www.winterduet.com Open in urlscan Pro
18.218.220.81 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://winterduet.com/
Effective URL:
https://www.winterduet.com/
Submission: On April 07 via manual (April 7th 2022, 8:02:00 pm UTC) from US — Scanned from DE

Summary HTTP 70 Redirects Behaviour Indicators

Summary

This website contacted 17 IPs in 4 countries across 12 domains to perform 70 HTTP transactions. The main IP is 18.218.220.81, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is www.winterduet.com.
TLS certificate: Issued by R3 on March 24th 2022. Valid for: 3 months.

This is the only time www.winterduet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 10	18.218.220.81 18.218.220.81	16509 (AMAZON-02) (AMAZON-02)
3	120.77.167.45 120.77.167.45	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
5	2600:9000:223... 2600:9000:223d:7400:5:a2fb:12c0:93a1	16509 (AMAZON-02) (AMAZON-02)
21	2606:4700::68... 2606:4700::6812:166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
11	151.101.65.21 151.101.65.21	54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:223... 2600:9000:223d:6800:11:77ab:5a00:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	104.111.228.123 104.111.228.123	16625 (AKAMAI-AS) (AKAMAI-AS)
2	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
1	119.3.72.88 119.3.72.88	55990 (HWCSNET H...) (HWCSNET Huawei Cloud Service data center)
6	151.101.1.35 151.101.1.35	54113 (FASTLY) (FASTLY)
1 2	64.4.245.84 64.4.245.84	17012 (PAYPAL) (PAYPAL)
70	17

10 18.218.220.81 (Columbus, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-218-220-81.us-east-2.compute.amazonaws.com

winterduet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.winterduet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 120.77.167.45 (Shenzhen, China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:223d:7400:5:a2fb:12c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2n92a4bi8klzf.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2606:4700::6812:166 (United States)

ASN13335 (CLOUDFLARENET, US)

statics.cloudfastin.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.cloudfastin.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 151.101.65.21 (United States)

ASN54113 (FASTLY, US)

www.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223d:6800:11:77ab:5a00:21 (United States)

ASN16509 (AMAZON-02, US)

d3ud6u98s3z9ew.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.228.123 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.3.72.88 (China)

ASN55990 (HWCSNET Huawei Cloud Service data center, CN)
PTR: ecs-119-3-72-88.compute.hwclouds-dns.com

wshop-s3.frp.codefriend.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.1.35 (United States)

ASN54113 (FASTLY, US)

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c6.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.4.245.84 (United States) 1 redirects

ASN17012 (PAYPAL, US)

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dub.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	paypal.com 1 redirects www.paypal.com — Cisco Umbrella Rank: 2500 t.paypal.com — Cisco Umbrella Rank: 3392 c.paypal.com — Cisco Umbrella Rank: 5906 b.stats.paypal.com — Cisco Umbrella Rank: 4652 dub.stats.paypal.com — Cisco Umbrella Rank: 17957 c6.paypal.com — Cisco Umbrella Rank: 6738	403 KB
21	cloudfastin.top statics.cloudfastin.top — Cisco Umbrella Rank: 106853 cdn.cloudfastin.top — Cisco Umbrella Rank: 139316	2 MB
10	winterduet.com 2 redirects winterduet.com www.winterduet.com	72 KB
7	cloudfront.net d2n92a4bi8klzf.cloudfront.net d3ud6u98s3z9ew.cloudfront.net	325 KB
3	aliyuncs.com conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com — Cisco Umbrella Rank: 158910	8 KB
2	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 1886	33 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	388 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	20 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 138	114 KB
1	codefriend.top wshop-s3.frp.codefriend.top	7 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 647	30 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71	38 KB
70	12

	Domain	Requested by
16	cdn.cloudfastin.top	www.winterduet.com
11	www.paypal.com	www.winterduet.com www.paypal.com www.paypalobjects.com statics.cloudfastin.top
8	www.winterduet.com	www.winterduet.com statics.cloudfastin.top
5	c.paypal.com	www.paypal.com c.paypal.com
5	statics.cloudfastin.top	www.winterduet.com statics.cloudfastin.top
5	d2n92a4bi8klzf.cloudfront.net	www.winterduet.com
3	conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com	www.winterduet.com conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com d2n92a4bi8klzf.cloudfront.net
2	t.paypal.com	www.winterduet.com
2	www.paypalobjects.com	www.paypal.com www.paypalobjects.com
2	www.facebook.com	www.winterduet.com
2	www.google-analytics.com	www.googletagmanager.com statics.cloudfastin.top
2	d3ud6u98s3z9ew.cloudfront.net	statics.cloudfastin.top
2	connect.facebook.net	www.winterduet.com connect.facebook.net
2	winterduet.com	2 redirects
1	c6.paypal.com
1	dub.stats.paypal.com	www.paypal.com
1	b.stats.paypal.com	1 redirects
1	wshop-s3.frp.codefriend.top	www.winterduet.com
1	code.jquery.com	conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com
1	www.googletagmanager.com	www.winterduet.com
70	20

This site contains no links.

Subject Issuer	Validity	Valid
www.winterduet.com R3	`2022-03-24` - `2022-06-22`	3 months	crt.sh
*.oss-cn-shenzhen.aliyuncs.com GlobalSign Organization Validation CA - SHA256 - G2	`2022-01-20` - `2023-02-21`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-12-01` - `2022-11-30`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-01-15` - `2022-04-15`	3 months	crt.sh
*.frp.codefriend.top R3	`2022-03-09` - `2022-06-07`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.winterduet.com/
Frame ID: 153620C21EF63E47F8FFC102B4F7A0E7
Requests: 64 HTTP requests in this frame

Frame: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true
Frame ID: 3619E2FD4A2CE2E27E20B1E745BD5F13
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 5F6E4127B1D4EC92FABA36237C79EC10
Requests: 1 HTTP requests in this frame

Frame: https://www.paypalobjects.com/muse/analytics/index.html
Frame ID: 48535F81C3AFA6956A32FD25CE42D973
Requests: 2 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 649B106121CE96D2CF1F7084A5AE9B31
Requests: 5 HTTP requests in this frame

Frame: https://dub.stats.paypal.com/v2/counter2.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS
Frame ID: 6DA64C2312EF4B09AA1EE9CAE63DF2C9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Winterduet

Page URL History Show full URLs

http://winterduet.com/ HTTP 308
https://winterduet.com/ HTTP 302
https://www.winterduet.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

70
Requests

99 %
HTTPS

50 %
IPv6

12
Domains

20
Subdomains

17
IPs

4
Countries

3626 kB
Transfer

8615 kB
Size

21
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://winterduet.com/ HTTP 308
https://winterduet.com/ HTTP 302
https://www.winterduet.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://b.stats.paypal.com/v2/counter.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS HTTP 302
https://dub.stats.paypal.com/v2/counter2.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS

70 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.winterduet.com/
Redirect Chain

http://winterduet.com/
https://winterduet.com/
https://www.winterduet.com/

313 KB
58 KB

2500ms
268ms

Document
text/html

18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 9ffb9a0e6c47ecb403e312b76a14957c32ad19ac85c0cf8aa445e3fbb9a92784

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 07 Apr 2022 20:01:52 GMT
expires: -1
pragma: no-cache
vary: Accept-Encoding Accept-Encoding

Redirect headers

cache-control: private, must-revalidate
content-type: text/html; charset=UTF-8
date: Thu, 07 Apr 2022 20:01:49 GMT
expires: -1
location: //www.winterduet.com/
pragma: no-cache

GET
H/1.1 200
OK index.js Show response
conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/ 3 KB
2 KB 1034ms
222ms Script
application/x-javascript 120.77.167.45
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/index.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 120.77.167.45 Shenzhen, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash: a3e0ef9f198e3832e3470c87a787480bbf25bef1a4cd7ed156176152b42bcb5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-oss-object-type: Normal
Date: Thu, 07 Apr 2022 20:01:53 GMT
Content-Encoding: gzip
x-oss-request-id: 624F43313D8A5833356FB172
Last-Modified: Sat, 02 Apr 2022 06:04:17 GMT
Server: AliyunOSS
Content-MD5: ky3bn2wYWH4ZuIgzYobsUA==
Vary: Accept-Encoding
Content-Type: application/x-javascript
Transfer-Encoding: chunked
x-oss-storage-class: Standard
Connection: keep-alive
x-oss-hash-crc64ecma: 14718963725355675328
x-oss-server-time: 4

GET
H2 200 jquery.min.js Show response
d2n92a4bi8klzf.cloudfront.net/js/jquery/3.6.0/ 87 KB
30 KB 34ms
7ms Script
application/javascript 2600:9000:223d:7400:5:a2fb:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2n92a4bi8klzf.cloudfront.net/js/jquery/3.6.0/jquery.min.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:7400:5:a2fb:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 06:11:25 GMT
content-encoding: br
last-modified: Fri, 25 Mar 2022 11:47:13 GMT
server: AmazonS3
age: 49828
etag: W/"0732e3eabbf8aa7ce7f69eedbd07dfdd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-cf-id: ZmurpMt7qFg6SDAeELcVUD8spseVK-_fBA2irk8vraVr_4zmyCOyeQ==

