xcraft.net Open in urlscan Pro
51.195.106.115 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzx...
Effective URL:
https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=...
Submission: On June 26 via api (June 26th 2024, 2:52:42 am UTC) from US — Scanned from DE

Summary HTTP 49 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 16 IPs in 7 countries across 20 domains to perform 49 HTTP transactions. The main IP is 51.195.106.115, located in France and belongs to OVH, FR. The main domain is xcraft.net.
TLS certificate: Issued by R3 on May 23rd 2024. Valid for: 3 months.

This is the only time xcraft.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5 8	173.214.240.15 173.214.240.15	15317 (SERVEREL-AS) (SERVEREL-AS)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
4 4	199.182.164.180 199.182.164.180	15317 (SERVEREL-AS) (SERVEREL-AS)
1 3	104.19.133.76 104.19.133.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 5	172.64.152.106 172.64.152.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	104.19.129.76 104.19.129.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	172.67.192.46 172.67.192.46	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	51.195.106.115 51.195.106.115	16276 (OVH) (OVH)
9	172.67.215.147 172.67.215.147	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:67c:4e8:... 2001:67c:4e8:f004::9	62041 (TELEGRAM) (TELEGRAM)
1 2	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
3 8	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
3	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
3	116.203.95.45 116.203.95.45	24940 (HETZNER-AS) (HETZNER-AS)
1 2	88.212.202.52 88.212.202.52	39134 (UNITEDNET) (UNITEDNET)
1 1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
1 1	172.217.16.196 172.217.16.196	15169 (GOOGLE) (GOOGLE)
1	142.250.185.99 142.250.185.99	() ()
49	16

8 173.214.240.15 (United States) 5 redirects

ASN15317 (SERVEREL-AS, US)
PTR: 173.214.240.15.serverel.net

welovetop5.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
freetrckr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ershopsale4.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.182.164.180 (United States) 4 redirects

ASN15317 (SERVEREL-AS, US)
PTR: 180.164.182.199.serverel.net

xml.pushking.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.19.133.76 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

c.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.64.152.106 (San Francisco, United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

c.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
clck.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.129.76 (None, )

ASN13335 (CLOUDFLARENET, US)

clck.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.192.46 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

r.clickfrog.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 51.195.106.115 (France)

ASN16276 (OVH, FR)
PTR: xcraft.ru

xcraft.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.67.215.147 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.xcraft.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:67c:4e8:f004::9 (Amsterdam, Netherlands)

ASN62041 (TELEGRAM, VG)

telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oauth.telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.1.44 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
psb.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 116.203.95.45 (Munich, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.45.95.203.116.clients.your-server.de

stat.scroogefrog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.202.52 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host152.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.196 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f196.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.99 (None, )

ASN- ()

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	xcraft.net xcraft.net cdn.xcraft.net	112 KB
6	yandex.com 2 redirects mc.yandex.com	5 KB
6	ershopsale4.xyz 3 redirects ershopsale4.xyz	4 KB
5	adskeeper.com 1 redirects c.adskeeper.com — Cisco Umbrella Rank: 29618 s-img.adskeeper.com — Cisco Umbrella Rank: 27266 clck.adskeeper.com — Cisco Umbrella Rank: 129066	14 KB
4	mgid.com 1 redirects c.mgid.com — Cisco Umbrella Rank: 5892 s-img.mgid.com — Cisco Umbrella Rank: 8542 clck.mgid.com — Cisco Umbrella Rank: 37550	19 KB
4	pushking.net 4 redirects xml.pushking.net — Cisco Umbrella Rank: 65344	1 KB
3	scroogefrog.com stat.scroogefrog.com	6 KB
3	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 844 psb.taboola.com — Cisco Umbrella Rank: 6802 trc.taboola.com — Cisco Umbrella Rank: 711	24 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 11706	3 KB
2	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 3382	57 KB
2	google-analytics.com 1 redirects ssl.google-analytics.com — Cisco Umbrella Rank: 745	17 KB
2	telegram.org telegram.org — Cisco Umbrella Rank: 8697 oauth.telegram.org — Cisco Umbrella Rank: 208208	6 KB
2	gstatic.com fonts.gstatic.com	31 KB
1	google.de www.google.de	63 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 5	21 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 136	381 B
1	clickfrog.org 1 redirects r.clickfrog.org	638 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	1 KB
1	freetrckr.com 1 redirects freetrckr.com — Cisco Umbrella Rank: 672301	339 B
1	welovetop5.xyz 1 redirects welovetop5.xyz	120 B
49	20

	Domain	Requested by
9	cdn.xcraft.net	xcraft.net cdn.xcraft.net
6	mc.yandex.com	2 redirects xcraft.net mc.yandex.ru
6	ershopsale4.xyz	3 redirects ershopsale4.xyz
5	xcraft.net	clck.mgid.com xcraft.net cdn.xcraft.net
4	xml.pushking.net	4 redirects
3	stat.scroogefrog.com	xcraft.net stat.scroogefrog.com
2	counter.yadro.ru	1 redirects xcraft.net
2	mc.yandex.ru	1 redirects xcraft.net
2	ssl.google-analytics.com	1 redirects xcraft.net
2	fonts.gstatic.com	fonts.googleapis.com
2	s-img.adskeeper.com	ershopsale4.xyz
2	c.adskeeper.com	ershopsale4.xyz
2	s-img.mgid.com	ershopsale4.xyz
1	oauth.telegram.org	telegram.org
1	www.google.de	xcraft.net
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	trc.taboola.com	cdn.taboola.com
1	psb.taboola.com	cdn.taboola.com
1	cdn.taboola.com	xcraft.net
1	telegram.org	xcraft.net
1	r.clickfrog.org	1 redirects
1	clck.mgid.com	ershopsale4.xyz
1	clck.adskeeper.com	1 redirects
1	c.mgid.com	1 redirects
1	fonts.googleapis.com	ershopsale4.xyz
1	freetrckr.com	1 redirects
1	welovetop5.xyz	1 redirects
49	28

This site contains links to these domains. Also see Links.

Domain
liveinternet.ru

Subject Issuer	Validity	Valid
todayspark4.xyz E5	`2024-06-10` - `2024-09-08`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
mgid.com E1	`2024-05-09` - `2024-08-07`	3 months	crt.sh
adskeeper.com GTS CA 1P5	`2024-05-24` - `2024-08-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
xcraft.net R3	`2024-05-23` - `2024-08-21`	3 months	crt.sh
*.telegram.org Go Daddy Secure Certificate Authority - G2	`2023-08-11` - `2024-09-11`	a year	crt.sh
*.google-analytics.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
stat.scroogefrog.com R11	`2024-06-18` - `2024-09-16`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Frame ID: CE5284D1F2D25EDA69ECA9F8BE92C282
Requests: 46 HTTP requests in this frame

Frame: https://stat.scroogefrog.com/queue2/c_q2_ai.php?sid=4037405246&u=https%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&ref=https%3A//clck.mgid.com/&mm=0&c8pad=&ga=&fr=0&cl=2b47bf14048105a582b35139614fd3d5&h=0
Frame ID: 2EAFE9C81EEEE2571634E4C72EE85A08
Requests: 1 HTTP requests in this frame

Frame: https://oauth.telegram.org/embed/XcraftNetLoginBot?origin=https%3A%2F%2Fxcraft.net&return_to=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&size=small&userpic=false&radius=4
Frame ID: 4D50A3CCD70B594C48A768C60797E476
Requests: 1 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: E9F26CAF31F9C9622FC3B719DF94A055
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Xcraft - Registrierung

Page URL History Show full URLs

http://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymi... HTTP 307
https://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymi... HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0Ew... Page URL
https://xml.pushking.net/click?s=1&tid=534&sid=7994a99e527656f3bb8b31e42959473a&rnd=998134440 HTTP 302
https://clck.adskeeper.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFyc... HTTP 301
https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFyc... Page URL
https://r.clickfrog.org/xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_cam... HTTP 301
http://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11... HTTP 307
https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11... Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Liveinternet (Analytics) Expand

Overall confidence: 100%
Detected patterns

<script[^<>]*>[^]{0,128}?src\s*=\s*['"]//counter\.yadro\.ru/hit(?:;\S+)?\?(?:t\d+\.\d+;)?r

