze4XX1MdXyZlDeNt2QMY2m4%2BNQfjqQ875a4p7egr9B1BGz%2Ft9TmUsM12ozyf9lBSj8lyR%2BS2b7n7qxzWGy56%2FtBaEBjT9X8wTK7gbtsUJF0i80WeFj28C2W2b4m4wCgl%2BGU83t%2FC2rFU7WQwlZZywHHyJSsLgCLUCX2Yx99mjGn1WYSEoloh7xk1i5mqqQRS8OSsYRjLvez2oYhSj5ACmmcD7%2FvIfHYmUw%2BqIbg327nA3Y%2BTuB0glBml5FI%2Bx44CrF2eqmeu4vrObbytYq%2B8fXrwKYrojg2nGNLCeo7QGURl3PeI4tExD9WouDc9GacOP7ptrH8HhRhqxaiXEDF7Elwra%2BNA9hi7GpDrWo81qJ3TU4oBeLMkeYPvy7jmoa%2BQUfPT3r9pwOuD%2Bt00bCN7Z2vyEzOZPXdnuE3DZdqyGGzAX4PQnDxRKkTIe3YQjtV7JZnCTtt55qW8AGlRYzOBEID58gA9%2BPcyXoGlrjW3f8imvIS7JBYHhLvZwMEbAA3bx%2BGP2Z4odCceNf30fGe%2FIJvWIwYajbbDqr0MD3YE86SCBN%2BF%2Fqndd39EsKVZOvhFZAdRXbeufNo7Uo31fbjkZ%2BJ6NEemfxQGucQmsGb4A80PdyPENzcf8I%2Bgi3qJepqrcvi2%2FriRsy7QQmqpYhmq1wNOKOebsaRtgipI7z6uQwHxLMhlPx0HXWS3I0Ay5gzbFsjZAEGCx5CSKhLKw6KwYz38sDaxpX96A8zib2XokzLhJ0ks8rDQ1OLVT%2F2Fke3FtunE7fqbdIDdLaEJagsCtzw1B3a70eHvLjjCl2IThW9VkilinE3Rmp7Y9KJFmT60m3sSm%2F5FKV2tsU1iOOEhFyr5psYkyzn%2FiEEzbFHavJOaAlVQ5trfLW8eBBU4TtkkW1OYB8Ks01fP5sz44LVSKdk0lYHXX8c9TPfdVY5Zjt042x2juYa0OkqBn13rK64JDlwzNu4tb69%2FlWW8ZJOutR295T5112%2BTCId1wJyDUTedPYBG93abUQ4%2FYY%3D&redirectType=js&inIframe=false&inPopUp=false Page URL
https://mybettermb.com/aS/feedclick?s=eHtFB03dVeGmMPd-4tN4aUWut6U4gTSnsGnkh5YdYpvFWIcgvNCIfjZTiQMvAXg5dnQ3qd4H7z-pbTnNK1c9Rxz0pbUsp-ySewBMB8RVJvv-4e4vQl9iCIHdqoH80EYFgS41QDYTbhAEysjXg8JANJjEIILW_3V7XWOpnxryNlyD_-EyqYTXzh5iQDKzeGF5p-9toP0wSyVO5bithrIRzre5M5wh_2296gVKsCgCLXDmL5dkRmI0AZiQ_XlpchTKAxYHlLUDWFC4I-u_0uTq15LWn5o__bjzVAiao_hmXLVVuzq_sbbS6jmSwHuZkXLl9OV4Oa1eapNSeztZ6oKZUQ6IoTsV4uyq0W7bPlWS2DkIufsERhbN5g99muPaWKX3ya9MH3U1n2FvAbFu1pUBwJCACOHRif6BNNpllat6NTMpncu2D4d9U5mNGhtkwFA2ZbVZuIrx6sxMebEsb5unMWD_xwyf171t_mGP7WCs7Ii2SV9jbc1832eOW5Z7uIXNsuuikQhDl2n0TiD9SjMi-Ab553T2s8NBwMaridiRAzcFo8RSoK8_FHvIusTJ_nEu5jLj1TMiRU---Q4eNpmv96EZtm1-h_jr9MbrtXSLgOcDsIR3j8h3Ng9YlY8dO1ISrzn8BgRlCBxlQ1X1Qh0_J6cKHy1Ajk6bB79t-h_dZ7ZDyFw9KQqgl94QvZ8s0j25uKuEb6rQZTHbWLJdeYp-bIHPUsK4c26nw9UenhTIyZDGivfQK0ppcLClhcTw00W-9r8_JvJexjt7NnnewoBwFMlaUfRgHdX3vjcdIRngSv7qOvaZxskOo8IddMDkxP1JGkz9_MmxLH3e_afcLLjYzAlA-XD2khHnhh4yoyr4ZTcVjTZH-2D3SyXjcuw9M66G4_r-bsxu1MSFhXvq4BA_Z1_cgd3os8plowi2uWUlHS5sFDrLeUMmuiQPtXcJTecQHYnF_uGKIhdpqhpekI-YEw-YHz9wjN_awDi-Dmm-PmzdOqEacpXy1KfcdWylcCcSvRBQgM3YgBigngA9SL4TWj_LFKaQfdCIV7zGDkXThF6fxRzXxISqKCG6-EnCPrjjd-p9flQvgrionx8B71l6CMW_LZEobZfJsgSZluxHBz07pgHk6WO8eNpqovRHA8A5hQo4QOZKHM-HX8y66E6MIDjFpjO-N-K6-9eeE09G80ktzC0AAdjLlFHaauiSvts47WwBM7LF7_bNPR6MM7x-J3hfw9iuQdgoYYq2TIPdPHhwNLeGZ4Uj-yo2n8E3GBbw6YovX51eA3I7lDB2T4_I2pIWVmNGd1JSUehu6q5V7w0S0PcEc920mNdd00CROGA6XplivgMpiylXeiMdhlzjo0DLIfC_Ww5pCfzy4TVgy56v61O5UkK_kh76vg9TiGAvEmfXnSDS12GMezhtiZRb6UdTHOtEN6rKie_OzXwBkYa-fYSMenlQYOaHrLZE3F_n HTTP 302
https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2ZNFXwO8VzTTzWAN3HZHTE_vFuZNQMdMI-vaI8tzj08RcFkWxwtwURVAyyHwv1sOaQn88uE1YMueO_Q7McWmjiKH9SFJ1-MU32M5phm9rHEHiXj74sTRpwfVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2ngYPWvbjlcEmi4OL1mnImvE_T1XpkVx2uqizULJaOmbn6iLaoUOknGn&ui=eHtFB03dVeGmMPd-4tN4accaKRMNtL4xIaIc3yOo5HI1CMylEAGH61oLh4u9NP8ikiTZH7yPHc4VhDYqMCsd2XuUvhsj6bZG6MUUZt9iGdhyG6Wz93TtmQ&si=1&oref=dc1a87bf46753ffb38de97cf3f736f21&optunit=ZBwc-nE1DjyqZ9W-M14IonnSiUDV5iGD&rb=1Q6mD28z45k&rr=1&abtg=0 Page URL
https://mghnhfvz.com/click?trvid=31499&clickid=89596505556&bid=0.0006&keyword=duoconsulting.com&geo=DE&campaignname=WinSim-DE-Domain-RON&device=Desktop&os=Windows+10&browser=Chrome+107&carrier=UNKNOWN&source=440543828 Page URL
https://mghnhfvz.com/double?t=2&d=eyJVUkwiOiJodHRwczovL3ZpcGVzdG9yZXMuY29tL2xpbmtzP2lkdz01ODY3XHUwMDI2c3ViaWQ9YjlhMnQzb2htMjZwIiwiUmVkaXJlY3RXb3JkaW5nIjoiICIsIlJlZGlyZWN0VGl0bGUiOiJSZWRpcmVjdGlvbi4uLiIsIlJlZGlyZWN0TGlua1RleHQiOiIgIiwiSW5zdGFsbElkIjoyMDAxfQ== Page URL
https://vipestores.com/links?idw=5867&subid=b9a2t3ohm26p Page URL
https://vipestores.com/de/shopping-malls/winsim-de Page URL
https://r.srvtrck.com/v1/redirect?type=linkId&id=b94652c2ff4d4791a21abaad296140a0&api_key=8848fdddeac2f1ab5d3871e1a330d101&site_id=7404ae0f5bf448bda88917a98ec42047&dch=feed&ad_t=advertiser&yk_tag=b9a2t3ohm26p HTTP 302
https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439 Page URL
https://www.communicationads.net/tc.php?t=10874C12023200T&subid=v03040001444117a8aceec4d94a8894b79b6f9790619a HTTP 302
https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://mybettermb.com/aS/feedclick?s=eHtFB03dVeGmMPd-4tN4aUWut6U4gTSnsGnkh5YdYpvFWIcgvNCIfjZTiQMvAXg5dnQ3qd4H7z-pbTnNK1c9Rxz0pbUsp-ySewBMB8RVJvv-4e4vQl9iCIHdqoH80EYFgS41QDYTbhAEysjXg8JANJjEIILW_3V7XWOpnxryNlyD_-EyqYTXzh5iQDKzeGF5p-9toP0wSyVO5bithrIRzre5M5wh_2296gVKsCgCLXDmL5dkRmI0AZiQ_XlpchTKAxYHlLUDWFC4I-u_0uTq15LWn5o__bjzVAiao_hmXLVVuzq_sbbS6jmSwHuZkXLl9OV4Oa1eapNSeztZ6oKZUQ6IoTsV4uyq0W7bPlWS2DkIufsERhbN5g99muPaWKX3ya9MH3U1n2FvAbFu1pUBwJCACOHRif6BNNpllat6NTMpncu2D4d9U5mNGhtkwFA2ZbVZuIrx6sxMebEsb5unMWD_xwyf171t_mGP7WCs7Ii2SV9jbc1832eOW5Z7uIXNsuuikQhDl2n0TiD9SjMi-Ab553T2s8NBwMaridiRAzcFo8RSoK8_FHvIusTJ_nEu5jLj1TMiRU---Q4eNpmv96EZtm1-h_jr9MbrtXSLgOcDsIR3j8h3Ng9YlY8dO1ISrzn8BgRlCBxlQ1X1Qh0_J6cKHy1Ajk6bB79t-h_dZ7ZDyFw9KQqgl94QvZ8s0j25uKuEb6rQZTHbWLJdeYp-bIHPUsK4c26nw9UenhTIyZDGivfQK0ppcLClhcTw00W-9r8_JvJexjt7NnnewoBwFMlaUfRgHdX3vjcdIRngSv7qOvaZxskOo8IddMDkxP1JGkz9_MmxLH3e_afcLLjYzAlA-XD2khHnhh4yoyr4ZTcVjTZH-2D3SyXjcuw9M66G4_r-bsxu1MSFhXvq4BA_Z1_cgd3os8plowi2uWUlHS5sFDrLeUMmuiQPtXcJTecQHYnF_uGKIhdpqhpekI-YEw-YHz9wjN_awDi-Dmm-PmzdOqEacpXy1KfcdWylcCcSvRBQgM3YgBigngA9SL4TWj_LFKaQfdCIV7zGDkXThF6fxRzXxISqKCG6-EnCPrjjd-p9flQvgrionx8B71l6CMW_LZEobZfJsgSZluxHBz07pgHk6WO8eNpqovRHA8A5hQo4QOZKHM-HX8y66E6MIDjFpjO-N-K6-9eeE09G80ktzC0AAdjLlFHaauiSvts47WwBM7LF7_bNPR6MM7x-J3hfw9iuQdgoYYq2TIPdPHhwNLeGZ4Uj-yo2n8E3GBbw6YovX51eA3I7lDB2T4_I2pIWVmNGd1JSUehu6q5V7w0S0PcEc920mNdd00CROGA6XplivgMpiylXeiMdhlzjo0DLIfC_Ww5pCfzy4TVgy56v61O5UkK_kh76vg9TiGAvEmfXnSDS12GMezhtiZRb6UdTHOtEN6rKie_OzXwBkYa-fYSMenlQYOaHrLZE3F_n HTTP 302
https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2ZNFXwO8VzTTzWAN3HZHTE_vFuZNQMdMI-vaI8tzj08RcFkWxwtwURVAyyHwv1sOaQn88uE1YMueO_Q7McWmjiKH9SFJ1-MU32M5phm9rHEHiXj74sTRpwfVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2ngYPWvbjlcEmi4OL1mnImvE_T1XpkVx2uqizULJaOmbn6iLaoUOknGn&ui=eHtFB03dVeGmMPd-4tN4accaKRMNtL4xIaIc3yOo5HI1CMylEAGH61oLh4u9NP8ikiTZH7yPHc4VhDYqMCsd2XuUvhsj6bZG6MUUZt9iGdhyG6Wz93TtmQ&si=1&oref=dc1a87bf46753ffb38de97cf3f736f21&optunit=ZBwc-nE1DjyqZ9W-M14IonnSiUDV5iGD&rb=1Q6mD28z45k&rr=1&abtg=0

