novelden.com Open in urlscan Pro
104.17.48.43 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://1000ulbs.com/
Effective URL:
https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&c...
Submission: On December 27 via api (December 27th 2019, 3:31:44 am UTC) from DE

Summary HTTP 33 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 5 countries across 13 domains to perform 33 HTTP transactions. The main IP is 104.17.48.43, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is novelden.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on November 25th 2019. Valid for: 6 months.

This is the only time novelden.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.0.7.30 52.0.7.30	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	54.209.22.226 54.209.22.226	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	18.195.71.253 18.195.71.253	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 3	99.198.108.194 99.198.108.194	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
1 3	107.6.174.196 107.6.174.196	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
1	104.26.7.83 104.26.7.83	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2	109.123.118.67 109.123.118.67	13213 (UK2NET-AS) (UK2NET-AS)
1	31.170.100.125 31.170.100.125	201942 (SOLTIA) (SOLTIA)
2 2	104.18.223.81 104.18.223.81	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
23	104.17.48.43 104.17.48.43	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
33	9

1 52.0.7.30 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-0-7-30.compute-1.amazonaws.com

1000ulbs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.209.22.226 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-209-22-226.compute-1.amazonaws.com

ortrun-adi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.71.253 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-71-253.eu-central-1.compute.amazonaws.com

declation-grateger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.198.108.194 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

x.letmeleadyou.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.6.174.196 (Amsterdam, Netherlands) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: bigfish.setupcentral.network

up.trkgenius.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.7.83 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

onwardinated.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 109.123.118.67 (Ilford, United Kingdom) 1 redirects

ASN13213 (UK2NET-AS, GB)
PTR: 118-67.topstaffsolutions.com

tr7ck.bruceleadx2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.170.100.125 (Spain)

ASN201942 (SOLTIA, ES)

mobi.billiwa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.223.81 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

routeserve.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 104.17.48.43 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

novelden.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	novelden.com novelden.com	429 KB
3	trkgenius.com 1 redirects up.trkgenius.com	4 KB
3	letmeleadyou.me 1 redirects x.letmeleadyou.me	4 KB
2	routeserve.info 2 redirects routeserve.info	1 KB
2	bruceleadx2.com 1 redirects tr7ck.bruceleadx2.com	3 KB
1	gstatic.com fonts.gstatic.com	9 KB
1	googletagmanager.com www.googletagmanager.com	19 KB
1	googleapis.com fonts.googleapis.com	748 B
1	billiwa.com mobi.billiwa.com	477 B
1	onwardinated.com onwardinated.com	4 KB
1	declation-grateger.com 1 redirects declation-grateger.com	854 B
1	ortrun-adi.com 1 redirects ortrun-adi.com	551 B
1	1000ulbs.com 1 redirects 1000ulbs.com	317 B
33	13

	Domain	Requested by
23	novelden.com	novelden.com
3	up.trkgenius.com	1 redirects x.letmeleadyou.me up.trkgenius.com
3	x.letmeleadyou.me	1 redirects x.letmeleadyou.me
2	routeserve.info	2 redirects
2	tr7ck.bruceleadx2.com	1 redirects onwardinated.com
1	fonts.gstatic.com	novelden.com
1	www.googletagmanager.com	novelden.com
1	fonts.googleapis.com	novelden.com
1	mobi.billiwa.com	tr7ck.bruceleadx2.com
1	onwardinated.com
1	declation-grateger.com	1 redirects
1	ortrun-adi.com	1 redirects
1	1000ulbs.com	1 redirects
33	13

This site contains no links.

Subject Issuer	Validity	Valid
up.trkgenius.com Let's Encrypt Authority X3	`2019-11-18` - `2020-02-16`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-15` - `2020-10-09`	a year	crt.sh
ads.conscier.com Let's Encrypt Authority X3	`2019-10-15` - `2020-01-13`	3 months	crt.sh
ssl918618.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-25` - `2020-06-02`	6 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
Frame ID: 562AE70AFDAAE7B12AFA0A83FBAD44B1
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://1000ulbs.com/ HTTP 302
http://ortrun-adi.com/1000ulbs.com?adTagId=5cd7fb70-175c-11ea-81fc-0a97765f9322&keywords=lightbulbs HTTP 302
http://declation-grateger.com/voluum/b70cd950-7cfb-40f6-aea8-1e0ba4739c8e?clickid=5dc9fb69-2859-11ea-9a2a-... HTTP 302
http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_a... Page URL
http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
http://x.letmeleadyou.me/proc.php?5ca36119484d09bdc181fc41164fd10e5c012d4b HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=677495652311524... Page URL
https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249... Page URL
https://up.trkgenius.com/out.php?v=731c8615246282a209a2a8ed08c19550 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf... Page URL
http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_... Page URL
http://tr7ck.bruceleadx2.com/ck_jump?id=cz0yOTg1NDQ2NjQ0MzQyNTI4NCZ0PTE1Nzc0MTc0ODkmaD0xODE1NzgzNzMw&__if... HTTP 302
https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836... Page URL
http://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149... HTTP 301
https://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149... HTTP 302
https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
html //i