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

49
Requests

73 %
HTTPS

32 %
IPv6

20
Domains

28
Subdomains

16
IPs

7
Countries

292 kB
Transfer

6851 kB
Size

33
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://liveinternet.ru/click

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5mwq5zmm5zmitmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1719301237122&rnd=407725262&js...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 307
https://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5mwq5zmm5zmitmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1719301237122&rnd=407725262&js...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D Page URL
https://xml.pushking.net/click?s=1&tid=534&sid=7994a99e527656f3bb8b31e42959473a&rnd=998134440 HTTP 302
https://clck.adskeeper.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF HTTP 301
https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1 Page URL
https://r.clickfrog.org/xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id HTTP 301
http://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id HTTP 307
https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5mwq5zmm5zmitmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1719301237122&rnd=407725262&js...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 307
https://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5mwq5zmm5zmitmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1719301237122&rnd=407725262&js...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Request Chain 2

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3285_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGQ2MDNlZmQyMDI2MzVjYzY3NjQzNThiMGIwODNjOGVhJTI2cm5kJTNENzI5OTUzOTU4&t=1719370356248&rnd=332001491&i=1 HTTP 302
https://xml.pushking.net/icon?sid=d603efd202635cc6764358b0b083c8ea&rnd=729953958 HTTP 302
https://c.mgid.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XcSTF_UeJBB26r3LAJStBFddoTxMSo8tDJ1t3dnDqn2ST7Yjim-xUWGVXYTAlDWdusIAXdlTLgrXTnrylls5Yus*&cid=1423484&f=1&h2=vlJ0RdnMYFlD0pCQy6adPrmkLhdwwlmaR3J7WcOuQX8HR8pSUPvgtXfPfYszt80L&rid=2435beb7-3367-11ef-a3ba-c84bd6836428&psid=885913&iub=aHR0cHM6Ly9zLWltZy5tZ2lkLmNvbS9nLzE4OTIxMTY2LzMyOHgzMjgvLS9hSFIwY0RvdkwyTnNMbWx0WjJodmMzUnpMbU52YlM5cGJXZG9MMmx0WVdkbEwyWmxkR05vTDJGeVh6RTZNU3hqWDJacGJHd3NaVjl6YUdGeWNHVnVPakV3TUN4bVgycHdaeXhuWDNoNVgyTmxiblJsY2l4eFgyRjFkRzg2WjI5dlpDeDNYemsyTUN4NFh6RXhNRFFzZVY4ek5UY3ZhSFIwY0RvdkwybHRaMmh2YzNSekxtTnZiUzkwTHpJd01qUXRNRE12TnpFNU5qY3pMelF4TURJMk5UVTVaREppTlRSa01qRm1NR1l6T1Rkak1UaGlOVGRpWW1SakxtcHdady53ZWJwP3Y9MTcxOTM3MDM1NS0tVElpcWpZX2xVNElsQ3YwSEJ0WXdTd01BSWJ4c1FFWEFuenJsdHNYM1lr HTTP 301
https://s-img.mgid.com/g/18921166/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzExMDQseV8zNTcvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczLzQxMDI2NTU5ZDJiNTRkMjFmMGYzOTdjMThiNTdiYmRjLmpwZw.webp?v=1719370355--TIiqjY_lU4IlCv0HBtYwSwMAIbxsQEXAnzrltsX3Yk

Request Chain 3

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3303_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDc5OTRhOTllNTI3NjU2ZjNiYjhiMzFlNDI5NTk0NzNhJTI2cm5kJTNENzI5OTUzOTU4&t=1719370356248&rnd=836431968&i=1 HTTP 302
https://xml.pushking.net/icon?sid=7994a99e527656f3bb8b31e42959473a&rnd=729953958 HTTP 302
https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&cid=1538383&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&psid=885913

Request Chain 4

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3489_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGZiNjQ4OGZlNzg4YmNjZjM4Nzk3ZGI3YTFlYmQ5YmQ5JTI2cm5kJTNENzI5OTUzOTU4&t=1719370356248&rnd=645793695&i=1 HTTP 302
https://xml.pushking.net/icon?sid=fb6488fe788bccf38797db7a1ebd9bd9&rnd=729953958 HTTP 302
https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65Xa2T_eJdUJ56050gg0jiRMG_qBclP_5-WNr3y2hlb8XZT7Yjim-xUWGVXYTAlDWdum54o_Di5z4vAmUUo8XzDnI*&cid=1508808&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435a1e2-3367-11ef-a3ba-c84bd6836428&psid=78859130

Request Chain 12

https://xml.pushking.net/click?s=1&tid=534&sid=7994a99e527656f3bb8b31e42959473a&rnd=998134440 HTTP 302
https://clck.adskeeper.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF HTTP 301
https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1

Request Chain 24

https://counter.yadro.ru/hit?t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id;0.13283115429900771 HTTP 302
https://counter.yadro.ru/hit?q;t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id;0.13283115429900771

Request Chain 36

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1938937557&utmhn=xcraft.net&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=Xcraft%20-%20Registrierung&utmhid=2120664298&utmr=https%3A%2F%2Fclck.mgid.com%2F&utmp=%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&utmht=1719370360704&utmac=UA-32348388-2&utmcc=__utma%3D137179577.1957401979.1719370361.1719370361.1719370361.1%3B%2B__utmz%3D137179577.1719370361.1.1.utmcsr%3Dmgid_net%7Cutmccn%3DXCraftDEU%7Cutmcmd%3Dcpc%7Cutmctr%3D57869945s885913%7Cutmcct%3D18692297%3B&utmjid=1733229515&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557&slf_rd=1&random=3955479175

Request Chain 45

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10411.OdkUUz0KcVKyrGyGcnPm39i1sNx4KavAx6pnmTyWbSpxbZDNnfmv-rOeoxzn5_-G.2HgliRS9KqsgtEvSRghR62Z4Ulg%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10411.djXGPlK5pDUyz9-BrkkQHJ6sJVmAkTPGC5CMn6GSVQZAbFMs25G3BoLuxoV8hIaEFtPZQ2jVPTaPTtvuQf_grD9H7olQ59BXJ0XzuKbkx196bM_RVOEs2Soz3s4vB2kCnV7N7FyRNde1k8RP4rzKiTIKh7p7DZb-pNBslfzrG_iWr6dnZPJixb5dKLiRT9eL0BkvJmznSAvKRQ06oslvJ9V1_L7BX_f2p3yHCsBZy0s%2C.iJB0XQOru8HGoIUjn7PRorgbAyY%2C

Request Chain 48

https://mc.yandex.com/watch/2135185?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&page-ref=https%3A%2F%2Fclck.mgid.com%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22126%22%2C%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22126%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A126.0.6478.126%0Achl%0A%22Not%2FA)Brand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22126.0.6478.126%22%2C%22Google%20Chrome%22%3Bv%3D%22126.0.6478.126%22%0Achm%0A%3F0%0Achp%0AWin32%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A1ddf25rn73ebk2eteqr6jr5riz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1370%3Acn%3A1%3Adp%3A0%3Als%3A452433958123%3Ahid%3A1009680036%3Az%3A120%3Ai%3A20240626045241%3Aet%3A1719370361%3Ac%3A1%3Arn%3A387767032%3Arqn%3A1%3Au%3A171937036114901109%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A570%3Ads%3A0%2C125%2C56%2C2%2C159%2C0%2C%2C191%2C0%2C%2C%2C%2C544%3Aco%3A0%3Acpf%3A1%3Ans%3A1719370360022%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1719370361%3At%3AXcraft%20-%20Registrierung&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)eco(3178756)ti(1) HTTP 302
https://mc.yandex.com/watch/2135185/1?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&page-ref=https%3A%2F%2Fclck.mgid.com%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22126%22%2C%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22126%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A126.0.6478.126%0Achl%0A%22Not%2FA%29Brand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22126.0.6478.126%22%2C%22Google%20Chrome%22%3Bv%3D%22126.0.6478.126%22%0Achm%0A%3F0%0Achp%0AWin32%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A1ddf25rn73ebk2eteqr6jr5riz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1370%3Acn%3A1%3Adp%3A0%3Als%3A452433958123%3Ahid%3A1009680036%3Az%3A120%3Ai%3A20240626045241%3Aet%3A1719370361%3Ac%3A1%3Arn%3A387767032%3Arqn%3A1%3Au%3A171937036114901109%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A570%3Ads%3A0%2C125%2C56%2C2%2C159%2C0%2C%2C191%2C0%2C%2C%2C%2C544%3Aco%3A0%3Acpf%3A1%3Ans%3A1719370360022%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1719370361%3At%3AXcraft%20-%20Registrierung&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%283178756%29ti%281%29

