landing.navigatebuddy.com Open in urlscan Pro
172.67.192.85 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://zenoanime.onionlive.workers.dev/
Effective URL:
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+...
Submission: On March 26 via manual (March 26th 2024, 4:51:13 am UTC) from GB — Scanned from GB

Summary HTTP 38 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 11 domains to perform 38 HTTP transactions. The main IP is 172.67.192.85, located in United States and belongs to CLOUDFLARENET, US. The main domain is landing.navigatebuddy.com. The Cisco Umbrella rank of the primary domain is 378677.
TLS certificate: Issued by GTS CA 1P5 on February 21st 2024. Valid for: 3 months.

This is the only time landing.navigatebuddy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3030::6815:923	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 5	139.45.197.234 139.45.197.234	9002 (RETN-AS) (RETN-AS)
3	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	139.45.195.253 139.45.195.253	9002 (RETN-AS) (RETN-AS)
10	172.64.172.11 172.64.172.11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	139.45.197.251 139.45.197.251	9002 (RETN-AS) (RETN-AS)
2	2a00:c98:2030... 2a00:c98:2030:a025:9::	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
1 3	172.67.192.85 172.67.192.85	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.16.87.20 104.16.87.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
38	11

1 2606:4700:3030::6815:923 (United States)

ASN13335 (CLOUDFLARENET, US)

zenoanime.onionlive.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 139.45.197.234 (United Kingdom) 1 redirects

ASN9002 (RETN-AS, GB)

bedrapiona.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.253 (United Kingdom)

ASN9002 (RETN-AS, GB)

datatechone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.64.172.11 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

bawelteey.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 139.45.197.251 (United Kingdom)

ASN9002 (RETN-AS, GB)

jouteetu.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:c98:2030:a025:9:: (Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

track.routes.name	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.192.85 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

landing.navigatebuddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.16.87.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	bawelteey.com bawelteey.com — Cisco Umbrella Rank: 69284	37 KB
9	jouteetu.net jouteetu.net — Cisco Umbrella Rank: 21055
5	bedrapiona.com 1 redirects bedrapiona.com — Cisco Umbrella Rank: 117420	16 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 449	59 KB
3	navigatebuddy.com 1 redirects landing.navigatebuddy.com — Cisco Umbrella Rank: 378677	9 KB
3	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 8136	2 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 389	10 KB
2	routes.name track.routes.name — Cisco Umbrella Rank: 415060	2 KB
1	datatechone.com datatechone.com — Cisco Umbrella Rank: 21413	467 B
1	workers.dev zenoanime.onionlive.workers.dev — Cisco Umbrella Rank: 110002	1 KB
0	suggestive.com Failed suggestive.com Failed
38	11

	Domain	Requested by
10	bawelteey.com	bawelteey.com
9	jouteetu.net	bawelteey.com
5	bedrapiona.com	1 redirects zenoanime.onionlive.workers.dev bedrapiona.com
3	cdn.jsdelivr.net	landing.navigatebuddy.com
3	landing.navigatebuddy.com	1 redirects
3	my.rtmark.net	bedrapiona.com bawelteey.com
2	cdnjs.cloudflare.com	landing.navigatebuddy.com
2	track.routes.name	bawelteey.com
1	datatechone.com	bedrapiona.com
1	zenoanime.onionlive.workers.dev
0	suggestive.com Failed	landing.navigatebuddy.com
38	11

This site contains no links.

Subject Issuer	Validity	Valid
onionlive.workers.dev GTS CA 1P5	`2024-03-03` - `2024-06-01`	3 months	crt.sh
bedrapiona.com R3	`2024-03-20` - `2024-06-18`	3 months	crt.sh
rtmark.net R3	`2024-03-02` - `2024-05-31`	3 months	crt.sh
datatechone.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-10` - `2024-12-23`	a year	crt.sh
bawelteey.com GTS CA 1P5	`2024-01-31` - `2024-04-30`	3 months	crt.sh
jouteetu.net R3	`2024-03-13` - `2024-06-11`	3 months	crt.sh
track.routes.name ZeroSSL RSA Domain Secure Site CA	`2024-01-05` - `2024-04-04`	3 months	crt.sh
navigatebuddy.com GTS CA 1P5	`2024-02-21` - `2024-05-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh

This page contains 1 frames:

Frame: https://suggestive.com/top-four-trendy-new-hotels-you-need-to-visit-this-season/
Frame ID: B377F8A6589CF6BAEC15983E17E68254
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://zenoanime.onionlive.workers.dev/ Page URL
https://bedrapiona.com/4/5615727/ Page URL
https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z... Page URL
https://track.routes.name/6517545af1a71e0001de416a?sub1=4662728&sub2=7481977&sub3=broadband&sub4=chrom... Page URL
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrad... HTTP 302
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrad... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