Page Statistics

33
Requests

91 %
HTTPS

23 %
IPv6

13
Domains

13
Subdomains

9
IPs

5
Countries

471 kB
Transfer

772 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://1000ulbs.com/ HTTP 302
http://ortrun-adi.com/1000ulbs.com?adTagId=5cd7fb70-175c-11ea-81fc-0a97765f9322&keywords=lightbulbs HTTP 302
http://declation-grateger.com/voluum/b70cd950-7cfb-40f6-aea8-1e0ba4739c8e?clickid=5dc9fb69-2859-11ea-9a2a-12d10ccaf96f HTTP 302
http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq Page URL
http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e Page URL
http://x.letmeleadyou.me/proc.php?5ca36119484d09bdc181fc41164fd10e5c012d4b HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169 Page URL
https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169&m=L7WxsFOSHOHl6FpUAmzfxFEibC5Hw72rZQPwxEIr4NoLXFJSaAXJskwjqZIJH7Gmnngeu9D7IaDjk4ONuNknwEwv7vwnwEMQ79Xbwc7tHhkt7tJpfacRnBGNXP7cMk7PqQshfoppbCFpb7cVnoGV7vX3toHBPP Page URL
https://up.trkgenius.com/out.php?v=731c8615246282a209a2a8ed08c19550 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx Page URL
http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_id=17820&subid_spx=195885-SQQD_12D2GHvmSm1I3nW& Page URL
http://tr7ck.bruceleadx2.com/ck_jump?id=cz0yOTg1NDQ2NjQ0MzQyNTI4NCZ0PTE1Nzc0MTc0ODkmaD0xODE1NzgzNzMw&__if=0&__pm=0&__wv=0&__type=unknown&__deviceid= HTTP 302
https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3ODIwLEM6MjcyOTY%3D&externalid=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531 Page URL
http://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS HTTP 301
https://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS HTTP 302
https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://1000ulbs.com/ HTTP 302
http://ortrun-adi.com/1000ulbs.com?adTagId=5cd7fb70-175c-11ea-81fc-0a97765f9322&keywords=lightbulbs HTTP 302
http://declation-grateger.com/voluum/b70cd950-7cfb-40f6-aea8-1e0ba4739c8e?clickid=5dc9fb69-2859-11ea-9a2a-12d10ccaf96f HTTP 302
http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq

Request Chain 2

http://x.letmeleadyou.me/proc.php?5ca36119484d09bdc181fc41164fd10e5c012d4b HTTP 302
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

Request Chain 4

https://up.trkgenius.com/out.php?v=731c8615246282a209a2a8ed08c19550 HTTP 302
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx

Request Chain 6

http://tr7ck.bruceleadx2.com/ck_jump?id=cz0yOTg1NDQ2NjQ0MzQyNTI4NCZ0PTE1Nzc0MTc0ODkmaD0xODE1NzgzNzMw&__if=0&__pm=0&__wv=0&__type=unknown&__deviceid= HTTP 302
https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3ODIwLEM6MjcyOTY%3D&externalid=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531

33 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set / Show response
x.letmeleadyou.me/
Redirect Chain

http://1000ulbs.com/
http://ortrun-adi.com/1000ulbs.com?adTagId=5cd7fb70-175c-11ea-81fc-0a97765f9322&keywords=lightbulbs
http://declation-grateger.com/voluum/b70cd950-7cfb-40f6-aea8-1e0ba4739c8e?clickid=5dc9fb69-2859-11ea-9a2a-12d10ccaf96f
http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq

3 KB
2 KB

215ms
194ms

Document
text/html

99.198.108.194
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq
Protocol: HTTP/1.1
Server: 99.198.108.194 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/7.3.4
Resource Hash: 04f8d2e13a675fe9f0bdf49039f0a2e8eee4c72365d7f55ac9cb8610c5b958ed

Request headers

Host: x.letmeleadyou.me
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Fri, 27 Dec 2019 03:31:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.4
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: u=dd4b3d7a2381bb2255e4480318ed63db; expires=Sat, 26-Dec-2020 03:31:28 GMT; Max-Age=31536000; path=/
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Fri, 27 Dec 2019 03:31:28 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq
Pragma: no-cache
Set-Cookie: b70cd950-7cfb-40f6-aea8-1e0ba4739c8e-v4=b70cd950-7cfb-40f6-aea8-1e0ba4739c8e;Max-Age=86400;Expires=Sat, 28-Dec-2019 03:31:28 GMT;domain=declation-grateger.com;path=/;HttpOnly cc-v4=pp1zGh7d8lwbNHQuNOpWuyNxnPGBd3GqpxOyKBScSO1fvS3RDcEBxfae%2FETpU2JOlt4aVmLudAcm61134kadOCwdwNNsjcxHPG12xDy5e4ozNC451IkhZaXAPw05vqUKPebcp9JynXYFXSQPr09Prw%3D%3D;Max-Age=31536000;Expires=Sat, 26-Dec-2020 03:31:28 GMT;domain=declation-grateger.com;path=/;HttpOnly

GET
H/1.1 200
OK / Show response
x.letmeleadyou.me/ 5 KB
2 KB 128ms
128ms Document
text/html 99.198.108.194
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
Requested by: Host: x.letmeleadyou.me
URL: http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq
Protocol: HTTP/1.1
Server: 99.198.108.194 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: server04.com-2.mobi
Software: nginx / PHP/7.3.4
Resource Hash: b705525ebaf18234c8eff8c0fbb5a4a20d6c464c38574d540139f84fb25fa8a6

Request headers

Host: x.letmeleadyou.me
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq
Accept-Encoding: gzip, deflate
Cookie: u=dd4b3d7a2381bb2255e4480318ed63db
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://x.letmeleadyou.me/?utm_medium=d2ba35e633002f77cfb76c1d3b9f94640aed9491&utm_campaign=fallback_all&1=&2=&cid=wkp5atqbptd26bpr1nbbnoeq