GET
H2 200 bootstrap.min.js Show response
d2n92a4bi8klzf.cloudfront.net/js/bootstrap/4.6.1/js/ 61 KB
15 KB 8ms
7ms Script
application/javascript 2600:9000:223d:7400:5:a2fb:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2n92a4bi8klzf.cloudfront.net/js/bootstrap/4.6.1/js/bootstrap.min.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:7400:5:a2fb:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0b107098fc8b361ce610dba0d1656c620c725311e51d4417c7c57c8bda369e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 04:28:25 GMT
content-encoding: gzip
last-modified: Fri, 25 Mar 2022 11:46:27 GMT
server: AmazonS3
age: 56008
etag: W/"55d39b6bff845a12b1f838acb73c444c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-cf-id: s3rgsJgzsPm97EGCYKoUrxvUMrsfy32ZQz-g5jhtN3I0Yc8YchZSCA==

GET
H2 200 vue.min.js Show response
d2n92a4bi8klzf.cloudfront.net/js/vue/2.6.14/ 92 KB
33 KB 8ms
7ms Script
application/javascript 2600:9000:223d:7400:5:a2fb:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2n92a4bi8klzf.cloudfront.net/js/vue/2.6.14/vue.min.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:7400:5:a2fb:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6e28a8fb9b74533ece152229dafcc3ebc0f4b3dcd62879df115706bce55927d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 05:21:41 GMT
content-encoding: br
last-modified: Mon, 28 Mar 2022 02:10:55 GMT
server: AmazonS3
age: 52813
etag: W/"0a9a4681294d8c5f476687eea6e74842"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-cf-id: eFisH-8VYr7ON7haLGkjk81CxosZ9a_Qv7o6IrhMnHK-YRTOP24eXg==

GET
H2 200 index.js Show response
d2n92a4bi8klzf.cloudfront.net/js/element-ui/2.13.0/ 554 KB
128 KB 8ms
7ms Script
application/javascript 2600:9000:223d:7400:5:a2fb:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2n92a4bi8klzf.cloudfront.net/js/element-ui/2.13.0/index.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:7400:5:a2fb:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f66cb165dbbf011418cff8a277801fe0aa86484b89809ee6825aeb9b0a34499

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 02:44:38 GMT
content-encoding: br
last-modified: Mon, 28 Mar 2022 02:06:24 GMT
server: AmazonS3
age: 62235
etag: W/"aad8e2ee90fb795b70705b06c69a8367"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-cf-id: 9aWMK-Nd1wHMjxpIW9-8KGU1Ykdzwr_kxUmQZ5Hn_kIZuRY8qRJjeQ==

GET
H2 200 app.1aeac8.js Show response
statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/ 1 MB
239 KB 64ms
23ms Script
application/javascript 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2d4723f425de98b009505c1de48cfcb8943865886ae9a43fbb6b4631bd507db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:52 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1335
x-cache: Hit from cloudfront
last-modified: Sun, 03 Apr 2022 06:21:26 GMT
server: cloudflare
etag: W/"034c5e6816c2dcb607538d7ec059bcc9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 bc899ba900b38f8013d849341ebb71c8.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
x-amz-cf-pop: TXL50-P4
cf-ray: 6f855b8f09b99bd0-FRA
x-amz-cf-id: XcyxrE9UsCQpBmuODMiXGjHXPLOowY-rcDHrBNSwmqQt8CKgusWUCw==
expires: Fri, 07 Apr 2023 20:01:52 GMT

GET
H2 200 index.css
d2n92a4bi8klzf.cloudfront.net/js/element-ui/2.13.0/theme-chalk/ 227 KB
35 KB 8ms
7ms Stylesheet
text/css 2600:9000:223d:7400:5:a2fb:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2n92a4bi8klzf.cloudfront.net/js/element-ui/2.13.0/theme-chalk/index.css
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:7400:5:a2fb:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c954d6f71089537dd993b791472192bd20cdbe29cd71dfeb8adf8dc24f61103d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 03:24:46 GMT
content-encoding: gzip
last-modified: Mon, 28 Mar 2022 10:22:09 GMT
server: AmazonS3
age: 59826
etag: W/"d28b24857449b697847be95be3d3701d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-cf-id: 72tyac5kuCVCMbmZF4v5yOdK8Pvi_dJ7w7xLC22Bhv8gxJr-yrdxyw==

GET
H2 200 fonts.59a56c.css
statics.cloudfastin.top/static/v1.27.18.3/store/vogue/css/ 212 KB
43 KB 25ms
24ms Stylesheet
text/css 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/css/fonts.59a56c.css
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 398ad657b117c1145ae0f3f8a9c2c1e9255db09091bdedabc10c7e2a1f19a6b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:52 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 387966
x-cache: Hit from cloudfront
last-modified: Sun, 03 Apr 2022 06:21:14 GMT
server: cloudflare
etag: W/"ba17ee35db52e6bbe76a37e6dc76b3f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
via: 1.1 c31ad517510d586c0f2aa3c5dbc40b06.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
x-amz-cf-pop: DUS51-P1
cf-ray: 6f855b8f5a709bd0-FRA
x-amz-cf-id: HIG0lc8z_oliP4n07F-vI4tnzgsC-jtfWVdfvMY7rFOjTYob-51g3g==
expires: Fri, 07 Apr 2023 20:01:52 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 44ms
20ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-224303903-4

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

15b2387ada2be7754faeec500663fad42e94ee9e4ac06e1e20e84fb9602e196c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38066
x-xss-protection: 0
last-modified: Thu, 07 Apr 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 07 Apr 2022 20:01:53 GMT

GET
H2 200 e7e09da5d09da88bf9d467da4749d2e9.png
cdn.cloudfastin.top/assets/2021/12/ 23 KB
24 KB 76ms
66ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/assets/2021/12/e7e09da5d09da88bf9d467da4749d2e9.png

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31b3cd2cf6a2639f877dc768d171fe201a3a231d50acff6aa766192c2ff2eb5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 13 Dec 2021 09:11:59 GMT
server: cloudflare
etag: "cfV7vGcsEgLq_HMQZ41ZRvHw:31444883d334f5df8513b629607d90ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 23958
accept-ranges: bytes
cf-ray: 6f855b92fa769bd0-FRA
cf-resized: internal=ok/h q=0 n=9 c=71 v=2022.3.3 l=23958
cf-bgj: imgq:86,h2pri

GET
H2 200 index.74cf03.js Show response
statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/ 2 MB
433 KB 20ms
20ms Script
application/javascript 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/index.74cf03.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eac2431bd3d7cd438ab94518f7a3ab3023228665b5d865d673818fde75b13650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:52 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 384222
x-cache: Hit from cloudfront
last-modified: Sun, 03 Apr 2022 06:21:37 GMT
server: cloudflare
etag: W/"2c7fe1b602771a08d9fcce8854ee1d9a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 a0a596e6d2f8589dbdee9e266338e31e.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
x-amz-cf-pop: CDG50-C2
cf-ray: 6f855b8ffbf19bd0-FRA
x-amz-cf-id: FxCw5Rjm5_KcCqXrKYQhBPwZ21EUrqkwOpFvG52z1shmrtvxf_iDDw==
expires: Fri, 07 Apr 2023 20:01:52 GMT

GET
H2 200 js Show response
www.paypal.com/sdk/ 329 KB
101 KB 405ms
405ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&commit=false&currency=USD&locale=en_US

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2da24e0c345cd3c9216a60d279e428959e218c40a28b4e17130f6c62e03dd244

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
age: 0
via: 1.1 varnish
x-cache: HIT
p3p: true
paypal-debug-id: f302534be7826
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 102856
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4043-HHN
x-timer: S1649361713.183004,VS0,VE398
x-frame-options: SAMEORIGIN
date: Thu, 07 Apr 2022 20:01:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=10800
etag: W/"191c8-dVTDYoGbw16dNPbYBh7rh18hMJk"
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 paypal.69709a.js Show response
statics.cloudfastin.top/static/v1.27.18.3/store/default/js/ 8 KB
3 KB 38ms
37ms Script
application/javascript 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/default/js/paypal.69709a.js
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f64abbabbe75127379374bda209ef682d1d2d7833cc68b209abb15c617c3d35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 967
x-cache: Hit from cloudfront
last-modified: Sun, 03 Apr 2022 06:22:07 GMT
server: cloudflare
etag: W/"38208432a5b2346d84430680bd2b8e5e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 d9a3650110a8e2b78edd73b33e0fa948.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
x-amz-cf-pop: TXL50-P4
cf-ray: 6f855b9548039bd0-FRA
x-amz-cf-id: uYBQHxOTVx1eJLeG0POntbnekkV285n8SRsJVh8XX7ESxBkv0PtFTg==
expires: Fri, 07 Apr 2023 20:01:53 GMT

GET
H2 200 remembered Show response
www.paypal.com/checkoutnow/ 66 B
3 KB 331ms
216ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/checkoutnow/remembered?callback=paypalisrememberedcallback