Request Chain 7

https://r.srvtrck.com/v1/redirect?type=linkId&id=b94652c2ff4d4791a21abaad296140a0&api_key=8848fdddeac2f1ab5d3871e1a330d101&site_id=7404ae0f5bf448bda88917a98ec42047&dch=feed&ad_t=advertiser&yk_tag=b9a2t3ohm26p HTTP 302
https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439

33 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
www.duoconsulting.com/ 7 KB
7 KB 829ms
620ms Document
text/html 69.16.230.227
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://www.duoconsulting.com/
Protocol: HTTP/1.1
Server: 69.16.230.227 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb05.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 08 Nov 2022 01:16:45 GMT
Keep-Alive: timeout=5, max=98
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
Transfer-Encoding: chunked
X-Powered-By: PHP/5.4.16

GET
H/1.1 200
OK bouncy.php
www.duoconsulting.com/page/ 5 KB
5 KB 234ms
233ms Document
text/html 69.16.230.227
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://www.duoconsulting.com/page/bouncy.php?&bpae=GbhGc7Hawip7jnPX9QxEkj7DaGupYVx6tyO%2FBs1H1LGSGvini%2FmC%2FtVQ2g3ENRRR7tJv52kVlxBYuIGEQs5JdioR0HhiY8%2FzTVKn5B95pNHHdsZa8QU%2Fc9LbeDnxxwInhTzVjT8HiYtlAmq4veo3MBc3wU1cgj16OnvsmSy5epYWqU8%2Fcyfldj%2BHX9ol4i9QoDSZc%2FMs%2B2JadiUCABTOoMLRqlmA1YzOBLM82TFYSWv6I76m4OHUcSJ5exFF%2Bres9XpKOH2TDT7nszCvsIZj3JDP7XWyZqDiDceCjiAbFCnTvmMAZl3o7ZA1D5CNZfL2R2ypnhuG0s3JFxvTtFjkxhl%2Fo3AWfr0Qu%2FcoT69jXEkyrtTdBp9YaHJuToOLUXRXgguXRRLXlcI7eE%2FXsFDbNQk3FLx0cSqBuWO7afUcHOxLPjO9riLVFgBoBa6j02v0ZQfg70OMIDVQc0A0%2BsA6QmLWUt9vwZ%2B%2F9SNSIta%2ByEZ%2F190qoEDTpNnCMhuwbB3hVYf5iAkrvGyA9AvPTUSNBvTxdTIposfDtygYibb05Na2EsGLuKBI%2Fqxy4N4l6W%2FBoHUag%2FbvoiIgIB9xENXI%2BplikjCOXSUcS%2BHXxM%2FnqvIK3Q6PcpaV7v9Uxz6F3RJ2cP3xLM0YOBlbH99RTepeeOLo9zKcQHkiaePjwlGFegbFyGnGeiZfgkLF7ToPa7ezW2Uo04yepf%2FZoGHTRNfkCIG1670SA3hnCMmXjIc4RemindW6l%2BGfgTha8OgcpogHW%2FsGZwNGFNryHMhpnYK14wQ%2Bca2e0yCEHw5hLuzqosbwJsm%2BG3r96LZSBUrC6JAnKKeFAhmYJAOZlbwXL724LQsvP7M5MhSiS0NTVjq%2FkHwMO4CvexsdB8uwqz5dGAsL60Y8vYUZwYGUslkEQaFZMd9k6wDSUHkNXSqiBQGE5oonIb%2BDM9KMr3LFTphFQze4XX1MdXyZlDeNt2QMY2m4%2BNQfjqQ875a4p7egr9B1BGz%2Ft9TmUsM12ozyf9lBSj8lyR%2BS2b7n7qxzWGy56%2FtBaEBjT9X8wTK7gbtsUJF0i80WeFj28C2W2b4m4wCgl%2BGU83t%2FC2rFU7WQwlZZywHHyJSsLgCLUCX2Yx99mjGn1WYSEoloh7xk1i5mqqQRS8OSsYRjLvez2oYhSj5ACmmcD7%2FvIfHYmUw%2BqIbg327nA3Y%2BTuB0glBml5FI%2Bx44CrF2eqmeu4vrObbytYq%2B8fXrwKYrojg2nGNLCeo7QGURl3PeI4tExD9WouDc9GacOP7ptrH8HhRhqxaiXEDF7Elwra%2BNA9hi7GpDrWo81qJ3TU4oBeLMkeYPvy7jmoa%2BQUfPT3r9pwOuD%2Bt00bCN7Z2vyEzOZPXdnuE3DZdqyGGzAX4PQnDxRKkTIe3YQjtV7JZnCTtt55qW8AGlRYzOBEID58gA9%2BPcyXoGlrjW3f8imvIS7JBYHhLvZwMEbAA3bx%2BGP2Z4odCceNf30fGe%2FIJvWIwYajbbDqr0MD3YE86SCBN%2BF%2Fqndd39EsKVZOvhFZAdRXbeufNo7Uo31fbjkZ%2BJ6NEemfxQGucQmsGb4A80PdyPENzcf8I%2Bgi3qJepqrcvi2%2FriRsy7QQmqpYhmq1wNOKOebsaRtgipI7z6uQwHxLMhlPx0HXWS3I0Ay5gzbFsjZAEGCx5CSKhLKw6KwYz38sDaxpX96A8zib2XokzLhJ0ks8rDQ1OLVT%2F2Fke3FtunE7fqbdIDdLaEJagsCtzw1B3a70eHvLjjCl2IThW9VkilinE3Rmp7Y9KJFmT60m3sSm%2F5FKV2tsU1iOOEhFyr5psYkyzn%2FiEEzbFHavJOaAlVQ5trfLW8eBBU4TtkkW1OYB8Ks01fP5sz44LVSKdk0lYHXX8c9TPfdVY5Zjt042x2juYa0OkqBn13rK64JDlwzNu4tb69%2FlWW8ZJOutR295T5112%2BTCId1wJyDUTedPYBG93abUQ4%2FYY%3D&redirectType=js&inIframe=false&inPopUp=false
Requested by: Host: www.duoconsulting.com
URL: http://www.duoconsulting.com/
Protocol: HTTP/1.1
Server: 69.16.230.227 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb05.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash

