wap4dollar.com Open in urlscan Pro
167.86.92.34 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://speedflow.io/adult/?a=rr
Effective URL:
https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F...
Submission Tags: demotag1 demotag2 Search All
Submission: On November 08 via api (November 8th 2020, 6:03:30 am UTC) from US

Summary HTTP 65 Redirects Behaviour Indicators

Summary

This website contacted 27 IPs in 5 countries across 27 domains to perform 65 HTTP transactions. The main IP is 167.86.92.34, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is wap4dollar.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 24th 2020. Valid for: 3 months.

This is the only time wap4dollar.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	198.54.116.135 198.54.116.135	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	95.211.229.245 95.211.229.245	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	162.213.255.36 162.213.255.36	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 4	107.170.39.103 107.170.39.103	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	35.190.72.161 35.190.72.161	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:3::621 2a04:4e42:3::621	54113 (FASTLY) (FASTLY)
1 5	2606:4700:303... 2606:4700:3035::ac43:9ef3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::2008	15169 (GOOGLE) (GOOGLE)
4	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
1 5	167.86.92.34 167.86.92.34	51167 (CONTABO) (CONTABO)
10	139.45.196.132 139.45.196.132	9002 (RETN-AS) (RETN-AS)
1	109.206.162.83 109.206.162.83	50245 (SERVEREL-AS) (SERVEREL-AS)
1	178.162.156.37 178.162.156.37	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
7	139.45.196.130 139.45.196.130	9002 (RETN-AS) (RETN-AS)
1	62.171.173.170 62.171.173.170	51167 (CONTABO) (CONTABO)
1	139.45.197.8 139.45.197.8	9002 (RETN-AS) (RETN-AS)
1	139.45.195.162 139.45.195.162	9002 (RETN-AS) (RETN-AS)
1	139.45.195.150 139.45.195.150	9002 (RETN-AS) (RETN-AS)
65	27

1 198.54.116.135 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server193-5.web-hosting.com

speedflow.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

a.realsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.211.229.245 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

syndication.realsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.213.255.36 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server145-4.web-hosting.com

manyhit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 107.170.39.103 (New York, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

traffdaq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.161 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 161.72.190.35.bc.googleusercontent.com

c.securepaths.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::ac43:9ef3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tr.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 167.86.92.34 (Nuremberg, Germany) 1 redirects

ASN51167 (CONTABO, DE)
PTR: vmi301782.contaboserver.net

wap4dollar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 139.45.196.132 (Ascension Island)

ASN9002 (RETN-AS, EU)

propu.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.206.162.83 (Netherlands)

ASN50245 (SERVEREL-AS, NL)
PTR: 83.162.serverel.net

2cnjuh34jbpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.162.156.37 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: hosted-by.leaseweb.com

iclickcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 139.45.196.130 (Ascension Island)

ASN9002 (RETN-AS, EU)

pushsar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.171.173.170 (United Kingdom)

ASN51167 (CONTABO, DE)
PTR: plesk.bdwebhost.net

mailbd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.8 (Ascension Island)

ASN9002 (RETN-AS, EU)

bedrapiona.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.162 (Ascension Island)

ASN9002 (RETN-AS, EU)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.150 (Ascension Island)

ASN9002 (RETN-AS, EU)

onmarshtompor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	propu.sh propu.sh	87 KB
9	googlesyndication.com pagead2.googlesyndication.com b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com tpc.googlesyndication.com	145 KB
7	pushsar.com pushsar.com	178 KB
5	wap4dollar.com 1 redirects wap4dollar.com	6 KB
5	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	119 KB
5	tr.im 1 redirects tr.im	24 KB
4	traffdaq.com 1 redirects traffdaq.com	4 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	gstatic.com fonts.gstatic.com	16 KB
2	realsrv.com a.realsrv.com syndication.realsrv.com	1 KB
1	onmarshtompor.com onmarshtompor.com
1	rtmark.net my.rtmark.net	772 B
1	bedrapiona.com bedrapiona.com	2 KB
1	mailbd.net mailbd.net	13 KB
1	iclickcdn.com iclickcdn.com	26 KB
1	2cnjuh34jbpoint.com 2cnjuh34jbpoint.com	26 KB
1	googletagservices.com www.googletagservices.com	27 KB
1	google.com adservice.google.com	832 B
1	google.de adservice.google.de	832 B
1	googleadservices.com partner.googleadservices.com	404 B
1	googleapis.com fonts.googleapis.com	624 B
1	bootstrapcdn.com stackpath.bootstrapcdn.com	24 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	jsdelivr.net cdn.jsdelivr.net	10 KB
1	securepaths.com c.securepaths.com
1	manyhit.com manyhit.com
1	speedflow.io speedflow.io	1 KB
65	27

	Domain	Requested by
10	propu.sh	wap4dollar.com propu.sh speedflow.io
7	pushsar.com	wap4dollar.com pushsar.com
5	wap4dollar.com	1 redirects tr.im wap4dollar.com
5	tr.im	1 redirects traffdaq.com tr.im
4	pagead2.googlesyndication.com	tr.im pagead2.googlesyndication.com
4	traffdaq.com	1 redirects speedflow.io traffdaq.com
3	b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	securepubads.g.doubleclick.net	tr.im securepubads.g.doubleclick.net
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
1	onmarshtompor.com	iclickcdn.com
1	my.rtmark.net	speedflow.io
1	bedrapiona.com	iclickcdn.com
1	mailbd.net	wap4dollar.com
1	iclickcdn.com	wap4dollar.com
1	2cnjuh34jbpoint.com	wap4dollar.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fonts.googleapis.com	tr.im
1	stackpath.bootstrapcdn.com	tr.im
1	www.googletagmanager.com	tr.im
1	cdn.jsdelivr.net	traffdaq.com
1	c.securepaths.com	traffdaq.com
1	manyhit.com	speedflow.io
1	syndication.realsrv.com	a.realsrv.com
1	a.realsrv.com	speedflow.io
1	speedflow.io
65	31

This site contains no links.

Subject Issuer	Validity	Valid
realsrv.com Let's Encrypt Authority X3	`2020-10-26` - `2021-01-24`	3 months	crt.sh
traffdaq.com Let's Encrypt Authority X3	`2020-10-31` - `2021-01-29`	3 months	crt.sh
*.securepaths.com Let's Encrypt Authority X3	`2020-09-22` - `2020-12-21`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-10` - `2021-07-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
wap4dollar.com Let's Encrypt Authority X3	`2020-10-24` - `2021-01-22`	3 months	crt.sh
propu.sh Let's Encrypt Authority X3	`2020-10-24` - `2021-01-22`	3 months	crt.sh
2cnjuh34jbpoint.com Let's Encrypt Authority X3	`2020-09-22` - `2020-12-21`	3 months	crt.sh
iclickcdn.com Let's Encrypt Authority X3	`2020-11-05` - `2021-02-03`	3 months	crt.sh
pushsar.com Let's Encrypt Authority X3	`2020-10-19` - `2021-01-17`	3 months	crt.sh
mailbd.net Let's Encrypt Authority X3	`2020-10-28` - `2021-01-26`	3 months	crt.sh
bedrapiona.com Let's Encrypt Authority X3	`2020-10-08` - `2021-01-06`	3 months	crt.sh
*.rtmark.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-27` - `2021-11-26`	a year	crt.sh
onmarshtompor.com Let's Encrypt Authority X3	`2020-10-19` - `2021-01-17`	3 months	crt.sh