38
Requests

97 %
HTTPS

20 %
IPv6

11
Domains

11
Subdomains

11
IPs

4
Countries

134 kB
Transfer

469 kB
Size

13
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://zenoanime.onionlive.workers.dev/ Page URL
https://bedrapiona.com/4/5615727/ Page URL
https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0 Page URL
https://track.routes.name/6517545af1a71e0001de416a?sub1=4662728&sub2=7481977&sub3=broadband&sub4=chrome&sub5=windows&sub6=DE&sub7=19120475&sub8=core-backbone%20gmbh&sub9=desktop&ref_id=796352153106265059&cost=0.000023&os_version=10.0.0&oaid=00802bb6a0fa4b17f7bd76106e669ff5 Page URL
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&subid=master&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages. HTTP 302
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false HTTP 302
https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0

Request Chain 38

http://ww2.suggestive.com/ HTTP 307
https://ww2.suggestive.com/ HTTP 302
https://suggestive.com/top-four-trendy-new-hotels-you-need-to-visit-this-season/

38 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
zenoanime.onionlive.workers.dev/ 1 KB
1 KB 153ms
48ms Document
text/html 2606:4700:3030::6815:923
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zenoanime.onionlive.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:923 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41073afd70d67192731d0e6330e0c56eef44eac903dca4baa6b319d8a87928ed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 86a486189b695315-LHR
content-encoding: br
content-type: text/html;charset=UTF-8
date: Tue, 26 Mar 2024 04:51:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zcRTknTotkVRQYAIwXq3tzDsym9j1WT3fWMFBDfT4WEt329aMixOCowpj4OAe8qGzetnm1Nfln64uih8ZyP4VQgtxMOlyWq2l53G8YYmbMgb6CzAarEWHDITdeXF4KESAyFgvBd3IFB02Ln5VIPP%2BzFdMgupB3VqiQn0CFVu"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
bedrapiona.com/4/5615727/ 33 KB
14 KB 260ms
118ms Document
text/html 139.45.197.234
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bedrapiona.com/4/5615727/

Requested by

Host: zenoanime.onionlive.workers.dev
URL: https://zenoanime.onionlive.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

cdeb9a80cbf6b9718cb8d313428bfe0c1e9f7d2cb1c8624e0040dc7985822031

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://zenoanime.onionlive.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf8
date: Tue, 26 Mar 2024 04:51:08 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma: no-cache
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: * *
x-content-type-options: nosniff
x-trace-id: 3d7faff4f72b8698a831d8208f200b56

POST
H2 200 sftouch
bedrapiona.com/ 2 B
604 B 60ms
59ms Ping
text/plain 139.45.197.234
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bedrapiona.com/sftouch?userId=00802bb6a0fa4b17f7bd76106e669ff5&z=5615727&p_rid=70cd59e5-7d18-4688-acc3-d3430d3bb37c&p_src=sf&branchId=0&rb=RUuepvYWNj4DXxLl1LfRFFoDEco5ZtS_buGJcwjlcrwLyT6-yNQ1hFgm1mIDWxo3h_-XF9JV2aOKsVhlHSUTwbkegObqpqxYJXJsyc3WaECAhOolGYLv0UFUx08GKxm-adnJ0P53v3OYFf0PLb4ezpYtSAYJeZFxw4jYVzSPMYrir8dZEenzT2fm8-dH8F6WcVGOL44qd65WvxiVl81xVauRQ9CEVPiO-SOuHlxepwgV43x_gkZhWDXelekLV_D4JcvUkUIKYINB-dhB7lzKjfPBzd26kXNBb5G4FCSEsQKaYiAm0hphZSvEp0I9TwmBzSxtzWSb2quQNC5H8pzcqRyWbhE20McY

Requested by

Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-arch: "x86"
sec-ch-ua-full-version: "123.0.6312.58"
Referer: https://bedrapiona.com/4/5615727/
sec-ch-ua-bitness: "64"
sec-ch-ua-full-version-list: "Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-model: ""
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:08 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
content-length: 2
x-trace-id: 87dc5ad4eed7a72ff2c65b479c876fb1
pragma: no-cache
server: nginx
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
access-control-allow-origin: https://bedrapiona.com
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 img.gif
my.rtmark.net/ 43 B
491 B 188ms
60ms Image
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=00802bb6a0fa4b17f7bd76106e669ff5&z=5615727&p_rid=70cd59e5-7d18-4688-acc3-d3430d3bb37c&p_src=sf

Requested by

Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bedrapiona.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:08 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

POST
H/1.1 200
OK add
datatechone.com/log/ 2 B
467 B 201ms
59ms XHR
text/plain 139.45.195.253
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=70cd59e5-7d18-4688-acc3-d3430d3bb37c
Requested by: Host: bedrapiona.com
URL: https://bedrapiona.com/4/5615727/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.195.253 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bedrapiona.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 26 Mar 2024 04:51:08 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://bedrapiona.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H2 204 favicon.ico
bedrapiona.com/ 0
150 B 59ms
58ms Other
text/plain 139.45.197.234
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bedrapiona.com/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-arch: "x86"
sec-ch-ua-full-version: "123.0.6312.58"
Referer: https://bedrapiona.com/4/5615727/
sec-ch-ua-bitness: "64"
sec-ch-ua-full-version-list: "Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-model: ""
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Tue, 26 Mar 2024 04:51:08 GMT
cache-control: max-age=315360000, public, must-revalidate, proxy-revalidate
server: nginx
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3