Response headers

Server: nginx
Date: Fri, 27 Dec 2019 03:31:28 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.4
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Encoding: gzip

GET
H2

200

in.html Show response
up.trkgenius.com/
Redirect Chain

http://x.letmeleadyou.me/proc.php?5ca36119484d09bdc181fc41164fd10e5c012d4b
https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

6 KB
3 KB

84ms
27ms

Document
text/html

107.6.174.196
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

Requested by

Host: x.letmeleadyou.me
URL: http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

107.6.174.196 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

bigfish.setupcentral.network

Software

nginx/1.16.1 /

Resource Hash

7e11348d49a8eb6e7584fca5405c42b697353d4c8b6946ac4d57c4e17b0e0eaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: up.trkgenius.com
:scheme: https
:path: /in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://x.letmeleadyou.me/?utm_term=6774956523115249898&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e

Response headers

status: 200
server: nginx/1.16.1
date: Fri, 27 Dec 2019 03:31:28 GMT
content-type: text/html
last-modified: Sun, 27 Jan 2019 05:38:08 GMT
etag: W/"5c4d43c0-1605"
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

Redirect headers

Server: nginx
Date: Fri, 27 Dec 2019 03:31:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.4
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

GET
H2 200 in.php Show response
up.trkgenius.com/ 1 KB
984 B 41ms
40ms Document
text/html 107.6.174.196
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169&m=L7WxsFOSHOHl6FpUAmzfxFEibC5Hw72rZQPwxEIr4NoLXFJSaAXJskwjqZIJH7Gmnngeu9D7IaDjk4ONuNknwEwv7vwnwEMQ79Xbwc7tHhkt7tJpfacRnBGNXP7cMk7PqQshfoppbCFpb7cVnoGV7vX3toHBPP

Requested by

Host: up.trkgenius.com
URL: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

107.6.174.196 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

bigfish.setupcentral.network

Software

nginx/1.16.1 /

Resource Hash

6c551627918ddaafd572af352c6d3fae62eb130afe8789ffae0561cc6ed0b6d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: up.trkgenius.com
:scheme: https
:path: /in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169&m=L7WxsFOSHOHl6FpUAmzfxFEibC5Hw72rZQPwxEIr4NoLXFJSaAXJskwjqZIJH7Gmnngeu9D7IaDjk4ONuNknwEwv7vwnwEMQ79Xbwc7tHhkt7tJpfacRnBGNXP7cMk7PqQshfoppbCFpb7cVnoGV7vX3toHBPP
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://up.trkgenius.com/in.html?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169

Response headers

status: 200
server: nginx/1.16.1
date: Fri, 27 Dec 2019 03:31:28 GMT
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
pragma: no-cache
expires: 0
surrogate-control: no-store
refresh: 0; url=out.php?v=731c8615246282a209a2a8ed08c19550
set-cookie: t=51aa33160cf079af
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2

200

5a37c8ad-f104-11e5-9f1f-0626cc8adced Show response
onwardinated.com/c/
Redirect Chain

https://up.trkgenius.com/out.php?v=731c8615246282a209a2a8ed08c19550
https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx

5 KB
4 KB

157ms
111ms

Document
text/html

104.26.7.83
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.7.83 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f51574fd81199e6ed5c0c9eb151187cb5b20287434332e0cb57941f92ae7fcbf

Request headers

:method: GET
:authority: onwardinated.com
:scheme: https
:path: /c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169&m=L7WxsFOSHOHl6FpUAmzfxFEibC5Hw72rZQPwxEIr4NoLXFJSaAXJskwjqZIJH7Gmnngeu9D7IaDjk4ONuNknwEwv7vwnwEMQ79Xbwc7tHhkt7tJpfacRnBGNXP7cMk7PqQshfoppbCFpb7cVnoGV7vX3toHBPP
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://up.trkgenius.com/in.php?campaign=58500fec724faa9b59248365d547186e&s1=dvx&cid=6774956523115249898&pubid=3169&m=L7WxsFOSHOHl6FpUAmzfxFEibC5Hw72rZQPwxEIr4NoLXFJSaAXJskwjqZIJH7Gmnngeu9D7IaDjk4ONuNknwEwv7vwnwEMQ79Xbwc7tHhkt7tJpfacRnBGNXP7cMk7PqQshfoppbCFpb7cVnoGV7vX3toHBPP