This page contains 10 frames:

Primary Page: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
Frame ID: 23A01DE2A35ABEFD43D10D9B053B2E3C
Requests: 54 HTTP requests in this frame

Frame: http://syndication.realsrv.com/ads-iframe-display.php?idzone=4053336&type=900x250&p=http%3A//speedflow.io/adult/%3Fa%3Drr&dt=1604815382382&sub=&tags=&screen_resolution=1600x1200&el=%22
Frame ID: 0B10DB96A4C29D816B929326F4471A99
Requests: 1 HTTP requests in this frame

Frame: http://manyhit.com/autosurf_if.php?user=speedflow
Frame ID: EC9685D0CA73F8507D3CDD54509860A6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/zrt_lookup.html
Frame ID: DB2E2E38B461D341709E875A5559D492
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1604815394&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1opva&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604815394382&bpp=11&bdt=127&idt=125&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=894487512954&frm=20&pv=2&ga_vid=1698864730.1604815394&ga_sid=1604815395&ga_hid=654545040&ga_fc=0&iag=0&icsg=10410&dssz=17&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=2497149031344260&pem=559&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=151
Frame ID: 12CBFD940C698379373219F21414A838
Requests: 1 HTTP requests in this frame

Frame: https://b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 6F0AADE3528631DDEB3AC9C1C8914A98
Requests: 1 HTTP requests in this frame

Frame: https://b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 5A24BABBA85B7BC0B831DC4CC057E1A5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: FA01BE24F0C564672A4E14DFB928A605
Requests: 1 HTTP requests in this frame

Frame: https://onmarshtompor.com/fac.php
Frame ID: AC80DD88D9319D0DCADC3EC20F19D6B1
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 8237BCB6AAC7E753E238AD11CA9EE729
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://speedflow.io/adult/?a=rr Page URL
http://traffdaq.com/delivery/dl/47382?category=gay HTTP 301
https://traffdaq.com/delivery/dl/47382?category=gay Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6InFDMFVXVmtnd3F2a2dSUTkrSUNBUHc9PSIsI... Page URL
http://tr.im/1opva HTTP 308
https://tr.im/1opva Page URL
http://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&u... HTTP 301
https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&u... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

65
Requests

95 %
HTTPS

42 %
IPv6

27
Domains

31
Subdomains

27
IPs

5
Countries

769 kB
Transfer

2244 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://speedflow.io/adult/?a=rr Page URL
http://traffdaq.com/delivery/dl/47382?category=gay HTTP 301
https://traffdaq.com/delivery/dl/47382?category=gay Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6InFDMFVXVmtnd3F2a2dSUTkrSUNBUHc9PSIsInZhbHVlIjoieWQ3QWlIZ3hkdjdaTzJBd3B1bDNlVG10N2RuVjh4ZU5iU1F4ZHRHaFpMSlBzZkZjQVwvWUhYdDJtN1ZBTm5ZYzZxdTVcL1wvb1owNFlBeDUzT2xRTURZRDdUcjdsaG9VdmtHeUxvWFRmcXIzMGZFeXJEUTM0S05CdTFJdTdXMERzR0tRdnM0cll0cXdyVXFma3U0K2RpZlJKMlM1S3JOQ3hrNnl6djNVZXIwcW1HYUhueWJ2cDZcL0s4UUlCWFR6N3RSSlZGa2k0K1wvcjd3cHk1ZXIwaTk2dVdjT2wyUUVZdFJIZFJnMFZhNVBcLzBka281YnowYk1LMGErNjdzZXVmUHBjZE1uQ25tYXFBRisrbjNwcHVoQlwvWk52WGZoNnZWY1ozbzgrMWs5Rm1YUnJNPSIsIm1hYyI6IjAzMGE4MDk5YjQ0ZTdmNmMzMWU5YzIyZWU2NzdhZjY2ZGZjYzI5ODExNTU5MWIxMGI3Y2Q2OTM1ZTI4ZWZkN2UifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Page URL
http://tr.im/1opva HTTP 308
https://tr.im/1opva Page URL
http://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input HTTP 301
https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://traffdaq.com/delivery/dl/47382?category=gay HTTP 301
https://traffdaq.com/delivery/dl/47382?category=gay

Request Chain 9

http://tr.im/1opva HTTP 308
https://tr.im/1opva

65 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
speedflow.io/adult/ 1017 B
1 KB 169ms
169ms Document
text/html 198.54.116.135
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Server: 198.54.116.135 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server193-5.web-hosting.com
Software: Apache / PHP/7.1.33
Resource Hash: 886945a529bfc628436360861c47918ba8ec36b23061e3b44c269ee895d92f14

Request headers

Host: speedflow.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr

Response headers

date: Sun, 08 Nov 2020 06:03:02 GMT
server: Apache
x-powered-by: PHP/7.1.33
set-cookie: visits_todaya=1; expires=Sun, 08-Nov-2020 22:59:00 GMT; Max-Age=60958; path=/ time_start=1604815382.2949; expires=Sun, 08-Nov-2020 22:59:00 GMT; Max-Age=60958; path=/ ip=82.102.18.114 mobile=0 country=PT visits_todayi=0; expires=Sun, 08-Nov-2020 22:59:00 GMT; Max-Age=60958; path=/
vary: Accept-Encoding
content-encoding: gzip
content-length: 541
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK ads.js Show response
a.realsrv.com/ 2 KB
1 KB 6ms
6ms Script
application/javascript 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://a.realsrv.com/ads.js
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: d3f814d49049b29143de2fccdbd97d0a1f0739e2554c482684c7c906b535ea43

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:02 GMT
Content-Encoding: gzip
X-HW: 1604815377.dop167.fr8.t,1604815382.cds164.fr8.shn,1604815382.cds164.fr8.c
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=10800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 928

GET
H/1.1 200
OK Cookie set ads-iframe-display.php
syndication.realsrv.com/ Frame 0B10 0
0 85ms
67ms Document
text/html 95.211.229.245
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: http://syndication.realsrv.com/ads-iframe-display.php?idzone=4053336&type=900x250&p=http%3A//speedflow.io/adult/%3Fa%3Drr&dt=1604815382382&sub=&tags=&screen_resolution=1600x1200&el=%22
Requested by: Host: a.realsrv.com
URL: https://a.realsrv.com/ads.js
Protocol: HTTP/1.1
Server: 95.211.229.245 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: syndication.realsrv.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 06:03:02 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%225fa78a16695992.561401963097512197%22%3B%7D; expires=Tue, 08 Nov 2022 06:03:02 GMT; path=; domain=.realsrv.com;
Content-Encoding: gzip

GET
H/1.1 200
OK autosurf_if.php
manyhit.com/ Frame EC96 0
0 174ms
174ms Document
text/html 162.213.255.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://manyhit.com/autosurf_if.php?user=speedflow
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Server: 162.213.255.36 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server145-4.web-hosting.com
Software: Apache / PHP/5.4.45
Resource Hash