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Express

Resource Hash

47f1bf737f83f0054b66bf51c560205588a69a8e65d0c00961046d699d0e1afc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://connect.facebook.net https://www.facebook.com https://m.facebook.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.cardinalcommerce.com https://staticxx.facebook.com https://www.facebook.com https://m.facebook.com https://.baidu.com https://.baifubao.com https://.qualtrics.com; script-src 'self' https://.paypal.com https://.paypal.cn https://.paypal.com https://.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src https: data:; base-uri 'self' https://.paypal.com; object-src 'none'; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://connect.facebook.net https://www.facebook.com https://m.facebook.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.cardinalcommerce.com https://staticxx.facebook.com https://www.facebook.com https://m.facebook.com https://*.baidu.com https://*.baifubao.com https://*.qualtrics.com; script-src 'self' https://*.paypal.com https://*.paypal.cn https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src https: data:; base-uri 'self' https://*.paypal.com; object-src 'none'; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
via: 1.1 varnish
x-content-type-options: nosniff
x-powered-by: Express
x-cache: MISS
paypal-debug-id: f8068905116d6
dc: ccg11-origin-www-1.paypal.com
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
content-encoding: br
x-csrf-jwt-hash: da2b5167f8abb0742ef2944b6163b31fdb9099adc1da151e850c6595518c83b9
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4043-HHN
x-timer: S1649361713.832997,VS0,VE208
date: Thu, 07 Apr 2022 20:01:53 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-csrf-jwt: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbiI6IjlfVU1mVFZlbzdGTHFSWHJnRHhIS1dCX2VFanhseWtlc0tyeHF5dy12dFF5ZTV3QjlkSTY1VGxOVllBU1JmSWlUQnhlN1d3cWw1OUM4N0U0SVdLc2JkY3F4eG9OM0NnaktuLWhYU2hCV1lkVlN4Y3h0NjNnZ1BJUDR2THlrUFpPQUY4SVVITnVSajNyN1lZOXcyRXFqQXZTa2hRQ1dJN25MdDNsbk5ubHdXajN5dW1ETUh2dG1UUUJiVWEiLCJpYXQiOjE2NDkzNjE3MTIsImV4cCI6MTY0OTM2NTMxMn0.r6eC0xCgJX_uWO8miopTd_ik6hvEksqTVF70KGQ5Msc
cache-control: max-age=0, no-cache, no-store, must-revalidate
etag: W/"42-4SbENl3yIM7WtFI51AQmuKOWROQ"
accept-ranges: none
x-cache-hits: 0

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 229ms
17ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com
URL: https://conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d9d"
vary: Accept-Encoding
x-hw: 1649361713.dop240.am5.t,1649361713.cds223.am5.hn,1649361713.cds007.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H/1.1 200
OK index.css
conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/ 8 KB
2 KB 219ms
219ms Stylesheet
text/css 120.77.167.45
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/index.css
Requested by: Host: conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com
URL: https://conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 120.77.167.45 Shenzhen, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash: cf5a57e9403107691b0ba9707c598605960f5a5d55c3228d68b660f6be7d4400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-oss-object-type: Normal
Date: Thu, 07 Apr 2022 20:01:53 GMT
Content-Encoding: gzip
x-oss-request-id: 624F43313D8A583335FCB172
Last-Modified: Fri, 01 Apr 2022 13:38:06 GMT
Server: AliyunOSS
Content-MD5: RQXQXcRsVByLcEQPO29qAw==
Vary: Accept-Encoding
Content-Type: text/css; charset=utf-8
Transfer-Encoding: chunked
x-oss-storage-class: Standard
Connection: keep-alive
x-oss-hash-crc64ecma: 13529445141035419490
x-oss-server-time: 1

POST
H2 201 pv Show response
www.winterduet.com/api/statistics/ 0
758 B 649ms
649ms XHR
text/html 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/statistics/pv
Requested by: Host: www.winterduet.com
URL: https://www.winterduet.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.winterduet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
cache-control: private, must-revalidate
content-type: text/html; charset=UTF-8
etag: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
expires: -1

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 25ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26311
x-xss-protection: 0
pragma: public
x-fb-debug: UcQ73XgHdgKnP3EWzcmZk/KYtP3j3LvX9lncRc/n5QrNcE5//BDa9kfAkJRm3Q9RSaQHms1ryR0NUEAESsa/rA==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Thu, 07 Apr 2022 20:01:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 NunitoSans-Regular.woff2
d3ud6u98s3z9ew.cloudfront.net/fonts-ttf/ 49 KB
49 KB 34ms
8ms Font
binary/octet-stream 2600:9000:223d:6800:11:77ab:5a00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ud6u98s3z9ew.cloudfront.net/fonts-ttf/NunitoSans-Regular.woff2
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/css/fonts.59a56c.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:6800:11:77ab:5a00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1b0f32db905a4fce90aad56fa3fccb59be5f6f2ce040da7742cc7802b5ec09de

Request headers

Referer: https://statics.cloudfastin.top/
Origin: https://www.winterduet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 04:01:06 GMT
via: 1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
vary: Origin
age: 59238
x-cache: Hit from cloudfront
content-length: 49724
last-modified: Tue, 28 Dec 2021 06:00:03 GMT
server: AmazonS3
etag: "fb5bf6a0e88849dec2c5e6bf1a16f3df"
access-control-max-age: 3000
access-control-allow-methods: PUT, POST, DELETE, GET
content-type: binary/octet-stream
access-control-allow-origin: *
access-control-expose-headers: x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P3
accept-ranges: bytes
x-amz-cf-id: PjbIxmDfPUeSYVoHcXG34V6anGL5wy6OA1zJ_I61bWaY2wcxna9R5w==

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b45950cd536d5e9121ed5dc812cd8ca0d1195c438a2011d7b363ed1db5f2a13

Request headers

Referer
Origin: https://www.winterduet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: application/x-font-woff2;charset=utf-8

GET
DATA 200
OK truncated
/ 6 KB
6 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c352ae7c7e28e8a29b2f1c8943473add7b8fe297837f86ac6ac70e535892eb12

Request headers

Referer
Origin: https://www.winterduet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: application/x-font-woff2;charset=utf-8

GET
H2 200 1b12760377a738eee81079d3c2a4360b-180x115.jpg
cdn.cloudfastin.top/assets/2022/02/ 4 KB
4 KB 129ms
129ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/assets/2022/02/1b12760377a738eee81079d3c2a4360b-180x115.jpg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0271ba731822bfe551c5f09e691493e82c4783ac928c063d6ff088dfd824b507

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 09:50:31 GMT
server: cloudflare
etag: "cfceS1RUeVBsnxkvZOiOWERw:399028ca4e447a4670387281e9efe7df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 4074
accept-ranges: bytes
cf-ray: 6f855b95c92c9bd0-FRA
cf-resized: internal=ok/h q=0 n=11 c=11 v=2022.2.2 l=4074
cf-bgj: imgq:86,h2pri

GET
H2 200 317058630001841 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 10ms
9ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/317058630001841?v=2.9.57&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1f421b13bc9531d321d024932d750ba6287e68ee25e057603e0eaa41c8474ad5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 89095
x-xss-protection: 0
pragma: public
x-fb-debug: 56IjEzj3bth91ty6Hw7LA/RKfhctno1+K4/vRJeqEcmncbwAdEM13mqQkSJxWzwQzGMzGmig7Tkj0WlNqEMp+A==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 07 Apr 2022 20:01:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 Muli.woff2
d3ud6u98s3z9ew.cloudfront.net/fonts-ttf/v1/ 34 KB
35 KB 15ms
15ms Font
binary/octet-stream 2600:9000:223d:6800:11:77ab:5a00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3ud6u98s3z9ew.cloudfront.net/fonts-ttf/v1/Muli.woff2
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/css/fonts.59a56c.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:6800:11:77ab:5a00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3b14e2a7eb86c2b888f03d81b55ca4d016d4a357a4ea047cbea2c412d7cb5f88

Request headers

Referer: https://statics.cloudfastin.top/
Origin: https://www.winterduet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 04:01:06 GMT
via: 1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
vary: Origin
age: 59236
x-cache: Hit from cloudfront
content-length: 34864
last-modified: Tue, 28 Dec 2021 06:31:04 GMT
server: AmazonS3
etag: "0c521373f8a378c0036fcd33d833d047"
access-control-max-age: 3000
access-control-allow-methods: PUT, POST, DELETE, GET
content-type: binary/octet-stream
access-control-allow-origin: *
access-control-expose-headers: x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P3
accept-ranges: bytes
x-amz-cf-id: FBZziCQgk9L9d8De2FUuJs-H9IzwP6Raq1CnoKqOKiAgOTPFGhEdpw==

GET
H2 200 pptm.js Show response
www.paypal.com/tagmanager/ 13 KB
6 KB 9ms
9ms Script
application/x-javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/tagmanager/pptm.js?id=www.winterduet.com&t=xo&v=5.0.303&source=payments_sdk&client_id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&vault=false

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&commit=false&currency=USD&locale=en_US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

269c253ba1ce1bcf23acdcce0e64d9333b797dc8f00f669e2aa2dc7dfc3ec9a1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-jXdNcOqns+++WkF2tDXmJRmwTGus2ChGNxMyzrQJSqYIagCJ' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://.google-analytics.com 'unsafe-inline' https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-jXdNcOqns+++WkF2tDXmJRmwTGus2ChGNxMyzrQJSqYIagCJ' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
content-encoding: gzip
x-content-type-options: nosniff
age: 15618
x-cache: HIT
paypal-debug-id: f499326c777cd
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 4752
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4043-HHN
x-timer: S1649361714.665182,VS0,VE2
x-frame-options: SAMEORIGIN
date: Thu, 07 Apr 2022 20:01:53 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/x-javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=3600
etag: W/"3544-UxK3DT7hHah9OIKTLKZJDi2JEDY"
accept-ranges: bytes
x-cache-hits: 1

