turf3615.1sturf.com Open in urlscan Pro
194.150.236.236 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://turf3615.1sturf.com/
Submission: On May 24 via manual (May 24th 2022, 9:20:53 pm UTC) from ML — Scanned from FR

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 16 domains to perform 27 HTTP transactions. The main IP is 194.150.236.236, located in France and belongs to HIWIT_AS, FR. The main domain is turf3615.1sturf.com.

This is the only time turf3615.1sturf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	194.150.236.236 194.150.236.236	44976 (HIWIT_AS) (HIWIT_AS)
9	194.150.236.165 194.150.236.165	44976 (HIWIT_AS) (HIWIT_AS)
2 5	2a06:98c1:312... 2a06:98c1:3120::a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	173.225.100.28 173.225.100.28	19318 (IS-AS-1) (IS-AS-1)
2 4	194.150.236.190 194.150.236.190	44976 (HIWIT_AS) (HIWIT_AS)
1	91.121.164.142 91.121.164.142	16276 (OVH) (OVH)
1	194.150.236.5 194.150.236.5	44976 (HIWIT_AS) (HIWIT_AS)
4	185.119.26.1 185.119.26.1	203544 (WEBDEVIIN-AS) (WEBDEVIIN-AS)
1	194.0.255.28 194.0.255.28	8218 (NEO-ASN l...) (NEO-ASN legacy Neotelecoms)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
27	12

2 194.150.236.236 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns76.hiwit.net

turf3615.1sturf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.biltoturf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 194.150.236.165 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns5.hiwit.net

www.pronoscourse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.levainqueur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a06:98c1:3120::a (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

img.root-top.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.225.100.28 (United States)

ASN19318 (IS-AS-1, US)

turftriomphe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 194.150.236.190 (France) 2 redirects

ASN44976 (HIWIT_AS, FR)
PTR: ns30.hiwit.net

www.turfsur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zetop.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zetop.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.snprono.powa.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.121.164.142 (France)

ASN16276 (OVH, FR)
PTR: ns360576.ip-91-121-164.eu

nsm05.casimages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.150.236.5 (France)

ASN44976 (HIWIT_AS, FR)
PTR: ns.allo-heberge.com

ns.allo-heberge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.119.26.1 (France)

ASN203544 (WEBDEVIIN-AS, FR)
PTR: 1.26.119.185.in-addr.arpa

payment.allopass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.0.255.28 (France)

ASN8218 (NEO-ASN legacy Neotelecoms, FR)
PTR: srv28.bdmultimedia.fr

script.starpass.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pronoscourse.com www.pronoscourse.com	241 KB
5	root-top.com 2 redirects img.root-top.com	22 KB
4	allopass.com payment.allopass.com	11 KB
2	zetop.info 1 redirects zetop.info www.zetop.info	11 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	20 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71	39 KB
1	starpass.fr script.starpass.fr	286 B
1	allo-heberge.com ns.allo-heberge.com
1	powa.fr 1 redirects www.snprono.powa.fr	282 B
1	casimages.com nsm05.casimages.com	9 KB
1	biltoturf.com www.biltoturf.com	6 KB
1	turfsur.com www.turfsur.com	12 KB
1	levainqueur.com www.levainqueur.com	28 KB
1	turftriomphe.com turftriomphe.com	77 KB
1	1sturf.com turf3615.1sturf.com	635 B
0	gambling-affiliation.com Failed www.gambling-affiliation.com Failed
27	16

	Domain	Requested by
8	www.pronoscourse.com	turf3615.1sturf.com www.pronoscourse.com
5	img.root-top.com	2 redirects www.pronoscourse.com
4	payment.allopass.com	www.pronoscourse.com payment.allopass.com
1	www.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	payment.allopass.com
1	script.starpass.fr	www.pronoscourse.com
1	ns.allo-heberge.com	www.pronoscourse.com
1	www.snprono.powa.fr	1 redirects
1	nsm05.casimages.com	www.pronoscourse.com
1	www.biltoturf.com	www.pronoscourse.com
1	www.zetop.info	www.pronoscourse.com
1	zetop.info	1 redirects
1	www.turfsur.com	www.pronoscourse.com
1	www.levainqueur.com	www.pronoscourse.com
1	turftriomphe.com	www.pronoscourse.com
1	turf3615.1sturf.com
0	www.gambling-affiliation.com Failed	www.pronoscourse.com
27	17

This site contains no links.