Request headers

Host: manyhit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/

Response headers

date: Sun, 08 Nov 2020 06:03:02 GMT
server: Apache
x-powered-by: PHP/5.4.45
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: PHPSESSID=c0485419c7a667fee305cbd6992d075f; path=/
vary: Accept-Encoding
content-encoding: gzip
content-length: 1269
content-type: text/html

GET
H/1.1

200
OK

47382 Show response
traffdaq.com/delivery/dl/
Redirect Chain

http://traffdaq.com/delivery/dl/47382?category=gay
https://traffdaq.com/delivery/dl/47382?category=gay

3 KB
2 KB

1951ms
1756ms

Document
text/html

107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/dl/47382?category=gay
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: 89bb7b389ca18dd47ee76dd01ce8810ece896c7a57285db6a2c6951f89279f4a

Request headers

Host: traffdaq.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/adult/?a=rr

Response headers

Server: nginx/1.16.1 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: no-cache
Date: Sun, 08 Nov 2020 06:03:04 GMT
Content-Encoding: gzip

Redirect headers

Content-length: 0
Location: https://traffdaq.com/delivery/dl/47382?category=gay
Connection: close

GET
H/1.1 200
OK eyJpdiI6IkFoVXY1TlZVQ1paRmw2amJUU1RRb2c9PSIsInZhbHVlIjoiQkw2SHNQbjVYYjQzS2YzN3dFcDRFM21Jc2xSN3l4SWNqbWpvcEZla1wvOE9zb3Rpd1dBVEpNT0xwV3ZuWlJFVUtLQWkzbzFKSVI1YlRUZ0dySGwxdjFRPT0iLCJtYWMiOiJjOTU0NjU1Y...
traffdaq.com/users/track/ 0
858 B 744ms
545ms Image
text/html 107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traffdaq.com/users/track/eyJpdiI6IkFoVXY1TlZVQ1paRmw2amJUU1RRb2c9PSIsInZhbHVlIjoiQkw2SHNQbjVYYjQzS2YzN3dFcDRFM21Jc2xSN3l4SWNqbWpvcEZla1wvOE9zb3Rpd1dBVEpNT0xwV3ZuWlJFVUtLQWkzbzFKSVI1YlRUZ0dySGwxdjFRPT0iLCJtYWMiOiJjOTU0NjU1Y2NlZGMwNWNhNWViMGRiOTIxMWM5YTc1MmNjNGM5MjYzMmY2OTAwNTRjMmFjYjBmYmU2OTVlMTQ5In0%3D
Requested by: Host: traffdaq.com
URL: https://traffdaq.com/delivery/dl/47382?category=gay
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:05 GMT
Cache-Control: no-cache
Server: nginx/1.16.1 (Ubuntu)
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 401 implement.js
c.securepaths.com/js/ 0
0 31ms
30ms Script
application/javascript 35.190.72.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c.securepaths.com/js/implement.js?org=FziBhN0qA1aE5tBQrQLl&s=5fa78a183fefe&p=TDQ47382&a=47382&cmp=47382&rd=http%3A%2F%2Fspeedflow.io%2F&rt=click&sl=0&stId=0&ty=l

Requested by

Host: traffdaq.com
URL: https://traffdaq.com/delivery/dl/47382?category=gay

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.72.161 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

161.72.190.35.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 Nov 2020 06:03:04 GMT
via: 1.1 google
status: 401
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
x-xss-protection: 0
expires: 0

GET
H2 200 fingerprint2.min.js Show response
cdn.jsdelivr.net/fingerprintjs2/1.4.0/ 33 KB
10 KB 6ms
5ms Script
application/javascript 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/fingerprintjs2/1.4.0/fingerprint2.min.js

Requested by

Host: traffdaq.com
URL: https://traffdaq.com/delivery/dl/47382?category=gay

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 899373
x-cache: HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 10191
etag: W/"83f3-ijg3WuTgKQH1Hch06eHdIajrA24"
x-served-by: cache-fra19160-FRA
date: Sun, 08 Nov 2020 06:03:04 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK 47382 Show response
traffdaq.com/delivery/directlink/ 2 KB
1 KB 2875ms
2688ms Document
text/html 107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6InFDMFVXVmtnd3F2a2dSUTkrSUNBUHc9PSIsInZhbHVlIjoieWQ3QWlIZ3hkdjdaTzJBd3B1bDNlVG10N2RuVjh4ZU5iU1F4ZHRHaFpMSlBzZkZjQVwvWUhYdDJtN1ZBTm5ZYzZxdTVcL1wvb1owNFlBeDUzT2xRTURZRDdUcjdsaG9VdmtHeUxvWFRmcXIzMGZFeXJEUTM0S05CdTFJdTdXMERzR0tRdnM0cll0cXdyVXFma3U0K2RpZlJKMlM1S3JOQ3hrNnl6djNVZXIwcW1HYUhueWJ2cDZcL0s4UUlCWFR6N3RSSlZGa2k0K1wvcjd3cHk1ZXIwaTk2dVdjT2wyUUVZdFJIZFJnMFZhNVBcLzBka281YnowYk1LMGErNjdzZXVmUHBjZE1uQ25tYXFBRisrbjNwcHVoQlwvWk52WGZoNnZWY1ozbzgrMWs5Rm1YUnJNPSIsIm1hYyI6IjAzMGE4MDk5YjQ0ZTdmNmMzMWU5YzIyZWU2NzdhZjY2ZGZjYzI5ODExNTU5MWIxMGI3Y2Q2OTM1ZTI4ZWZkN2UifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8
Requested by: Host: traffdaq.com
URL: https://traffdaq.com/delivery/dl/47382?category=gay
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: cc40fc10c663f6ca27e436a1f6a7b67ff7c0e756e38c8af989a5c97c70f7a5fa

Request headers

Host: traffdaq.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://traffdaq.com/delivery/dl/47382?category=gay
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: tdqct=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://traffdaq.com/delivery/dl/47382?category=gay

Response headers

Server: nginx/1.16.1 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: no-cache
Date: Sun, 08 Nov 2020 06:03:07 GMT
Content-Encoding: gzip

GET
H2

200

1opva Show response
tr.im/
Redirect Chain

http://tr.im/1opva
https://tr.im/1opva

9 KB
3 KB

6194ms
6179ms

Document
text/html

2606:4700:3035::ac43:9ef3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.im/1opva

Requested by

Host: traffdaq.com
URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6InFDMFVXVmtnd3F2a2dSUTkrSUNBUHc9PSIsInZhbHVlIjoieWQ3QWlIZ3hkdjdaTzJBd3B1bDNlVG10N2RuVjh4ZU5iU1F4ZHRHaFpMSlBzZkZjQVwvWUhYdDJtN1ZBTm5ZYzZxdTVcL1wvb1owNFlBeDUzT2xRTURZRDdUcjdsaG9VdmtHeUxvWFRmcXIzMGZFeXJEUTM0S05CdTFJdTdXMERzR0tRdnM0cll0cXdyVXFma3U0K2RpZlJKMlM1S3JOQ3hrNnl6djNVZXIwcW1HYUhueWJ2cDZcL0s4UUlCWFR6N3RSSlZGa2k0K1wvcjd3cHk1ZXIwaTk2dVdjT2wyUUVZdFJIZFJnMFZhNVBcLzBka281YnowYk1LMGErNjdzZXVmUHBjZE1uQ25tYXFBRisrbjNwcHVoQlwvWk52WGZoNnZWY1ozbzgrMWs5Rm1YUnJNPSIsIm1hYyI6IjAzMGE4MDk5YjQ0ZTdmNmMzMWU5YzIyZWU2NzdhZjY2ZGZjYzI5ODExNTU5MWIxMGI3Y2Q2OTM1ZTI4ZWZkN2UifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:9ef3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/5.6.28-1+deb.sury.org~xenial+1