Request headers

Referer: http://www.duoconsulting.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 08 Nov 2022 01:16:45 GMT
Keep-Alive: timeout=5, max=97
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
Transfer-Encoding: chunked
X-Powered-By: PHP/5.4.16

GET
H2

200

domainClick
p237996.mybettermb.com/adServe/
Redirect Chain

https://mybettermb.com/aS/feedclick?s=eHtFB03dVeGmMPd-4tN4aUWut6U4gTSnsGnkh5YdYpvFWIcgvNCIfjZTiQMvAXg5dnQ3qd4H7z-pbTnNK1c9Rxz0pbUsp-ySewBMB8RVJvv-4e4vQl9iCIHdqoH80EYFgS41QDYTbhAEysjXg8JANJjEIILW_3V...
https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U...

413 B
692 B

157ms
148ms

Document
text/html

108.168.193.189
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2ZNFXwO8VzTTzWAN3HZHTE_vFuZNQMdMI-vaI8tzj08RcFkWxwtwURVAyyHwv1sOaQn88uE1YMueO_Q7McWmjiKH9SFJ1-MU32M5phm9rHEHiXj74sTRpwfVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2ngYPWvbjlcEmi4OL1mnImvE_T1XpkVx2uqizULJaOmbn6iLaoUOknGn&ui=eHtFB03dVeGmMPd-4tN4accaKRMNtL4xIaIc3yOo5HI1CMylEAGH61oLh4u9NP8ikiTZH7yPHc4VhDYqMCsd2XuUvhsj6bZG6MUUZt9iGdhyG6Wz93TtmQ&si=1&oref=dc1a87bf46753ffb38de97cf3f736f21&optunit=ZBwc-nE1DjyqZ9W-M14IonnSiUDV5iGD&rb=1Q6mD28z45k&rr=1&abtg=0
Requested by: Host: www.duoconsulting.com
URL: http://www.duoconsulting.com/page/bouncy.php?&bpae=GbhGc7Hawip7jnPX9QxEkj7DaGupYVx6tyO%2FBs1H1LGSGvini%2FmC%2FtVQ2g3ENRRR7tJv52kVlxBYuIGEQs5JdioR0HhiY8%2FzTVKn5B95pNHHdsZa8QU%2Fc9LbeDnxxwInhTzVjT8HiYtlAmq4veo3MBc3wU1cgj16OnvsmSy5epYWqU8%2Fcyfldj%2BHX9ol4i9QoDSZc%2FMs%2B2JadiUCABTOoMLRqlmA1YzOBLM82TFYSWv6I76m4OHUcSJ5exFF%2Bres9XpKOH2TDT7nszCvsIZj3JDP7XWyZqDiDceCjiAbFCnTvmMAZl3o7ZA1D5CNZfL2R2ypnhuG0s3JFxvTtFjkxhl%2Fo3AWfr0Qu%2FcoT69jXEkyrtTdBp9YaHJuToOLUXRXgguXRRLXlcI7eE%2FXsFDbNQk3FLx0cSqBuWO7afUcHOxLPjO9riLVFgBoBa6j02v0ZQfg70OMIDVQc0A0%2BsA6QmLWUt9vwZ%2B%2F9SNSIta%2ByEZ%2F190qoEDTpNnCMhuwbB3hVYf5iAkrvGyA9AvPTUSNBvTxdTIposfDtygYibb05Na2EsGLuKBI%2Fqxy4N4l6W%2FBoHUag%2FbvoiIgIB9xENXI%2BplikjCOXSUcS%2BHXxM%2FnqvIK3Q6PcpaV7v9Uxz6F3RJ2cP3xLM0YOBlbH99RTepeeOLo9zKcQHkiaePjwlGFegbFyGnGeiZfgkLF7ToPa7ezW2Uo04yepf%2FZoGHTRNfkCIG1670SA3hnCMmXjIc4RemindW6l%2BGfgTha8OgcpogHW%2FsGZwNGFNryHMhpnYK14wQ%2Bca2e0yCEHw5hLuzqosbwJsm%2BG3r96LZSBUrC6JAnKKeFAhmYJAOZlbwXL724LQsvP7M5MhSiS0NTVjq%2FkHwMO4CvexsdB8uwqz5dGAsL60Y8vYUZwYGUslkEQaFZMd9k6wDSUHkNXSqiBQGE5oonIb%2BDM9KMr3LFTphFQze4XX1MdXyZlDeNt2QMY2m4%2BNQfjqQ875a4p7egr9B1BGz%2Ft9TmUsM12ozyf9lBSj8lyR%2BS2b7n7qxzWGy56%2FtBaEBjT9X8wTK7gbtsUJF0i80WeFj28C2W2b4m4wCgl%2BGU83t%2FC2rFU7WQwlZZywHHyJSsLgCLUCX2Yx99mjGn1WYSEoloh7xk1i5mqqQRS8OSsYRjLvez2oYhSj5ACmmcD7%2FvIfHYmUw%2BqIbg327nA3Y%2BTuB0glBml5FI%2Bx44CrF2eqmeu4vrObbytYq%2B8fXrwKYrojg2nGNLCeo7QGURl3PeI4tExD9WouDc9GacOP7ptrH8HhRhqxaiXEDF7Elwra%2BNA9hi7GpDrWo81qJ3TU4oBeLMkeYPvy7jmoa%2BQUfPT3r9pwOuD%2Bt00bCN7Z2vyEzOZPXdnuE3DZdqyGGzAX4PQnDxRKkTIe3YQjtV7JZnCTtt55qW8AGlRYzOBEID58gA9%2BPcyXoGlrjW3f8imvIS7JBYHhLvZwMEbAA3bx%2BGP2Z4odCceNf30fGe%2FIJvWIwYajbbDqr0MD3YE86SCBN%2BF%2Fqndd39EsKVZOvhFZAdRXbeufNo7Uo31fbjkZ%2BJ6NEemfxQGucQmsGb4A80PdyPENzcf8I%2Bgi3qJepqrcvi2%2FriRsy7QQmqpYhmq1wNOKOebsaRtgipI7z6uQwHxLMhlPx0HXWS3I0Ay5gzbFsjZAEGCx5CSKhLKw6KwYz38sDaxpX96A8zib2XokzLhJ0ks8rDQ1OLVT%2F2Fke3FtunE7fqbdIDdLaEJagsCtzw1B3a70eHvLjjCl2IThW9VkilinE3Rmp7Y9KJFmT60m3sSm%2F5FKV2tsU1iOOEhFyr5psYkyzn%2FiEEzbFHavJOaAlVQ5trfLW8eBBU4TtkkW1OYB8Ks01fP5sz44LVSKdk0lYHXX8c9TPfdVY5Zjt042x2juYa0OkqBn13rK64JDlwzNu4tb69%2FlWW8ZJOutR295T5112%2BTCId1wJyDUTedPYBG93abUQ4%2FYY%3D&redirectType=js&inIframe=false&inPopUp=false
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.168.193.189 Dallas, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: bd.c1.a86c.ip4.static.sl-reverse.com
Software: nginx /
Resource Hash