Subject Issuer	Validity	Valid
pronoscourse.com R3	`2022-04-07` - `2022-07-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
turftriomphe.com cPanel, Inc. Certification Authority	`2021-09-08` - `2021-12-07`	3 months	crt.sh
levainqueur.com R3	`2022-04-07` - `2022-07-06`	3 months	crt.sh
turfsur.com R3	`2022-04-05` - `2022-07-04`	3 months	crt.sh
biltoturf.com R3	`2022-04-19` - `2022-07-18`	3 months	crt.sh
*.allopass.com Gandi Standard SSL CA 2	`2021-10-08` - `2022-10-08`	a year	crt.sh
script.starpass.fr ZeroSSL RSA Domain Secure Site CA	`2022-05-24` - `2022-08-22`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://turf3615.1sturf.com/
Frame ID: 84D3E1252127BA5BAF27A324D39E7569
Requests: 1 HTTP requests in this frame

Frame: https://www.pronoscourse.com/turf/3615turf/
Frame ID: E4741BB3F52593249D8E542DA086EFAA
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

3615 TURF

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Page Statistics

27
Requests

78 %
HTTPS

27 %
IPv6

16
Domains

17
Subdomains

12
IPs

3
Countries

476 kB
Transfer

569 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://zetop.info/img/logo_zetop.gif HTTP 301
https://www.zetop.info/img/logo_zetop.gif

Request Chain 9

https://img.root-top.com/topsite/ficebook/banner.gif HTTP 302
https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

Request Chain 12

https://img.root-top.com/topsite/secreturf/banner.gif HTTP 302
https://www.snprono.powa.fr/secreturf.gif HTTP 302
https://ns.allo-heberge.com/

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
turf3615.1sturf.com/ 414 B
635 B 85ms
48ms Document
text/html 194.150.236.236
HIWIT_AS

General

Check archive.org

Show headers Download Go to

Full URL: http://turf3615.1sturf.com/
Protocol: HTTP/1.1
Server: 194.150.236.236 , France, ASN44976 (HIWIT_AS, FR),
Reverse DNS: ns76.hiwit.net
Software: Apache /
Resource Hash: 67d41c1e688392df7aaee69f818bb4d002d27adb395ae422dff8cb901dd44e16

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 May 2022 21:20:49 GMT
Keep-Alive: timeout=15, max=100
Server: Apache
Transfer-Encoding: chunked
Vary: Host

GET
H/1.1 200
OK / Show response
www.pronoscourse.com/turf/3615turf/ Frame E474 10 KB
11 KB 126ms
47ms Document
text/html 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pronoscourse.com/turf/3615turf/

Requested by

Host: turf3615.1sturf.com
URL: http://turf3615.1sturf.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

88da8b0f0de25032dd58636368386cd0d85f3f2e679db683f93631ee665500ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://turf3615.1sturf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html
Date: Tue, 24 May 2022 21:20:49 GMT
Keep-Alive: timeout=15, max=100
Server: Apache
Strict-Transport-Security: max-age=15768000
Transfer-Encoding: chunked
Vary: Host

GET
H/1.1 200
OK h1.png
www.pronoscourse.com/turf/3615turf/ Frame E474 38 KB
38 KB 24ms
20ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h1.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

1cd686935fd8522adbb341859df741b4284e46a532918d9d708867ccdc19e454

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:07 GMT
Server: Apache
ETag: "194d9cb-9681-55742b56f94c0"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 38529