Resource Hash

899d836fa7235efedd7b3614f496744880d1a7c540f6030e03b36ecd1e962568

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: tr.im
:scheme: https
:path: /1opva
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dff80ed626230dbf423f51fd284db20541604815387
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6InFDMFVXVmtnd3F2a2dSUTkrSUNBUHc9PSIsInZhbHVlIjoieWQ3QWlIZ3hkdjdaTzJBd3B1bDNlVG10N2RuVjh4ZU5iU1F4ZHRHaFpMSlBzZkZjQVwvWUhYdDJtN1ZBTm5ZYzZxdTVcL1wvb1owNFlBeDUzT2xRTURZRDdUcjdsaG9VdmtHeUxvWFRmcXIzMGZFeXJEUTM0S05CdTFJdTdXMERzR0tRdnM0cll0cXdyVXFma3U0K2RpZlJKMlM1S3JOQ3hrNnl6djNVZXIwcW1HYUhueWJ2cDZcL0s4UUlCWFR6N3RSSlZGa2k0K1wvcjd3cHk1ZXIwaTk2dVdjT2wyUUVZdFJIZFJnMFZhNVBcLzBka281YnowYk1LMGErNjdzZXVmUHBjZE1uQ25tYXFBRisrbjNwcHVoQlwvWk52WGZoNnZWY1ozbzgrMWs5Rm1YUnJNPSIsIm1hYyI6IjAzMGE4MDk5YjQ0ZTdmNmMzMWU5YzIyZWU2NzdhZjY2ZGZjYzI5ODExNTU5MWIxMGI3Y2Q2OTM1ZTI4ZWZkN2UifQ%3D%3D&fp=66abd220fd1aeed21a48c2d9b60f0bf8

Response headers

status: 200
date: Sun, 08 Nov 2020 06:03:14 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/5.6.28-1+deb.sury.org~xenial+1
cache-control: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
cf-request-id: 06480c95ab00002c3a55958000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
set-cookie: __cf_bm=2b80d65584f225b211a0e296072f46509083fbef-1604815394-1800-AUPsXULQHD8BBLnoAoReyD8pRdwbPIJgwI6YRMcV6rHG5J2+p6X6yX0FOjJOsiAoRRppMcwgevkNhS5xD1tTB6U=; path=/; expires=Sun, 08-Nov-20 06:33:14 GMT; domain=.tr.im; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KKD2tmsdZjNpEZ4zIshJJgn0EBXdL3ZM0q8eKksa03UXXCm4c5WjgJVu35XhAv0ywutMNFFUurJVehxdLrPGFBTmfdRtRWKjpy0JBfJJ1vnFhg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5eed16cf7e232c3a-FRA
content-encoding: br

Redirect headers

Date: Sun, 08 Nov 2020 06:03:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dff80ed626230dbf423f51fd284db20541604815387; expires=Tue, 08-Dec-20 06:03:07 GMT; path=/; domain=.tr.im; HttpOnly; SameSite=Lax __cf_bm=4892cd634d3317eac12cf8eba5f2ec7172b41db4-1604815388-1800-AdDHaAhv7vldqP+aXvdpN3sWcgoKrhn5vrZxE2TUyWjhAHA5CZd1XuLIg5FcXl6o2NQE+1kL4MzNW1BWt05UB7g=; path=/; expires=Sun, 08-Nov-20 06:33:08 GMT; domain=.tr.im; HttpOnly; SameSite=None
Location: https://tr.im/1opva
CF-Cache-Status: DYNAMIC
cf-request-id: 06480c943600002c32c8b1b000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vc8jCnn5R1I44QNMBaB67m8ma9uG%2B4Qm%2FT0YA21e1hxv62jX0%2FvFLL6LTPHq79FsfLbpivg8jfaWmHXTEc%2FZNjc%2FhltZ9cURgKqJMvqu5Ezwrg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 5eed16cd2fcc2c32-FRA

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 131 KB
45 KB 45ms
22ms Script
text/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e83b2cdd58cbb5bc2b28882b64aa965231f491804d497999763ba8df84282910

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45426
x-xss-protection: 0
server: cafe
etag: 10562869928832476540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 38ms
15ms Script
application/javascript 2a00:1450:4001:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-139146315-9

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6d00421703479478838ab557ed3ed0785c83227cbd7a2e1528f347c752b9180

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38327
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 55 KB
18 KB 110ms
39ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

c8e84928f85600eb9ebdb568154749d211a9d59ab2195ba2483eabb2090c627b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "687 / 174 of 1000 / last-modified: 1604704676"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18264
x-xss-protection: 0
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 157 KB
24 KB 30ms
9ms Stylesheet
text/css 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 May 2020 17:29:51 GMT
status: 200
etag: "1589304591"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 23841

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
624 B 17ms
15ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a3120d4bddcbcde8e4f0e0088646c6ab2c06e11d21257d238748f6ac76c51417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 08 Nov 2020 06:03:14 GMT
server: ESF
date: Sun, 08 Nov 2020 06:03:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H2 200 style.css
tr.im/bundles/trim/ad-page-072020/css/ 2 KB
903 B 18ms
16ms Stylesheet
text/css 2606:4700:3035::ac43:9ef3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.im/bundles/trim/ad-page-072020/css/style.css

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:9ef3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8234f5e5b2933912bf30cbcff6aade9d5f5a2dbe15d44937c13b46090d1f1498

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7066
status: 200
cf-request-id: 06480caddf00002c3a869f3000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: W/"5f7c1bb9-813"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TcE7XGPIZp0R%2F7j2O%2BZUY1uz%2BWHzz0e2xxYWqtFCBcqhsg3m08mkCQ32yJgN9byNOh%2Focn%2F32UKvVjZ9p3sgO3ElDN8W78lxu3v2IwfT0%2FJFZg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5eed16f639742c3a-FRA

GET
H2 200 logo.png
tr.im/bundles/trim/ad-page-072020/images/ 5 KB
5 KB 12ms
11ms Image
image/png 2606:4700:3035::ac43:9ef3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.im/bundles/trim/ad-page-072020/images/logo.png

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:9ef3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

317b57b8207135b3223181d14cf2e213bf0b7a0050a3e2f92a48c26f13703365

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7066
status: 200
content-length: 4650
cf-request-id: 06480caddf00002c3a55b10000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: "5f7c1bb9-122a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=02hRh9atZvb1gQ%2BFCCnxBpR4PJGTzIfFw7ae%2BfLkMgWAcdWmjLWUnA1d%2FDfDQvwty5H9g%2BSvsIwdTw7cM60Bybsldv2I7qnwD9lToDxl6tWIPA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5eed16f639782c3a-FRA