200

/ Show response
bawelteey.com/
Redirect Chain

https://bedrapiona.com/?z=5615727&syncedCookie=true&rhd=false
https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0

42 KB
14 KB

343ms
239ms

Document
text/html

172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: c3422d23b729a2c9904137051bc184ec9a50ebbe16a8b1bc25f61860a0a6e627

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://bedrapiona.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-arch: "x86"
sec-ch-ua-bitness: "64"
sec-ch-ua-full-version: "123.0.6312.58"
sec-ch-ua-full-version-list: "Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-mobile: ?0
sec-ch-ua-model: ""
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86a4861d8d6871d5-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 26 Mar 2024 04:51:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=slH9LE59ys1bf%2BRA4V7dRe%2BPrNPRc6g5MgS8M7ObXcMj7kHmRdO4plLI6nN0lXSqfwCxoKM%2FdVtTmiHWqWs3wvyxcBWCfrlh8TCNl9uxjv7Uxpo26w1O2DwwCnw%2Bselr"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://bedrapiona.com
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length: 0
date: Tue, 26 Mar 2024 04:51:08 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://bawelteey.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
pragma: no-cache
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: * *
x-content-type-options: nosniff
x-trace-id: e167e0875919e033af069b9a8e66bfe2

GET
H2 204 favicon.ico
bedrapiona.com/ 0
150 B 59ms
59ms Other
text/plain 139.45.197.234
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bedrapiona.com/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-arch: "x86"
sec-ch-ua-full-version: "123.0.6312.58"
Referer: https://bedrapiona.com/afu.php?zoneid=5615727&var=5615727&rid=e8DJqkaKU-A8kEnzk7U3FA%3D%3D&rhd=false&ab2r=0&sf=1&os=win32&os_version=10.0.0&is_mobile=false&browser_version=123.0.6312.58
sec-ch-ua-bitness: "64"
sec-ch-ua-full-version-list: "Google Chrome";v="123.0.6312.58", "Not:A-Brand";v="8.0.0.0", "Chromium";v="123.0.6312.58"
sec-ch-ua-model: ""
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Tue, 26 Mar 2024 04:51:08 GMT
cache-control: max-age=315360000, public, must-revalidate, proxy-revalidate
server: nginx
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
542 B 186ms
61ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?userId=377246db48e6d2c57340110318b06a72

Requested by

Host: bawelteey.com
URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e4a569f314f79767a252b9527ea29a6ee94b24063e80d77f243b70d499cb3b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://bawelteey.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 micro.tag.min.js Show response
bawelteey.com/pfe/current/ 35 KB
13 KB 69ms
69ms Script
application/javascript 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 955a7f7e7a9158b178d2ca39513763b297bbec13f6083c534c099af7876c1c8c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 26 Mar 2024 04:51:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 20 Mar 2024 09:50:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65fab17e-8def"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ddNumZoqJqlB%2BfzjVmpt9JXPuDM8CEaDFnsiszFhiaUYzyKTgiH50t%2B5Hwd%2BM9%2BZS1NfsxOYJQxqaX2IO8S7niV%2BBCdG5XT%2Fjf7kN4iwb%2BvegM2FEHWWS%2F%2FKzyvE47lX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 86a4861f3e4271d5-LHR
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 / Show response
bawelteey.com/19/4662728/ 3 KB
2 KB 59ms
59ms XHR
application/json 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/19/4662728/?abt_opts=1&var=5615727&var3=796352152963658345&ymid=&rhd=1&os=win32&os_version=10.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fef92f87b72065d7e474eaadbb7d8b93ec76e8ec3d494acab5de5956962d67e