GET
H/1.1 200
OK head.jpg
www.pronoscourse.com/turf/3615turf/ Frame E474 61 KB
61 KB 69ms
19ms Image
image/jpeg 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/head.jpg

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

09f5a6c9114102b27434d90a2d508df76a02d91edffcc3d94f6b4a85841ac00d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:18 GMT
Server: Apache
ETag: "194d9ce-f416-55742b6176d80"
Vary: Host
Content-Type: image/jpeg
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 62486

GET
H2 200 banner.gif
img.root-top.com/topsite/lavoyante/ Frame E474 7 KB
7 KB 114ms
57ms Image
image/gif 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/lavoyante/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7684c04888ca98dc344012047da584c5d8d283644788eb4f79c6de4e9d42833

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 24 May 2022 21:20:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 30362
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6899
last-modified: Tue, 24 May 2022 12:54:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XrrDge6ukxcItY1HtPxnLGGz2jM2wI9J5y7H%2Bxj1V01uwSc9NBz6bCeZACWegeIpvjONPGOpSi5J0nsreVEsTQkn3DIFZukJY%2F0KQeFPrQVp1yzuJ1DT%2F5L2A9f7Ea4MCGGnqKro5OC3nBjk6x1e"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 710913d53d5b40f3-CDG
expires: Fri, 27 May 2022 12:54:47 GMT

GET
H2 200 logo2.gif
turftriomphe.com/lien/ Frame E474 77 KB
77 KB 948ms
172ms Image
image/gif 173.225.100.28
IS-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turftriomphe.com/lien/logo2.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.225.100.28 , United States, ASN19318 (IS-AS-1, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 7adb98959fb28df7c99082b45bbf1f1f75b818282b220ea5c86b667912aa402d

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 24 May 2022 21:20:50 GMT
last-modified: Tue, 03 Nov 2015 11:59:38 GMT
server: LiteSpeed
content-type: image/gif
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 78622
expires: Tue, 31 May 2022 21:20:50 GMT

GET
H/1.1 200
OK logo.gif
www.levainqueur.com/ Frame E474 28 KB
28 KB 123ms
22ms Image
image/gif 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.levainqueur.com/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

6270f4fc23be1ddceb334705172b0470d61d28d201fcc23402dbdc8bac85bdc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Tue, 13 Oct 2015 12:36:31 GMT
Server: Apache
ETag: "e76ccd-70a5-521fbb20911c0"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 28837

GET
H/1.1 200
OK logo.gif
www.turfsur.com/img/ Frame E474 11 KB
12 KB 127ms
20ms Image
image/gif 194.150.236.190
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.turfsur.com/img/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.190 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns30.hiwit.net

Software

Apache /

Resource Hash

9bd0c1e96f9d3b63b53ba8c355ada916479d8815034cab0aad1540c3c602d896

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 05 Mar 2018 05:51:23 GMT
Server: Apache
ETag: "878aad-2cb9-566a3ea782cc0"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Content-Length: 11449

GET
H/1.1

200
OK

logo_zetop.gif
www.zetop.info/img/ Frame E474
Redirect Chain

https://zetop.info/img/logo_zetop.gif
https://www.zetop.info/img/logo_zetop.gif

11 KB
11 KB

1368ms
21ms

Image
image/gif

194.150.236.190
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zetop.info/img/logo_zetop.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Server

194.150.236.190 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns30.hiwit.net

Software

Apache /

Resource Hash

7c9a501ff24c88a1c67c41a92315b5c7b94e19bed6381da81631f691e501a8be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:50 GMT
Last-Modified: Thu, 06 Jun 2013 09:17:28 GMT
Server: Apache
ETag: "64570c-2ac9-4de78c87e3a00"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Content-Length: 10953

Redirect headers

Date: Tue, 24 May 2022 21:20:49 GMT
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html; charset=iso-8859-1
Location: https://www.zetop.info/img/logo_zetop.gif
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 249