GET
H2 200 feature.png
tr.im/bundles/trim/ad-page-072020/images/ 14 KB
15 KB 13ms
12ms Image
image/png 2606:4700:3035::ac43:9ef3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.im/bundles/trim/ad-page-072020/images/feature.png

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:9ef3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3a2ed372eb25f036218e1cf130657ba79eff86384c1292bb16c95e4d34af5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7066
status: 200
content-length: 14664
cf-request-id: 06480caddf00002c3a6917d000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: "5f7c1bb9-3948"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vjHSwslDt0odOtRiLRNFHi%2B9RkQ7FYlHXWRA1XImc0WX4Dt8hVp9gOf1u3YYsTyNk8uj%2BAqt70v6etox1fCgHJCt%2Fw70FbOWQMQesSeokvsX8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5eed16f639792c3a-FRA

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 22:12:55 GMT
x-content-type-options: nosniff
last-modified: Thu, 05 Nov 2020 22:01:44 GMT
server: sffe
age: 201019
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7776
x-xss-protection: 0
expires: Fri, 05 Nov 2021 22:12:55 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 22:12:55 GMT
x-content-type-options: nosniff
last-modified: Thu, 05 Nov 2020 22:01:13 GMT
server: sffe
age: 201019
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
expires: Fri, 05 Nov 2021 22:12:55 GMT

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/ 230 KB
87 KB 56ms
42ms Script
text/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22f38713e3cb086adc05ce7b3f126b1a3c18d0bd120bafd17c85117de81741b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 88225
x-xss-protection: 0
server: cafe
etag: 10001109163846534958
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/ Frame DB2E 0
0 7ms
6ms Document
text/html 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201104/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1opva
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Sat, 07 Nov 2020 18:54:19 GMT
expires: Sat, 21 Nov 2020 18:54:19 GMT
content-type: text/html; charset=UTF-8
etag: 5228831996244654541
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4745
x-xss-protection: 0
age: 40135
cache-control: public, max-age=1209600
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-139146315-9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 2846
date: Sun, 08 Nov 2020 05:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Sun, 08 Nov 2020 07:15:48 GMT

GET
H3-Q050 200 pubads_impl_2020110401.js Show response
securepubads.g.doubleclick.net/gpt/ 277 KB
98 KB 86ms
49ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020110401.js?21068477

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

9008854b291ccca39167cc572535eb078a759ce6f2b20d55bfaf7d3b66f993ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99491
x-xss-protection: 0
last-modified: Wed, 04 Nov 2020 09:40:09 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Nov 2020 06:03:14 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
49 B 13ms
13ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=654545040&t=pageview&_s=1&dl=https%3A%2F%2Ftr.im%2F1opva&ul=en-us&de=UTF-8&dt=Best%20Sponsored%20Links&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=938640956&gjid=797448575&cid=1698864730.1604815394&tid=UA-139146315-9&_gid=169828627.1604815394&_r=1&gtm=2ouas1&z=2007931502

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 08 Nov 2020 06:03:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://tr.im
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 195 B
404 B 38ms
37ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=tr.im&callback=_gfp_s_&client=ca-pub-1229858928340193

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

263b3d717068c0c646f2247b7a5070b0d380c1ba823f848524a6eb438d5fa426

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 189
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
832 B 35ms
16ms Script
application/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=tr.im

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
832 B 36ms
16ms Script
application/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=tr.im

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 12CB 0
0 29ms
28ms Document
text/html 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1604815394&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1opva&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604815394382&bpp=11&bdt=127&idt=125&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=894487512954&frm=20&pv=2&ga_vid=1698864730.1604815394&ga_sid=1604815395&ga_hid=654545040&ga_fc=0&iag=0&icsg=10410&dssz=17&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=2497149031344260&pem=559&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=151

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1604815394&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1opva&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604815394382&bpp=11&bdt=127&idt=125&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=894487512954&frm=20&pv=2&ga_vid=1698864730.1604815394&ga_sid=1604815395&ga_hid=654545040&ga_fc=0&iag=0&icsg=10410&dssz=17&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=2497149031344260&pem=559&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=151
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1opva
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 08 Nov 2020 06:03:14 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 08-Nov-2020 06:18:14 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Sun, 08 Nov 2020 06:03:14 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b67b0772cddf8915ec85788e361a4331fbdcc4bcf7656b9d6aa4299b5b470f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1604665402527796"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27920
x-xss-protection: 0
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 8 KB
4 KB 79ms
78ms XHR
text/plain 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2497149031344260&correlator=3215863978718791&output=ldjh&impl=fifs&eid=21068474%2C21068476%2C21068477%2C21065113%2C21067448%2C21068418&vrg=2020110401&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201108&iu_parts=7421032%2Ctr.im_top_banner%2Ctr.im_300x250%2Ctr.im_intermediary_ad_unit&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x100%7C728x90%7C320x50%2C300x250%2C1x1&cookie_enabled=1&bc=31&abxe=1&lmt=1604815394&dt=1604815394574&dlt=1604815394256&idt=300&frm=20&biw=1600&bih=1200&oid=3&adxs=640%2C650%2C0&adys=128%2C326%2C1473&adks=3911691608%2C2859235672%2C716300676&ucis=1%7C2%7C3&ifi=1&u_tz=60&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftr.im%2F1opva&dssz=18&icsg=534698&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100%7C300x250%7C1600x1473&msz=1600x100%7C300x-1%7C1x-1&ga_vid=1698864730.1604815394&ga_sid=1604815395&ga_hid=654545040&fws=0%2C0%2C0&ohw=0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020110401.js?21068477

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

b8a4a485e616667752c78e1619759c6a31863ea80a38b9d83509a5894a0f42d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3121
x-xss-protection: 0
google-lineitem-id: 5459744855,5448126947,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138321056366,138319698993,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://tr.im
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 84ms
14ms Other
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020110401.js?21068477
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 46ms
33ms XHR
application/json 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201104&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d83897a8a1f2026717e29dd5d5336b555d97e61826b8c8afdc1b889eb5931e06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6417
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 62ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Sun, 08 Nov 2020 06:03:14 GMT

GET
H3-Q050 200 container.html
b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 6F0A 0
0 34ms
20ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020110401.js?21068477

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1opva
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Sun, 08 Nov 2020 06:03:14 GMT
expires: Mon, 08 Nov 2021 06:03:14 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html
b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 5A24 0
0 31ms
21ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020110401.js?21068477