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: b289e8d6928671f676298be32d020cd8
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QFh2bMiZgEkjENj%2FV4zFUHkIO%2F7fYAPjZPTuAnzJRhwJ0ksQwcvZyHagcAVhWfGLciLLGjL62W8ZbQXPBccwUe%2FYhsBYJ5ZMxCzE13VTghbMjeksBh9WoelQI4SkqZAY"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
cf-ray: 86a4861f3e4571d5-LHR
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H3 200 / Show response
bawelteey.com/ 2 B
520 B 94ms
94ms XHR
application/json 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0&mprtr=1&os_version=10.0.0
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUzD5esAfjeaZOa97ArmAA6Wo%2FtrVPwb4ZN2OqBuLQ2R469aYDsHKoYjCQz11gBYJ6erAop%2FIKtUbuEoGJBdn0iRaTVsis0abS1Tkc0d%2F3HCeoA5B%2BU4wpPZpvyrtuJm"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 86a4861f4e4971d5-LHR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 rhd Show response
bawelteey.com/ 3 KB
3 KB 60ms
59ms Fetch
application/json 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/rhd?rb=FUynYOqYhkZ2Uh0ljhwjLN5ju6Zp9CsMAovtp_wae-WU3PzMaf3iDjhYHH8pVnfznNv5FLIFYPXISAVrYXvEi9qxoe_kodRGgYEmlgoMQG2uePpcLySxBmj2mwHzi5PX_7ICwKFdu9PKo64CjnUW0o-Bm8cykYP3u4DzBp3CcfZtlE3Aj0c98xCRD0VdFZi61Exii2ES9q8UoLlvr_4PWa1ShirqADXWC28zZ95SVNGPKDJ8K8ONk9iu4qnX6wxE-mtvUHe3tIUEN0ZeGQCyNnWMcMrH42NkHfkG023N7chCC9cTgVWYzyEutqmU_3K1jGsftSsry-0hSE4iwdTAu-ty83RhHB7tFgcPzXQWMOZGQsVcYfQS7ebDM6l7PxeChXj8QsBupC0KvbAjhbjRg3Ea_BwrbO8nZvnJgNM1_PaO3Bi_HS0dZMgCucpb7TTmanwy83csB-DI0rTfc0tS15wsLf4kJ-IdgUfHTNt3024HMcNKPflSCwTFRiOVlhMpXM169cS2zXzkwbCpcwzTSw7o2E452f-1F4t6T1QpaVxWqe3H&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=800&sh=600&sah=600&wx=240&wy=240&ww=1600&wh=1198&cw=1600&wih=1113&wiw=1600&wfc=0&pl=https%3A%2F%2Fbawelteey.com%2F%3Fs%3D796352152963658345%26ssk%3De110183f0fb29821d255b42d106122ea%26svar%3D1711428668%26z%3D5615727%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26btz%3DEurope%2FLondon%26bto%3D0&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=5615727&var3=796352152963658345&ymid=&rhd=1&os=win32&os_version=10.0.0&m=link

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dfb5157d3803c814228164fc1ca4836eec79b0648b3ee219b29f6332c12d37f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 76916e533b71924bb92efe3b9fbe3fe3
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XbnJvSWeGnelUpj8aVQpQfYIaZ2ukpYRM5Zh5fWbxGAzC2dPbM%2F48r5vIaM9P8vxReeYV%2Fa8bjfmvc9jpUUeqGl14CaTvEeeWVyuEx1NdrS9pS90tSToaT3zmc6DzrEU"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
cf-ray: 86a4861fae7771d5-LHR
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H2 200 custom
jouteetu.net/ 0
0 253ms
117ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 4662709
bawelteey.com/sw-check-permissions/ 0
993 B 62ms
61ms Other
application/javascript 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bawelteey.com/sw-check-permissions/4662709?var=5615727&ymid=796352152963658345&uhd=1&zoneId=4662709
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S2WY%2BWVAXO0L0i3e5Ry4DY4ZcYiGV%2FOAU8rjYmryj88mO29REICQsWPHZTz%2Feg0eILUoTIFLk026ovOLd7W8CExDxSIugtcynneZrCRJTA6Eu2VMpezVqwBEE9iM4oi2"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 86a4861ffe9e71d5-LHR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H2 200 custom
jouteetu.net/ 0
0 246ms
113ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H3 200 zone
bawelteey.com/ 0
590 B 58ms
58ms Ping
text/plain 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=bawelteey.com&var=5615727&ymid=796352152963658345&var_3=&var_4=&dsig=&tg=1&sw=3.1.497&trace_id=9f0a8da7-9914-41eb-bb64-32a040d36dba&action=prerequest&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjMifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJHb29nbGUgQ2hyb21lIiwidmVyc2lvbiI6IjEyMy4wLjYzMTIuNTgifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOC4wLjAuMCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMuMC42MzEyLjU4In1dLCJtb2JpbGUiOmZhbHNlLCJtb2RlbCI6IiIsInBsYXRmb3JtIjoiV2luMzIiLCJwbGF0Zm9ybVZlcnNpb24iOiIxMC4wLjAiLCJ3b3c2NCI6ZmFsc2V9

Requested by

Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: cb871a3357eafc14553d132ae11833ad
date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AKja8WAyAYcKyF0Abwxcrqe2QNpbV1Kau1T4JNZbXmq4GS%2FdkKoWaVDK%2BTiuYFOLniyN9JXynW1CZR6xSf5r3B89rQPzgfmqU7s5LYTB0Os8LOzA9Qr%2BFLqAfe35W7F1"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://bawelteey.com
access-control-allow-credentials: true
cf-ray: 86a4861ffe9f71d5-LHR
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

POST
H2 200 custom
jouteetu.net/ 0
0 246ms
114ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 custom
jouteetu.net/ 0
0 195ms
63ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
541 B 65ms
62ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=796352152963658345&var=5615727

Requested by

Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e4a569f314f79767a252b9527ea29a6ee94b24063e80d77f243b70d499cb3b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://bawelteey.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