GET
H/1.1 200
OK vogue.js Show response
conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/ 15 KB
4 KB 217ms
217ms Script
application/x-javascript 120.77.167.45
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com/vogue.js?_=1649361713611
Requested by: Host: d2n92a4bi8klzf.cloudfront.net
URL: https://d2n92a4bi8klzf.cloudfront.net/js/jquery/3.6.0/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 120.77.167.45 Shenzhen, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash: 317f9a1d96344b724273945a2ef3b6f7f0e176f86b6c9ec17ddb78dcbb8a084c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-oss-object-type: Normal
Date: Thu, 07 Apr 2022 20:01:53 GMT
Content-Encoding: gzip
x-oss-request-id: 624F4331E3A1873036EB146E
Last-Modified: Fri, 01 Apr 2022 13:38:06 GMT
Server: AliyunOSS
Content-MD5: PiUAullZHI+YySPtXjB1DQ==
Vary: Accept-Encoding
Content-Type: application/x-javascript
Transfer-Encoding: chunked
x-oss-storage-class: Standard
Connection: keep-alive
x-oss-hash-crc64ecma: 6711054147413055855
x-oss-server-time: 1

GET
H2 200 sentry.chunk.b2e95.js Show response
statics.cloudfastin.top/static/v1.27.18.3/store/chunk/ 71 KB
21 KB 23ms
22ms Script
application/javascript 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/chunk/sentry.chunk.b2e95.js
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b3838dcf9b90e77aac2e13926915c894395cf37f2add983ed5e3541ace2c665

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 388844
x-cache: Hit from cloudfront
last-modified: Sun, 03 Apr 2022 06:22:36 GMT
server: cloudflare
etag: W/"335711771a07b5545d3c3771b4d7cced"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
x-amz-cf-pop: DUS51-P1
cf-ray: 6f855b96db7a9bd0-FRA
x-amz-cf-id: LsM1vwRcGVWAsfDdhoTddNmR3R3Tj5vwMDWmsiRby0q4DVWn7CSS0g==
expires: Fri, 07 Apr 2023 20:01:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 42ms
7ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-224303903-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1623
date: Thu, 07 Apr 2022 19:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 07 Apr 2022 21:34:50 GMT

POST
H2 204 facebook-conversions-api Show response
www.winterduet.com/api/store/ 0
698 B 884ms
884ms XHR
text/html 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/facebook-conversions-api
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IlwvZ24wRXZ1TGJUSU5BXC9DYVo2Qzh1Zz09IiwidmFsdWUiOiJLTkswTjB4YlVJdXVDUHk3ZjM5UTBBMnY3XC80WVRjcTI1em5Rdk9IUkRyRUU2NElPVXRTbzFQdHQxVndwKzZBbG16UUx3T2xQY1FXSjd0MjBtNWxMTmhPcmFGOU1DTnBKMDNwbktWY1JGQ0pDaEFHS3liUzg1RkVuZmVEc0xwWjciLCJtYWMiOiJlNWIwY2M3OTI4Mzk0NWYyNzliYTM4OGE3OWZiYzEyNThiOTBlM2M1MDkzODQwYWVhZDlmMDg0YTBmMzNjN2QxIn0=
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
cache-control: private, must-revalidate
content-type: text/html
etag: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
expires: -1

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 25ms
8ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=317058630001841&ev=PageView&dl=https%3A%2F%2Fwww.winterduet.com%2F&rl=&if=false&ts=1649361713790&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1649361713788.1061956540&it=1649361713599&coo=false&eid=a57376ad-5bc8-4b8f-98ff-2a047e472cb1&exp=p0&rqm=GET

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 07 Apr 2022 20:01:53 GMT

GET
H2 200 muse.js Show response
www.paypalobjects.com/muse/ 55 KB
17 KB 72ms
8ms Script
application/javascript 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/muse.js

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/tagmanager/pptm.js?id=www.winterduet.com&t=xo&v=5.0.303&source=payments_sdk&client_id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&vault=false

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Resource Hash

a4b749626aab6395c52aed1a8016aa5f6c4c8ca60cf771c0d8ce54202a53e725

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
date: Thu, 07 Apr 2022 20:01:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: W/"622a407f-dad7"
surrogate-control: max-age=31536000
vary: Accept-Encoding
content-type: application/javascript
paypal-debug-id: cd2c3ab99398c
cache-control: s-maxage=31536000, public,max-age=3600
strict-transport-security: max-age=31536000
dc: ccg11-origin-www-1.paypal.com
content-length: 16529

GET
H2 200 ts
t.paypal.com/ 42 B
706 B 208ms
166ms Image
image/gif 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3AXX7QCJLE83HY6-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3AXX7QCJLE83HY6-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=feb4cf9c-610e-48f0-b008-12620f18a8fc&fltp=analytics&mrid=XX7QCJLE83HY6&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&flag_consume=yes&pt=Winterduet&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1649361713939&g=0&completeurl=https%3A%2F%2Fwww.winterduet.com%2F

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/8F16) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
content-type: image/gif
server: ECAcc (frc/8F16)
strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: ef65d89cbea61
cache-control: max-age=0, no-cache, no-store, must-revalidate
server-timing: content-encoding;desc="", x-cdn;desc="edgecast",edge;dur=161
timing-allow-origin: *
content-length: 42
expires: Thu, 07 Apr 2022 20:01:54 GMT

GET
DATA 200
OK truncated
/ 21 KB
21 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fef4c5463ee7f7ecd0a369d08bb105b7be191dc9a0b87916f2633842360562d7

Request headers

Referer
Origin: https://www.winterduet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 9d19a9845a75620270684568a430d46fdf0779a7299b4ba44f88ea931d57a867-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 4 KB
4 KB 163ms
162ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/9d19a9845a75620270684568a430d46fdf0779a7299b4ba44f88ea931d57a867-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

854748b07ed364acbee02407566eb20b9fb7170bf9c6b425ddbc6d1432a34fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 10:02:44 GMT
server: cloudflare
etag: "cfEgOmpfJvabkjhCcZCNE_Wg:851b133d727329d90240e4a3118aa4cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 4274
accept-ranges: bytes
cf-ray: 6f855b9a6c879bd0-FRA
cf-resized: internal=ok/h q=0 n=9 c=16 v=2022.4.2 l=4274
cf-bgj: imgq:86,h2pri

GET
H2 200 631e40a9238b0238fb0bd7a7a89a65e3f93de42ecb390b02102b17182be22f2f-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 4 KB
4 KB 186ms
185ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/631e40a9238b0238fb0bd7a7a89a65e3f93de42ecb390b02102b17182be22f2f-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d03dc629d49626c56fc0b9d6652254c376982f309e10de4b265c6be5ce3a869

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfy0-sOao6ve-6xEcl9EC6nA:625bdc39a53b7e96856779032511be8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 4122
accept-ranges: bytes
cf-ray: 6f855b9a7c8b9bd0-FRA
cf-resized: internal=ok/m q=0 n=140 c=17 v=2022.4.2 l=4122
cf-bgj: imgq:86,h2pri

GET
H2 200 edc6e7f8bf070785f29cf512a8847b521bdd1e47178c7c4634d1649e41f19f20-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 4 KB
4 KB 129ms
128ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/edc6e7f8bf070785f29cf512a8847b521bdd1e47178c7c4634d1649e41f19f20-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e117484f22003aba54255a70f93fbe60f9a24920d43a95305e7a6ea259e778e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfW_DWPMaSZVlwmUogF1EsUg:d37fc2a45adb99c047066f755e653ae1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 3656
accept-ranges: bytes
cf-ray: 6f855b9a7c8c9bd0-FRA
cf-resized: internal=ok/h q=0 n=16 c=16 v=2022.4.2 l=3656
cf-bgj: imgq:86,h2pri

GET
H2 200 29d4031c24ddee029c049231609cd331a33e263a36a537bc2ed73ce8501c4373-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 5 KB
5 KB 134ms
133ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/29d4031c24ddee029c049231609cd331a33e263a36a537bc2ed73ce8501c4373-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69eede3e66ee10bfea0ff58eb8e9cc7bef76855f73a1d8e0e629fe541acb4755

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfpXLpZfL-SnImMLwIOaTUSQ:439dd5c6a9c43d53624939114dd0f19c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 4704
accept-ranges: bytes
cf-ray: 6f855b9a7c909bd0-FRA
cf-resized: internal=ok/h q=0 n=12 c=15 v=2022.3.3 l=4704
cf-bgj: imgq:86,h2pri

GET
H2 200 1414626d5e87ec4eb20a8a81044015a2c012777919035b3a81e6cc9c6d217077-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 6 KB
6 KB 142ms
142ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/1414626d5e87ec4eb20a8a81044015a2c012777919035b3a81e6cc9c6d217077-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33468d7a2084fb75051e5f57ce17d459dd3b54e490cb327ce64dd8f20361ba1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfbxdnolD-W_bn83Wuzjx3vQ:7cc7912147221a8c6ac5cd51df9cc613"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 5942
accept-ranges: bytes
cf-ray: 6f855b9a7c939bd0-FRA
cf-resized: internal=ok/h q=0 n=28 c=18 v=2022.4.2 l=5942
cf-bgj: imgq:86,h2pri

GET
H2 200 24c2741dc23c9953ec1997e0fb41a2874561a7ff024bc809cd76dd7face490fe-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 5 KB
6 KB 138ms
138ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/24c2741dc23c9953ec1997e0fb41a2874561a7ff024bc809cd76dd7face490fe-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fb9966c0ca2bcf98d4ad6e8943f767e0cd19f62fbca9afe67c62a9c418f3027

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfdGa0vo72RTMBzmTLTbEmKQ:7feb89b91c54e5d25153b3b6ab489a78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 5506
accept-ranges: bytes
cf-ray: 6f855b9a7c959bd0-FRA
cf-resized: internal=ok/h q=0 n=8 c=16 v=2022.4.2 l=5506
cf-bgj: imgq:86,h2pri