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1opva
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Sun, 08 Nov 2020 06:03:14 GMT
expires: Mon, 08 Nov 2021 06:03:14 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame FA01 0
0 34ms
21ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1opva
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Sun, 08 Nov 2020 01:10:41 GMT
expires: Mon, 08 Nov 2021 01:10:41 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 17553
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
87 B 15ms
15ms Image
image/gif 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201104&jk=2497149031344260&bg=!SUqlSmrNAAXuKKZk7lixjfmwNRm8xgIAAABqUgAAAAtoAQcKAX5ScIaAYKiZfEObJDXT3bP98iKdPlOB9Eqs99wDqHoe5iIdLoqOATM9_DnhfB2taR90pLnieGavxhfD8GTy-_70TxYFy1_tWPptio6LcpbVoO52pQi9l3LR5yuFG1xP02rmvNXAKtxvG1E451jODpkp-5enjCyct28PvDt0wJEuFat4jiPS7ffgDg9qdjLM68BFkipDc5H4r6V8XVuOHsUb9PXpMEWUCtI_SK47PbHN09PV9semmpoQH16xdctrADjL8tVRllFdZzOIOM5YyB75j--O4zGH7mjVrSa3y2Xp3t_El4UMvPXsc-1QERVkNcxp_Az3F5_x37pkLM3zXY2X3AcjdrLu8Ry9-siHM_ktEN5MJ5zfNHiSh04k3D1ot1wQZUlkbBPMnKMb0VEGV4tHtN2xa2zJzSMx3CftISAREs-PcXvJ7dyxrwkrxVtKUYxSf4FGKHdyZstP0JfE_Uef54Kq9Gp8AT_n4aY5s_gFyKEa7WsKiMfrBZTLXufjmQGuRiUFb72GxEIqJ2gNysIznp-5Ru77oTh_7VVLV1zYxMgoYOmLEISGzMtvYkBpptiRPR_Bam9PskLHcCiikU7uxAZV-uv7SmPUDTUhurXW8Sx3tnP6TcSLZMq_AmosXAEWP953mD1WGamZtvlWIctF9rtChjoanXe4Xjb_JJ05WV959BejIQ2RnxK19p7jxwRHyAC4GYtWtbCdGMnsdFeMWYvgkTMU1VSOc6MDSMhQNceaPZgS_nZ0LxqOetMODI3pmpntD8NWsl9AJlv5mUVKXmIMCiqkQDz0ys5jVAcxe9cTmfmf0aZ9Vp0CysZSD4v34wHYz-sI9ZITn3UY2p6GRBwO5BIdG_QS-qPcW6pID5OLgspiI-75rX1dO8N_kaBgoxk5iTDFET8kXrmr1cOVGidvDc3D9-pQreV1rTKHHm4Vfpr9lluldYXkXJ4c8dcgtMP8azcbvPRdd2RvyZ0gWgfwddG7GSXLAyHhHKnEId4rtGkzZ_MpPNBcBmhhCgxcfEd88-P7EIMI8soBnP3AdSsAiipekKBRoPIZbN7HMaRJJWofazbTSU_MRjAOTQ

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 Nov 2020 06:03:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

Primary Request serve.php Show response
wap4dollar.com/ad/nonadult/
Redirect Chain

http://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

1 KB
985 B

102ms
34ms

Document
text/html

167.86.92.34
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Requested by

Host: tr.im
URL: https://tr.im/1opva

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

167.86.92.34 Nuremberg, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

vmi301782.contaboserver.net

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

cdcd3baa13f9188929e47c6c27810d17e58eb4afdc61034f40ba6bcae6fa0e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: wap4dollar.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1opva

Response headers

Server: nginx/1.14.0 (Ubuntu)
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
X-DNS-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
ETag: W/"409-J9a0ujFizb992dpU81v2/np1Fts"
Content-Encoding: gzip

Redirect headers

Server: nginx/1.14.0 (Ubuntu)
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Type: text/html
Content-Length: 194
Connection: keep-alive
Location: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

GET
H/1.1 200
OK tag.min.js Show response
propu.sh/pfe/current/ 39 KB
11 KB 125ms
52ms Script
application/javascript 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/pfe/current/tag.min.js?z=2933063
Requested by: Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 3d0e796c7da983002ccfe308d38910e1014af204bd37b3fe661ea3c1d81d8671

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-9ab7"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H/1.1 200
OK brt.js Show response
2cnjuh34jbpoint.com/t/9/fret/meow4/1367352/ 63 KB
26 KB 162ms
52ms Script
application/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://2cnjuh34jbpoint.com/t/9/fret/meow4/1367352/brt.js

Requested by

Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_CBC

Server

109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),

Reverse DNS

83.162.serverel.net

Software

nginx /

Resource Hash

ac370e6457a165ea1c416d6fa1888a74ac6d2e9e463d82a5e26a9473a4555b6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 02 Nov 2020 13:08:05 GMT
Server: nginx
ETag: W/"5fa004b5-fd47"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK / Show response
wap4dollar.com/ad/code/ 432 B
1 KB 37ms
36ms Script
application/javascript 167.86.92.34
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://wap4dollar.com/ad/code/?id=ilmty02q81

Requested by

Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

167.86.92.34 Nuremberg, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

vmi301782.contaboserver.net

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

0473b1bc52b4929cfed2037b301f9c67afe4dd306eb73a665635fb63b22f2bbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.14.0 (Ubuntu)
X-Frame-Options: SAMEORIGIN
ETag: W/"1b0-5kIdxSTmP8ixMtw/G3KdP22w3PQ"
X-Download-Options: noopen
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-DNS-Prefetch-Control: off
Content-Length: 432
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK / Show response
wap4dollar.com/ad/codex/ 432 B
1 KB 75ms
36ms Script
application/javascript 167.86.92.34
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://wap4dollar.com/ad/codex/?id=ilmty02q81

Requested by

Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

167.86.92.34 Nuremberg, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

vmi301782.contaboserver.net

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

0473b1bc52b4929cfed2037b301f9c67afe4dd306eb73a665635fb63b22f2bbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.14.0 (Ubuntu)
X-Frame-Options: SAMEORIGIN
ETag: W/"1b0-5kIdxSTmP8ixMtw/G3KdP22w3PQ"
X-Download-Options: noopen
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-DNS-Prefetch-Control: off
Content-Length: 432
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK / Show response
wap4dollar.com/ad/pops/ 2 KB
3 KB 100ms
34ms Script
application/javascript 167.86.92.34
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://wap4dollar.com/ad/pops/?id=ilmty02q81

Requested by

Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

167.86.92.34 Nuremberg, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

vmi301782.contaboserver.net

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

61bf6d2675bfd035c164d6a68b5e983077f93d8d1d4c3253012c6da7e894ea0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.14.0 (Ubuntu)
X-Frame-Options: SAMEORIGIN
ETag: W/"9c4-GDYefU71cvor8bzOnUuDUTtQhTQ"
X-Download-Options: noopen
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-DNS-Prefetch-Control: off
Content-Length: 2500
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK tag.min.js Show response
iclickcdn.com/ 81 KB
26 KB 105ms
46ms Script
application/javascript 178.162.156.37
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://iclickcdn.com/tag.min.js
Requested by: Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.162.156.37 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: hosted-by.leaseweb.com
Software: nginx /
Resource Hash: 18805631bdb46d9e98a0a48f14ce30d4242c62694153a8f9ff7b00f575028303

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Connection: keep-alive
Content-Length: 25509
X-Trace-Id: 36d489c58833b552bba204772ae66c08
Pragma: no-cache
Last-Modified: Fri, 06 Nov 2020 09:55:22 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding
Expires: Mon, 09 Nov 2020 06:03:24 GMT

GET
H/1.1 200
OK zone Show response
propu.sh/ 757 B
1 KB 36ms
35ms Fetch
application/json 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://propu.sh/zone?pub=0&zone_id=2933063&is_mobile=false&domain=wap4dollar.com&var=&ymid=&var_3=