GET
H/1.1 200
OK logo.gif
www.biltoturf.com/ Frame E474 6 KB
6 KB 104ms
22ms Image
image/gif 194.150.236.236
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.biltoturf.com/logo.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.236 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns76.hiwit.net

Software

Apache /

Resource Hash

ead7dff95228a235e92f3cc50bcd67d3e448ccb40cee683514504e8a59aa8f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Sat, 24 Apr 2021 03:49:26 GMT
Server: Apache
ETag: "2563ddd-165f-5c0afcc7b5d80"
Vary: Host
Content-Type: image/gif
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 5727

GET
H/1.1

200
OK

1110070340161338798861456.gif
nsm05.casimages.com/img/2011/10/07/ Frame E474
Redirect Chain

https://img.root-top.com/topsite/ficebook/banner.gif
https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

8 KB
9 KB

93ms
16ms

Image
image/gif

91.121.164.142
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Server

91.121.164.142 , France, ASN16276 (OVH, FR),

Reverse DNS

ns360576.ip-91-121-164.eu

Software

Apache /

Resource Hash

c208d77e0e089f3e3b6e76a7811758dc5fe21725e55e37d22d54a878cefec06c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:26:50 GMT
Last-Modified: Thu, 14 Jan 2016 06:35:23 GMT
Server: Apache
ETag: "9c6610d-219d-529457dc380c0"
Strict-Transport-Security: max-age=31556926
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.casimages.com
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8605
Expires: Wed, 24 May 2023 21:26:50 GMT

Redirect headers

date: Tue, 24 May 2022 21:20:49 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FTypBcyZ7oqp3yeorsaTtm7lOFBf2MATZFRBIfSUtAUEXLNywvPk7eg69HasqLZanTqoOC%2FfCNxHWb9RcdnEWN4w09opLiA3hVnSaU%2FhfXIiEhp8Cs43uxAALIfXcfFj1ZMfzMC1hJcxZ71hnDRM"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: http://nsm05.casimages.com/img/2011/10/07/1110070340161338798861456.gif
cf-ray: 710913d53d4e40f3-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 banner.gif
img.root-top.com/topsite/turfistes/ Frame E474 10 KB
10 KB 94ms
47ms Image
image/gif 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/turfistes/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cccb4032a92544df0c4b8ad151530e7b8baf342a96ba817f8f8b1ca335fd0ad

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 24 May 2022 21:20:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 92794
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9828
last-modified: Mon, 23 May 2022 19:34:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yHugy%2BMvY7cRWa6dD%2F7qhzO9MFtPO4rFsON0kF27xJ9%2BRxGzFijinb9Iri%2F4pbTanjybKX7gjXDW7iAtTdTL%2BLCidTmAgXnW3HaSbYIvQbHxkVGfSWtVXFGiZNdjXaOGW6tfvZonapLkbBi6Ck2T"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 710913d53d4f40f3-CDG
expires: Thu, 26 May 2022 19:34:15 GMT

GET
H2 200 banner.gif
img.root-top.com/topsite/turfplus/ Frame E474 4 KB
4 KB 95ms
47ms Image
image/png 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.root-top.com/topsite/turfplus/banner.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c89138fe4d60f677872fa14679dd7d6807b9f614bd62beb3ffc112f082442b8d

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 24 May 2022 21:20:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6828
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3872
last-modified: Wed, 14 Sep 2011 18:49:04 GMT
server: cloudflare
etag: "510718442"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0QBi9JGMJAAaUMJPKZWZ80%2B8F6boutYou6aUkl1f%2BbLRbXVo8wzsAXD9SBTC72mrZS0kcsVEb6S%2BnjgtUkuaQh5yyy%2B6melz2SkrjLBf9q78ni7e0sg6uQ3cBLjNThDaoCij%2BkcgykmW4%2Fq7lJtc"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 710913d53d5140f3-CDG
expires: Mon, 16 Aug 2021 22:46:50 GMT