GET
H2 200 82255e357b9d1261a368e6d9923b0f311e68fc039b6c010740921905939ed23c-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 6 KB
6 KB 136ms
136ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/82255e357b9d1261a368e6d9923b0f311e68fc039b6c010740921905939ed23c-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ed1e9bab1e36eaeb766dc205f3c55ef4f0091bbce75f2e51aa603d4fad9e589

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:59:17 GMT
server: cloudflare
etag: "cfrg0J3fxCR9vdIcM5dhuLJQ:02b26fae0186e6d91531754234fc4424"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 5712
accept-ranges: bytes
cf-ray: 6f855b9b3e729bd0-FRA
cf-resized: internal=ok/h q=0 n=19 c=17 v=2022.4.2 l=5712
cf-bgj: imgq:86,h2pri

GET
H2 200 75b1ac8bbefe8aa7c0f5d307cec7783f8923d10b2604a30f8da672f20f1f4e56-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 6 KB
6 KB 142ms
142ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/75b1ac8bbefe8aa7c0f5d307cec7783f8923d10b2604a30f8da672f20f1f4e56-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86d41e4c5ab552819c73946b34186f67474c874761f4f0c5d21b36f13a6e27f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 02 Mar 2022 09:57:26 GMT
server: cloudflare
etag: "cf9JWDww0Nypf1O9NNF-Fn-Q:a623ec7166a7eb66eccf5af09aed393f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 5814
accept-ranges: bytes
cf-ray: 6f855b9b4e889bd0-FRA
cf-resized: internal=ok/m q=0 n=143 c=17 v=2022.4.2 l=5814
cf-bgj: imgq:86,h2pri

GET
H2 200 cart Show response
www.winterduet.com/api/store/ 862 B
1 KB 887ms
886ms XHR
application/json 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/cart
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: bd9a2f55c628746eb0a5bb41e4e86b843dd8fc32df626c2a2d70a6c6a1aed1f6

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IlRNN0NEZ1FidFFFOXZkRVlxdW9GREE9PSIsInZhbHVlIjoiSExcL3pGMFRDXC8rTDdHZTczQmZ3ZWZZZDQ3WDJ1d0ViRXhpT2NNZmlNZG1hcDljT3NVcjF0YWhxekJRdlM5dlI5cGo2TGorY0MzbGpTNnU1UkE5VloxdldITXhmSTgxR0x6OUhHdTFENG5OcmgxZmZiT0huMitHamhiZDlORkJ1biIsIm1hYyI6IjhmMTM4ZWYyNDVmZWZlOWJhYWE3MTYzODE4MjYzODRmNWEwYTk2OTQyMDVlZDE3MDc5ZmIyNzBiMmVhZmNjMzcifQ==
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
etag: W/"341cc1236da0fd774f8ec78df1838ceee32fc346"
vary: Accept-Encoding
content-type: application/json
cache-control: private, must-revalidate
expires: -1

GET
H/1.1 200
OK f151a930f79fa05ce2a336c5b357d98d.png
wshop-s3.frp.codefriend.top/wshop-develop/2021/04/ 7 KB
7 KB 1173ms
266ms Image
image/png 119.3.72.88
HWCSNET Huawei Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wshop-s3.frp.codefriend.top/wshop-develop/2021/04/f151a930f79fa05ce2a336c5b357d98d.png

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

119.3.72.88 , China, ASN55990 (HWCSNET Huawei Cloud Service data center, CN),

Reverse DNS

ecs-119-3-72-88.compute.hwclouds-dns.com

Software

nginx /

Resource Hash

55962f24f388eb8dcf4a122180dcfc9833f1b3758c545dee9633cd1832812755

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Thu, 07 Apr 2022 20:01:55 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Apr 2021 08:42:12 GMT
Server: nginx
X-Amz-Request-Id: 16E3B5BDCDE31E9A
Etag: W/"293a8ea295390aaea5165635095c6e5d"
Vary: Accept-Encoding, Origin
Content-Type: image/png
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Content-Security-Policy: block-all-mixed-content
Connection: keep-alive
X-Xss-Protection: 1; mode=block

GET
H2 200 exchanges Show response
www.winterduet.com/api/store/ 3 KB
2 KB 692ms
691ms XHR
application/json 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/exchanges
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 5e76722ec1a2f9be8cdefb3de74a6c89f34be4926bc485dbe9e8dff698b51a53

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IlRNN0NEZ1FidFFFOXZkRVlxdW9GREE9PSIsInZhbHVlIjoiSExcL3pGMFRDXC8rTDdHZTczQmZ3ZWZZZDQ3WDJ1d0ViRXhpT2NNZmlNZG1hcDljT3NVcjF0YWhxekJRdlM5dlI5cGo2TGorY0MzbGpTNnU1UkE5VloxdldITXhmSTgxR0x6OUhHdTFENG5OcmgxZmZiT0huMitHamhiZDlORkJ1biIsIm1hYyI6IjhmMTM4ZWYyNDVmZWZlOWJhYWE3MTYzODE4MjYzODRmNWEwYTk2OTQyMDVlZDE3MDc5ZmIyNzBiMmVhZmNjMzcifQ==
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
content-encoding: gzip
etag: W/"3bf5fe8b31c11a46f1648a21e1c73be28e7f5421"
vary: Accept-Encoding
content-type: application/json
cache-control: private, must-revalidate
expires: -1

GET
H2 200 custom_payment_icon Show response
www.winterduet.com/api/store/ 15 KB
6 KB 865ms
864ms XHR
application/json 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/custom_payment_icon
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: a5d2d28a0fe40585b956c2c1d259a60ae0328d38b8199d1380226a9ff27692e4

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IlRNN0NEZ1FidFFFOXZkRVlxdW9GREE9PSIsInZhbHVlIjoiSExcL3pGMFRDXC8rTDdHZTczQmZ3ZWZZZDQ3WDJ1d0ViRXhpT2NNZmlNZG1hcDljT3NVcjF0YWhxekJRdlM5dlI5cGo2TGorY0MzbGpTNnU1UkE5VloxdldITXhmSTgxR0x6OUhHdTFENG5OcmgxZmZiT0huMitHamhiZDlORkJ1biIsIm1hYyI6IjhmMTM4ZWYyNDVmZWZlOWJhYWE3MTYzODE4MjYzODRmNWEwYTk2OTQyMDVlZDE3MDc5ZmIyNzBiMmVhZmNjMzcifQ==
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
etag: W/"bc7e815326cc855db9af7f7b82a022f4e8378d52"
vary: Accept-Encoding
content-type: application/json
cache-control: private, must-revalidate
expires: -1

GET
H2 200 last-sales Show response
www.winterduet.com/api/store/ 26 KB
2 KB 1301ms
1301ms XHR
application/json 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/last-sales
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/vogue/js/app.1aeac8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: b83e7a4e4f0e9b03d95dd90d07b6ff3c77ecaf7b3199e1e00164708220f824a7

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IlRNN0NEZ1FidFFFOXZkRVlxdW9GREE9PSIsInZhbHVlIjoiSExcL3pGMFRDXC8rTDdHZTczQmZ3ZWZZZDQ3WDJ1d0ViRXhpT2NNZmlNZG1hcDljT3NVcjF0YWhxekJRdlM5dlI5cGo2TGorY0MzbGpTNnU1UkE5VloxdldITXhmSTgxR0x6OUhHdTFENG5OcmgxZmZiT0huMitHamhiZDlORkJ1biIsIm1hYyI6IjhmMTM4ZWYyNDVmZWZlOWJhYWE3MTYzODE4MjYzODRmNWEwYTk2OTQyMDVlZDE3MDc5ZmIyNzBiMmVhZmNjMzcifQ==
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
etag: W/"ed161d1e23f23a52ff6ecc7e9f421435df25addb"
vary: Accept-Encoding
content-type: application/json
cache-control: private, must-revalidate
expires: -1

GET
H2 200 buttons Show response
www.paypal.com/smart/ Frame 3619 352 KB
145 KB 521ms
521ms Document
text/html 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&commit=false&currency=USD&locale=en_US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c92f1f225f3797d5f9871db6d13b4722fc108b45896128ab9550432c91afe143