Requested by

Host: propu.sh
URL: https://propu.sh/pfe/current/tag.min.js?z=2933063

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

7efb013b8ab17bbe346753a1c313a30a90fae4ade5ad8e1e6f4a0c83b3e14a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Trace-Id: 1bb07b608a560445eff4a7a66751e58c
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 757

GET
H/1.1 200
OK universal.min.js Show response
propu.sh/pfe/current/ 190 KB
54 KB 106ms
49ms Fetch
application/javascript 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/pfe/current/universal.min.js?v=3.1.276
Requested by: Host: propu.sh
URL: https://propu.sh/pfe/current/tag.min.js?z=2933063
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 07bbf1d1d1cb00c0b7eb00af354b3cb43123d588fc8b435fb1d7842a4be92e04

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-2f7b2"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H/1.1 200
OK tag.min.js Show response
pushsar.com/pfe/current/ 39 KB
11 KB 107ms
46ms Script
application/javascript 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077
Requested by: Host: wap4dollar.com
URL: https://wap4dollar.com/ad/code/?id=ilmty02q81
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 3d0e796c7da983002ccfe308d38910e1014af204bd37b3fe661ea3c1d81d8671

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-9ab7"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H2 200 dl.png
mailbd.net/ 13 KB
13 KB 141ms
60ms Image
image/png 62.171.173.170
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mailbd.net/dl.png
Requested by: Host: wap4dollar.com
URL: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.171.173.170 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: plesk.bdwebhost.net
Software: nginx / PleskLin
Resource Hash: f3176b04e55891d79dbfe10cee3ff48070518e6c8fb95ce836db4bb6794253f6

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 06:03:24 GMT
last-modified: Mon, 10 Aug 2020 13:54:55 GMT
server: nginx
x-powered-by: PleskLin
etag: "5f3151af-32bf"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 12991

GET
H/1.1 200
OK apu.php Show response
bedrapiona.com/ 3 KB
2 KB 119ms
32ms XHR
application/json 139.45.197.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bedrapiona.com/apu.php?oo=1&zoneid=104152

Requested by

Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

139.45.197.8 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

89285566f0fcaee1cee8ae76e7129db35351dea572541d1e81c8559809f3950e

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: keep-alive
X-Trace-Id: 35ebea3b7ab97fd983ea90c1df4188d5
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=1
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *, *
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding
Expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H/1.1 200
OK zone Show response
pushsar.com/ 716 B
1 KB 30ms
29ms Fetch
application/json 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pushsar.com/zone?pub=0&zone_id=2933077&is_mobile=false&domain=wap4dollar.com&var=&ymid=&var_3=

Requested by

Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

0d0ec3b5525eace83717346e879076f9455fb81ab3143bb8027c5fd710f1171c

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Trace-Id: 9288f5df9baec6b58196700e3d49d79f
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 716

GET
H/1.1 200
OK universal.min.js Show response
pushsar.com/pfe/current/ 190 KB
54 KB 106ms
48ms Fetch
application/javascript 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pushsar.com/pfe/current/universal.min.js?v=3.1.276
Requested by: Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 07bbf1d1d1cb00c0b7eb00af354b3cb43123d588fc8b435fb1d7842a4be92e04

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-2f7b2"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H/1.1 200
OK zone Show response
pushsar.com/ 716 B
1 KB 57ms
30ms Fetch
application/json 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pushsar.com/zone?pub=0&zone_id=2933077&is_mobile=false&domain=wap4dollar.com&var=&ymid=&var_3=

Requested by

Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

0d0ec3b5525eace83717346e879076f9455fb81ab3143bb8027c5fd710f1171c

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Trace-Id: 3a1266a1cce4eb0ae5ec5533beb23a7f
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 716

GET
H/1.1 200
OK universal.min.js Show response
pushsar.com/pfe/current/ 190 KB
54 KB 105ms
48ms Fetch
application/javascript 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pushsar.com/pfe/current/universal.min.js?v=3.1.276
Requested by: Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 07bbf1d1d1cb00c0b7eb00af354b3cb43123d588fc8b435fb1d7842a4be92e04

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-2f7b2"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H/1.1 200
OK zone Show response
pushsar.com/ 716 B
1 KB 83ms
29ms Fetch
application/json 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pushsar.com/zone?pub=0&zone_id=2933077&is_mobile=false&domain=wap4dollar.com&var=&ymid=&var_3=

Requested by

Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

0d0ec3b5525eace83717346e879076f9455fb81ab3143bb8027c5fd710f1171c

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Trace-Id: fabed510c042b35c6ba5ab4a09fa4e9f
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 716

GET
H/1.1 200
OK universal.min.js Show response
pushsar.com/pfe/current/ 190 KB
54 KB 123ms
55ms Fetch
application/javascript 139.45.196.130
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pushsar.com/pfe/current/universal.min.js?v=3.1.276
Requested by: Host: pushsar.com
URL: https://pushsar.com/pfe/current/tag.min.js?z=2933077
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.130 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: 07bbf1d1d1cb00c0b7eb00af354b3cb43123d588fc8b435fb1d7842a4be92e04

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-2f7b2"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

OPTIONS
H/1.1 200
OK custom
propu.sh/ Frame 0
0 28ms
28ms Other
text/plain 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/custom
Protocol: HTTP/1.1
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://wap4dollar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 86400

POST
H/1.1 200
OK custom Show response
propu.sh/ 39 B
489 B 37ms
37ms Fetch
application/json 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://propu.sh/custom

Requested by

Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Trace-Id: 3986499fc247ed636335120b01cf1cdd
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 39

GET
H/1.1 200
OK gid.js Show response
my.rtmark.net/ 65 B
772 B 115ms
29ms Fetch
application/json 139.45.195.162
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=b205ab5ddb6c4354a2f396052119bc73&zoneId=2933063&checkDuplicate=true&ymid=&var=

Requested by

Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

139.45.195.162 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

247231cdc7183af8fc2d4091837ec1bea265b4dc8845ce64a4c95374d76aa666

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Expose-Headers: Authorization
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *, *
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
Content-Length: 65

OPTIONS
H/1.1 200
OK custom
propu.sh/ Frame 0
0 47ms
28ms Other
text/plain 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/custom
Protocol: HTTP/1.1
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://wap4dollar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 86400

POST
H/1.1 200
OK custom Show response
propu.sh/ 39 B
489 B 46ms
35ms Fetch
application/json 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://propu.sh/custom

Requested by

Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Trace-Id: 8aedcc3f914f24ba271bb742c6411491
Date: Sun, 08 Nov 2020 06:03:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 39

GET
H/1.1 204
No Content fac.php
onmarshtompor.com/ Frame AC80 0
0 121ms
30ms Document
text/html 139.45.195.150
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://onmarshtompor.com/fac.php

Requested by

Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

139.45.195.150 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Host: onmarshtompor.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://wap4dollar.com/ad/nonadult/serve.php?id=ilmty02q81&utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1opva&utm_content=direct_input