POST
H2 200 custom
jouteetu.net/ 0
0 190ms
59ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 204 favicon.ico
bawelteey.com/ 0
407 B 51ms
50ms Other
text/plain 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5114
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oY83MlBg6ziuDbXNejrOUce7TpIs90EZb65P0qk9VRPK4vZs52VfC8uciapN2sNX62MYPoH2m2UZl%2FubrAMS7KwuZDpmLdRYGfVYfA9oOfF8KXFTTxEkd7emuHJdXt%2Fq"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 86a486200eb071d5-LHR
alt-svc: h3=":443"; ma=86400

POST
H2 200 custom
jouteetu.net/ 0
0 222ms
113ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 zone Show response
bawelteey.com/ 796 B
1 KB 61ms
61ms Fetch
application/json 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=bawelteey.com&var=5615727&ymid=796352152963658345&var_3=&var_4=&dsig=&tg=1&sw=3.1.497&trace_id=9f0a8da7-9914-41eb-bb64-32a040d36dba&action=settings&ch=eyJhcmNoaXRlY3R1cmUiOiJ4ODYiLCJiaXRuZXNzIjoiNjQiLCJicmFuZHMiOlt7ImJyYW5kIjoiR29vZ2xlIENocm9tZSIsInZlcnNpb24iOiIxMjMifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMifV0sImZ1bGxWZXJzaW9uTGlzdCI6W3siYnJhbmQiOiJHb29nbGUgQ2hyb21lIiwidmVyc2lvbiI6IjEyMy4wLjYzMTIuNTgifSx7ImJyYW5kIjoiTm90OkEtQnJhbmQiLCJ2ZXJzaW9uIjoiOC4wLjAuMCJ9LHsiYnJhbmQiOiJDaHJvbWl1bSIsInZlcnNpb24iOiIxMjMuMC42MzEyLjU4In1dLCJtb2JpbGUiOmZhbHNlLCJtb2RlbCI6IiIsInBsYXRmb3JtIjoiV2luMzIiLCJwbGF0Zm9ybVZlcnNpb24iOiIxMC4wLjAiLCJ3b3c2NCI6ZmFsc2V9

Requested by

Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a61ecdea150c735a91158c173fce9812d3bb542cef5f8b1f499b41e2677706f

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:09 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: cbd2d5c3a9135ef7fae1a29a4c4deaa1
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w4IarHZmc57PCspEh6jLuL%2Fcpim%2F7eDdbiXCp%2BF4FLpo8yPcD0c1HMp%2B9NNeZzbFR1o5GhE9XxKueLjKATqTZQcivdlzI4sblJmrRRMnQ%2F43DyWozGFPyLDQKYcj%2Fjrf"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 86a486201eb471d5-LHR
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept

POST
H2 200 custom
jouteetu.net/ 0
0 58ms
58ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 custom
jouteetu.net/ 0
0 59ms
58ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 custom
jouteetu.net/ 0
0 60ms
60ms Ping
application/json 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://jouteetu.net/custom
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/pfe/current/micro.tag.min.js?z=4662709&ymid=796352152963658345&var=5615727&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H/1.1 200
OK 6517545af1a71e0001de416a Show response
track.routes.name/ 937 B
2 KB 252ms
60ms Document
text/html 2a00:c98:2030:a025:9::
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: https://track.routes.name/6517545af1a71e0001de416a?sub1=4662728&sub2=7481977&sub3=broadband&sub4=chrome&sub5=windows&sub6=DE&sub7=19120475&sub8=core-backbone%20gmbh&sub9=desktop&ref_id=796352153106265059&cost=0.000023&os_version=10.0.0&oaid=00802bb6a0fa4b17f7bd76106e669ff5
Requested by: Host: bawelteey.com
URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 2a00:c98:2030:a025:9:: , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 8d59dfc3a06f7f26ece0291285f9b1c5d673516c6dfb6c7fe22a4e129467f088

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 937
Content-Type: text/html; charset=utf-8
Date: Tue, 26 Mar 2024 04:51:12 GMT
Server: nginx/1.20.2