49 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js Show response
ershopsale4.xyz/
Redirect Chain

http://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5m...
https://welovetop5.xyz/event_7fd79d93-f11e-09c1-ff29-7fd96d93fe18_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytnjdmn2u4njc4mtnlnjk1ngqxngiyndu5...
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

7 KB
3 KB

576ms
182ms

Document
text/html

173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: e9fefc4ae267adad2c6cd185c1c59715177c2fa155d64789af1820c3d9e39636

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 26 Jun 2024 02:52:36 GMT
server: nginx

Redirect headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-WoW64, Sec-CH-UA-Bitness, Sec-CH-UA-Model
date: Wed, 26 Jun 2024 02:52:35 GMT
location: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
server: nginx

GET
H2 200 css
fonts.googleapis.com/ 6 KB
1 KB 142ms
51ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ershopsale4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Jun 2024 02:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 02:18:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Jun 2024 02:52:36 GMT

GET
H3

200

aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzExMDQseV8zNTcvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvN...
s-img.mgid.com/g/18921166/328x328/-/
Redirect Chain

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3285_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGQ2MDNlZmQyMDI2MzVjYzY3NjQzNThiMGIwODNjOGVhJTI2...
https://xml.pushking.net/icon?sid=d603efd202635cc6764358b0b083c8ea&rnd=729953958
https://c.mgid.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XcSTF_UeJBB26r3LAJStBFddoTxMSo8tDJ1t3dnDqn2ST7Yjim-xUWGVXYTAlDWdusIAXdlTLgrXTnrylls5Yus*&cid=1423484&f=1&h2=vlJ0RdnMYFlD0pCQy6adPrmkLhdwwlmaR3J...
https://s-img.mgid.com/g/18921166/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzExMDQseV8zN...

8 KB
8 KB

45ms
44ms

Image
image/webp

104.19.133.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-img.mgid.com/g/18921166/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzExMDQseV8zNTcvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczLzQxMDI2NTU5ZDJiNTRkMjFmMGYzOTdjMThiNTdiYmRjLmpwZw.webp?v=1719370355--TIiqjY_lU4IlCv0HBtYwSwMAIbxsQEXAnzrltsX3Yk

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Server

104.19.133.76 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

822a111baef0867e5d1871de0aec9085165513bc0c11831d444d9055246c9efa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://ershopsale4.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 26 Jun 2024 02:52:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
x-mg-request-uuid: cfadfc06-43d2-423e-87f4-2505d926d93a
age: 1649841
alt-svc: h3=":443"; ma=86400
content-length: 8376
last-modified: Mon, 20 May 2024 21:17:04 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 8999e6fc8e26aca4-TXL

Redirect headers

date: Wed, 26 Jun 2024 02:52:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-mg-request-uuid: 040956a3-d7c0-470f-8a6c-7e30bed9d6d3
server: cloudflare
location: https://s-img.mgid.com/g/18921166/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzExMDQseV8zNTcvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczLzQxMDI2NTU5ZDJiNTRkMjFmMGYzOTdjMThiNTdiYmRjLmpwZw.webp?v=1719370355--TIiqjY_lU4IlCv0HBtYwSwMAIbxsQEXAnzrltsX3Yk
cf-ray: 8999e6fc2d92aca4-TXL
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3

200

c
c.adskeeper.com/
Redirect Chain

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3303_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDc5OTRhOTllNTI3NjU2ZjNiYjhiMzFlNDI5NTk0NzNhJTI2...
https://xml.pushking.net/icon?sid=7994a99e527656f3bb8b31e42959473a&rnd=729953958
https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&cid=1538383&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1...

43 B
230 B

60ms
59ms

Image
image/gif

172.64.152.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&cid=1538383&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&psid=885913

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Server

172.64.152.106 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://ershopsale4.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 26 Jun 2024 02:52:37 GMT
strict-transport-security: max-age=15768000; includeSubdomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-mg-request-uuid: 9a7e2df8-056e-4a50-9b87-4d0484044ccd
server: cloudflare
content-type: image/gif
cf-ray: 8999e6fc2c0058f0-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43

Redirect headers

location: https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&cid=1538383&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&psid=885913
date: Wed, 26 Jun 2024 02:43:58 GMT
server: nginx

GET
H3

200

c
c.adskeeper.com/
Redirect Chain

https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_3489_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRGZiNjQ4OGZlNzg4YmNjZjM4Nzk3ZGI3YTFlYmQ5YmQ5JTI2...
https://xml.pushking.net/icon?sid=fb6488fe788bccf38797db7a1ebd9bd9&rnd=729953958
https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65Xa2T_eJdUJ56050gg0jiRMG_qBclP_5-WNr3y2hlb8XZT7Yjim-xUWGVXYTAlDWdum54o_Di5z4vAmUUo8XzDnI*&cid=1508808&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1...

43 B
229 B

55ms
53ms

Image
image/gif

172.64.152.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65Xa2T_eJdUJ56050gg0jiRMG_qBclP_5-WNr3y2hlb8XZT7Yjim-xUWGVXYTAlDWdum54o_Di5z4vAmUUo8XzDnI*&cid=1508808&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435a1e2-3367-11ef-a3ba-c84bd6836428&psid=78859130

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Server

172.64.152.106 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://ershopsale4.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 26 Jun 2024 02:52:37 GMT
strict-transport-security: max-age=15768000; includeSubdomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-mg-request-uuid: 42148dca-eefc-498c-a009-aac1d8634c95
server: cloudflare
content-type: image/gif
cf-ray: 8999e6fc2bff58f0-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43

Redirect headers

location: https://c.adskeeper.com/c?pv=2&v=0|0|0|a8pZx2oN156FO-hdtx65Xa2T_eJdUJ56050gg0jiRMG_qBclP_5-WNr3y2hlb8XZT7Yjim-xUWGVXYTAlDWdum54o_Di5z4vAmUUo8XzDnI*&cid=1508808&f=1&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rid=2435a1e2-3367-11ef-a3ba-c84bd6836428&psid=78859130
date: Wed, 26 Jun 2024 02:43:58 GMT
server: nginx

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3XzEwMjAseF8xMTA0LHlfMzU3L2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAzL...
s-img.mgid.com/g/18921166/453x227/-/ 8 KB
8 KB 300ms
44ms Image
image/webp 104.19.133.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-img.mgid.com/g/18921166/453x227/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3XzEwMjAseF8xMTA0LHlfMzU3L2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAzLzcxOTY3My80MTAyNjU1OWQyYjU0ZDIxZjBmMzk3YzE4YjU3YmJkYy5qcGc.webp?v=1719370355-NPVJsB7ybPKGkixaX95SSVeb_NVKgSrJwsl2gOtsHwk

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.133.76 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d301780ee7d567c8fe0b1ce66b0cef8e7c1c2979246130dc85941e094866cd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ershopsale4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
x-mg-request-uuid: 2afe0285-a560-410f-9543-a7e6e5af0ead
age: 4677304
alt-svc: h3=":443"; ma=86400
content-length: 7736
last-modified: Mon, 18 Mar 2024 16:38:44 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 8999e6f9d973aca4-TXL

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvNDQ2OTI3Lzg3NTZlM...
s-img.adskeeper.com/g/18692297/200x200/-/ 5 KB
5 KB 334ms
61ms Image
image/webp 172.64.152.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.com/g/18692297/200x200/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvNDQ2OTI3Lzg3NTZlMGNiZDFjMDk5ZWU0ODEwODk4ZDFkMjc2YjFmLmpwZw.webp?v=1719370355-9PEKli6YSFcsXvj0y7Q9vIp2muFasPv4Wveora8RqbY
Requested by: Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.152.106 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 381467b67445deae6be8a1efb2de7ee549ba44034f1ed797489d522bc57af0bc