Request headers

Referer: http://www.duoconsulting.com/page/bouncy.php?&bpae=GbhGc7Hawip7jnPX9QxEkj7DaGupYVx6tyO%2FBs1H1LGSGvini%2FmC%2FtVQ2g3ENRRR7tJv52kVlxBYuIGEQs5JdioR0HhiY8%2FzTVKn5B95pNHHdsZa8QU%2Fc9LbeDnxxwInhTzVjT8HiYtlAmq4veo3MBc3wU1cgj16OnvsmSy5epYWqU8%2Fcyfldj%2BHX9ol4i9QoDSZc%2FMs%2B2JadiUCABTOoMLRqlmA1YzOBLM82TFYSWv6I76m4OHUcSJ5exFF%2Bres9XpKOH2TDT7nszCvsIZj3JDP7XWyZqDiDceCjiAbFCnTvmMAZl3o7ZA1D5CNZfL2R2ypnhuG0s3JFxvTtFjkxhl%2Fo3AWfr0Qu%2FcoT69jXEkyrtTdBp9YaHJuToOLUXRXgguXRRLXlcI7eE%2FXsFDbNQk3FLx0cSqBuWO7afUcHOxLPjO9riLVFgBoBa6j02v0ZQfg70OMIDVQc0A0%2BsA6QmLWUt9vwZ%2B%2F9SNSIta%2ByEZ%2F190qoEDTpNnCMhuwbB3hVYf5iAkrvGyA9AvPTUSNBvTxdTIposfDtygYibb05Na2EsGLuKBI%2Fqxy4N4l6W%2FBoHUag%2FbvoiIgIB9xENXI%2BplikjCOXSUcS%2BHXxM%2FnqvIK3Q6PcpaV7v9Uxz6F3RJ2cP3xLM0YOBlbH99RTepeeOLo9zKcQHkiaePjwlGFegbFyGnGeiZfgkLF7ToPa7ezW2Uo04yepf%2FZoGHTRNfkCIG1670SA3hnCMmXjIc4RemindW6l%2BGfgTha8OgcpogHW%2FsGZwNGFNryHMhpnYK14wQ%2Bca2e0yCEHw5hLuzqosbwJsm%2BG3r96LZSBUrC6JAnKKeFAhmYJAOZlbwXL724LQsvP7M5MhSiS0NTVjq%2FkHwMO4CvexsdB8uwqz5dGAsL60Y8vYUZwYGUslkEQaFZMd9k6wDSUHkNXSqiBQGE5oonIb%2BDM9KMr3LFTphFQze4XX1MdXyZlDeNt2QMY2m4%2BNQfjqQ875a4p7egr9B1BGz%2Ft9TmUsM12ozyf9lBSj8lyR%2BS2b7n7qxzWGy56%2FtBaEBjT9X8wTK7gbtsUJF0i80WeFj28C2W2b4m4wCgl%2BGU83t%2FC2rFU7WQwlZZywHHyJSsLgCLUCX2Yx99mjGn1WYSEoloh7xk1i5mqqQRS8OSsYRjLvez2oYhSj5ACmmcD7%2FvIfHYmUw%2BqIbg327nA3Y%2BTuB0glBml5FI%2Bx44CrF2eqmeu4vrObbytYq%2B8fXrwKYrojg2nGNLCeo7QGURl3PeI4tExD9WouDc9GacOP7ptrH8HhRhqxaiXEDF7Elwra%2BNA9hi7GpDrWo81qJ3TU4oBeLMkeYPvy7jmoa%2BQUfPT3r9pwOuD%2Bt00bCN7Z2vyEzOZPXdnuE3DZdqyGGzAX4PQnDxRKkTIe3YQjtV7JZnCTtt55qW8AGlRYzOBEID58gA9%2BPcyXoGlrjW3f8imvIS7JBYHhLvZwMEbAA3bx%2BGP2Z4odCceNf30fGe%2FIJvWIwYajbbDqr0MD3YE86SCBN%2BF%2Fqndd39EsKVZOvhFZAdRXbeufNo7Uo31fbjkZ%2BJ6NEemfxQGucQmsGb4A80PdyPENzcf8I%2Bgi3qJepqrcvi2%2FriRsy7QQmqpYhmq1wNOKOebsaRtgipI7z6uQwHxLMhlPx0HXWS3I0Ay5gzbFsjZAEGCx5CSKhLKw6KwYz38sDaxpX96A8zib2XokzLhJ0ks8rDQ1OLVT%2F2Fke3FtunE7fqbdIDdLaEJagsCtzw1B3a70eHvLjjCl2IThW9VkilinE3Rmp7Y9KJFmT60m3sSm%2F5FKV2tsU1iOOEhFyr5psYkyzn%2FiEEzbFHavJOaAlVQ5trfLW8eBBU4TtkkW1OYB8Ks01fP5sz44LVSKdk0lYHXX8c9TPfdVY5Zjt042x2juYa0OkqBn13rK64JDlwzNu4tb69%2FlWW8ZJOutR295T5112%2BTCId1wJyDUTedPYBG93abUQ4%2FYY%3D&redirectType=js&inIframe=false&inPopUp=false
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=ISO-8859-1
date: Tue, 08 Nov 2022 01:16:46 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Tue, 08 Nov 2022 01:16:46 GMT
location: https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2ZNFXwO8VzTTzWAN3HZHTE_vFuZNQMdMI-vaI8tzj08RcFkWxwtwURVAyyHwv1sOaQn88uE1YMueO_Q7McWmjiKH9SFJ1-MU32M5phm9rHEHiXj74sTRpwfVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2ngYPWvbjlcEmi4OL1mnImvE_T1XpkVx2uqizULJaOmbn6iLaoUOknGn&ui=eHtFB03dVeGmMPd-4tN4accaKRMNtL4xIaIc3yOo5HI1CMylEAGH61oLh4u9NP8ikiTZH7yPHc4VhDYqMCsd2XuUvhsj6bZG6MUUZt9iGdhyG6Wz93TtmQ&si=1&oref=dc1a87bf46753ffb38de97cf3f736f21&optunit=ZBwc-nE1DjyqZ9W-M14IonnSiUDV5iGD&rb=1Q6mD28z45k&rr=1&abtg=0
server: nginx

GET
H2 200 click Show response
mghnhfvz.com/ 1003 B
3 KB 50ms
9ms Document
text/html 3.125.239.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mghnhfvz.com/click?trvid=31499&clickid=89596505556&bid=0.0006&keyword=duoconsulting.com&geo=DE&campaignname=WinSim-DE-Domain-RON&device=Desktop&os=Windows+10&browser=Chrome+107&carrier=UNKNOWN&source=440543828
Requested by: Host: p237996.mybettermb.com
URL: https://p237996.mybettermb.com/adServe/domainClick?ai=LyBVgUe5lpl8gX_8jonkoJ5y6WbYTqNpeF_D2K5B2CiGdpv3nxMN8u2-THs-oNc9W1uW9gUoLHwFSX-ujSdXRQafDdQqpNxpaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2ZNFXwO8VzTTzWAN3HZHTE_vFuZNQMdMI-vaI8tzj08RcFkWxwtwURVAyyHwv1sOaQn88uE1YMueO_Q7McWmjiKH9SFJ1-MU32M5phm9rHEHiXj74sTRpwfVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2ngYPWvbjlcEmi4OL1mnImvE_T1XpkVx2uqizULJaOmbn6iLaoUOknGn&ui=eHtFB03dVeGmMPd-4tN4accaKRMNtL4xIaIc3yOo5HI1CMylEAGH61oLh4u9NP8ikiTZH7yPHc4VhDYqMCsd2XuUvhsj6bZG6MUUZt9iGdhyG6Wz93TtmQ&si=1&oref=dc1a87bf46753ffb38de97cf3f736f21&optunit=ZBwc-nE1DjyqZ9W-M14IonnSiUDV5iGD&rb=1Q6mD28z45k&rr=1&abtg=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.125.239.17 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-239-17.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a637c66a0760a4d4147f21eb9b1b83ffbe6e7621a3da2ff8e8ee0642e73f868d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
content-length: 1003
content-type: text/html; charset=utf-8
date: Tue, 08 Nov 2022 01:16:46 GMT
expires: Thu, 01 Jan 1970 00:00:00 UTC
pragma: no-cache
server: nginx

GET
H2 200 double Show response
mghnhfvz.com/ 636 B
816 B 9ms
8ms Document
text/html 3.125.239.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mghnhfvz.com/double?t=2&d=eyJVUkwiOiJodHRwczovL3ZpcGVzdG9yZXMuY29tL2xpbmtzP2lkdz01ODY3XHUwMDI2c3ViaWQ9YjlhMnQzb2htMjZwIiwiUmVkaXJlY3RXb3JkaW5nIjoiICIsIlJlZGlyZWN0VGl0bGUiOiJSZWRpcmVjdGlvbi4uLiIsIlJlZGlyZWN0TGlua1RleHQiOiIgIiwiSW5zdGFsbElkIjoyMDAxfQ==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.125.239.17 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-239-17.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5a6cfe6493050e65aaf17421c394af6673dffd280cc66ee33cee80f179429788

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
content-length: 636
content-type: text/html; charset=utf-8
date: Tue, 08 Nov 2022 01:16:46 GMT
expires: Thu, 01 Jan 1970 00:00:00 UTC
pragma: no-cache
server: nginx

GET
H2 200 links
vipestores.com/ 593 B
1 KB 76ms
43ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://vipestores.com/links?idw=5867&subid=b9a2t3ohm26p