Security Headers

Name	Value
Content-Security-Policy	form-action 'self' https://.paypal.com https://.cardinalcommerce.com; default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com: https://.paypalobjects.com https://.googleapis.com https://.firebaseio.com wss://.firebaseio.com https://api2.amplitude.com http://127.0.0.1:* https://.qualtrics.com; frame-src 'self' https://.paypal.com:* https://.paypalobjects.com https://.cardinalcommerce.com https://.firebaseapp.com https://.qualtrics.com; script-src 'self' https://.paypal.com: https://.paypalobjects.com 'unsafe-inline' 'unsafe-eval' https://apis.google.com; style-src 'self' https://.paypal.com:* https://.paypalobjects.com 'unsafe-inline'; font-src 'self' https://.paypal.com https://.paypalobjects.com data:; object-src 'none'; img-src https: data:; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.winterduet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: none
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-disposition: inline
content-encoding: br
content-security-policy: form-action 'self' https://*.paypal.com https://*.cardinalcommerce.com; default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.googleapis.com https://*.firebaseio.com wss://*.firebaseio.com https://api2.amplitude.com http://127.0.0.1:* https://*.qualtrics.com; frame-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.cardinalcommerce.com https://*.firebaseapp.com https://*.qualtrics.com; script-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval' https://apis.google.com; style-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; object-src 'none'; img-src https: data:; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html; charset=utf-8
date: Thu, 07 Apr 2022 20:01:54 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/"57fdf-i89A534W3ex77INodW4+3jR9wAk"
p3p: true
paypal-debug-id: f484067822835
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-csrf-jwt: __blank__
x-served-by: cache-hhn4043-HHN
x-timer: S1649361714.386267,VS0,VE514
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame 5F6E 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 18ms
8ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=317058630001841&ev=Microdata&dl=https%3A%2F%2Fwww.winterduet.com%2F&rl=&if=false&ts=1649361714394&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%20%20Winterduet%22%2C%22meta%3Adescription%22%3A%22Winterduet%22%7D&cd[OpenGraph]=%7B%22og%3Aurl%22%3A%22http%3A%2F%2Fwww.winterduet.com%22%2C%22og%3Atitle%22%3A%22Winterduet%22%2C%22og%3Adescription%22%3A%22Winterduet%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Asite_name%22%3A%22Winterduet%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22WebSite%22%2C%22name%22%3A%22Winterduet%22%2C%22potentialAction%22%3A%7B%22%40type%22%3A%22SearchAction%22%2C%22target%22%3A%22http%3A%2F%2Fwww.winterduet.com%2Fsearch%3Fq%3D%7Bq%7D%22%2C%22query-input%22%3A%22required%20name%3Dq%22%7D%2C%22url%22%3A%22http%3A%2F%2Fwww.winterduet.com%22%7D%5D&sw=1600&sh=1200&v=2.9.57&r=stable&ec=1&o=30&fbp=fb.1.1649361713788.1061956540&it=1649361713599&coo=false&es=automatic&tm=3&exp=p0&rqm=GET

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 07 Apr 2022 20:01:54 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 30ms
15ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=447776366&t=pageview&_s=1&dl=https%3A%2F%2Fwww.winterduet.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Winterduet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=487760628&gjid=2128345330&cid=1576829669.1649361714&tid=UA-224303903-4&_gid=1906707880.1649361714&_r=1&gtm=2ou3u0&z=575624536

Requested by

Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/chunk/sentry.chunk.b2e95.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winterduet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winterduet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1b12760377a738eee81079d3c2a4360b-1600.jpg
cdn.cloudfastin.top/assets/2022/02/ 58 KB
58 KB 142ms
142ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/assets/2022/02/1b12760377a738eee81079d3c2a4360b-1600.jpg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

004bba045cbbc8deeef8c28ee4f970486000dcc677215c0b17a69b7d268010ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 09:50:31 GMT
server: cloudflare
etag: "cfcJAj4H7GW3XADsHEGRRoWg:399028ca4e447a4670387281e9efe7df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 59132
accept-ranges: bytes
cf-ray: 6f855b9b4ea19bd0-FRA
cf-resized: internal=ok/m q=0 n=135 c=87 v=2022.2.2 l=59132
cf-bgj: imgq:86,h2pri

GET
H2 200 index.html Show response
www.paypalobjects.com/muse/analytics/ Frame 4853 54 KB
17 KB 8ms
8ms Document
text/html 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/muse/analytics/index.html

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/muse.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Resource Hash

1b8f3d676f1df1ca5867197fb16660fe565e70b9c6cd4176985a522df98e6d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winterduet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: s-maxage=31536000 public,max-age=3600
content-encoding: gzip
content-length: 16790
content-type: text/html
date: Thu, 07 Apr 2022 20:01:54 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/"622a407f-d994"
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
paypal-debug-id: 35bde807ed88e
strict-transport-security: max-age=31536000
surrogate-control: max-age=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 ts
t.paypal.com/ 42 B
447 B 171ms
171ms Image
image/gif 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3AXX7QCJLE83HY6-1&page=muse%3Aoffer%3A%3A%3AXX7QCJLE83HY6-1%3A%3AvisitorInfoFlowStarted%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=feb4cf9c-610e-48f0-b008-12620f18a8fc&es=visitorInfoFlowStarted&mrid=XX7QCJLE83HY6&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=Winterduet&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1649361714661&g=0&completeurl=https%3A%2F%2Fwww.winterduet.com%2F

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/8F16) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:54 GMT
content-type: image/gif
server: ECAcc (frc/8F16)
strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: 63974d8d78da8
cache-control: max-age=0, no-cache, no-store, must-revalidate
server-timing: content-encoding;desc="", x-cdn;desc="edgecast",edge;dur=163
timing-allow-origin: *
content-length: 42
expires: Thu, 07 Apr 2022 20:01:54 GMT

POST
H2 200 graphql Show response
www.paypal.com/targeting/ Frame 4853 434 B
2 KB 266ms
265ms Fetch
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/targeting/graphql

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/analytics/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d38b1463006a40f99d400a527fdf067cf5cf9f0434381ce7b763806a561299b5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; img-src 'self' https:; script-src 'nonce-S09/pYPozjdJcZ+/5l6MApXd11IIzTAPha3WIgh278UjB+pD' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; object-src 'none'; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.paypalobjects.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' https:; script-src 'nonce-S09/pYPozjdJcZ+/5l6MApXd11IIzTAPha3WIgh278UjB+pD' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'none'; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
via: 1.1 varnish
vary: Accept-Encoding
x-cache: MISS
paypal-debug-id: f9977836c7ee6
date: Thu, 07 Apr 2022 20:01:55 GMT
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4043-HHN
x-timer: S1649361715.865079,VS0,VE258
x-frame-options: SAMEORIGIN
etag: W/"1b2-yAL0WHDZnOeOeAGuvNO7CyDBaxQ"
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.paypalobjects.com
content-encoding: br
access-control-expose-headers: Paypal-Debug-Id
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: none
x-cache-hits: 0

OPTIONS
H2 204 graphql
www.paypal.com/targeting/ Frame 0
0 195ms
177ms Preflight 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/targeting/graphql

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.paypalobjects.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.paypalobjects.com
access-control-expose-headers: Paypal-Debug-Id
cache-control: max-age=0, no-cache, no-store, must-revalidate
date: Thu, 07 Apr 2022 20:01:54 GMT
dc: ccg11-origin-www-1.paypal.com
paypal-debug-id: f997783fdd479
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-hhn4032-HHN
x-timer: S1649361715.685937,VS0,VE167

GET
H2 200 eb7649fb1b1b8ddf4c9ac33a1c7022d9f35315444580b0c69b4614e9465df7cd-500.jpeg
cdn.cloudfastin.top/image/2022/03/ 30 KB
30 KB 145ms
145ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/eb7649fb1b1b8ddf4c9ac33a1c7022d9f35315444580b0c69b4614e9465df7cd-500.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04cb2276e8c5a44105551612c0badfb0c12eee6c625f5b7940920f00c4e23c0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 08 Mar 2022 02:29:52 GMT
server: cloudflare
etag: "cfBD9jpsC-R6hoq1wxAZObnQ:353f51d729d510ce0b528c4b3c25ec87"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 30344
accept-ranges: bytes
cf-ray: 6f855b9cda1a9bd0-FRA
cf-resized: internal=ok/h q=0 n=13 c=81 v=2022.4.2 l=30344
cf-bgj: imgq:86,h2pri

GET
H2 200 47df3a35190b9c816ab349f928d36c1f516dad93f3a6c4c9a04ba380f2cbc41d-500.gif
cdn.cloudfastin.top/image/2022/03/ 2 MB
2 MB 132ms
132ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/47df3a35190b9c816ab349f928d36c1f516dad93f3a6c4c9a04ba380f2cbc41d-500.gif

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73e7f048923162982a88292b23a3dbc78eff794e5bd5d31f91f7866b195c10c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 08 Mar 2022 02:26:37 GMT
server: cloudflare
etag: "cfUXs1GXxrwLM1PQCOWhLw7g:d6777b00bc48471ab85ecbc7042cd161"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 1639102
accept-ranges: bytes
cf-ray: 6f855b9cda1d9bd0-FRA
cf-resized: internal=ok/h q=0 n=63 c=3311 v=2022.4.2 l=1639102
cf-bgj: imgq:85,h2pri

GET
H2 200 ed195883fdac4b4c8a9ee255d879d005d768d7bc26221bf5457c85dbc121be38-500.jpeg
cdn.cloudfastin.top/image/2022/03/ 28 KB
28 KB 167ms
167ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/ed195883fdac4b4c8a9ee255d879d005d768d7bc26221bf5457c85dbc121be38-500.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d3ce0352108f82d591704af84ff984fd51135bcac0ecbfbd09ed89621aba3f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 07 Mar 2022 09:58:04 GMT
server: cloudflare
etag: "cfZrAtYiw-A_DSXibF78g_vg:a12414d9b9b7f40082cf25773defe8f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 28884
accept-ranges: bytes
cf-ray: 6f855b9cda1e9bd0-FRA
cf-resized: internal=ok/h q=0 n=6 c=57 v=2022.4.2 l=28884
cf-bgj: imgq:86,h2pri

GET
H2 200 js Show response
www.paypal.com/sdk/ Frame 3619 329 KB
101 KB 10ms
9ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/sdk/js?client-id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&commit=false&currency=USD&locale=en_US

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2da24e0c345cd3c9216a60d279e428959e218c40a28b4e17130f6c62e03dd244

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; script-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-5e00YuEymCJj/zAd2Et5dChTDR+qmtrEDGoi7hOdEaT13Kje' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding: gzip
x-content-type-options: nosniff
age: 1
via: 1.1 varnish
x-cache: HIT
p3p: true
paypal-debug-id: f302534be7826
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 102856
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4043-HHN
x-timer: S1649361715.932546,VS0,VE1
x-frame-options: SAMEORIGIN
date: Thu, 07 Apr 2022 20:01:54 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=10800
etag: W/"191c8-dVTDYoGbw16dNPbYBh7rh18hMJk"
accept-ranges: bytes
x-cache-hits: 2