POST
H3 200 cat.php
bawelteey.com/ 0
739 B 68ms
68ms Ping
text/plain 172.64.172.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bawelteey.com/cat.php?userId=377246db48e6d2c57340110318b06a72&zoneid=4662728&rb=FUynYOqYhkZ2Uh0ljhwjLN5ju6Zp9CsMAovtp_wae-WU3PzMaf3iDjhYHH8pVnfznNv5FLIFYPXISAVrYXvEi9qxoe_kodRGgYEmlgoMQG2uePpcLySxBmj2mwHzi5PX_7ICwKFdu9PKo64CjnUW0o-Bm8cykYP3u4DzBp3CcfZtlE3Aj0c98xCRD0VdFZi61Exii2ES9q8UoLlvr_4PWa1ShirqADXWC28zZ95SVNGPKDJ8K8ONk9iu4qnX6wxE-mtvUHe3tIUEN0ZeGQCyNnWMcMrH42NkHfkG023N7chCC9cTgVWYzyEutqmU_3K1jGsftSsry-0hSE4iwdTAu-ty83RhHB7tFgcPzXQWMOZGQsVcYfQS7ebDM6l7PxeChXj8QsBupC0KvbAjhbjRg3Ea_BwrbO8nZvnJgNM1_PaO3Bi_HS0dZMgCucpb7TTmanwy83csB-DI0rTfc0tS15wsLf4kJ-IdgUfHTNt3024HMcNKPflSCwTFRiOVlhMpXM169cS2zXzkwbCpcwzTSw7o2E452f-1F4t6T1QpaVxWqe3H&var=5615727&var3=796352152963658345&ymid=&rhd=1&os=win32&os_version=10.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.172.11 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 26 Mar 2024 04:51:12 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 0
x-trace-id: 623d6c3c524b4631934171e17e3ea3b1
pragma: no-cache
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iwbPLqmlaIWF7ygotcLQZ2q9uYrzWksyKownOIEeawL4eQ09oAuZTZVHRXjFDpVMt6n45xuwP0EcqXeSdbde4xX%2FCxcuqH8Q1fQWVqz3xhZ7lUTh3NIzK2K626xFXRx7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://bawelteey.com
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
cf-ray: 86a4863358fe71d5-LHR
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H3

200

Primary Request / Show response
landing.navigatebuddy.com/
Redirect Chain

https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&subid=master&text1=Navigate+...
https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+Whi...

17 KB
8 KB

71ms
70ms

Document
text/html

172.67.192.85
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages.
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.192.85 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd9fa72502947ad4d5e3d132f46874802d84d35bb52b124bf2be094f921d2dbd

Request headers

Referer: https://track.routes.name/6517545af1a71e0001de416a?sub1=4662728&sub2=7481977&sub3=broadband&sub4=chrome&sub5=windows&sub6=DE&sub7=19120475&sub8=core-backbone%20gmbh&sub9=desktop&ref_id=796352153106265059&cost=0.000023&os_version=10.0.0&oaid=00802bb6a0fa4b17f7bd76106e669ff5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 86a486363ec62407-LHR
content-encoding: br
content-type: text/html;charset=UTF-8
date: Tue, 26 Mar 2024 04:51:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2WnVJ0OhcpZmrAlJa0%2B0g56apW3DcnThWbxqA0AROnzIXbesOdX68GKvFHF6OkhGVDPpZoun1lYCU49QTXCehMTtzwKjKw6Cs8t4JpAIbypcIzVE29tMV6UhWzwJbuonEIvMXzDLPmxHuKIw"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-ray: 86a48635ee992407-LHR
content-length: 0
date: Tue, 26 Mar 2024 04:51:12 GMT
location: https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages.
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IdHUjqgZHOXi6VNy2HqHcGfrKTaCPOcrIyKqe5w0epf2Bq1%2B%2BGaVC2muFT7ElG5qUhbVLYMaht8HKjSf%2FU7ShC24xZ2wwbesFMbqBd%2FlcSaR1hM8dIjkRWmSW6sUv%2FV0krWQFn%2BQ7N7uonjx"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 403
Forbidden favicon.ico
track.routes.name/ 41 B
236 B 58ms
57ms Other
text/html 2a00:c98:2030:a025:9::
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: https://track.routes.name/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 2a00:c98:2030:a025:9:: , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Location: /disabled.html
Date: Tue, 26 Mar 2024 04:51:12 GMT
Server: nginx/1.20.2
Connection: keep-alive
Content-Length: 41
Content-Type: text/html; charset=utf-8

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ 152 KB
24 KB 110ms
60ms Stylesheet
text/css 104.16.87.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

Requested by

Host: landing.navigatebuddy.com
URL: https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages.

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://landing.navigatebuddy.com/
Origin: https://landing.navigatebuddy.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 350858
x-jsd-version: 5.0.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230097-FRA, cache-lga21934-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m3cvkzkkisoDfnChMCaE7MpvHDP9CTTfyzfC857rQu5fumYzNX7MTPgg2GDbmrYkiHfJ7YnxETLOds%2B%2Bf%2BNfbOZXQEBSen1knMGoRTMBs843FrLPRUIiikrd7yGXQpvP9Tc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86a486370c2663e8-LHR

GET
H3 200 bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/ 79 KB
11 KB 104ms
55ms Stylesheet
text/css 104.16.87.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/bootstrap-icons.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af35cc6aba34e5005de77099dfa72d4c1a7715d28ddcec343f48031dc8cb08bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://landing.navigatebuddy.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 33524
x-jsd-version: 1.8.1
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10883
x-served-by: cache-fra-etou8220090-FRA, cache-lga21939-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"13a7e-T26mnA4DQx/6Ggl6RUU7WzskbYs"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FuefYlARK3kJq4HRe%2Bed1r6wQRTQWiJIxoY7iQM0yZVQKq90%2B%2FGpwnGqyOlleRDc%2FgQ83DfqcvamPudfURSmahwLfABU8Cxxyu7hapFdXwBIac4q2seQ7Io%2B%2FErPqaaGbws%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86a486370a126430-LHR