Response headers

status: 200
date: Fri, 27 Dec 2019 03:31:28 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=df0c95145860a85759b794553ec12416e1577417488; expires=Sun, 26-Jan-20 03:31:28 GMT; path=/; domain=.onwardinated.com; HttpOnly; SameSite=Lax; Secure hK0ctfHxdYFF5S3EBZj8HME2kqs7jyS%2FcZbJO1clXNk%3D=188970809c77b9ab9bc0c5601d214e44_1577417488.9018; domain=onwardinated.com; path=/; expires=Mon, 24-Dec-2029 03:31:28 UTC P1Q%2B3W3pzWcqnG4d7bhTG44ocU3PyJaN%2F6PPYBiVfCA%3D=1577417488.9198; domain=onwardinated.com; path=/; expires=Mon, 24-Dec-2029 03:31:28 UTC gE4KpkNN1Gi3IcjDpFr%2FAsteG2QErOJ0TJ%2Fi90EWWsc%3D=WHlvZ1RKeTY5eW1UQkpKSmh1Sjl3V0dGSmZhMVFwaERkNUc3b2dVUm96NFpjeFRqbXYrdjBYdTBmQWVQcHlULw%3D%3D; domain=onwardinated.com; path=/; expires=Mon, 24-Dec-2029 03:31:28 UTC 188970809c77b9ab9bc0c5601d214e44_1577417488.9018_ck=bnFOempDdUVWUGVudFVVTmE5bEF2V1VyS1NXb21RYjliOXdLZ05JTmNhWHBNSkQ0YWQ0OGYrM0VKcjZYOGVoN05ka3ZpYVAvdkxyZExkNVd2MzB6OE9ZSkVmR2ZVZmFwcGlnTXJBa2pZUklMS2JCVnI1SGlvMWxRd2FvZEkwY29jNDFvUzBiZlo3c3haVUVwb0xObUd0ZHl6OHhaZlNwOGt6d29WVWlvVHpQY2Z3K01WdEFBdXBVSk83OXM5T1FKcEdFb1dPL1Z1WURWdVRCaU0yQ1RRbmtTdDRXdDl1blloZUNRR1p1U25uN3lTbmVuZXpHbk1mT1VEbFQ1TGd1WmExYTlueHVjWlJQTXAxVjVXbTA2RGZUTHdHL0NvYjVEU2lOU2oxSUVXZXAyMmhPVzZldW82UHl3VUp3SjFaR3E1eE1wbUdyVSs2WG9XeFVEOXJKbXBEdnZheFpyQjhZbVVwbDJ3S1NBNS82aE1YMkJFK3RKaHZoV1ZsMU1GUkVhcTYrWG5BSG90TFprRDYwNlhXK1JLYjcrSWl1NVlNTWZRU1NSNkpRc2lSSFB4Sms4d2p3Q0JVMS9JRFZuZ2lXZ1M3ejAwbjdSQ1VUN3FkSU9EVjE4M3BvUm44eUdNNENrcEtLL1ZQbDRkWmpIa2dwWE8yaUFHRTJIWnNYTnN0RFZIdEp6QmNJc0dleGFBZUQrYVppSkVrSzB6U0VIVnlRcVM4UmFFMEVLemtQTDBxai9VUmNHeVI5YjlxaHVUcEc1d0VIZW1VMkJqNmQyWHgzVHY1Z1Z2d3hJanlwelhLVmQ3WDkrQjl2Tm1IU2l5TXRIbHlsL2ZiTHltc3BvcXpTUlplTGR6cm5rUHNQZllqeHl0WjlXWHBIdk9ac0kreFhCQ2pZS1krRWFoK1hiM1ZYT1haNFhaQ1BQVGdUU3c3UjFpQWozZHJkTFAvS0xKVVJaMFBCeWR4WGRnakJyVXU4UzFNVlVCUnF2bEo1TXM4U3FvUjI0Y1BwcjBFYU5iQTBFbEYzMTc4OXVUV3gwL0s0T1VkT2tjYk5PK3FEc01aL29HTHBpNVF0RWpwY0dVNUdOSWNVbk5PekY0OEM0Q0ZvcTVCdlUzUDFhRElaYWU2aVRqOXlCSUNUVnkwMm9ZTmJkaTdobkEwTXZkMVFkYVUzQjZ4QStjZTJIRUFhWWhwWUk5K0puUk9iTU5ST3hGQlllaHMyRFNESlBHMFFWY25FRkFYNFVSRWQ0NWdqRlptS1VDQUw3NlgyME1jdUEvNGpWdzdhcVN6cWxJa2ZGbDJnNXZ4NVV0QWFlZGFHdCtoODZMcXhMMlJTMFhxWT0%3D; domain=onwardinated.com; path=/; expires=Mon, 24-Dec-2029 03:31:28 UTC jMXpTJjt569n5ssk1X%2FbdSpmpn%2Bcw3Zy7cYBeFXyloA%3D=YnZVV2dZRWtSUmVRUFplaTZ6Y1lqZGxiMkRaVUpHUjVlQzBONXVPWHg4VTYwTjc3ZXl3cHFvekxZQzVpK2RWYU1tOXJ6L0pyQTBmZmlHWUF2NHFoTk5Wak81VmpYTm02aUtuM29xZnBsQjg9; domain=onwardinated.com; path=/; expires=Fri, 27-Dec-2019 04:36:28 UTC SERVERID=sfc15; path=/
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 54b838c97a67e684-LHR

Redirect headers

status: 302
server: nginx/1.16.1
date: Fri, 27 Dec 2019 03:31:28 GMT
content-type: text/html; charset=UTF-8
location: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
pragma: no-cache
expires: 0
surrogate-control: no-store
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK Cookie set ck.php Show response
tr7ck.bruceleadx2.com/ 1 KB
2 KB 45ms
24ms Document
text/html 109.123.118.67
UK2NET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_id=17820&subid_spx=195885-SQQD_12D2GHvmSm1I3nW&
Requested by: Host: onwardinated.com
URL: https://onwardinated.com/c/5a37c8ad-f104-11e5-9f1f-0626cc8adced?subid=43a3e18edb7d9bc7cdd2738d4d0caaf1&pubid=dvx
Protocol: HTTP/1.1
Server: 109.123.118.67 Ilford, United Kingdom, ASN13213 (UK2NET-AS, GB),
Reverse DNS: 118-67.topstaffsolutions.com
Software: SpirooxPerformance-Server-1.0 /
Resource Hash: 9d3f05dbaaba71af3ade85090553066b9b5b14513d74f205713e942c85223561

Request headers

Host: tr7ck.bruceleadx2.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://onwardinated.com/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://onwardinated.com/