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ershopsale4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:36 GMT
cf-cache-status: HIT
last-modified: Fri, 31 May 2024 13:20:38 GMT
x-mg-request-uuid: 571c6aa1-9868-4470-998e-cc0c99812c4f
server: cloudflare
age: 388781
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 8999e6f9f83358f0-TXL
content-length: 5252
alt-svc: h3=":443"; ma=86400

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzI2Nix5XzMwNC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyNC0wMi80N...
s-img.adskeeper.com/g/18686803/200x200/-/ 7 KB
7 KB 333ms
61ms Image
image/webp 172.64.152.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.com/g/18686803/200x200/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX3h5X2NlbnRlcixxX2F1dG86Z29vZCx3Xzk2MCx4XzI2Nix5XzMwNC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyNC0wMi80NDY5MjcvM2FiZDE2NDY2OGQxY2NhMTc2YmZlMTQyZmVkYWZiYTYuanBn.webp?v=1719370355-0-9F-oJAf-3sz_tmZyKwGYNes3YafZW7D0BM55jUidk
Requested by: Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.152.106 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b568a34e0958862a41af3eccfce4ce973560f2a5aeaa5599fe75b3c40b48f76

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ershopsale4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:36 GMT
cf-cache-status: HIT
last-modified: Thu, 13 Jun 2024 16:08:59 GMT
x-mg-request-uuid: 6bef090e-d3a9-46df-8738-cb0703860de3
server: cloudflare
age: 1075380
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 8999e6f9f82358f0-TXL
content-length: 6998
alt-svc: h3=":443"; ma=86400

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 311ms
40ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://ershopsale4.xyz
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 22:08:40 GMT
x-content-type-options: nosniff
age: 17036
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 22:08:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 331ms
60ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://ershopsale4.xyz
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 14:43:19 GMT
x-content-type-options: nosniff
age: 43757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 14:43:19 GMT

GET
H2 404 favicon.ico
ershopsale4.xyz/ 548 B
245 B 182ms
182ms Other
text/html 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ershopsale4.xyz/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:37 GMT
content-encoding: gzip
server: nginx
content-type: text/html

GET
H2 200 event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_0_3000
ershopsale4.xyz/ 117 B
208 B 182ms
182ms Script
application/javascript 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_0_3000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LWQ2MDNlZmQyMDI2MzVjYzY3NjQzNThiMGIwODNjOGVhLTMyODUtMC4wMDAzMTclMjIlMkMlMjI1MzQtNzk5NGE5OWU1Mjc2NTZmM2JiOGIzMWU0Mjk1OTQ3M2EtMzMwMy0wLjAxNDM2NiUyMiUyQyUyMjUzNC1mYjY0ODhmZTc4OGJjY2YzODc5N2RiN2ExZWJkOWJkOS0zNDg5LTAuMDE0MzY2JTIyJTVEJTdE&t=1719370356248&rnd=392437762&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Requested by: Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/sw_d1eec353-c5b0-9275-25da-535f644b7c72_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:38 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript

GET
H3

200

1
clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/
Redirect Chain

https://xml.pushking.net/click?s=1&tid=534&sid=7994a99e527656f3bb8b31e42959473a&rnd=998134440
https://clck.adskeeper.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA*&rid=2435e0cb-...
https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-336...

2 KB
2 KB

194ms
147ms

Document
text/html

104.19.129.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1

Requested by

Host: ershopsale4.xyz
URL: https://ershopsale4.xyz/event_dcf2ece5-3e48-eb57-b79f-f6848fbe6264_101_0_3000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LWQ2MDNlZmQyMDI2MzVjYzY3NjQzNThiMGIwODNjOGVhLTMyODUtMC4wMDAzMTclMjIlMkMlMjI1MzQtNzk5NGE5OWU1Mjc2NTZmM2JiOGIzMWU0Mjk1OTQ3M2EtMzMwMy0wLjAxNDM2NiUyMiUyQyUyMjUzNC1mYjY0ODhmZTc4OGJjY2YzODc5N2RiN2ExZWJkOWJkOS0zNDg5LTAuMDE0MzY2JTIyJTVEJTdE&t=1719370356248&rnd=392437762&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.129.76 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-wow64,sec-ch-ua-bitness,sec-ch-ua-model
alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8999e70cf838453a-TXL
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 26 Jun 2024 02:52:39 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
x-mg-click-uuid: 697ed7d2-4e7c-b547-05e4-0027c872ff58
x-robots-tag: noindex

Redirect headers

accept-ch: sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-wow64,sec-ch-ua-bitness,sec-ch-ua-model
alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8999e70bbabc4541-TXL
content-type: text/html; charset=UTF-8
date: Wed, 26 Jun 2024 02:52:39 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
location: https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1
server: cloudflare
x-robots-tag: noindex

GET
H2

200

Primary Request / Show response
xcraft.net/registration/
Redirect Chain

https://r.clickfrog.org/xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d49037...
http://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7...
https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a...

13 KB
6 KB

191ms
56ms

Document
text/html

51.195.106.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Requested by: Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.195.106.115 , France, ASN16276 (OVH, FR),
Reverse DNS: xcraft.ru
Software: nginx /
Resource Hash: b668494df010c200fef609d4ddebd847e13cf110ffb4497ab3bc2431ffad9e48

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://clck.mgid.com/ghits/18692297/i/57869945/2/src/885913/pp/1/1?h=a8pZx2oN156FO-hdtx65XbyVKFycPzFxK-F_z3DZL2XKUDsGnAhd6wrTjHfBGXPBT7Yjim-xUWGVXYTAlDWduiItIWfGGtIyk3eMIs-hutA%2A&rid=2435e0cb-3367-11ef-a3ba-c84bd6836428&tt=Direct&att=3&pubsrcid=885913&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPsBE2jaiK1qq8RJq43zft0v3uXmjMmK4ocI1wQyB1hsF&rdrct=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache, must-revalidate no-store, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 26 Jun 2024 02:52:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx

Redirect headers

Location: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 registration.terran.css
cdn.xcraft.net/assets/build/css/ 10 KB
3 KB 144ms
88ms Stylesheet
text/css 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/assets/build/css/registration.terran.css?v=4007
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb2783fe8ce163b317325b95fa374e4c488d23c1ef395300ee1e1b6d2c94e517

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57895
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 04 Jan 2023 08:19:15 GMT
server: cloudflare
etag: W/"63b53683-2901"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P19LsZQbJ2rcht7FTv7ozI6x8D0v206dOnvVQIec0ct225vwDIxzlEUZRTmL5LqqgKNiIRkevla3lcszWgURwMZ6TyUt0GW8G10PC2FPB%2Fvfj1YzMwhZqd0U7N0I4uJgAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000, public
cf-ray: 8999e710fa05bbad-FRA
expires: Thu, 25 Jul 2024 10:47:45 GMT

GET
H2 200 lgr.min.js Show response
xcraft.net/assets/build/js/ 6 KB
3 KB 43ms
42ms Script
application/javascript 51.195.106.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://xcraft.net/assets/build/js/lgr.min.js?v=13246
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.195.106.115 , France, ASN16276 (OVH, FR),
Reverse DNS: xcraft.ru
Software: nginx /
Resource Hash: 02e66cb6ed9cadd2b5602eb1b262b739e7b86027581ec25bdf5e77f87cced7a9

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
last-modified: Tue, 25 Jun 2024 13:59:08 GMT
server: nginx
etag: W/"667acd2c-1603"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H2 200 cdn.min.js Show response
xcraft.net/assets/build/js/ 2 KB
1 KB 45ms
44ms Script
application/javascript 51.195.106.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://xcraft.net/assets/build/js/cdn.min.js?v=13246
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.195.106.115 , France, ASN16276 (OVH, FR),
Reverse DNS: xcraft.ru
Software: nginx /
Resource Hash: ac341c6e920f9cdd68213ecfaad1252de3bf3fb1b4ba8e8bbf5e36019c1da0e4

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
last-modified: Tue, 25 Jun 2024 13:59:07 GMT
server: nginx
etag: W/"667acd2b-702"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H3 200 autoloader.es8.min.js Show response
cdn.xcraft.net/assets/build/js/es8/ 4 KB
2 KB 102ms
47ms Script
application/javascript 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/assets/build/js/es8/autoloader.es8.min.js?v=13246
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21ec302dbd6a1e133bf70aa9f0fc63b047a73b6a1a67a05061fef8d9e18090fc