GET
H/1.1

200
OK

/
ns.allo-heberge.com/ Frame E474
Redirect Chain

https://img.root-top.com/topsite/secreturf/banner.gif
https://www.snprono.powa.fr/secreturf.gif
https://ns.allo-heberge.com/

0
0

121ms
21ms

Image
text/html

194.150.236.5
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ns.allo-heberge.com/
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Server: 194.150.236.5 , France, ASN44976 (HIWIT_AS, FR),
Reverse DNS: ns.allo-heberge.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

Date: Tue, 24 May 2022 21:20:50 GMT
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html; charset=iso-8859-1
Location: http://ns.allo-heberge.com/
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 211

GET
H/1.1 200
OK checkout.apu Show response
payment.allopass.com/buy/ Frame E474 11 KB
4 KB 516ms
393ms Script
text/html 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: ea65817ee06d4a23cc99815ee02ada0b64769285ef8757d24931d1ffd9378fc6

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 May 2022 21:20:49 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP='NON NID OTPa OUR NOR' policy-ref='http://payment.allopass.com/info/p3p/policy-references.xml'
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html
Content-Length: 2961
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK script.php Show response
script.starpass.fr/ Frame E474 20 B
286 B 158ms
39ms Script
text/html 194.0.255.28
NEO-ASN legacy Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://script.starpass.fr/script.php?idd=433566&datas=
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.0.255.28 , France, ASN8218 (NEO-ASN legacy Neotelecoms, FR),
Reverse DNS: srv28.bdmultimedia.fr
Software: Apache /
Resource Hash: 65e35c6ae1f74e16cbe663763323963eec7c6a22512042ab0758bd68151934a1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:17 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 40

GET
H/1.1 200
OK victoire.jpg
www.pronoscourse.com/turf/3615turf/ Frame E474 27 KB
27 KB 58ms
20ms Image
image/jpeg 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/victoire.jpg

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

3860e27e99358de8ad6acb927762f09f6900304d7140042c23d7586e9565d7ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:51 GMT
Server: Apache
ETag: "194d9d4-6bb9-55742b80ef7c0"
Vary: Host
Content-Type: image/jpeg
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 27577

GET
H/1.1 200
OK h3.png
www.pronoscourse.com/turf/3615turf/ Frame E474 38 KB
38 KB 26ms
20ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h3.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

02efc6cd18465bb07e5ae600e17b189ff274e97d1ce2ca95694a6268f84ac3a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:16 GMT
Server: Apache
ETag: "194d9cd-96a6-55742b5f8e900"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 38566

GET
H/1.1 200
OK /
www.pronoscourse.com/turf/3615turf/ Frame E474 1 KB
1 KB 74ms
47ms Image
text/html 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Vary: Host
Server: Apache
Strict-Transport-Security: max-age=15768000
Content-Type: text/html
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100

GET
H/1.1 200
OK h2.png
www.pronoscourse.com/turf/3615turf/ Frame E474 27 KB
28 KB 47ms
20ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/h2.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

dcde21057bf448c3ce030ee91d5ed7e8b32ff3f4e2760bce988d17164441153b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:13 GMT
Server: Apache
ETag: "194d9cc-6d5b-55742b5cb2240"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 27995

GET
H/1.1 200
OK date.png
www.pronoscourse.com/turf/3615turf/ Frame E474 36 KB
37 KB 52ms
20ms Image
image/png 194.150.236.165
HIWIT_AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pronoscourse.com/turf/3615turf/date.png

Requested by

Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.150.236.165 , France, ASN44976 (HIWIT_AS, FR),

Reverse DNS

ns5.hiwit.net

Software

Apache /

Resource Hash

5bebe6f273dbd0db76f40e3533f48d3c3dbf0f5ef1a3df861447a580d35c145b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/turf/3615turf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Mon, 21 Aug 2017 12:35:04 GMT
Server: Apache
ETag: "194d9ca-90d5-55742b541ce00"
Vary: Host
Content-Type: image/png
Connection: Keep-Alive
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 37077