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 766a77182fa69b46-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 08 Nov 2022 01:16:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HGQ3%2BbtfKEaUAqBCy0jIE%2BOL0O1n1QhmHE0alYm7gKKJcSMho%2FiwMj%2FvKjDgZrIKK0Qq2%2FylJ5%2BauusF2hFWHHNoKZ%2BqoMG%2FRQKZMqzgzqEfj9qKfQcy%2FYYYkAYsi9aAljdDL52QWRALW2fdMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 winsim-de
vipestores.com/de/shopping-malls/ 726 B
1 KB 38ms
36ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://vipestores.com/de/shopping-malls/winsim-de

Requested by

Host: vipestores.com
URL: https://vipestores.com/links?idw=5867&subid=b9a2t3ohm26p

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 766a7718a8469b46-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 08 Nov 2022 01:16:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cge6z9DUg1QGebDEnQ3liBHA89VvFe3TIHdEFZfjWoP09kgbMq%2BwtSyk%2FvJZyzI3E0MGk%2BddC85SoHaGi5%2BJOT0ZaE2nmazM6n9x8v5iXlCZ3YWHBMlGNozZwpjFPjFLrBfTOD7YyB2xlzFo4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H3

200

go
r.srvtrck.com/v2/
Redirect Chain

https://r.srvtrck.com/v1/redirect?type=linkId&id=b94652c2ff4d4791a21abaad296140a0&api_key=8848fdddeac2f1ab5d3871e1a330d101&site_id=7404ae0f5bf448bda88917a98ec42047&dch=feed&ad_t=advertiser&yk_tag=b...
https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=...

1 KB
701 B

43ms
32ms

Document
text/html

2606:4700::6813:a860
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439
Requested by: Host: vipestores.com
URL: https://vipestores.com/de/shopping-malls/winsim-de
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:a860 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://vipestores.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 766a771a5ac56940-FRA
content-encoding: br
content-type: text/html;charset=UTF-8
date: Tue, 08 Nov 2022 01:16:47 GMT
server: cloudflare

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 766a7719280e9a3f-FRA
content-length: 0
date: Tue, 08 Nov 2022 01:16:46 GMT
location: /v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439
p3p: CP="CAO PSA OUR"
server: cloudflare

GET
H2

200

Primary Request / Show response
www.winsim.de/
Redirect Chain

https://www.communicationads.net/tc.php?t=10874C12023200T&subid=v03040001444117a8aceec4d94a8894b79b6f9790619a
https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

267 KB
52 KB

401ms
371ms

Document
text/html

212.227.177.21
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Requested by

Host: r.srvtrck.com
URL: https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.227.177.21 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

212-227-177-21-customer.elastic-ssl.ui-r.com

Software

nginx /

Resource Hash

a7e5061977c34ddf194f7f1582be72f46093f79695201cfc1b6b34909e74eb5b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy	default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://r.srvtrck.com/v2/go?t=at1p0%3A7%2Ffwb.7o4m8nac9t4oeacs8n7t1t4.1h0%3F4%3D30v7dCb2s2T2003%260u1i4%3D8010t0p0p4c4%2F1ea.adencida4i8u9mbc9w6w9%2F9s6t9h&s=https%3A%2F%2Fvipestores.com%2F&e=1&ai=3f838de8cd4346719ceb20cc8b02a8ea&sct=0&ct=1667870206946&cu=17a8aceec4d94a8894b79b6f9790619a&ykuid=464be0b4e47f4ff4a252063f70f4a151&sc=1&cs=c474d34c6e81de31ed3825722c811439
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate max-age=0, must-revalidate, private
content-encoding: gzip
content-security-policy: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'
content-type: text/html; charset=UTF-8
date: Tue, 08 Nov 2022 01:16:47 GMT
etag: "add97bfb40454f476477e4cfe07c11da"
expires: Tue, 08 Nov 2022 01:16:47 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-security-policy: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'
x-content-type-options: nosniff
x-webkit-csp: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'nonce-c887abde17d43fe7738909b0ce3863f7' 'nonce-ba14a7d139affa78057be993738b6df0' 'nonce-6cb1aa640219931e9b688723dc7de6a8' 'nonce-15b483beda8153d0aa37ab8db1825343' 'nonce-215c1073872ab06a8f3f5658f2979e0d' 'nonce-d097f23ec34913e8b77120229044344f' 'nonce-00c52fe5fc956057bdc549caa6177819' 'self' 'unsafe-inline' https: 'report-sample'
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 08 Nov 2022 01:16:47 GMT
Location: https://www.winsim.de?refid=23418&drag_vars=1681903705_10874
P3P: policyref="https://www.communicationads.net/de/w3c/p3p.xml",CP="NOI CUR OUR STP"
Server: Apache

GET
H2 200 css_complete-rev46511-global47681-time1667826149-group302-version13-screen.css
www.winsim.de/static/ 579 KB
81 KB 27ms
25ms Stylesheet
text/css 212.227.177.21
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.winsim.de/static/css_complete-rev46511-global47681-time1667826149-group302-version13-screen.css

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.227.177.21 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

212-227-177-21-customer.elastic-ssl.ui-r.com

Software

nginx /

Resource Hash

dcb6e56b18d1cb7c115d23f93cf97247446a24cd0e69826c0497decd64eb7ff0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Mon, 07 Nov 2022 13:05:17 GMT
server: nginx
etag: "6369028d-14095"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
content-length: 82069
x-xss-protection: 1; mode=block
expires: Thu, 08 Dec 2022 01:16:47 GMT

GET
H2 200 js_complete-rev46511-global47681-time1667826149-group302-version13-screen.js Show response
www.winsim.de/static/ 284 KB
80 KB 45ms
44ms Script
application/javascript 212.227.177.21
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.winsim.de/static/js_complete-rev46511-global47681-time1667826149-group302-version13-screen.js

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.227.177.21 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

212-227-177-21-customer.elastic-ssl.ui-r.com

Software

nginx /

Resource Hash

cb3da004a9ce6962fc662d9b9f1b3edc85eec274d8cdf3ac103ed864ed81a138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Mon, 07 Nov 2022 13:04:03 GMT
server: nginx
etag: "63690243-13e6c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
content-length: 81516
x-xss-protection: 1; mode=block
expires: Thu, 08 Dec 2022 01:16:47 GMT

GET
H2 200 GT-Walsheim-Medium.woff2
imagepool.winsim.de/v2/global/fonts/GT-Walsheim/ 44 KB
45 KB 72ms
34ms Font
application/octet-stream 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://imagepool.winsim.de/v2/global/fonts/GT-Walsheim/GT-Walsheim-Medium.woff2

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

1ef100075419c40050f5c86c157cc04c2100bddf56e2e2ef8d501f943dae2b6e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

Referer: https://www.winsim.de/
Origin: https://www.winsim.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 03 Aug 2021 12:36:44 GMT
server: nginx
etag: "6109385c-b1f4"
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 45556
expires: Wed, 08 Nov 2023 01:16:47 GMT

GET
H2 200 GT-Walsheim-Bold.woff2
imagepool.winsim.de/v2/global/fonts/GT-Walsheim/ 48 KB
49 KB 82ms
45ms Font
application/octet-stream 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://imagepool.winsim.de/v2/global/fonts/GT-Walsheim/GT-Walsheim-Bold.woff2

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

5843cc4eeeebd4ba92b08ed7602a984251db9bbde44fc13e05c020b8b6bf346e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

Referer: https://www.winsim.de/
Origin: https://www.winsim.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 03 Aug 2021 12:36:45 GMT
server: nginx
etag: "6109385d-c078"
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 49272
expires: Wed, 08 Nov 2023 01:16:47 GMT

GET
H2 200 mega_fresh-webfont.woff2
imagepool.winsim.de/v2/global/fonts/mega-fresh/ 277 KB
278 KB 93ms
55ms Font
application/octet-stream 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://imagepool.winsim.de/v2/global/fonts/mega-fresh/mega_fresh-webfont.woff2

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

a6644f79a77967d814c2a50be0bc066aabe8689b2c18480b571a294c525f7f9e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

Referer: https://www.winsim.de/
Origin: https://www.winsim.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Thu, 24 Nov 2016 05:44:14 GMT
server: nginx
etag: "58367e2e-45430"
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 283696
expires: Wed, 08 Nov 2023 01:16:47 GMT

POST
H2 200 csp-reports
www.winsim.de/ 0
5 KB 155ms
155ms Other
text/html 212.227.177.21
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.winsim.de/csp-reports

Requested by

Host: www.duoconsulting.com
URL: http://www.duoconsulting.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.227.177.21 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

212-227-177-21-customer.elastic-ssl.ui-r.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy	default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/csp-report