Response headers

Date: Fri, 27 Dec 2019 3:31:29 GMT
Server: SpirooxPerformance-Server-1.0
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Expires: 0
Pragma: no-cache
Content-Length: 1172
Connection: close
Content-Type: text/html; charset=utf-8
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: session=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531%7C29854466443425284%7C2019-12-27T03%3A31%3A29%2B0000%7C2635167%7CUnited+Kingdom%7C17820%7C195885-SQQD_12D2GHvmSm1I3nW%7ClGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000%7C2806%7C4%7C1897%7C17820%7C2%7C2402%7C0%7C12657%7C10976%7C27296%7C2767%7C0%7C5647918%7C3%7C1%7CMac%7C74%7C%7C%7CChrome%7CHydra+Communications+Ltd%7CWIFI%7C185.38.150.0%2F24%7C185.38.150.91%7C0%7C195885-SQQD_12D2GHvmSm1I3nW%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7C%7C0.0%7C0.0%7C1.0%7C0.2%7C1%7Conwardinated.com%7C1577417489020%7C%7Cfalse%7Cfalse%7C55%7C0%7C27%7C%7C0%7C0%7C%7Ctr7ck.bruceleadx2.com%7Cgb%7C%7C0.0%7C; domain=tr7ck.bruceleadx2.com; path=/; expires=Sat, 25 Jan 2020 3:31:29 GMT

GET
H2

200

/ Show response
mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/
Redirect Chain

http://tr7ck.bruceleadx2.com/ck_jump?id=cz0yOTg1NDQ2NjQ0MzQyNTI4NCZ0PTE1Nzc0MTc0ODkmaD0xODE1NzgzNzMw&__if=0&__pm=0&__wv=0&__type=unknown&__deviceid=
https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3...

254 B
477 B

212ms
121ms

Document
text/html

31.170.100.125
SOLTIA

General

Check archive.org

Show headers Download Go to

Full URL: https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3ODIwLEM6MjcyOTY%3D&externalid=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531
Requested by: Host: tr7ck.bruceleadx2.com
URL: http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_id=17820&subid_spx=195885-SQQD_12D2GHvmSm1I3nW&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 31.170.100.125 , Spain, ASN201942 (SOLTIA, ES),
Reverse DNS
Software: nginx /
Resource Hash: 1be859e140c6b17d92800e003491b684a815e8c989fcd57972c03fee641c93f8

Request headers

:method: GET
:authority: mobi.billiwa.com
:scheme: https
:path: /desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3ODIwLEM6MjcyOTY%3D&externalid=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_id=17820&subid_spx=195885-SQQD_12D2GHvmSm1I3nW&
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://tr7ck.bruceleadx2.com/ck.php?kp=lGB20B47J0909d50000RS00E660T3ZP04759LW07NS0475900000000&line_item_id=17820&subid_spx=195885-SQQD_12D2GHvmSm1I3nW&

Response headers

status: 200
server: nginx
date: Fri, 27 Dec 2019 03:31:29 GMT
content-type: text/html; charset=UTF-8
content-length: 230
access-control-allow-origin: *
access-control-allow-headers: Content-Type
cache-control: no-cache, private
content-encoding: gzip
x-device: desktop
accept-ranges: bytes
age: 0
tp-cache: MISS
vary: Accept-Encoding

Redirect headers

Date: Fri, 27 Dec 2019 3:31:29 GMT
Server: SpirooxPerformance-Server-1.0
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Expires: 0
Pragma: no-cache
Connection: close
Location: https://mobi.billiwa.com/desk/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/0c836b61-d153-4126-82b0-3653254e9e7c/?&subid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xSTNuVyxMOjE3ODIwLEM6MjcyOTY%3D&externalid=20191227_5e75a51b-2859-11ea-9e1a-e3278305f531
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: c27296=1 ; domain=tr7ck.bruceleadx2.com; path=/; expires=Sat, 28 Dec 2019 3:31:29 GMT l17820=1 ; domain=tr7ck.bruceleadx2.com; path=/; expires=Sat, 28 Dec 2019 3:31:29 GMT

GET
H2

200

Primary Request registration Show response
novelden.com/
Redirect Chain

http://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS
https://routeserve.info/?affid=384hgfifb45&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS
https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS...

30 KB
7 KB

141ms
55ms

Document
text/html

104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9649f6fa8d3b6a0fc6a8e7b7275e7aa5e9253fc3611d53a09241ce4f0e786080

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: novelden.com
:scheme: https
:path: /registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 27 Dec 2019 03:31:29 GMT
content-type: text/html
set-cookie: __cfduid=d801c17236cf8fb451b4aa3a1c014a2f81577417489; expires=Sun, 26-Jan-20 03:31:29 GMT; path=/; domain=.novelden.com; HttpOnly; SameSite=Lax; Secure CakeCookie[a_aid]=Mzg0aGdmaWZiNDU%3D; Path=/; Secure; CakeCookie[clickid]=TTIwMTkxMjI3MDMtNmFlMmY5MDllMmQwZTNiMTQ5ZmIxODA4YWNhZjg4NTU%3D; Path=/; Secure; CakeCookie[lang]=eng; Path=/; Secure; CakeCookie[pubid]=VXpveE9EazNMRk5DT2pFNU5UZzROUzFUVVZGRVh6RXlSREpIU0hadFUyMHhT; Path=/; Secure; CakeCookie[v_id]=YmFhMWM1ZWQtNmU3NC0xOGY3LWY0YTAtMzhmMzY3MDcyYjVl; Path=/; Secure;
cf-ray: 54b838cded003450-LHR
age: 196308
cache-control: public, max-age=604800
expires: Fri, 03 Jan 2020 03:31:29 GMT
vary: Accept-Encoding
cf-cache-status: HIT
cache-tag: 1227,novelden.com,/registration,GB,m-2-allsportsX,eng
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-cache-url: https://novelden.com/registration?lang=eng&theme=m-2-allsportsX
x-frame-options: SAMEORIGIN
x-fruit: banana
server: cloudflare
content-encoding: gzip