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Origin: https://xcraft.net
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46155
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jun 2024 14:00:03 GMT
server: cloudflare
etag: W/"667acd63-112a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2mbYdjfxH%2FxhB%2FzPa%2FeKJxhxcdgY7bFGm1Wy8ARIPu%2B1B8yL9Vt3Y4w0Id20Mpqq%2FgjDxJNKMczion00P8HuICBz332U6oxCdUd4Zgdhagj9Fa82%2FTk7oMBeVBlflojImA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
cf-ray: 8999e710ff263a7e-FRA
expires: Thu, 25 Jul 2024 14:03:25 GMT

GET
H3 200 logo_terran_small.png
cdn.xcraft.net/images/ 17 KB
17 KB 104ms
48ms Image
image/png 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.xcraft.net/images/logo_terran_small.png
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ca8e83cf504aebda19344290f6df4a189eb2e2e5bde5cd43ec96d63b3ba2ea1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57895
alt-svc: h3=":443"; ma=86400
content-length: 17329
last-modified: Wed, 10 Mar 2021 16:52:23 GMT
server: cloudflare
etag: "6048f947-43b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZQdpLKeZurXjMp8kh7keYgqJcd349xAtBcrmDAJVQjgy27L7QCMGtXJMvuTLxibc36%2Fi9ykGV8bNyBXCH2HAQK40XsuHghm2h0LaByeF4i3Y63CjMKVqiQnDvZDIoVElg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
cf-ray: 8999e710fa02bbad-FRA
expires: Thu, 25 Jul 2024 10:47:45 GMT

GET
H2 200 telegram-widget.js Show response
telegram.org/js/ 20 KB
6 KB 150ms
49ms Script
application/javascript 2001:67c:4e8:f004::9
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://telegram.org/js/telegram-widget.js?9

Requested by

Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Mon, 03 Apr 2023 11:46:12 GMT
server: nginx/1.18.0
etag: W/"642abc84-4ff5"
content-type: application/javascript
cache-control: max-age=345600
expires: Sun, 30 Jun 2024 02:52:40 GMT

GET
H3 200 cnd_test.png Show response
cdn.xcraft.net/images/ 67 B
543 B 55ms
54ms XHR
image/png 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/images/cnd_test.png?v1719370360546
Requested by: Host: xcraft.net
URL: https://xcraft.net/assets/build/js/cdn.min.js?v=13246
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0ee6ce31a24984036bfd39b55ea8d696734e1eaa40c30010cf12c63fd04e196

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 67
last-modified: Wed, 10 Mar 2021 16:52:22 GMT
server: cloudflare
etag: "6048f946-43"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2FDggyLiRzP1rsYfQ6wHyO1ve8VpnT0chiRwRH8O42rli0zn3xEpMg%2FZK9iRbM%2Fj7BuoNwQQ94vTIaSK%2BkjunEkM0Y9J0wMGczvVDo2MVNGJ%2FDSd965LMHJ6iw6NsrzCCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
cf-ray: 8999e7118f753a7e-FRA
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 130ms
40ms Script
text/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 26 Jun 2024 02:51:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 64
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Wed, 26 Jun 2024 04:51:36 GMT

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 156 KB
56 KB 344ms
174ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

e6fa93b3219955fb46c0f4362e0ee2bd2efa9824af9573a27517e076586269ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Tue, 25 Jun 2024 12:26:08 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "667ab760-dcde"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 56542
expires: Wed, 26 Jun 2024 03:52:40 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1381512/ 70 KB
22 KB 129ms
41ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1381512/tfa.js
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3318e557dd519dc0bd927701767f4dc66e731941e7e04a8b90df23b442b30194

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: POoO_dirBY31UMoGCKJCU2Gj7uiwVXGl
content-encoding: gzip
via: 1.1 varnish
date: Wed, 26 Jun 2024 02:52:40 GMT
x-amz-request-id: N25N58WC7TDGCZEQ
age: 51
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 21716
x-amz-id-2: KC4oxud7uDI3jTBOlSlyactWYtvhPZycE9bMMdtB14RDJU9Qy/IACtVtcfl2aQbTXiLXI9NBGTk=
x-served-by: cache-fra-etou8220065-FRA
last-modified: Sun, 23 Jun 2024 11:47:49 GMT
server: AmazonS3
x-timer: S1719370361.656062,VS0,VE1
etag: "a825a18d83f5612bc5b1548b90bbd08f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 70
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 c_q2_ai.js Show response
stat.scroogefrog.com/queue2/ 20 KB
6 KB 143ms
47ms Script
text/html 116.203.95.45
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://stat.scroogefrog.com/queue2/c_q2_ai.js?u=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&r=0.2993974449493544

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

116.203.95.45 Munich, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.45.95.203.116.clients.your-server.de

Software

nginx / PHP/5.4.45

Resource Hash

13a80ccfaaf3034219ed981decb14a901ae78c30b95e475d5a6aeab94a08f5f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Wed, 26 Jun 2024 02:52:40 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
server: nginx
x-powered-by: PHP/5.4.45
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm...
https://counter.yadro.ru/hit?q;t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26u...

1 KB
2 KB

74ms
74ms

Image
image/gif

88.212.202.52
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id;0.13283115429900771

Requested by

Protocol

HTTP/1.1

Server

88.212.202.52 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host152.rax.ru

Software

nginx/1.17.9 /

Resource Hash

932c4514c4fe2502f38f1e00fa2dbe7f64a4693bc7b58cd43671309ce1b27d6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jun 2024 02:52:40 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 1305
Expires: Mon, 26 Jun 2023 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 26 Jun 2024 02:52:40 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t22.4;rhttps%3A//clck.mgid.com/;s1600*1200*24;uhttps%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id;0.13283115429900771
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Mon, 26 Jun 2023 21:00:00 GMT

GET
H3 206 start.mp4
cdn.xcraft.net/tutorial/missions/1/ 6 MB
0 47ms
47ms Media
video/mp4 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/tutorial/missions/1/start.mp4
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Referer: https://xcraft.net/
Range: bytes=0-
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57895
Content-Range: bytes 0-28984560/28984561
alt-svc: h3=":443"; ma=86400
Content-Length: 28984561
last-modified: Wed, 10 Mar 2021 16:52:31 GMT
server: cloudflare
etag: "6048f94f-1ba44f1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SZY9kNyP4T7861An%2BLo3dJiqqXsPOhR2NMxyG7vu2EnsMCVJeBycDqHvgCQKsQvycFuMGv5CB83kc%2BtiH%2BgD50MSVtItO2p6WxJc5SPz%2BOPwr%2FmnrlyKTSSqXysG1VQM%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: video/mp4
access-control-allow-origin: *
cache-control: max-age=2592000, public
cf-ray: 8999e7119a5fbbad-FRA
expires: Thu, 25 Jul 2024 10:47:45 GMT

GET
H2 200 lang-icons.png
xcraft.net/images/lang/ 443 B
656 B 40ms
39ms Image
image/png 51.195.106.115
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xcraft.net/images/lang/lang-icons.png
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.195.106.115 , France, ASN16276 (OVH, FR),
Reverse DNS: xcraft.ru
Software: nginx /
Resource Hash: ed143f7b3f3662966939b1e762ba4502462378864f05d06c970ecf4023aa8154

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
last-modified: Mon, 16 Aug 2021 07:55:35 GMT
server: nginx
etag: "611a19f7-1bb"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 443
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H3 200 registry_form_top.png
cdn.xcraft.net/templates/Terran/img/ 2 KB
0 83ms
83ms Image
image/png 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.xcraft.net/templates/Terran/img/registry_form_top.png
Requested by: Host: cdn.xcraft.net
URL: https://cdn.xcraft.net/assets/build/css/registration.terran.css?v=4007
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn.xcraft.net/assets/build/css/registration.terran.css?v=4007
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57895
alt-svc: h3=":443"; ma=86400
content-length: 12317
last-modified: Wed, 10 Mar 2021 16:52:29 GMT
server: cloudflare
etag: "6048f94d-301d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8PVI0NowwfSNyZ%2Fl7Fd6LkCoEvf49nAQJBXHtr21oMYxAJ2UFzbOMGqWR5ahuxwHOriGIOdXxr0WHek7sjpKUgAgjEgywNcDN%2BeMpcGR6VBwVQ5lM%2FJATgJmpaqOlf8yg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
cf-ray: 8999e7119a62bbad-FRA
expires: Thu, 25 Jul 2024 10:47:45 GMT