GET
H3 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ 77 KB
23 KB 153ms
104ms Script
application/javascript 104.16.87.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://landing.navigatebuddy.com/
Origin: https://landing.navigatebuddy.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 650528
x-jsd-version: 5.0.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230080-FRA, cache-lga21921-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"13397-kBFpUnUH/55mLPZNjjYfNZMIlw0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xD5UL0v1sxFNOO9Qwv5frUPUnDZ18qb%2BS49v5q6c2Ky6YRRdwqKHeCaV6VOKMYEpwXpLq6HvNZtNoRQACHn6XrqIjFCRZhe8ucIQcEwNNFmwq2Z6dhYiwvOXYXP3cL3JreY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86a486370c2863e8-LHR

GET
H3 200 ua-parser.min.js Show response
cdnjs.cloudflare.com/ajax/libs/UAParser.js/0.7.20/ 14 KB
6 KB 101ms
52ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/UAParser.js/0.7.20/ua-parser.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a7547ed8ce1cf622bba41c6cc4d1745861c85a51943a81ccadc2c7b04bc8fab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Origin: https://landing.navigatebuddy.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 382614
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5456
last-modified: Mon, 04 May 2020 16:04:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf3-38ee"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9kL9wEIzeGJaUbZ3DW5Qk%2BjxGflz%2FVBC6ULsg9LgpTw%2Fjvnjp0BfHNt35lxafmJmEKUH3eYiD3PjUofYipvTy0LhX14JEEDqsslWS55wLHBPX7LGHWdcQ7lgzl77qo%2Fd%2BS4g6eL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86a486370e4d9402-LHR
expires: Sun, 16 Mar 2025 04:51:13 GMT

GET
DATA 200
OK truncated
/ 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2bf339b4730ed9df2865f724168bcb3578f01bb836a4d47e7ab9084f447f4857

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 79bccc6b05b2515c956ca7f11889c309da76e3e90fea1f6296b6c3729092756d

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 chrome_48x48.png
cdnjs.cloudflare.com/ajax/libs/browser-logos/72.0.0/chrome/ 3 KB
4 KB 109ms
63ms Image
image/png 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnjs.cloudflare.com/ajax/libs/browser-logos/72.0.0/chrome/chrome_48x48.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://landing.navigatebuddy.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 388298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3171
last-modified: Thu, 07 Apr 2022 06:36:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "624e8672-c63"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HU2zdLnvjEVLEicKuNdY%2FM0cz392iqTi9220haIKAfeTPavMTLPCpUc4x9epqyYxxeAhm9RCH2R2RS%2FBNbHmrETnobs73W4bzWvS5PaTsa1VKuwbJ%2BBWZtjKqt6MjGGdWfN%2Ba43O"}],"group":"cf-nel","max_age":604800}
content-type: image/png; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86a486387da79480-LHR
expires: Sun, 16 Mar 2025 04:51:13 GMT

GET

/
suggestive.com/top-four-trendy-new-hotels-you-need-to-visit-this-season/
Redirect Chain

http://ww2.suggestive.com/
https://ww2.suggestive.com/
https://suggestive.com/top-four-trendy-new-hotels-you-need-to-visit-this-season/

0
0

GET
H3 200 favicon.ico
landing.navigatebuddy.com/ 315 B
623 B 57ms
56ms Other
text/html 172.67.192.85
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://landing.navigatebuddy.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.192.85 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://landing.navigatebuddy.com/?a=domain-ab&utm_source=3&utm_campaign=66025440687f68000171b009&title=Upgrade+Your+WhichBrowser+Experience.&incogdomain=suggestive.com&text1=Navigate+Buddy+For+WhichBrowser&text2=Click+continue+to+open+the+WhichBrowser+Web+Store+in+a+new+tab+and+install+our+WhichBrowser+Extension.+This+Extension+modifies+your+browser+to+improve+annoying+internet+error+pages%2C+provide+useful+information%2C+and+give+you+a+much+more+enjoyable+internet+experience.+This+extension+is+monetized+by+providing+multiple+search+options+from+Google%2C+Bing%2C+and+Yahoo+in+multiple+tabs+along+with+other+affiliate+offers.+Using+the+extension+allows+you+to+contribute+to+our+project+that+is+working+to+minimize+internet+errors+and+improve+awareness+of+internet+outages.
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:51:13 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3JquOr4AbsUlLHm289ZWLARX61NpKYK3d3G7fXRQOQvYsJs1oV0J%2B7AgnU%2Bvfwm03B%2BM8HuGpqpMp9c4mt2EDqnmg9sYByQvK9caDHw6N8yClhTu%2FdFL0idolHit4w97dI96J5Fi8L%2F76sI8"}],"group":"cf-nel","max_age":604800}
content-type: text/html;charset=UTF-8
cf-ray: 86a4863828552407-LHR
alt-svc: h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: suggestive.com
URL: https://suggestive.com/top-four-trendy-new-hotels-you-need-to-visit-this-season/