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame E474 101 KB
39 KB 96ms
35ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NHFGDSD

Requested by

Host: payment.allopass.com
URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a09ee09ecf00abf09122968e5c346385a06c4814681dd9406080b13c009804f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 24 May 2022 21:20:49 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39764
x-xss-protection: 0
last-modified: Tue, 24 May 2022 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 24 May 2022 21:20:49 GMT

GET
H/1.1 200
OK buy-button.css
payment.allopass.com/static/css/ Frame E474 2 KB
830 B 58ms
20ms Stylesheet
text/css 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.allopass.com/static/css/buy-button.css?1
Requested by: Host: payment.allopass.com
URL: https://payment.allopass.com/buy/checkout.apu?ids=316937&idd=1378513&lang=fr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: 95eb15e76b752a9c78d6281cd3b7c43a8fbc2931783edf3bf3703af55eff06e2

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Nov 2021 13:36:55 GMT
Server: Apache
ETag: "24bbe-69a-5d0e804cbabc0"
Vary: Accept-Encoding
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 546

GET
H/1.1 200
OK 162x56.png
payment.allopass.com/static/buy/button/fr/ Frame E474 6 KB
6 KB 59ms
21ms Image
image/png 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://payment.allopass.com/static/buy/button/fr/162x56.png
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: 7dd9659e56e92abc376e04d427903b2cfca1d52d854d38e35fefa4cf9e7fd9db

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Tue, 16 Nov 2021 13:36:55 GMT
Server: Apache
ETag: "218f3-1688-5d0e804cbabc0"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 5768

GET v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s=
www.gambling-affiliation.com/cpm/ Frame E474 0
0

GET
H/1.1 200
OK bt_ok.gif
payment.allopass.com/imgweb/common/ Frame E474 753 B
991 B 68ms
21ms Image
image/gif 185.119.26.1
WEBDEVIIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://payment.allopass.com/imgweb/common/bt_ok.gif
Requested by: Host: www.pronoscourse.com
URL: https://www.pronoscourse.com/turf/3615turf/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.119.26.1 , France, ASN203544 (WEBDEVIIN-AS, FR),
Reverse DNS: 1.26.119.185.in-addr.arpa
Software: Apache /
Resource Hash: d1d6b5efe0d6c2540778435a8f7873cbec1eb76a2b107370388a8806cb5dda6a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Tue, 24 May 2022 21:20:49 GMT
Last-Modified: Tue, 26 Nov 2019 14:39:46 GMT
Server: Apache
ETag: "22a09-2f1-59840d9fb3080"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 753

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame E474 49 KB
20 KB 86ms
26ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NHFGDSD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.pronoscourse.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 6364
date: Tue, 24 May 2022 19:34:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 24 May 2022 21:34:46 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.gambling-affiliation.com
URL: http://www.gambling-affiliation.com/cpm/v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s=

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			payment.allopass.com/	1969-12-31 23:59:59	Name: ShopSessionId Value: 161c9b15-2e22-42cd-bc7e-1e93b08f5b64
			.allopass.com/	1970-01-20 12:02:43	Name: AP_CUSK Value: 3569275619