GET
DATA 200
OK truncated
/ Frame 3619 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ip Show response
www.winterduet.com/api/store/ 261 B
951 B 240ms
239ms XHR
application/json 18.218.220.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winterduet.com/api/store/ip
Requested by: Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/chunk/sentry.chunk.b2e95.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.218.220.81 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-220-81.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 186852ceb393e8a3b6a1af32d80d4e1951e297276f1abd06e69cff5bb565ebbc

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.winterduet.com/
X-XSRF-TOKEN: eyJpdiI6IitqQ1h2M1VhSHlkS3U4YW5zZnhPRXc9PSIsInZhbHVlIjoiOU9tbFI3NjdQbW1lWFFxSnJcL3IxKzdLbFBxY3ViR0F3RjlHVlliZnllcVwvbFMrdU9EUmRaVVR3dHQ5WnVwSWV3RHJZNUoxSkxWc2pFM3k0T2VmV05tb3hJUDRJQnB0Z1hHUVdJZGQyXC9JVXFKc1RaM0t0UDZpR0lBbmVIbWZoTlMiLCJtYWMiOiI3ZDJiNDRmYWM5ZDRjNzUwNzZjZWE1MzYxZWE4ZTAyOTlhMGMwNWUwMGQyNGE2NWE0MzViZDY1Nzc5YzcxZjU1In0=
accept-language: de-DE,de;q=0.9
X-LANG: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
etag: W/"59343e40733a58a7a3b1ef0603c4375cc5918230"
vary: Accept-Encoding
content-type: application/json
cache-control: private, must-revalidate
expires: -1

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0fe6ab65342bc7b5829ccead5e2260e34595a0787976a3bd9cf61c07a8142979

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a727c616a2ffdb9156eb07cd503a03ff97e8ec109fa6e8b9a153c412c597c23f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6364944534106aa963194d32acc463acb0e38f570fe04bd558c9576a14714763

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6f8d43be7577a98ad13e140d50b299bfb74b55139a0843345c0a1b81730a053

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb5376ab87b2c34aecca7518f2fa43c595c79a63eec6fc572f523d0eb8207203

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72b0f4552ec214f7cf987c426f964687cf6709456553e53b9724fa3ca06ee5c9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 fd95fd22a00fd3c12ee19cea74eced5efeafa5042f8dc170d69f85064a7c5ee2-180x180.jpeg
cdn.cloudfastin.top/image/2022/03/ 11 KB
11 KB 20ms
19ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/fd95fd22a00fd3c12ee19cea74eced5efeafa5042f8dc170d69f85064a7c5ee2-180x180.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aef8d535a0fe619eebe90f6c4368ad4dab5cf7ac9980354eae6d15555eecf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 01 Apr 2022 06:05:04 GMT
server: cloudflare
etag: "cfdvl1PQZW_x_H8uTci38Bvw:a71d85c1a737ee16fc9097b336d7e548"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 11468
accept-ranges: bytes
cf-ray: 6f855ba29fcc9bd0-FRA
cf-resized: internal=ok/h q=0 n=5 c=18 v=2022.3.5 l=11468
cf-bgj: imgq:86,h2pri

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ Frame 3619 56 KB
19 KB 45ms
8ms Script
application/javascript 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ECAcc (frc/8FDD) /

Resource Hash

cdd271b86f93710e10a49e074bacf5a5462ebad6af7ed4c9d2325682371960ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 785648
x-cache: HIT, HIT
paypal-debug-id: b8c8e4846b0c2
x-cache-hits: 791486
access-control-allow-methods: GET
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 19339
via: 1.1 varnish
x-served-by: cache-hhn4052-HHN
last-modified: Mon, 28 Mar 2022 22:49:15 GMT
server: ECAcc (frc/8FDD)
x-timer: S1649361716.691350,VS0,VE1
etag: W/"62423b6b-de68"
access-control-max-age: 86400
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=86400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Apr 2022 20:01:55 GMT

GET
H2 200 i Show response
c.paypal.com/v1/r/d/ Frame 649B 160 B
883 B 177ms
176ms Document
text/html 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.paypal.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: none
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: ebd85bef7d4fc
date: Thu, 07 Apr 2022 20:01:55 GMT
paypal-debug-id: ebd85bef7d4fc
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-served-by: cache-hhn4052-HHN
x-timer: S1649361716.719516,VS0,VE170
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

counter2.cgi
dub.stats.paypal.com/v2/ Frame 6DA6
Redirect Chain

https://b.stats.paypal.com/v2/counter.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS
https://dub.stats.paypal.com/v2/counter2.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS

42 B
299 B

100ms
34ms

Image
image/jpeg

64.4.245.84
PAYPAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dub.stats.paypal.com/v2/counter2.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS
Requested by: Host: www.paypal.com
URL: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true
Protocol: HTTP/1.1
Server: 64.4.245.84 , United States, ASN17012 (PAYPAL, US),
Reverse DNS
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Thu, 07 Apr 2022 20:01:55 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 42
Content-Type: image/jpeg

Redirect headers

Location: https://dub.stats.paypal.com/v2/counter2.cgi?p=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS
Date: Thu, 07 Apr 2022 20:01:55 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 0
Content-Type: application/octet-stream

POST
H2 200 logger
www.paypal.com/xoplatform/logger/api/ Frame 3619 842 B
1 KB 184ms
183ms Ping
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5fcb0ce454382f554adaaa75be84a3413ec750b6c21fe35603a83760b41a7d6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 07 Apr 2022 20:01:55 GMT
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f485130434f3e
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-hhn4043-HHN
x-timer: S1649361716.722516,VS0,VE177
etag: W/"34a-qWec+bK+OMx9CceKOfxZGDl85Fg"
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.paypal.com
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: none
x-cache-hits: 0

GET
H2 200 fd95fd22a00fd3c12ee19cea74eced5efeafa5042f8dc170d69f85064a7c5ee2-100.jpeg
cdn.cloudfastin.top/image/2022/03/ 4 KB
4 KB 129ms
128ms Image
image/webp 2606:4700::6812:166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cloudfastin.top/image/2022/03/fd95fd22a00fd3c12ee19cea74eced5efeafa5042f8dc170d69f85064a7c5ee2-100.jpeg

Requested by

Host: www.winterduet.com
URL: https://www.winterduet.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a301cbfab0d16279dd5a465768a39c89ff528edacecd9713bd3c3586d4f331f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.winterduet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 01 Apr 2022 06:05:04 GMT
server: cloudflare
etag: "cfs_8gFNlup9vwdhMKFxAtXQ:a71d85c1a737ee16fc9097b336d7e548"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
content-length: 4032
accept-ranges: bytes
cf-ray: 6f855ba399f79bd0-FRA
cf-resized: internal=ok/h q=0 n=13 c=15 v=2022.4.2 l=4032
cf-bgj: imgq:86,h2pri

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ Frame 649B 56 KB
19 KB 8ms
8ms Script
application/javascript 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ECAcc (frc/8FDD) /

Resource Hash

cdd271b86f93710e10a49e074bacf5a5462ebad6af7ed4c9d2325682371960ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 785648
x-cache: HIT, HIT
paypal-debug-id: b8c8e4846b0c2
x-cache-hits: 791488
access-control-allow-methods: GET
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 19339
via: 1.1 varnish
x-served-by: cache-hhn4052-HHN
last-modified: Mon, 28 Mar 2022 22:49:15 GMT
server: ECAcc (frc/8FDD)
x-timer: S1649361716.905124,VS0,VE2
etag: W/"62423b6b-de68"
access-control-max-age: 86400
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=86400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Apr 2022 20:01:55 GMT

POST
H2 200 p1 Show response
c.paypal.com/v1/r/d/b/ Frame 649B 125 B
604 B 333ms
332ms XHR
application/json 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/b/p1

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

321a5c85154130c14ad46e100c1dfb99a9f693ff7b89b3287aa4f771a18fe0fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

timing-allow-origin: *
date: Thu, 07 Apr 2022 20:01:56 GMT
via: 1.1 varnish
correlation-id: da178068d3d0
x-served-by: cache-hhn4052-HHN
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR ADM OUR IND COM"
paypal-debug-id: da178068d3d0
cache-control: max-age=0, no-cache, no-store, must-revalidate
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
accept-ranges: bytes
content-type: application/json
content-length: 125
x-cache-hits: 0

POST
H2 200 e Show response
c.paypal.com/v1/r/d/b/ Frame 649B 15 B
200 B 212ms
212ms XHR
application/json 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/b/e

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d44c1f2a6531d774fda6e6eba865f1ba8aed10f372fe97f395895a8a1e1fa2a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 07 Apr 2022 20:01:56 GMT
via: 1.1 varnish
correlation-id: 62670ece4db49
x-served-by: cache-hhn4052-HHN
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS
content-type: application/json
paypal-debug-id: 62670ece4db49
cache-control: max-age=0, no-cache, no-store, must-revalidate
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
accept-ranges: bytes
timing-allow-origin: *
content-length: 15
x-cache-hits: 0

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ Frame 649B 0
87 B 437ms
197ms Image
text/plain 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=uid_56294316a2_mja6mde6ntq&s=SMART_PAYMENT_BUTTONS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 07 Apr 2022 20:01:56 GMT
via: 1.1 varnish
correlation-id: 3dac0904448ac
x-timer: S1649361716.179665,VS0,VE190
x-served-by: cache-hhn4052-HHN
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS
paypal-debug-id: 3dac0904448ac
cache-control: max-age=0, no-cache, no-store, must-revalidate
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-cache-hits: 0