GET registry_form-2inputs.png
cdn.xcraft.net/templates/Terran/img/ 0
0

GET oauth_sprite.png
cdn.xcraft.net/images/index/template/ 0
0

GET 360-button-play-light.png
cdn.xcraft.net/assets/js/lib/360-player/ 0
0

GET Xcraft_terran_theme.mp3
cdn.xcraft.net/images/sound/ 0
0

GET
H3 200 jquery.min.js Show response
cdn.xcraft.net/assets/build/js/es8/ 93 KB
38 KB 50ms
49ms Script
application/javascript 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/assets/build/js/es8/jquery.min.js?v=13246
Requested by: Host: cdn.xcraft.net
URL: https://cdn.xcraft.net/assets/build/js/es8/autoloader.es8.min.js?v=13246
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 826d82abcb34b5a7a5294519da1ea1d5d4730b50469161e52bfed730fb2f3b3c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Origin: https://xcraft.net
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46155
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jun 2024 13:59:26 GMT
server: cloudflare
etag: W/"667acd3e-175cc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3TTF8PcrbCx6B7IRnmLlEH1YFHdpjrg5OVEYlcd%2B38ndFdd5ymSQOz8fpmRpHheHJtatUBJs0gfhvUzEetfV%2B4kmeSuSf5x8khI%2B0fU%2FQ9WFBA1QBV6YUel%2F7poxf%2Fsi8w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
cf-ray: 8999e711af8e3a7e-FRA
expires: Thu, 25 Jul 2024 14:03:25 GMT

GET
H3 200 cnd_test.png
cdn.xcraft.net/images/ 67 B
0 0ms
0ms Image
image/png 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.xcraft.net/images/cnd_test.png?v1719370360546
Requested by: Host: xcraft.net
URL: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0ee6ce31a24984036bfd39b55ea8d696734e1eaa40c30010cf12c63fd04e196

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 67
last-modified: Wed, 10 Mar 2021 16:52:22 GMT
server: cloudflare
etag: "6048f946-43"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2FDggyLiRzP1rsYfQ6wHyO1ve8VpnT0chiRwRH8O42rli0zn3xEpMg%2FZK9iRbM%2Fj7BuoNwQQ94vTIaSK%2BkjunEkM0Y9J0wMGczvVDo2MVNGJ%2FDSd965LMHJ6iw6NsrzCCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
cf-ray: 8999e7118f753a7e-FRA
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H2 200 topics_api Show response
psb.taboola.com/ 65 B
284 B 124ms
41ms Fetch
text/html 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://psb.taboola.com/topics_api
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1381512/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e7112b70eed95d42b178135728e6153e34f07001827870748de87cd7dec3538e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-fra-etou8220036-FRA
date: Wed, 26 Jun 2024 02:52:40 GMT
via: 1.1 varnish
server: Varnish
observe-browsing-topics: ?1
x-timer: S1719370361.789170,VS0,VE0
x-cache: HIT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=2592000
accept-ranges: bytes
content-length: 65
retry-after: 0
x-cache-hits: 0

GET
H2 200 json Show response
trc.taboola.com/1381512/trc/3/ 2 KB
2 KB 70ms
62ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1381512/trc/3/json?tim=1719370360689&data=%7B%22id%22%3A877%2C%22ii%22%3A%22%2Fregistration%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1719370360684%2C%22cv%22%3A%2220240620-39-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id%22%2C%22e%22%3A%22https%3A%2F%2Fclck.mgid.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dscroogefrog-xcraft-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1719370360689%2C%22ref%22%3A%22https%3A%2F%2Fclck.mgid.com%2F%22%2C%22item-url%22%3A%22https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1381512/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: aefc8da5b631604286c9ef4a0b296d6e6cd49bb809e5f973094a890b5a43d718

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 15
date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
via: 1.1 varnish
cpu: 0.0745
x-fastly-to-nlb-rtt: 7496
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-etou8220065-FRA
x-log-content-encoding: gzip
server: nginx
x-timer: S1719370361.720139,VS0,VE15
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H3

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1938937557&utmhn=xcraft.net&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=Xcraft%20...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557&slf_rd=1&random=3955479175

42 B
63 B

98ms
49ms

Image
image/gif

142.250.185.99

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557&slf_rd=1&random=3955479175

Requested by

Protocol

Server

142.250.185.99 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:52:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:52:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-32348388-2&cid=1957401979.1719370361&jid=1733229515&_v=5.7.2&z=1938937557&slf_rd=1&random=3955479175
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 registration.min.de.js Show response
xcraft.net/assets/build/js/lang/ 88 B
319 B 45ms
45ms Script
application/javascript 51.195.106.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://xcraft.net/assets/build/js/lang/registration.min.de.js?v=13246
Requested by: Host: cdn.xcraft.net
URL: https://cdn.xcraft.net/assets/build/js/es8/autoloader.es8.min.js?v=13246
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.195.106.115 , France, ASN16276 (OVH, FR),
Reverse DNS: xcraft.ru
Software: nginx /
Resource Hash: a38ebdbe4b572aff39090ab494bf1da69854b1b11c0162cce8093940dd1b989f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/registration/?mgd_src=57869945s885913&utm_source=mgid_net&utm_campaign_id=11160744&utm_campaign=XCraftDEU&utm_medium=cpc&utm_content=18692297&mgid_click_id=d490373c66c3a8f53eae3a7806c51f07&utm_term=57869945s885913&adclida=mgid_click_id
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
last-modified: Tue, 25 Jun 2024 14:01:24 GMT
server: nginx
etag: "667acdb4-58"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 88
expires: Fri, 26 Jul 2024 02:52:40 GMT

GET
H2 200 c_q2_ai.php
stat.scroogefrog.com/queue2/ Frame 2EAF 0
0 144ms
45ms Document
text/html 116.203.95.45
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://stat.scroogefrog.com/queue2/c_q2_ai.php?sid=4037405246&u=https%3A//xcraft.net/registration/%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&ref=https%3A//clck.mgid.com/&mm=0&c8pad=&ga=&fr=0&cl=2b47bf14048105a582b35139614fd3d5&h=0

Requested by

Host: stat.scroogefrog.com
URL: https://stat.scroogefrog.com/queue2/c_q2_ai.js?u=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&r=0.2993974449493544

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

116.203.95.45 Munich, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.45.95.203.116.clients.your-server.de

Software

nginx / PHP/5.4.45

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 02:52:40 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
server: nginx
strict-transport-security: max-age=31536000
x-powered-by: PHP/5.4.45

GET
H2 200 XcraftNetLoginBot
oauth.telegram.org/embed/ Frame 4D50 0
0 196ms
98ms Document
text/html 2001:67c:4e8:f004::9
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://oauth.telegram.org/embed/XcraftNetLoginBot?origin=https%3A%2F%2Fxcraft.net&return_to=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&size=small&userpic=false&radius=4

Requested by

Host: telegram.org
URL: https://telegram.org/js/telegram-widget.js?9

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://xcraft.net
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	ALLOW-FROM https://xcraft.net

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store
content-encoding: gzip
content-length: 872
content-security-policy: frame-ancestors https://xcraft.net
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 02:52:40 GMT
pragma: no-cache
server: nginx/1.18.0
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: ALLOW-FROM https://xcraft.net

POST
H2 200 reciver_ai.php Show response
stat.scroogefrog.com/queue2/ 0
267 B 124ms
39ms XHR
text/html 116.203.95.45
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://stat.scroogefrog.com/queue2/reciver_ai.php?act=btr_inf

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

116.203.95.45 Munich, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.45.95.203.116.clients.your-server.de

Software

nginx / PHP/5.4.45

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
server: nginx
x-powered-by: PHP/5.4.45
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Content-Type, X-Requested-With