Redirect headers

status: 302
date: Fri, 27 Dec 2019 03:31:29 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
set-cookie: __cfduid=dbb25563ceed52c6a88813cb4bc2cec3e1577417489; expires=Sun, 26-Jan-20 03:31:29 GMT; path=/; domain=.routeserve.info; HttpOnly; SameSite=Lax; Secure data=eyJzaXRlIjoibm92ZWxkZW4uY29tIiwicmVxdWVzdGVkVGhlbWUiOiJtLTItYWxsc3BvcnRzIiwicm91dGVkVGhlbWUiOiJtLTItYWxsc3BvcnRzWCIsInZpc2l0b3JJZCI6ImJhYTFjNWVkLTZlNzQtMThmNy1mNGEwLTM4ZjM2NzA3MmI1ZSJ9; Max-Age=3600; Expires=Fri, 27 Dec 2019 03:31:33 GMT;
location: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 54b838cd2ea3e60c-LHR

GET
H2 200 green.css
novelden.com/theme/Flix/ConnSmythe/css/subscriptions/theme/ 129 KB
29 KB 78ms
77ms Stylesheet
text/css 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://novelden.com/theme/Flix/ConnSmythe/css/subscriptions/theme/green.css

Requested by

Host: novelden.com
URL: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ed384c8adc0d12c7f23df894f5516c248c4e2f13bedcbb112d8cb9b47011df7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: REVALIDATED
last-modified: Tue, 17 Dec 2019 20:10:46 GMT
server: cloudflare
etag: W/"5df93646-2027c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 54b838ce4d153450-LHR
x-fruit: banana
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 novelden.png
novelden.com/img/logos/books/min/ 9 KB
9 KB 25ms
25ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/logos/books/min/novelden.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcc5680617dd7453b8b99821d834d6da02c6332fd61ac0b1471ccac909c29939

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 3204
status: 200
content-length: 9060
last-modified: Tue, 17 Dec 2019 20:07:36 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93588-2364"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838ce4d163450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 en.png
novelden.com/img/flags/min/ 545 B
650 B 30ms
30ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/en.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6cf87f6b6f6c3cd542a6156d69257c1dba10b58fa034d291bcf83b1713938e9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 545
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-221"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838ce4d173450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 ar.png
novelden.com/img/flags/min/ 428 B
506 B 26ms
24ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/ar.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d42be6e56327fef927abfcdbed9a90ff588ed85eb7dc6d4fd977f23484b53776

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 428
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-1ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cefd353450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 da.png
novelden.com/img/flags/min/ 352 B
430 B 26ms
23ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/da.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

95253486ae74b2987697e95e810fb4e2c5866e7290d3e8c3bfa64b33ed7fb76b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 352
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-160"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d363450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 de.png
novelden.com/img/flags/min/ 364 B
442 B 30ms
27ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/de.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

21f38ae028adb9455c66a185775d4ea208add60aae4e4f2376f57227a48756a7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 364
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-16c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d373450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 es.png
novelden.com/img/flags/min/ 344 B
422 B 27ms
24ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/es.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0326c79a8e173153873aa2b31581b54aebc0bcbf4ab2d55807f5d84098d523b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 344
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-158"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d383450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 fr.png
novelden.com/img/flags/min/ 369 B
447 B 27ms
25ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/fr.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f414502d6c48e571dd4baf8bfbdf6fb5dabdd791cf6c789a0264806b314ca58

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 369
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-171"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d393450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 it.png
novelden.com/img/flags/min/ 420 B
481 B 30ms
28ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/it.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7992f57d67156f994a38c6bb4ec72fa57601a284558db5e065c02dc36ee9d8c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 420
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-1a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d3a3450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 ja.png
novelden.com/img/flags/min/ 420 B
520 B 28ms
25ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/ja.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 420
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-1a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d3b3450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 nl.png
novelden.com/img/flags/min/ 310 B
387 B 26ms
24ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/nl.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e188f98c3d1c722d93cf24bb7c2561584a6fc3ea2d1ab35a7fd52b3bbb2188cd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 310
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-136"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d3c3450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 no.png
novelden.com/img/flags/min/ 397 B
475 B 27ms
25ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/no.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f59e4cf0fa6ee21a54ba82946499f611b0333a1fc15e55590567a812d464b6fb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 397
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-18d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d3d3450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 pl.png
novelden.com/img/flags/min/ 374 B
453 B 33ms
31ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/pl.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

34f6a1822d880608e7124d2ea0e3da4cd9b3a3b3b7d18171b61031cedbe6e72f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 374
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-176"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf0d3e3450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 pt.png
novelden.com/img/flags/min/ 407 B
557 B 46ms
44ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/pt.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2af22923899eea4a4997481bae73840ab2f4294798b85509f3cb63c05fe68e2c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 407
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-197"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d413450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 sv.png
novelden.com/img/flags/min/ 389 B
485 B 46ms
44ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/sv.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f96fc8f9f474e8b8a6a82ed9bb5e22e19c6c5921fd363bb903fa693dfb9447a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 389
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-185"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d423450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 zh.png
novelden.com/img/flags/min/ 349 B
473 B 48ms
47ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/flags/min/zh.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0242f535f7ee0cc26bd88cc9f807ece4a6d70129303b902a232b38c58e66ef51