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bedrapiona.com/	1970-01-21 04:09:24	Name: OAID Value: 00802bb6a0fa4b17f7bd76106e669ff5
bedrapiona.com/	1970-01-21 04:09:24	Name: oaidts Value: 1711428668
my.rtmark.net/	1970-01-21 04:09:24	Name: ID Value: 00802bb6a0fa4b17f7bd76106e669ff5
bedrapiona.com/	1970-01-20 19:33:53	Name: syncedCookie Value: true
bawelteey.com/	1970-01-20 19:23:52	Name: reverse Value: uH3mYEUaGycWDMe2dXQK5dPc8wGovBVhWcuQvwKG8f8
bawelteey.com/	1970-01-21 04:09:24	Name: oaidts Value: 1711428669
bawelteey.com/	1970-01-20 19:23:48	Name: prefetchAd_4662728 Value: true
bawelteey.com/	1970-01-21 04:09:24	Name: OAID Value: 00802bb6a0fa4b17f7bd76106e669ff5
bawelteey.com/	1970-01-20 19:33:53	Name: syncedCookie Value: true
.track.routes.name/	1970-01-20 19:25:15	Name: redcmps Value: W3siaWQiOiI2NTE3NTQ1YWYxYTcxZTAwMDFkZTQxNmEiLCJ0IjoiMjAyNC0wMy0yNlQwNDo1MToxMi43NTc5NjgzOTJaIn1d
.track.routes.name/	1970-01-21 04:09:24	Name: redhash Value: NjYwMjU0NDA2ODdmNjgwMDAxNzFiMDA5fDB8NjUxNzU0NWFmMWE3MWUwMDAxZGU0MTZhfHw1NTAwMTg5Zi1mNWNmLTQ4YWEtOWQ2My1iMmFhMzkyMzk4MzJ8MTcxMTQyODY3Mg==
landing.navigatebuddy.com/	1970-01-20 19:23:48	Name: 2 Value: b
.navigatebuddy.com/	1970-01-20 19:32:34	Name: vcid Value: 66025440687f68000171b009

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://bedrapiona.com/4/5615727/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://bawelteey.com/?s=796352152963658345&ssk=e110183f0fb29821d255b42d106122ea&svar=1711428668&z=5615727&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&btz=Europe/London&bto=0 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://track.routes.name/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bawelteey.com
bedrapiona.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
datatechone.com
jouteetu.net
landing.navigatebuddy.com
my.rtmark.net
suggestive.com
track.routes.name
zenoanime.onionlive.workers.dev
suggestive.com
104.16.87.20
104.17.24.14
139.45.195.253
139.45.195.8
139.45.197.234
139.45.197.251
172.64.172.11
172.67.192.85
2606:4700:3030::6815:923
2a00:c98:2030:a025:9::
1a61ecdea150c735a91158c173fce9812d3bb542cef5f8b1f499b41e2677706f
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2bf339b4730ed9df2865f724168bcb3578f01bb836a4d47e7ab9084f447f4857
41073afd70d67192731d0e6330e0c56eef44eac903dca4baa6b319d8a87928ed
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4a7547ed8ce1cf622bba41c6cc4d1745861c85a51943a81ccadc2c7b04bc8fab
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e4a569f314f79767a252b9527ea29a6ee94b24063e80d77f243b70d499cb3b1
4fef92f87b72065d7e474eaadbb7d8b93ec76e8ec3d494acab5de5956962d67e
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc
6dfb5157d3803c814228164fc1ca4836eec79b0648b3ee219b29f6332c12d37f
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
79bccc6b05b2515c956ca7f11889c309da76e3e90fea1f6296b6c3729092756d
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
8d59dfc3a06f7f26ece0291285f9b1c5d673516c6dfb6c7fe22a4e129467f088
955a7f7e7a9158b178d2ca39513763b297bbec13f6083c534c099af7876c1c8c
af35cc6aba34e5005de77099dfa72d4c1a7715d28ddcec343f48031dc8cb08bc
c3422d23b729a2c9904137051bc184ec9a50ebbe16a8b1bc25f61860a0a6e627
cdeb9a80cbf6b9718cb8d313428bfe0c1e9f7d2cb1c8624e0040dc7985822031
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd9fa72502947ad4d5e3d132f46874802d84d35bb52b124bf2be094f921d2dbd

landing.navigatebuddy.com Open in urlscan Pro 172.67.192.85 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

38 Requests

97 %HTTPS

20 %IPv6

11 Domains

11 Subdomains

11 IPs

4 Countries

134 kBTransfer

469 kBSize

13 Cookies

0 Outgoing links

Page URL History

Redirected requests

38 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

landing.navigatebuddy.com Open in urlscan Pro
172.67.192.85 Public Scan

Screenshot
Live screenshot

Full Image

38
Requests

97 %
HTTPS

20 %
IPv6

11
Domains

11
Subdomains

11
IPs

4
Countries

134 kB
Transfer

469 kB
Size

13
Cookies

38 HTTP transactions
3 data transactions