19 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://turftriomphe.com/lien/logo2.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.levainqueur.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.turfsur.com/img/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://zetop.info/img/logo_zetop.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.biltoturf.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/ficebook/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfistes/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfplus/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/secreturf/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://turftriomphe.com/lien/logo2.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.levainqueur.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.turfsur.com/img/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://zetop.info/img/logo_zetop.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://www.biltoturf.com/logo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/ficebook/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfistes/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/turfplus/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.pronoscourse.com/turf/3615turf/(Line 161) Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure element 'http://img.root-top.com/topsite/secreturf/banner.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://www.pronoscourse.com/turf/3615turf/ Message: Mixed Content: The page at 'https://www.pronoscourse.com/turf/3615turf/' was loaded over HTTPS, but requested an insecure script 'http://www.gambling-affiliation.com/cpm/v=wFzycuy7.tL9Laz1nj8STDQ3Wrm06aNGFmrmcGGK6OC6rZt83-RBt4nacHiUs1xBT.GkYC1esWuVAwDMp3oFEA__&s='. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img.root-top.com
ns.allo-heberge.com
nsm05.casimages.com
payment.allopass.com
script.starpass.fr
turf3615.1sturf.com
turftriomphe.com
www.biltoturf.com
www.gambling-affiliation.com
www.google-analytics.com
www.googletagmanager.com
www.levainqueur.com
www.pronoscourse.com
www.snprono.powa.fr
www.turfsur.com
www.zetop.info
zetop.info
www.gambling-affiliation.com
173.225.100.28
185.119.26.1
194.0.255.28
194.150.236.165
194.150.236.190
194.150.236.236
194.150.236.5
2a00:1450:4001:800::200e
2a00:1450:4001:810::2008
2a06:98c1:3120::a
91.121.164.142
02efc6cd18465bb07e5ae600e17b189ff274e97d1ce2ca95694a6268f84ac3a5
09f5a6c9114102b27434d90a2d508df76a02d91edffcc3d94f6b4a85841ac00d
0a09ee09ecf00abf09122968e5c346385a06c4814681dd9406080b13c009804f
1cd686935fd8522adbb341859df741b4284e46a532918d9d708867ccdc19e454
3860e27e99358de8ad6acb927762f09f6900304d7140042c23d7586e9565d7ef
3cccb4032a92544df0c4b8ad151530e7b8baf342a96ba817f8f8b1ca335fd0ad
5bebe6f273dbd0db76f40e3533f48d3c3dbf0f5ef1a3df861447a580d35c145b
6270f4fc23be1ddceb334705172b0470d61d28d201fcc23402dbdc8bac85bdc7
65e35c6ae1f74e16cbe663763323963eec7c6a22512042ab0758bd68151934a1
67d41c1e688392df7aaee69f818bb4d002d27adb395ae422dff8cb901dd44e16
7adb98959fb28df7c99082b45bbf1f1f75b818282b220ea5c86b667912aa402d
7c9a501ff24c88a1c67c41a92315b5c7b94e19bed6381da81631f691e501a8be
7dd9659e56e92abc376e04d427903b2cfca1d52d854d38e35fefa4cf9e7fd9db
88da8b0f0de25032dd58636368386cd0d85f3f2e679db683f93631ee665500ed
95eb15e76b752a9c78d6281cd3b7c43a8fbc2931783edf3bf3703af55eff06e2
9bd0c1e96f9d3b63b53ba8c355ada916479d8815034cab0aad1540c3c602d896
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
b7684c04888ca98dc344012047da584c5d8d283644788eb4f79c6de4e9d42833
c208d77e0e089f3e3b6e76a7811758dc5fe21725e55e37d22d54a878cefec06c
c89138fe4d60f677872fa14679dd7d6807b9f614bd62beb3ffc112f082442b8d
d1d6b5efe0d6c2540778435a8f7873cbec1eb76a2b107370388a8806cb5dda6a
dcde21057bf448c3ce030ee91d5ed7e8b32ff3f4e2760bce988d17164441153b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea65817ee06d4a23cc99815ee02ada0b64769285ef8757d24931d1ffd9378fc6
ead7dff95228a235e92f3cc50bcd67d3e448ccb40cee683514504e8a59aa8f30

turf3615.1sturf.com Open in urlscan Pro 194.150.236.236 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

78 %HTTPS

27 %IPv6

16 Domains

17 Subdomains

12 IPs

3 Countries

476 kBTransfer

569 kBSize

2 Cookies

0 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

2 Cookies

turf3615.1sturf.com Open in urlscan Pro
194.150.236.236 Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

78 %
HTTPS

27 %
IPv6

16
Domains

17
Subdomains

12
IPs

3
Countries

476 kB
Transfer

569 kB
Size

2
Cookies

27 HTTP transactions
0 data transactions