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 1958
status: 200
content-length: 349
last-modified: Tue, 17 Dec 2019 20:07:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93587-15d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d433450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 novelden_dark.png
novelden.com/img/logos/books/min/ 9 KB
9 KB 59ms
58ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/img/logos/books/min/novelden_dark.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcc5680617dd7453b8b99821d834d6da02c6332fd61ac0b1471ccac909c29939

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 5190
status: 200
content-length: 9060
last-modified: Tue, 17 Dec 2019 20:07:36 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93588-2364"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d443450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 scripts.min.js Show response
novelden.com/theme/Flix/ConnSmythe/js/subscriptions/min/ 197 KB
63 KB 83ms
83ms Script
application/javascript 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://novelden.com/theme/Flix/ConnSmythe/js/subscriptions/min/scripts.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bc5f42b5e287e7c03334eb63d22dc67049fc246dc39b9d9e91da7ec382a44e7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: REVALIDATED
last-modified: Tue, 17 Dec 2019 20:09:44 GMT
server: cloudflare
etag: W/"5df93608-31377"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=14400
cf-ray: 54b838ce7d1b3450-LHR
x-fruit: banana
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 regValidation.min.js Show response
novelden.com/theme/Flix/ConnSmythe/js/subscriptions/validation/min/ 4 KB
988 B 87ms
87ms Script
application/javascript 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://novelden.com/theme/Flix/ConnSmythe/js/subscriptions/validation/min/regValidation.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7eef2992bcc13e98816a79226975590c86246e9396c9f09b914f4b2bbd0b25e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: REVALIDATED
last-modified: Tue, 17 Dec 2019 20:09:44 GMT
server: cloudflare
etag: W/"5df93608-10e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=14400
cf-ray: 54b838ce8d1c3450-LHR
x-fruit: banana
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
748 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:809::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans|Libre+Baskerville|Raleway

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

642af22c90a74a15bec1c794ef7e802fe6b3e237c49afc3f4dda533811cf5d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 27 Dec 2019 03:31:29 GMT
server: ESF
access-control-allow-origin: *
date: Fri, 27 Dec 2019 03:31:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Fri, 27 Dec 2019 03:31:29 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 50 KB
19 KB 16ms
14ms Script
application/javascript 2a00:1450:4001:80b::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MMPL24Z

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

588ffa985c7d88575fc4826408a2cd260e1b4d0abcc493bc60b1852d9331bd22

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://novelden.com/registration?theme=m-2-allsportsX&v_id=baa1c5ed-6e74-18f7-f4a0-38f367072b5e&page=m-2-allsports&clickid=M2019122703-6ae2f909e2d0e3b149fb1808acaf8855&pubid=UzoxODk3LFNCOjE5NTg4NS1TUVFEXzEyRDJHSHZtU20xS&a_aid=384hgfifb45
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
content-encoding: br
last-modified: Fri, 27 Dec 2019 03:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 19298
x-xss-protection: 0
expires: Fri, 27 Dec 2019 03:31:29 GMT

GET
H2 200 collage_sport.jpg
novelden.com/theme/Flix/ConnSmythe/img/bg/min/ 217 KB
218 KB 101ms
101ms Image
image/jpeg 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/theme/Flix/ConnSmythe/img/bg/min/collage_sport.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dbcfad13944cfcd266d1a45f46132832e6e3082bde5754ff9c7ceea802e71577

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/theme/Flix/ConnSmythe/css/subscriptions/theme/green.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: REVALIDATED
status: 200
content-length: 222517
last-modified: Tue, 17 Dec 2019 20:07:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df93586-36535"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d453450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 sprites.png
novelden.com/theme/Flix/ConnSmythe/img/sprites/ 11 KB
11 KB 43ms
43ms Image
image/png 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://novelden.com/theme/Flix/ConnSmythe/img/sprites/sprites.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c54a3667bc94ae5d5acb1607371cd35e44f59ed9c12d8afc6f54dd21db77ae49

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://novelden.com/theme/Flix/ConnSmythe/css/subscriptions/theme/green.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
cf-cache-status: HIT
age: 2631
status: 200
content-length: 11486
last-modified: Tue, 17 Dec 2019 20:08:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5df935ac-2cde"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
x-fruit: banana
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 54b838cf2d463450-LHR
expires: Fri, 27 Dec 2019 07:31:29 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans|Libre+Baskerville|Raleway
Origin: https://novelden.com

Response headers

date: Fri, 20 Dec 2019 05:36:27 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 597302
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9132
x-xss-protection: 0
expires: Sat, 19 Dec 2020 05:36:27 GMT

GET
H2 200 fontawesome-webfont.woff2
novelden.com/components/font-awesome/fonts/ 75 KB
76 KB 44ms
44ms Font
text/html 104.17.48.43
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://novelden.com/components/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.48.43 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://novelden.com/theme/Flix/ConnSmythe/css/subscriptions/theme/green.css
Origin: https://novelden.com

Response headers

date: Fri, 27 Dec 2019 03:31:29 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Tue, 17 Dec 2019 20:07:46 GMT
server: cloudflare
age: 4995
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
status: 200
cache-control: public, max-age=14400
cf-ray: 54b838cf2d473450-LHR
x-fruit: banana
expires: Fri, 27 Dec 2019 07:31:29 GMT