Response headers

x-content-security-policy: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'
date: Tue, 08 Nov 2022 01:16:47 GMT
content-security-policy: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate, max-age=0, must-revalidate, private
x-webkit-csp: default-src 'self'; object-src 'self' https://pts.winsim.de/p.swf; base-uri 'self'; media-src 'self' https://imagepool.winsim.de; img-src https: data:; font-src https:; form-action 'self' https://www.facebook.com https://connect.facebook.net https://hilfe-center.1und1.de https://var.uicdn.net https://www.tuev-saar.de https://www.trustedshops.de https://umfrage.winsim.de https://pts.winsim.de; connect-src 'self' https://widgets.trustedshops.com https://gw1.api.trustedshops.com https://cdn1.api.trustedshops.com https://cdn2.spatialbuzz.com https://cdn.spatialbuzz.com https://o2-de.spatialbuzz.net https://tags.tiqcdn.com https://collect.tealiumiq.com/event https://collect-eu-central-1.tealiumiq.com https://www.google.com https://www.googleadservices.com https://www.google-analytics.com https://stats.g.doubleclick.net https://adservice.google.com https://cts.communicationads.net https://www.bing.com https://bat.bing.com https://connect.facebook.net https://www.facebook.com https://trck.spoteffects.net https://tracking.drillisch.de https://www.dwin1.com https://www.awin1.com https://www7.smartadserver.com https://1and1internetag.demdex.net https://dpm.demdex.net https://the.sciencebehindecommerce.com https://o2.mouseflow.com https://cdn.mouseflow.com https://cm.everesttech.net https://assets.adobedtm.com https://chat.winsim.de https://stats.winsim.de https://imagepool.winsim.de https://pts.winsim.de; script-src 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'; style-src 'self' 'unsafe-inline' https: data:; frame-ancestors 'self' https://paketshop.myhermes.de; frame-src https://1and1internetag.demdex.net https://bid.g.doubleclick.net https://cdn2.spatialbuzz.com https://connect.facebook.net https://dpm.demdex.net https://paketshop.myhermes.de https://tags.tiqcdn.com https://tpc.googlesyndication.com https://www.awin1.com https://www.facebook.com https://www.youtube-nocookie.com https://pts.winsim.de; child-src https://1and1internetag.demdex.net https://ad13.adfarm1.adition.com https://cdn2.spatialbuzz.com https://dpm.demdex.net https://tags.tiqcdn.com https://trck.spoteffects.net https://www.facebook.com https://www.googleadservices.com https://www.youtube.com; upgrade-insecure-requests; block-all-mixed-content; report-uri /csp-reports; script-src-elem 'strict-dynamic' 'self' 'unsafe-inline' https: 'report-sample'
x-xss-protection: 1; mode=block
expires: Tue, 08 Nov 2022 01:16:47 GMT

GET
H2 200 v46922-page-index-dsl-introbanner-router--mobile-q85-157px.webp
imagepool.winsim.de/v2/global/page/index/dsl/v46922-page-index-dsl-introbanner-router--mobile/ 3 KB
4 KB 52ms
25ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/global/page/index/dsl/v46922-page-index-dsl-introbanner-router--mobile/v46922-page-index-dsl-introbanner-router--mobile-q85-157px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

81baefc33ae7ef0ca5f949a26d529362d92f1b443515fda8fb28f14ba9e21118

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Mon, 17 Oct 2022 08:39:07 GMT
server: nginx
etag: "634d14ab-da4"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 3492
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v45923-page-index-intro_teaser-q85-1720px.webp
imagepool.winsim.de/v2/page/index/intro_teaser/v45923-page-index-intro_teaser/ 60 KB
60 KB 62ms
35ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/intro_teaser/v45923-page-index-intro_teaser/v45923-page-index-intro_teaser-q85-1720px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

4847e22220cc74a6ba9cc9b4c0cfa2747ff58978b6c51f6c677ea48028da554e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Mon, 19 Sep 2022 06:27:50 GMT
server: nginx
etag: "63280be6-eefe"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 61182
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v39155-page-index-intro_teaser-router-q85-197px.webp
imagepool.winsim.de/v2/page/index/intro_teaser/v39155-page-index-intro_teaser-router/ 4 KB
4 KB 84ms
57ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/intro_teaser/v39155-page-index-intro_teaser-router/v39155-page-index-intro_teaser-router-q85-197px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

a3efb8c179b03d746bb08270003c373e242a21171bcb9de2fbdb66655ee9ad49

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Thu, 30 Jun 2022 09:19:04 GMT
server: nginx
etag: "62bd6a88-f00"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 3840
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/drillisch/winsim.de/prod/ 187 KB
52 KB 41ms
18ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.js
Requested by: Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dfe7188df082ee04b83a7925f7d7524e85b7db586d6ad508fe20ae72c502df63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:10:31 GMT
server: AkamaiNetStorage
etag: "697cf336858440a81a68ad1a0d2d0486:1666883431.040299"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
expires: Tue, 08 Nov 2022 01:21:47 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 v36781-page-index-teaser-top-angebot-q85-585px.webp
imagepool.winsim.de/v2/page/index/angebote/v36781-page-index-teaser-top-angebot/ 7 KB
8 KB 18ms
17ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/angebote/v36781-page-index-teaser-top-angebot/v36781-page-index-teaser-top-angebot-q85-585px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

811687a7728ba75819eaf3a05d25725ce53ccf4cf38f506183bca77c643ccd07

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Mon, 21 Mar 2022 14:02:01 GMT
server: nginx
etag: "62388559-1dc8"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 7624
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v39720-page-index-angebote-top-geraete-q85-585px.webp
imagepool.winsim.de/v2/page/index/angebote/v39720-page-index-angebote-top-geraete/ 11 KB
11 KB 22ms
21ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/angebote/v39720-page-index-angebote-top-geraete/v39720-page-index-angebote-top-geraete-q85-585px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

9d066ac572f25398f25f9746dfc39051173b37cdcf0ab1a3ab321b3a28c7eda4

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Thu, 12 May 2022 07:38:47 GMT
server: nginx
etag: "627cb987-2adc"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 10972
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v37006-index-dsl-teaser-q85-1200px.webp
imagepool.winsim.de/v2/page/index/v37006-index-dsl-teaser/ 43 KB
44 KB 26ms
25ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/v37006-index-dsl-teaser/v37006-index-dsl-teaser-q85-1200px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

f427c3789850fb1d473c278991a104103bf4ea2a509b9077b7d16af012183997

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Fri, 25 Mar 2022 14:40:44 GMT
server: nginx
etag: "623dd46c-ac92"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 44178
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v33975-index-dsl-router-q85-230px.webp
imagepool.winsim.de/v2/page/index/v33975-index-dsl-router/ 5 KB
6 KB 31ms
30ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/v33975-index-dsl-router/v33975-index-dsl-router-q85-230px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

37fe8e4911db6a476a10482f18ad087d5d03524d1b252c90bceb6dc39b0309ef

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 03 May 2022 11:44:51 GMT
server: nginx
etag: "627115b3-1580"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 5504
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v23885-page-index-info-lte-fuer-alle-q85-1200px.webp
imagepool.winsim.de/v2/page/index/info/v23885-page-index-info-lte-fuer-alle/ 113 KB
114 KB 37ms
36ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/info/v23885-page-index-info-lte-fuer-alle/v23885-page-index-info-lte-fuer-alle-q85-1200px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

7373fe5ae6a85954666592793a0cc63611f5bb72db48b8fa6bad12243fbd93ea

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 22 Feb 2022 12:51:50 GMT
server: nginx
etag: "6214dc66-1c4c4"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 115908
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
DATA 200
OK truncated
/ 180 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e2bfcec5c5c5d00be31565a6f9480b8fd9f626dec4ad791d9836cdd26299613

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 180 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 391ed16701406ed34e890f8e3810d32f6c2085bb9255e7b1f510269cd23270c2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 v23885-page-index-info-top-smartphones-q85-1200px.webp
imagepool.winsim.de/v2/page/index/info/v23885-page-index-info-top-smartphones/ 138 KB
139 KB 16ms
15ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/page/index/info/v23885-page-index-info-top-smartphones/v23885-page-index-info-top-smartphones-q85-1200px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

7b7f9aa12e15bfc22cbb0e8c8c4ba2b5d7fa1f4a002a9cda8fe7e47ebc39a93b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 22 Feb 2022 12:53:46 GMT
server: nginx
etag: "6214dcda-228e0"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 141536
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v31100-layout-badges-sz-institut-q85-238px.webp
imagepool.winsim.de/v2/layout/badges/v31100-layout-badges-sz-institut/ 9 KB
10 KB 25ms
24ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/layout/badges/v31100-layout-badges-sz-institut/v31100-layout-badges-sz-institut-q85-238px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

988db5eb7b8b8251dacc15564f4109b5c662d9bc4db42c24378b401929b3199a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload; always

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload; always
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
last-modified: Tue, 04 Jan 2022 09:42:21 GMT
server: nginx
etag: "61d4167d-24c2"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 9410
expires: Tue, 08 Nov 2022 01:36:47 GMT