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 06:03:25 GMT
Content-Type: text/html; charset=utf8
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding
Pragma: no-cache
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 11 Jan 1994 10:00:00 GMT
Timing-Allow-Origin: * *
X-Trace-Id: fa2e968cd5f63870b5dbc26a785d8e0a
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK defaultSkin.min.js Show response
propu.sh/pfe/current/ 56 KB
19 KB 31ms
31ms Fetch
application/javascript 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/pfe/current/defaultSkin.min.js
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash: c357f597ae58b89b41335942c7de0b7082db6f6807e4f49c54def56673155488

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 Nov 2020 06:03:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Nov 2020 13:09:14 GMT
Server: nginx
ETag: W/"5fa1567a-de6b"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: https://wap4dollar.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
DATA 200
OK truncated
/ Frame 8237 255 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

OPTIONS
H/1.1 200
OK custom
propu.sh/ Frame 0
0 28ms
28ms Other
text/plain 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://propu.sh/custom
Protocol: HTTP/1.1
Server: 139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://wap4dollar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 06:03:25 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 86400

POST
H/1.1 200
OK custom Show response
propu.sh/ 39 B
489 B 35ms
35ms Fetch
application/json 139.45.196.132
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://propu.sh/custom

Requested by

Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.196.132 , Ascension Island, ASN9002 (RETN-AS, EU),

Reverse DNS

Software

nginx /

Resource Hash

ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Trace-Id: 3f865ff58d6978e58dadf7461450b39f
Date: Sun, 08 Nov 2020 06:03:25 GMT
X-Content-Type-Options: nosniff
Server: nginx
Strict-Transport-Security: max-age=1
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wap4dollar.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 39

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wap4dollar.com/	1969-12-31 23:59:59	Name: connect.sid Value: s%3ABYxYPNe2QBKCkAYHzLMuyAmS09Z5bxdf.QrCqo%2BnpmalLi2Sr98U7xOtyXdrfC1Wz3J%2B5UhctZG8

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 1) Message: SDK installer already started
console-api	log	(Line 1) Message: SDK installer already started
console-api	log	(Line 1) Message: SDK installer already started

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2cnjuh34jbpoint.com
a.realsrv.com
adservice.google.com
adservice.google.de
b610e31fa57a1090478960da87fef855.safeframe.googlesyndication.com
bedrapiona.com
c.securepaths.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
iclickcdn.com
mailbd.net
manyhit.com
my.rtmark.net
onmarshtompor.com
pagead2.googlesyndication.com
partner.googleadservices.com
propu.sh
pushsar.com
securepubads.g.doubleclick.net
speedflow.io
stackpath.bootstrapcdn.com
syndication.realsrv.com
tpc.googlesyndication.com
tr.im
traffdaq.com
wap4dollar.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
107.170.39.103
109.206.162.83
139.45.195.150
139.45.195.162
139.45.196.130
139.45.196.132
139.45.197.8
162.213.255.36
167.86.92.34
178.162.156.37
198.54.116.135
2001:4de0:ac19::1:b:1a
2001:4de0:ac19::1:b:1b
216.58.207.66
2606:4700:3035::ac43:9ef3
2a00:1450:4001:801::2003
2a00:1450:4001:801::200e
2a00:1450:4001:803::2001
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::200a
2a00:1450:4001:81d::2002
2a00:1450:4001:820::2008
2a04:4e42:3::621
35.190.72.161
62.171.173.170
95.211.229.245
0473b1bc52b4929cfed2037b301f9c67afe4dd306eb73a665635fb63b22f2bbb
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07bbf1d1d1cb00c0b7eb00af354b3cb43123d588fc8b435fb1d7842a4be92e04
0d0ec3b5525eace83717346e879076f9455fb81ab3143bb8027c5fd710f1171c
18805631bdb46d9e98a0a48f14ce30d4242c62694153a8f9ff7b00f575028303
22f38713e3cb086adc05ce7b3f126b1a3c18d0bd120bafd17c85117de81741b8
247231cdc7183af8fc2d4091837ec1bea265b4dc8845ce64a4c95374d76aa666
263b3d717068c0c646f2247b7a5070b0d380c1ba823f848524a6eb438d5fa426
317b57b8207135b3223181d14cf2e213bf0b7a0050a3e2f92a48c26f13703365
3d0e796c7da983002ccfe308d38910e1014af204bd37b3fe661ea3c1d81d8671
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033
61bf6d2675bfd035c164d6a68b5e983077f93d8d1d4c3253012c6da7e894ea0e
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7efb013b8ab17bbe346753a1c313a30a90fae4ade5ad8e1e6f4a0c83b3e14a2b
8234f5e5b2933912bf30cbcff6aade9d5f5a2dbe15d44937c13b46090d1f1498
886945a529bfc628436360861c47918ba8ec36b23061e3b44c269ee895d92f14
89285566f0fcaee1cee8ae76e7129db35351dea572541d1e81c8559809f3950e
899d836fa7235efedd7b3614f496744880d1a7c540f6030e03b36ecd1e962568
89bb7b389ca18dd47ee76dd01ce8810ece896c7a57285db6a2c6951f89279f4a
9008854b291ccca39167cc572535eb078a759ce6f2b20d55bfaf7d3b66f993ff
a3120d4bddcbcde8e4f0e0088646c6ab2c06e11d21257d238748f6ac76c51417
a6d00421703479478838ab557ed3ed0785c83227cbd7a2e1528f347c752b9180
ac370e6457a165ea1c416d6fa1888a74ac6d2e9e463d82a5e26a9473a4555b6d
ad3995ed8857c7c6c71609fb70c4c77bc564d9279424bc5b9945134720730d24
b67b0772cddf8915ec85788e361a4331fbdcc4bcf7656b9d6aa4299b5b470f9e
b8a4a485e616667752c78e1619759c6a31863ea80a38b9d83509a5894a0f42d2
c357f597ae58b89b41335942c7de0b7082db6f6807e4f49c54def56673155488
c8e84928f85600eb9ebdb568154749d211a9d59ab2195ba2483eabb2090c627b
cc40fc10c663f6ca27e436a1f6a7b67ff7c0e756e38c8af989a5c97c70f7a5fa
cdcd3baa13f9188929e47c6c27810d17e58eb4afdc61034f40ba6bcae6fa0e30
d3f814d49049b29143de2fccdbd97d0a1f0739e2554c482684c7c906b535ea43
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
d83897a8a1f2026717e29dd5d5336b555d97e61826b8c8afdc1b889eb5931e06
e3a2ed372eb25f036218e1cf130657ba79eff86384c1292bb16c95e4d34af5d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e83b2cdd58cbb5bc2b28882b64aa965231f491804d497999763ba8df84282910
f3176b04e55891d79dbfe10cee3ff48070518e6c8fb95ce836db4bb6794253f6
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881

wap4dollar.com Open in urlscan Pro 167.86.92.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

95 %HTTPS

42 %IPv6

27 Domains

31 Subdomains

27 IPs

5 Countries

769 kBTransfer

2244 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

wap4dollar.com Open in urlscan Pro
167.86.92.34 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

95 %
HTTPS

42 %
IPv6

27
Domains

31
Subdomains

27
IPs

5
Countries

769 kB
Transfer

2244 kB
Size

1
Cookies

65 HTTP transactions
1 data transactions