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
novelden.com/	1969-12-31 23:59:59	Name: CakeCookie[v_id] Value: YmFhMWM1ZWQtNmU3NC0xOGY3LWY0YTAtMzhmMzY3MDcyYjVl
novelden.com/	1969-12-31 23:59:59	Name: CakeCookie[pubid] Value: VXpveE9EazNMRk5DT2pFNU5UZzROUzFUVVZGRVh6RXlSREpIU0hadFUyMHhT
novelden.com/	1969-12-31 23:59:59	Name: CakeCookie[lang] Value: eng
novelden.com/	1969-12-31 23:59:59	Name: CakeCookie[clickid] Value: TTIwMTkxMjI3MDMtNmFlMmY5MDllMmQwZTNiMTQ5ZmIxODA4YWNhZjg4NTU%3D
novelden.com/	1969-12-31 23:59:59	Name: CakeCookie[a_aid] Value: Mzg0aGdmaWZiNDU%3D
.novelden.com/	1970-01-19 06:53:29	Name: __cfduid Value: d801c17236cf8fb451b4aa3a1c014a2f81577417489

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1000ulbs.com
declation-grateger.com
fonts.googleapis.com
fonts.gstatic.com
mobi.billiwa.com
novelden.com
onwardinated.com
ortrun-adi.com
routeserve.info
tr7ck.bruceleadx2.com
up.trkgenius.com
www.googletagmanager.com
x.letmeleadyou.me
104.17.48.43
104.18.223.81
104.26.7.83
107.6.174.196
109.123.118.67
18.195.71.253
2a00:1450:4001:809::200a
2a00:1450:4001:80b::2008
2a00:1450:4001:814::2003
31.170.100.125
52.0.7.30
54.209.22.226
99.198.108.194
0242f535f7ee0cc26bd88cc9f807ece4a6d70129303b902a232b38c58e66ef51
04f8d2e13a675fe9f0bdf49039f0a2e8eee4c72365d7f55ac9cb8610c5b958ed
1bc5f42b5e287e7c03334eb63d22dc67049fc246dc39b9d9e91da7ec382a44e7
1be859e140c6b17d92800e003491b684a815e8c989fcd57972c03fee641c93f8
21f38ae028adb9455c66a185775d4ea208add60aae4e4f2376f57227a48756a7
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2af22923899eea4a4997481bae73840ab2f4294798b85509f3cb63c05fe68e2c
34f6a1822d880608e7124d2ea0e3da4cd9b3a3b3b7d18171b61031cedbe6e72f
3f414502d6c48e571dd4baf8bfbdf6fb5dabdd791cf6c789a0264806b314ca58
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
588ffa985c7d88575fc4826408a2cd260e1b4d0abcc493bc60b1852d9331bd22
5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
642af22c90a74a15bec1c794ef7e802fe6b3e237c49afc3f4dda533811cf5d73
6c551627918ddaafd572af352c6d3fae62eb130afe8789ffae0561cc6ed0b6d0
6f96fc8f9f474e8b8a6a82ed9bb5e22e19c6c5921fd363bb903fa693dfb9447a
7e11348d49a8eb6e7584fca5405c42b697353d4c8b6946ac4d57c4e17b0e0eaf
8ed384c8adc0d12c7f23df894f5516c248c4e2f13bedcbb112d8cb9b47011df7
95253486ae74b2987697e95e810fb4e2c5866e7290d3e8c3bfa64b33ed7fb76b
9649f6fa8d3b6a0fc6a8e7b7275e7aa5e9253fc3611d53a09241ce4f0e786080
9d3f05dbaaba71af3ade85090553066b9b5b14513d74f205713e942c85223561
b705525ebaf18234c8eff8c0fbb5a4a20d6c464c38574d540139f84fb25fa8a6
bcc5680617dd7453b8b99821d834d6da02c6332fd61ac0b1471ccac909c29939
c54a3667bc94ae5d5acb1607371cd35e44f59ed9c12d8afc6f54dd21db77ae49
c7992f57d67156f994a38c6bb4ec72fa57601a284558db5e065c02dc36ee9d8c
d0326c79a8e173153873aa2b31581b54aebc0bcbf4ab2d55807f5d84098d523b
d42be6e56327fef927abfcdbed9a90ff588ed85eb7dc6d4fd977f23484b53776
dbcfad13944cfcd266d1a45f46132832e6e3082bde5754ff9c7ceea802e71577
e188f98c3d1c722d93cf24bb7c2561584a6fc3ea2d1ab35a7fd52b3bbb2188cd
e6cf87f6b6f6c3cd542a6156d69257c1dba10b58fa034d291bcf83b1713938e9
e7eef2992bcc13e98816a79226975590c86246e9396c9f09b914f4b2bbd0b25e
f51574fd81199e6ed5c0c9eb151187cb5b20287434332e0cb57941f92ae7fcbf
f59e4cf0fa6ee21a54ba82946499f611b0333a1fc15e55590567a812d464b6fb

novelden.com Open in urlscan Pro 104.17.48.43 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

33 Requests

91 %HTTPS

23 %IPv6

13 Domains

13 Subdomains

9 IPs

5 Countries

471 kBTransfer

772 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

novelden.com Open in urlscan Pro
104.17.48.43 Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

91 %
HTTPS

23 %
IPv6

13
Domains

13
Subdomains

9
IPs

5
Countries

471 kB
Transfer

772 kB
Size

6
Cookies

33 HTTP transactions
0 data transactions