GET
H2 200 v24785-tuev-saarland-geprueftes-onlineportal-q85-588px.webp
imagepool.winsim.de/v2/layout/badges/v24785-tuev-saarland-geprueftes-onlineportal/ 14 KB
15 KB 271ms
270ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/layout/badges/v24785-tuev-saarland-geprueftes-onlineportal/v24785-tuev-saarland-geprueftes-onlineportal-q85-588px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

ed51a01010c676c4b52fcb21cffab1cfa514c6c8a332ca8af49645cb2726426b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests, default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload; always
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Nov 2022 01:16:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload; always
x-content-type-options: nosniff
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests, default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
server: nginx
x-frame-options: deny
content-type: image/webp
access-control-allow-origin: *, *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 08 Nov 2022 01:36:48 GMT

GET
H2 200 v11824-tuev-saarland-q85-588px.webp
imagepool.winsim.de/v2/layout/badges/v11824-tuev-saarland/ 14 KB
14 KB 290ms
289ms Image
image/webp 193.227.192.204
TELIKO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imagepool.winsim.de/v2/layout/badges/v11824-tuev-saarland/v11824-tuev-saarland-q85-588px.webp

Requested by

Host: www.winsim.de
URL: https://www.winsim.de/?refid=23418&drag_vars=1681903705_10874

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

193.227.192.204 , Germany, ASN29037 (TELIKO-AS, DE),

Reverse DNS

imagepool.winsim.de

Software

nginx /

Resource Hash

452e3d2e3b72ffad045c7e384e91a4aa5a3d28af039829f4b71b6c70bfea2c22

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests, default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload; always
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Nov 2022 01:16:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload; always
x-content-type-options: nosniff
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests, default-src https: data: 'unsafe-inline' 'unsafe-eval' always; upgrade-insecure-requests
server: nginx
x-frame-options: deny
content-type: image/webp
access-control-allow-origin: *, *
access-control-expose-headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cache-control: max-age=1200
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 08 Nov 2022 01:36:48 GMT

POST
H2 200 event Show response
collect.tealiumiq.com/ 0
514 B 43ms
7ms XHR
application/json 52.29.0.249
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/event
Requested by: Host: www.duoconsulting.com
URL: http://www.duoconsulting.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.0.249 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-0-249.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.winsim.de/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
x-serverid: uconnect_i-01080fc7061793694
x-tid: 018454cfaf6600199e7e19afdd4500073003d06b00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: drillisch:main:2:event
x-region: eu-central-1
pragma: no-cache
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.winsim.de
x-ulver: 795a515249d2a30af78540619848004f16c77638-SNAPSHOT
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-uuid: 64dad35d-ec11-469e-8560-1c8a84fc390e
expires: Tue, 08 Nov 2022 01:16:47 GMT

GET
H2 200 utag.35.js Show response
tags.tiqcdn.com/utag/drillisch/winsim.de/prod/ 14 KB
5 KB 16ms
16ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.35.js?utv=ut4.46.202005271102
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6fc5d4fdadf41df0b0253e6adbc0c6878ede8d6bfe183cb6e965e328a16ae566

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 08 Nov 2022 01:16:47 GMT
content-encoding: gzip
last-modified: Wed, 27 May 2020 11:02:56 GMT
server: AkamaiNetStorage
etag: "9df23836937027acf8615b0f7f1f2515:1590577376.006447"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4739
expires: Wed, 23 Nov 2022 01:16:47 GMT

POST
H2 200 i.gif Show response
collect-eu-central-1.tealiumiq.com/drillisch/main/2/ 43 B
759 B 45ms
9ms XHR
image/gif 18.197.246.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collect-eu-central-1.tealiumiq.com/drillisch/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.35.js?utv=ut4.46.202005271102
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.246.176 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-246-176.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.winsim.de/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB2tk8b0crvDDUCMA

Response headers

date: Tue, 08 Nov 2022 01:16:47 GMT
x-serverid: uconnect_i-0ebe07b93fb7f49f0
x-tid: 018454cfaf6600199e7e19afdd4500073003d06b00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: drillisch:main:2:datacloud
x-region: eu-central-1
content-length: 43
pragma: no-cache
x-did: 018454cfaf6600199e7e19afdd4500073003d06b00b08
vary: Origin
content-type: image/gif
access-control-allow-origin: https://www.winsim.de
x-ulver: 795a515249d2a30af78540619848004f16c77638-SNAPSHOT
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-uuid: e90d2d97-028f-4126-bb83-20b45f5b555f
expires: Tue, 08 Nov 2022 01:16:47 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
216 B 9ms
9ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=drillisch/winsim.de/202210271510&cb=1667870207908
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 08 Nov 2022 01:16:47 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Tue, 08 Nov 2022 01:26:47 GMT

GET
H2 200 018454cfaf6600199e7e19afdd4500073003d06b00b08 Show response
visitor-service-eu-central-1.tealiumiq.com/drillisch/main/ 774 B
992 B 53ms
9ms Script
application/javascript 35.158.248.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-eu-central-1.tealiumiq.com/drillisch/main/018454cfaf6600199e7e19afdd4500073003d06b00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1667870207955

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/drillisch/winsim.de/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.158.248.117 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-158-248-117.eu-central-1.compute.amazonaws.com

Software

Resource Hash

3d60743a36f16a7e52e1b6b218a244a0c364c3a3de9a20f0589f23e63d442d3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winsim.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-version: 795a515249d2a30af78540619848004f16c77638-SNAPSHOT
date: Tue, 08 Nov 2022 01:16:48 GMT
strict-transport-security: max-age=31536000; includeSubdomains
x-region: eu-central-1
content-length: 774
x-nodeid: i-0346d2d330681e752
content-type: application/javascript; charset=utf-8