GET
H3 200 registration.min.js Show response
cdn.xcraft.net/assets/build/js/es8/ 111 KB
39 KB 54ms
54ms Script
application/javascript 172.67.215.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.xcraft.net/assets/build/js/es8/registration.min.js?v=13246
Requested by: Host: cdn.xcraft.net
URL: https://cdn.xcraft.net/assets/build/js/es8/autoloader.es8.min.js?v=13246
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.215.147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ae29fc884e0192111efcfb3ae10cf444bf5e5a3ddbc864613a1cc3425cf8137

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Origin: https://xcraft.net
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:40 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 45939
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jun 2024 14:01:22 GMT
server: cloudflare
etag: W/"667acdb2-1baa7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysXfqY2Xie868JuZhmBc44z9xcUlKvV4TXicuaoPnoJ9sDo8I5PiMh3k4rvtoDSFD6%2BrosmqbfqOUHZXrIAppbMiLyeZHVe69q5IxPZfsLdfzG135QUhK56CWjvEVS%2BqIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
cf-ray: 8999e712e8933a7e-FRA
expires: Thu, 25 Jul 2024 14:07:01 GMT

GET WorkerStarter.min.js
xcraft.net/assets/build/js/es8/ Frame 0
0

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET Xcraft_terran_theme.mp3
cdn.xcraft.net/images/sound/ 0
0

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10411.OdkUUz0KcVKyrGyGcnPm39i1sNx4KavAx6pnmTyWbSpxbZDNnfmv-rOeoxzn5_-G.2HgliRS9KqsgtEvSRghR62Z4Ulg%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10411.djXGPlK5pDUyz9-BrkkQHJ6sJVmAkTPGC5CMn6GSVQZAbFMs25G3BoLuxoV8hIaEFtPZQ2jVPTaPTtvuQf_grD9H7olQ59BXJ0XzuKbkx196bM_RVOEs2Soz3s4vB2kCnV7N7FyRNd...

43 B
673 B

87ms
87ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10411.djXGPlK5pDUyz9-BrkkQHJ6sJVmAkTPGC5CMn6GSVQZAbFMs25G3BoLuxoV8hIaEFtPZQ2jVPTaPTtvuQf_grD9H7olQ59BXJ0XzuKbkx196bM_RVOEs2Soz3s4vB2kCnV7N7FyRNde1k8RP4rzKiTIKh7p7DZb-pNBslfzrG_iWr6dnZPJixb5dKLiRT9eL0BkvJmznSAvKRQ06oslvJ9V1_L7BX_f2p3yHCsBZy0s%2C.iJB0XQOru8HGoIUjn7PRorgbAyY%2C

Requested by

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 26 Jun 2024 02:52:41 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10411.djXGPlK5pDUyz9-BrkkQHJ6sJVmAkTPGC5CMn6GSVQZAbFMs25G3BoLuxoV8hIaEFtPZQ2jVPTaPTtvuQf_grD9H7olQ59BXJ0XzuKbkx196bM_RVOEs2Soz3s4vB2kCnV7N7FyRNde1k8RP4rzKiTIKh7p7DZb-pNBslfzrG_iWr6dnZPJixb5dKLiRT9eL0BkvJmznSAvKRQ06oslvJ9V1_L7BX_f2p3yHCsBZy0s%2C.iJB0XQOru8HGoIUjn7PRorgbAyY%2C
date: Wed, 26 Jun 2024 02:52:41 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
596 B 83ms
83ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://xcraft.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:52:41 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 25 Jun 2024 12:26:08 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "667ab760-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Wed, 26 Jun 2024 03:52:41 GMT

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame E9F2 0
0 338ms
85ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1048
content-type: text/html
date: Wed, 26 Jun 2024 02:52:41 GMT
etag: "667ab760-418"
expires: Wed, 26 Jun 2024 03:52:41 GMT
last-modified: Tue, 25 Jun 2024 12:26:08 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H2

200

1 Show response
mc.yandex.com/watch/2135185/
Redirect Chain

https://mc.yandex.com/watch/2135185?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCr...
https://mc.yandex.com/watch/2135185/1?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DX...

469 B
561 B

92ms
91ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/2135185/1?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&page-ref=https%3A%2F%2Fclck.mgid.com%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22126%22%2C%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22126%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A126.0.6478.126%0Achl%0A%22Not%2FA%29Brand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22126.0.6478.126%22%2C%22Google%20Chrome%22%3Bv%3D%22126.0.6478.126%22%0Achm%0A%3F0%0Achp%0AWin32%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A1ddf25rn73ebk2eteqr6jr5riz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1370%3Acn%3A1%3Adp%3A0%3Als%3A452433958123%3Ahid%3A1009680036%3Az%3A120%3Ai%3A20240626045241%3Aet%3A1719370361%3Ac%3A1%3Arn%3A387767032%3Arqn%3A1%3Au%3A171937036114901109%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A570%3Ads%3A0%2C125%2C56%2C2%2C159%2C0%2C%2C191%2C0%2C%2C%2C%2C544%3Aco%3A0%3Acpf%3A1%3Ans%3A1719370360022%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1719370361%3At%3AXcraft%20-%20Registrierung&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%283178756%29ti%281%29

Requested by

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

9ce4ae9a4f2174ed3678a2d8991af916bacf9f47780ce4d89c91fa9ade6b9d41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://xcraft.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:52:41 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Wed, 26-Jun-2024 02:52:41 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xcraft.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 469
x-xss-protection: 1; mode=block
expires: Wed, 26-Jun-2024 02:52:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:52:41 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 26-Jun-2024 02:52:41 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/2135185/1?wmode=7&page-url=https%3A%2F%2Fxcraft.net%2Fregistration%2F%3Fmgd_src%3D57869945s885913%26utm_source%3Dmgid_net%26utm_campaign_id%3D11160744%26utm_campaign%3DXCraftDEU%26utm_medium%3Dcpc%26utm_content%3D18692297%26mgid_click_id%3Dd490373c66c3a8f53eae3a7806c51f07%26utm_term%3D57869945s885913%26adclida%3Dmgid_click_id&page-ref=https%3A%2F%2Fclck.mgid.com%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22126%22%2C%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22126%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A126.0.6478.126%0Achl%0A%22Not%2FA%29Brand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22126.0.6478.126%22%2C%22Google%20Chrome%22%3Bv%3D%22126.0.6478.126%22%0Achm%0A%3F0%0Achp%0AWin32%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A1ddf25rn73ebk2eteqr6jr5riz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1370%3Acn%3A1%3Adp%3A0%3Als%3A452433958123%3Ahid%3A1009680036%3Az%3A120%3Ai%3A20240626045241%3Aet%3A1719370361%3Ac%3A1%3Arn%3A387767032%3Arqn%3A1%3Au%3A171937036114901109%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A570%3Ads%3A0%2C125%2C56%2C2%2C159%2C0%2C%2C191%2C0%2C%2C%2C%2C544%3Aco%3A0%3Acpf%3A1%3Ans%3A1719370360022%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1719370361%3At%3AXcraft%20-%20Registrierung&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%283178756%29ti%281%29
access-control-allow-origin: https://xcraft.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Wed, 26-Jun-2024 02:52:41 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.xcraft.net
URL: https://cdn.xcraft.net/templates/Terran/img/registry_form-2inputs.png

Domain: cdn.xcraft.net
URL: https://cdn.xcraft.net/images/index/template/oauth_sprite.png

Domain: cdn.xcraft.net
URL: https://cdn.xcraft.net/assets/js/lib/360-player/360-button-play-light.png

Domain: cdn.xcraft.net
URL: https://cdn.xcraft.net/images/sound/Xcraft_terran_theme.mp3

Domain: xcraft.net
URL: https://xcraft.net/assets/build/js/es8/WorkerStarter.min.js?v=1&path=/assets/build/js/es8/WorkerProcess.min.js?v=1&

Domain: cdn.xcraft.net
URL: https://cdn.xcraft.net/images/sound/Xcraft_terran_theme.mp3

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
stat.scroogefrog.com/queue2	1969-12-31 23:59:59	Name: ctcb Value: 1719370360
.mgid.com/	1970-01-20 21:36:12	Name: __cf_bm Value: GbR0lYwBKck9owBM6XpacpezybPnx_55om_6RCJEMzk-1719370356-1.0.1.1-wW3YU3pYac734Hn.qWjqQHjYHTAqdAB2oxMeH1Xn2y3uh6OMQvC4MhSIoPo9yJB2QVNL1nVeUXi9jAFtrqzicw
.adskeeper.com/	1970-01-20 21:37:36	Name: mgid Value: 18692297
.adskeeper.com/	1970-01-20 21:37:36	Name: mtid Value: 57869945
.adskeeper.com/	1970-01-20 21:37:36	Name: mtuid Value: 57869945s885913
.adskeeper.com/	1970-01-20 21:37:36	Name: mstatus Value: 0
.adskeeper.com/	1970-01-20 21:37:36	Name: mghd Value: r.clickfrog.org
.mgid.com/	1970-01-20 21:37:36	Name: mgid Value: 18692297
.mgid.com/	1970-01-20 21:37:36	Name: mtid Value: 57869945
.mgid.com/	1970-01-20 21:37:36	Name: mtuid Value: 57869945s885913
.mgid.com/	1970-01-20 21:37:36	Name: mstatus Value: 0
.mgid.com/	1970-01-20 21:37:36	Name: mghd Value: r.clickfrog.org
xcraft.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5ufmkuev60b9t1dvjjrj8qp5fg
xcraft.net/	1970-01-20 21:36:13	Name: x_utm_source Value: mgid_net
xcraft.net/	1970-01-20 21:36:13	Name: x_utm_term Value: 57869945s885913
xcraft.net/	1970-01-20 21:36:13	Name: x_utm_content Value: 18692297
xcraft.net/	1970-01-20 21:36:13	Name: x_utm_campaign Value: 11160744
xcraft.net/	1970-01-20 21:36:13	Name: x_utm_campaign_name Value: XCraftDEU
xcraft.net/	1970-01-20 21:36:13	Name: mgid Value: d490373c66c3a8f53eae3a7806c51f07
.xcraft.net/	1970-01-21 07:12:10	Name: __utma Value: 137179577.1957401979.1719370361.1719370361.1719370361.1
.xcraft.net/	1969-12-31 23:59:59	Name: __utmc Value: 137179577
.xcraft.net/	1970-01-21 01:58:58	Name: __utmz Value: 137179577.1719370361.1.1.utmcsr=mgid_net\|utmccn=XCraftDEU\|utmcmd=cpc\|utmctr=57869945s885913\|utmcct=18692297
.xcraft.net/	1970-01-20 21:36:10	Name: __utmt Value: 1
.xcraft.net/	1970-01-20 21:36:12	Name: __utmb Value: 137179577.1.10.1719370361
.yadro.ru/	1970-01-21 06:21:25	Name: FTID Value: 1cUu9u3XDo8p1cUu9u0030W_
.yadro.ru/	1970-01-21 06:21:25	Name: VID Value: 3xQwVP2WB0up1cUu9u0030Xe
.yandex.ru/	1970-01-21 07:12:10	Name: i Value: XE9r690zYw4eaE8UkfRG/w+9l4OneC0nxKtp7q50AuNBjGTS5cvSHrEQekhO8B5G6qndh1TIrY4bUuoiV8ZGMLCpr/Q=
.yandex.ru/	1970-01-21 07:12:10	Name: yandexuid Value: 7643964971719370360
.yandex.ru/	1970-01-21 06:21:46	Name: yashr Value: 8297344091719370360
mc.yandex.ru/	1970-01-21 06:21:46	Name: bh Value: EkAiR29vZ2xlIENocm9tZSI7dj0iMTI2IiwgIk5vdDpBLUJyYW5kIjt2PSI4IiwgIkNocm9taXVtIjt2PSIxMjYiKgI/MDoHIldpbjMyIg==
oauth.telegram.org/	1970-01-21 06:20:28	Name: stel_ssid Value: 049fa6d838115d2a27_3803356218588877818
.xcraft.net/	1970-01-21 06:21:46	Name: _ym_uid Value: 171937036114901109
.xcraft.net/	1970-01-21 06:21:46	Name: _ym_d Value: 1719370361

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ershopsale4.xyz/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.adskeeper.com
c.mgid.com
cdn.taboola.com
cdn.xcraft.net
clck.adskeeper.com
clck.mgid.com
counter.yadro.ru
ershopsale4.xyz
fonts.googleapis.com
fonts.gstatic.com
freetrckr.com
mc.yandex.com
mc.yandex.ru
oauth.telegram.org
psb.taboola.com
r.clickfrog.org
s-img.adskeeper.com
s-img.mgid.com
ssl.google-analytics.com
stat.scroogefrog.com
stats.g.doubleclick.net
telegram.org
trc.taboola.com
welovetop5.xyz
www.google.com
www.google.de
xcraft.net
xml.pushking.net
cdn.xcraft.net
xcraft.net
104.19.129.76
104.19.133.76
116.203.95.45
142.250.185.99
151.101.1.44
172.217.16.196
172.64.152.106
172.67.192.46
172.67.215.147
173.214.240.15
199.182.164.180
2001:67c:4e8:f004::9
2a00:1450:4001:803::2008
2a00:1450:4001:803::200a
2a00:1450:4001:829::2003
2a00:1450:400c:c06::9c
2a02:6b8::1:119
51.195.106.115
88.212.202.52
02e66cb6ed9cadd2b5602eb1b262b739e7b86027581ec25bdf5e77f87cced7a9
0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
13a80ccfaaf3034219ed981decb14a901ae78c30b95e475d5a6aeab94a08f5f5
21ec302dbd6a1e133bf70aa9f0fc63b047a73b6a1a67a05061fef8d9e18090fc
2b568a34e0958862a41af3eccfce4ce973560f2a5aeaa5599fe75b3c40b48f76
3318e557dd519dc0bd927701767f4dc66e731941e7e04a8b90df23b442b30194
381467b67445deae6be8a1efb2de7ee549ba44034f1ed797489d522bc57af0bc
3d301780ee7d567c8fe0b1ce66b0cef8e7c1c2979246130dc85941e094866cd5
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5ca8e83cf504aebda19344290f6df4a189eb2e2e5bde5cd43ec96d63b3ba2ea1
822a111baef0867e5d1871de0aec9085165513bc0c11831d444d9055246c9efa
826d82abcb34b5a7a5294519da1ea1d5d4730b50469161e52bfed730fb2f3b3c
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
8ae29fc884e0192111efcfb3ae10cf444bf5e5a3ddbc864613a1cc3425cf8137
932c4514c4fe2502f38f1e00fa2dbe7f64a4693bc7b58cd43671309ce1b27d6a
9ce4ae9a4f2174ed3678a2d8991af916bacf9f47780ce4d89c91fa9ade6b9d41
a38ebdbe4b572aff39090ab494bf1da69854b1b11c0162cce8093940dd1b989f
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66
ac341c6e920f9cdd68213ecfaad1252de3bf3fb1b4ba8e8bbf5e36019c1da0e4
aefc8da5b631604286c9ef4a0b296d6e6cd49bb809e5f973094a890b5a43d718
b668494df010c200fef609d4ddebd847e13cf110ffb4497ab3bc2431ffad9e48
bb2783fe8ce163b317325b95fa374e4c488d23c1ef395300ee1e1b6d2c94e517
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e0ee6ce31a24984036bfd39b55ea8d696734e1eaa40c30010cf12c63fd04e196
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6fa93b3219955fb46c0f4362e0ee2bd2efa9824af9573a27517e076586269ac
e7112b70eed95d42b178135728e6153e34f07001827870748de87cd7dec3538e
e9fefc4ae267adad2c6cd185c1c59715177c2fa155d64789af1820c3d9e39636
ed143f7b3f3662966939b1e762ba4502462378864f05d06c970ecf4023aa8154
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

xcraft.net Open in urlscan Pro 51.195.106.115 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

49 Requests

73 %HTTPS

32 %IPv6

20 Domains

28 Subdomains

16 IPs

7 Countries

292 kBTransfer

6851 kBSize

33 Cookies

1 Outgoing links

Page URL History

Redirected requests

49 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

xcraft.net Open in urlscan Pro
51.195.106.115 Public Scan

Screenshot
Live screenshot

Full Image

49
Requests

73 %
HTTPS

32 %
IPv6

20
Domains

28
Subdomains

16
IPs

7
Countries

292 kB
Transfer

6851 kB
Size

33
Cookies

49 HTTP transactions
1 data transactions