Verdicts & Comments Add Verdict or Comment

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mybettermb.com/	1970-01-20 11:37:02	Name: rhid Value: 82328109135
.mybettermb.com/	1970-01-20 07:17:53	Name: loi Value: ad_1311971_off_755165_aff_14470_cid_237996-DUOCONSULTING.COM_ts_1667870206
mghnhfvz.com/	1970-01-20 08:01:02	Name: ClickDataNG Value: H4sIAAAAAAAA_2RU227jNhD9FWGedrGKTFk3Wwthkdppt0jsLZqkeekLLY5twhIpDCllvZd_LygqidF9sufCmTMz5-g7DEhGagUlxBGLGIRgzx1CyUIw_e7h5X-t1YBkUUC5543BEOpG1qc_BZSwW_K5TfSxnecdhCC4RSjjPC8WBZuzPISatx2XB-WykzhdLkOQZvXX9Wst0pZbqceEvMiyEKhv0FksBEIhCWu7QXvUAsosBKN7qsf4IoSGKyHVYcqerEdqoAQIQe_3SC62TNI0hB1xVR-n3DHmM4_WdqaczQbZobGa0ES1bmeNVCfzSYrnKlvkxb89Y_Pc9Dspqv8NXWtjoWQRY25gwgFV7zfX8bPu7Vu_VU-Eqj5DCY_3awihJ3kBoD0c1XE_fBvbjzv-ZGmQohoX5xGMbimqxTJb5hnLsiz3AQfMY_D2Cc_PmkQlel1rZfrGSnVwlX34gLpa30w1pxsp3mL1JNW9bK_WN1dr3XKprv7-svVpAgdZY7VGc7K68z5t3AOhn82HmE1ASD8bpGp1JN3ih5gVL12IJFL1uL3dfnmaavprVmnKsjRZzBcQguyuhSA0xvEyWUTxchm5n2R-Gcz9iXuDdH1AZaGEjf4mm4bPsogF7yZUwfYhiFnEPgZPUuXpx-Brnr4PrruuwSfc3Uo7y5IiSvLg3e3nh81dGDTyhMEfWJ_0-8BPMItZEbEoS1gaLYrgnu85yekZuHvvkZA8HL-iV-VoN8OExPHR_POmOCe3aVVQgm_1WuE34kpcltxogc2lY8tb9Hbt28FKU6fJCdBJrIMS1txyd9vgTrbS6ddxtVeWHAHXNyP4g4ezvvnx4zMa4x7X0p4n1-_E1Wnfkw14G2y4VOBITajsyvFwkhnJg1R33YXLEleG117XBkrVN00IdW-sbqH8PkkGPF8hBPxqkRRvxm_KBbUhhIH5kkMMJfxCZheYv0wzJH7dv_DXxVKX5anrzOztMsF4iyF_PUMQs8J5CqdTz1ZnLqCEN6L-_PlfAAAA__9_P3CbQQUAAA==
mghnhfvz.com/	1970-01-20 08:01:02	Name: ClickDataNgFall Value: H4sIAAAAAAAA_2RU227jNhD9FWGedrGKTFk3Wwthkdppt0jsLZqkeekLLY5twhIpDCllvZd_LygqidF9sufCmTMz5-g7DEhGagUlxBGLGIRgzx1CyUIw_e7h5X-t1YBkUUC5543BEOpG1qc_BZSwW_K5TfSxnecdhCC4RSjjPC8WBZuzPISatx2XB-WykzhdLkOQZvXX9Wst0pZbqceEvMiyEKhv0FksBEIhCWu7QXvUAsosBKN7qsf4IoSGKyHVYcqerEdqoAQIQe_3SC62TNI0hB1xVR-n3DHmM4_WdqaczQbZobGa0ES1bmeNVCfzSYrnKlvkxb89Y_Pc9Dspqv8NXWtjoWQRY25gwgFV7zfX8bPu7Vu_VU-Eqj5DCY_3awihJ3kBoD0c1XE_fBvbjzv-ZGmQohoX5xGMbimqxTJb5hnLsiz3AQfMY_D2Cc_PmkQlel1rZfrGSnVwlX34gLpa30w1pxsp3mL1JNW9bK_WN1dr3XKprv7-svVpAgdZY7VGc7K68z5t3AOhn82HmE1ASD8bpGp1JN3ih5gVL12IJFL1uL3dfnmaavprVmnKsjRZzBcQguyuhSA0xvEyWUTxchm5n2R-Gcz9iXuDdH1AZaGEjf4mm4bPsogF7yZUwfYhiFnEPgZPUuXpx-Brnr4PrruuwSfc3Uo7y5IiSvLg3e3nh81dGDTyhMEfWJ_0-8BPMItZEbEoS1gaLYrgnu85yekZuHvvkZA8HL-iV-VoN8OExPHR_POmOCe3aVVQgm_1WuE34kpcltxogc2lY8tb9Hbt28FKU6fJCdBJrIMS1txyd9vgTrbS6ddxtVeWHAHXNyP4g4ezvvnx4zMa4x7X0p4n1-_E1Wnfkw14G2y4VOBITajsyvFwkhnJg1R33YXLEleG117XBkrVN00IdW-sbqH8PkkGPF8hBPxqkRRvxm_KBbUhhIH5kkMMJfxCZheYv0wzJH7dv_DXxVKX5anrzOztMsF4iyF_PUMQs8J5CqdTz1ZnLqCEN6L-_PlfAAAA__9_P3CbQQUAAA==
vipestores.com/	1970-01-20 07:17:57	Name: XSRF-TOKEN Value: eyJpdiI6Iis5d2V0SHJJT2VrcVdMc3dxYk0xaGc9PSIsInZhbHVlIjoiVlBWVmR2OElEVFBSTHlVVDZPUTR0R1VGZjBVM1I4SmRINlJ1a016V295TE5vNWEwL3I4ZVdqSkJLN3hDUVEwayIsIm1hYyI6ImNjNmU3OWJmZjFmZTQ1MDJiZjg2YzkzOTRhOWE0ZjA4MDUxZGRhNjI3ZDhhMDhlYzcwN2M3NDFhMDQ2MmFkNGMifQ%3D%3D
vipestores.com/	1970-01-20 07:17:57	Name: vipstores_session Value: eyJpdiI6Ik5rczlDemNhNzNpSnpDWE9ua0tudVE9PSIsInZhbHVlIjoiV3BFUHdRanBMb2xXMzV4WU4zaTVkdG1VR3MzVFFvakJkcmhVbldOR1p3a3BPS3hJbW5EWHUveVZFTXRhN3gydCIsIm1hYyI6Ijc2MzM5NGE5N2VjMTgyMzJhNDVlOWRmNmUzNzRhZjNmNzc5YWQ2OGIxN2JlY2MwMTk3YzFmOTQ5YzEwZTMyNTIifQ%3D%3D
.srvtrck.com/	1970-01-20 16:03:26	Name: ykuid Value: 464be0b4e47f4ff4a252063f70f4a151
.communicationads.net/	1970-01-20 08:52:52	Name: pp120 Value: 1681903705
.communicationads.net/	1970-01-20 08:52:52	Name: ppb120 Value: 1681903705
www.winsim.de/	1970-01-20 07:17:53	Name: DPX Value: v1:m/f8Wnq0uH:lfUQklPB:6369bc14:de
www.winsim.de/	1969-12-31 23:59:59	Name: winsim Value: irojf78ijqa940sr659eedoofd
.winsim.de/	1970-01-20 08:52:52	Name: refid Value: 23418
.winsim.de/	1970-01-20 08:52:52	Name: partnerid Value: 23418
.winsim.de/	1970-01-20 08:52:52	Name: drag_vars Value: 1681903705_10874
.winsim.de/	1970-01-20 09:41:50	Name: winsim_variation Value: 260%3A302
.tealiumiq.com/	1970-01-20 16:03:26	Name: TAPID Value: drillisch/main>018454cfaf6600199e7e19afdd4500073003d06b00b08\|
.winsim.de/	1970-01-20 16:03:26	Name: utag_main Value: v_id:018454cfaf6600199e7e19afdd4500073003d06b00b08$_sn:1$_se:1$_ss:1$_st:1667872009877$ses_id:1667870207846%3Bexp-session$_pn:1%3Bexp-session$consentsplit:consent-layer%3Bexp-session$qualifiedvisit:false%3Bexp-session$dc_visit:1$dc_event:1%3Bexp-session$dc_region:eu-central-1%3Bexp-session

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

collect-eu-central-1.tealiumiq.com
collect.tealiumiq.com
imagepool.winsim.de
mghnhfvz.com
mybettermb.com
p237996.mybettermb.com
r.srvtrck.com
tags.tiqcdn.com
vipestores.com
visitor-service-eu-central-1.tealiumiq.com
www.communicationads.net
www.duoconsulting.com
www.winsim.de
104.75.88.194
108.168.193.189
18.197.246.176
193.227.192.204
212.227.177.21
2606:4700::6813:a860
2a01:488:42:1000:b24d:7590:ff6e:e399
2a06:98c1:3120::3
3.125.239.17
35.158.248.117
52.29.0.249
69.16.230.227
1ef100075419c40050f5c86c157cc04c2100bddf56e2e2ef8d501f943dae2b6e
37fe8e4911db6a476a10482f18ad087d5d03524d1b252c90bceb6dc39b0309ef
391ed16701406ed34e890f8e3810d32f6c2085bb9255e7b1f510269cd23270c2
3d60743a36f16a7e52e1b6b218a244a0c364c3a3de9a20f0589f23e63d442d3a
452e3d2e3b72ffad045c7e384e91a4aa5a3d28af039829f4b71b6c70bfea2c22
4847e22220cc74a6ba9cc9b4c0cfa2747ff58978b6c51f6c677ea48028da554e
5843cc4eeeebd4ba92b08ed7602a984251db9bbde44fc13e05c020b8b6bf346e
5a6cfe6493050e65aaf17421c394af6673dffd280cc66ee33cee80f179429788
6fc5d4fdadf41df0b0253e6adbc0c6878ede8d6bfe183cb6e965e328a16ae566
7373fe5ae6a85954666592793a0cc63611f5bb72db48b8fa6bad12243fbd93ea
7b7f9aa12e15bfc22cbb0e8c8c4ba2b5d7fa1f4a002a9cda8fe7e47ebc39a93b
811687a7728ba75819eaf3a05d25725ce53ccf4cf38f506183bca77c643ccd07
81baefc33ae7ef0ca5f949a26d529362d92f1b443515fda8fb28f14ba9e21118
988db5eb7b8b8251dacc15564f4109b5c662d9bc4db42c24378b401929b3199a
9d066ac572f25398f25f9746dfc39051173b37cdcf0ab1a3ab321b3a28c7eda4
9e2bfcec5c5c5d00be31565a6f9480b8fd9f626dec4ad791d9836cdd26299613
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a3efb8c179b03d746bb08270003c373e242a21171bcb9de2fbdb66655ee9ad49
a637c66a0760a4d4147f21eb9b1b83ffbe6e7621a3da2ff8e8ee0642e73f868d
a6644f79a77967d814c2a50be0bc066aabe8689b2c18480b571a294c525f7f9e
a7e5061977c34ddf194f7f1582be72f46093f79695201cfc1b6b34909e74eb5b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
cb3da004a9ce6962fc662d9b9f1b3edc85eec274d8cdf3ac103ed864ed81a138
dcb6e56b18d1cb7c115d23f93cf97247446a24cd0e69826c0497decd64eb7ff0
dfe7188df082ee04b83a7925f7d7524e85b7db586d6ad508fe20ae72c502df63
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed51a01010c676c4b52fcb21cffab1cfa514c6c8a332ca8af49645cb2726426b
f427c3789850fb1d473c278991a104103bf4ea2a509b9077b7d16af012183997

www.winsim.de Open in urlscan Pro 212.227.177.21 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

33 Requests

94 %HTTPS

25 %IPv6

9 Domains

13 Subdomains

12 IPs

2 Countries

1096 kBTransfer

2141 kBSize

17 Cookies

6 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.winsim.de Open in urlscan Pro
212.227.177.21 Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

94 %
HTTPS

25 %
IPv6

9
Domains

13
Subdomains

12
IPs

2
Countries

1096 kB
Transfer

2141 kB
Size

17
Cookies

33 HTTP transactions
3 data transactions