POST
H2 200 logger Show response
www.paypal.com/xoplatform/logger/api/ Frame 3619 846 B
1 KB 186ms
186ms XHR
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger

Requested by

Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&commit=false&currency=USD&locale=en_US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9c00bbb221f79d8b7bb2992913bd122d1ca9efead93314a9cc011440c747868c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.paypal.com/smart/buttons?env=production&locale.lang=en&locale.country=US&style.label=paypal&style.layout=horizontal&style.color=gold&style.shape=rect&style.tagline=false&style.height=48&style.menuPlacement=below&components.0=buttons&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVEwT3pqNGFFLXMxWnFTWnl3R0dtUjR1VW5zNDNRLXhhY1hsUU1nbGRRV1ZyaEozUTI1OENQQVA4ZGZZZm9YbVZwMTdWVE5MSVZHUk9PUVAmY29tbWl0PWZhbHNlJmN1cnJlbmN5PVVTRCZsb2NhbGU9ZW5fVVMiLCJhdHRycyI6eyJkYXRhLXVpZCI6InVpZF9laXFpZnZxZ3BobW9kenNpc2VqbGpmcmRjY2xwemYifX0&clientID=AQ0Ozj4aE-s1ZqSZywGGmR4uUns43Q-xacXlQMgldQWVrhJ3Q258CPAP8dfYfoXmVp17VTNLIVGROOQP&sdkCorrelationID=f906114c1e34c&storageID=uid_120f341f46_mja6mde6ntq&sessionID=uid_56294316a2_mja6mde6ntq&buttonSessionID=uid_7f86da20bc_mja6mde6ntq&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsIm1lcmNoYW50Q29uZmlnSGFzaCI6IiIsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjp0cnVlfSwiaWRlYWwiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmFuY29udGFjdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJnaXJvcGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImVwcyI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzb2ZvcnQiOnsiZWxpZ2libGUiOmZhbHNlfSwibXliYW5rIjp7ImVsaWdpYmxlIjpmYWxzZX0sInAyNCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ6aW1wbGVyIjp7ImVsaWdpYmxlIjpmYWxzZX0sIndlY2hhdHBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwYXl1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImJsaWsiOnsiZWxpZ2libGUiOmZhbHNlfSwidHJ1c3RseSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJveHhvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1heGltYSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJib2xldG8iOnsiZWxpZ2libGUiOmZhbHNlfSwibWVyY2Fkb3BhZ28iOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&experiment.disablePaylater=false&experiment.enableVenmoAppLabel=false&flow=purchase&currency=USD&intent=capture&commit=false&vault=false&renderedButtons.0=paypal&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&experience=&allowBillingPayments=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
content-type: application/json

Response headers

date: Thu, 07 Apr 2022 20:01:56 GMT
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f485130abf1f1
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-hhn4043-HHN
x-timer: S1649361716.972838,VS0,VE174
etag: W/"34e-UIufJ1LDRucUNUtG0hbpWO0lCSA"
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.paypal.com
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: none
x-cache-hits: 0

POST
H2 200 logger Show response
www.paypal.com/xoplatform/logger/api/ 826 B
1 KB 172ms
172ms XHR
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger

Requested by

Host: statics.cloudfastin.top
URL: https://statics.cloudfastin.top/static/v1.27.18.3/store/chunk/sentry.chunk.b2e95.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0aa9cf2cc88305fa3e65923be5af18f326345ee181d85fa0a8bb9faad91cd1d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.winterduet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
content-type: application/json

Response headers

date: Thu, 07 Apr 2022 20:01:56 GMT
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
paypal-debug-id: f485130be316c
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
x-served-by: cache-hhn4032-HHN
x-timer: S1649361716.131371,VS0,VE166
etag: W/"33a-Pkff1HsVLHpVjuOuE2sHflXb2Ro"
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.winterduet.com
content-encoding: br
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: none
x-cache-hits: 0

OPTIONS
H2 200 logger
www.paypal.com/xoplatform/logger/api/ Frame 0
0 157ms
157ms Preflight 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/xoplatform/logger/api/logger

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.winterduet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

accept-ranges: none
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.winterduet.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: br
date: Thu, 07 Apr 2022 20:01:56 GMT
dc: ccg11-origin-www-1.paypal.com
paypal-debug-id: f4851303a30b6
server-timing: content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: accept-encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-served-by: cache-hhn4032-HHN
x-timer: S1649361716.973603,VS0,VE150

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
winterduet.com/	1970-01-20 02:10:33	Name: XSRF-TOKEN Value: eyJpdiI6Im1PT2toRGd2ZWpPb25VamdTRlFLUXc9PSIsInZhbHVlIjoiMXZveFQ3OHB0eWZpR1JwMTNTXC9nTTkzNUhtM08zK2JkZTFqV1VIaUtyVWplUStaY0ZMWE55cllwYWRJOHVVa01ER01iYnN4NHg2TjRGVUIyMFpKZ1B6Q2p4TEV1bG5oUWd2bnhOWDF3NHpNRXJlSXFcL2YzdTMyVjV4T1JcL0pFdlkiLCJtYWMiOiJlMTUzZjI5OTA4MWFlMTBiYTNkMTRlNGUxMGM1ZjNiZDRjOTNmZDYwZWZhYTVhODhlODUxN2VkYTBkOWU2MGE5In0%3D
winterduet.com/	1970-01-20 02:10:33	Name: jitosra53_session Value: eyJpdiI6Ik52R2s2a29XXC8zemJKWGl6YzlpVDNRPT0iLCJ2YWx1ZSI6ImlvaWRkWnFcL2M0Y3c2QUJJSlFacDh0MjR5WUNcL2krbjRMMjR1Q0Z4UFRrbEZvTTR0RjNXMzkwWDJaVTlXZjBoOG10NElUbTBPbXVXV0FFSGQycHZlWVYyM3lQaGxBNmRONGxSVXZodm9jY211UWo4NmZtczY4WkZ5WUx0XC9cL0J2OSIsIm1hYyI6IjljY2JhYTE1M2QyMzNkYjgwYzg0ZTU4MmIyYzE2YTRlZWRhYmUxN2ZiNzY0YTFiYmZiZGM4NmNlMzg1ZjE5Y2MifQ%3D%3D
www.winterduet.com/	1969-12-31 23:59:59	Name: visitor_unique_id Value: eyJpdiI6IkhMTW41NWZQNmhRUkU0NjNJSWpvaVE9PSIsInZhbHVlIjoicEh6SnZob0FQXC81UjJja0M2YlNTdThWREdXb3VOU1lRWEZNVVR0RmVxNUt5TEMyOGVWODZIcjg3VVA5TU9DZ2krSzRJUHV5M2xkNkhUQnFpdEJzSmJUbmhST2FGT3d6SURrRkE1emVZeks0PSIsIm1hYyI6ImQ5MzgyODk2YjJkMTBhNTMzNjhkYWI5MTZkODEyNDM5OGQwZWI2MDE5Zjk5ODg5OTkyYTJjMGJiYzJmODk3N2UifQ%3D%3D
.paypal.com/	1970-01-20 02:09:53	Name: LANG Value: de_DE%3BDE
.paypal.com/	1970-01-20 10:54:57	Name: enforce_policy Value: gdpr_v2.1
.paypal.com/	1970-01-20 02:19:26	Name: x-csrf-jwt Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbiI6IkR1bDhOZHRBeDZWbExwSmxzN1NncV9hRjZSVzFCMFBoNEhacVVkRlNFMWc3bVQzVUl2MmtMeXVMNWMwSVFJV3NHY0ZPVzdaWnhaWncwU20tVDNNaURmd2EwR3hCX0lEM19lVGpTSmJHaGMtOVFERDJ6Zm9uT3dmZ05xeldXQlBkRnBDX0VDdVN6MUJLbXcyakQzclctQkZxamxIT2tJbTFybEJ4V1R5RzZPYnBGSWxtVTlwd2FHZDZYLUMiLCJpYXQiOjE2NDkzNjE3MTIsImV4cCI6MTY0OTM2NTMxMn0.pB2qP6OMje7v9t3EUQ8wIa93fNHgKDnF8XRoElGVOAc
www.paypal.com/	1969-12-31 23:59:59	Name: nsid Value: s%3AZPsdbPnkgXhkUzAkELOuZI56tzRj2jSK.ISbcyHGZWN8UjsCDxSxye2fJs1hr5Sc%2FC3EafZhLoOM
.paypal.com/	1970-01-21 04:26:09	Name: ts_c Value: vr%3D059e770e1800a7a067a9b549fdad137c%26vt%3D059e770e1800a7a067a9b549fdad137b
.winterduet.com/	1970-01-20 04:18:57	Name: _fbp Value: fb.1.1649361713788.1061956540
.winterduet.com/	1970-01-20 19:40:33	Name: _ga Value: GA1.2.1576829669.1649361714
.winterduet.com/	1970-01-20 02:10:48	Name: _gid Value: GA1.2.1906707880.1649361714
.winterduet.com/	1970-01-20 02:09:21	Name: _gat_gtag_UA_224303903_4 Value: 1
.paypal.com/	1969-12-31 23:59:59	Name: x-pp-s Value: eyJ0IjoiMTY0OTM2MTcxNTA0MSIsImwiOiIwIiwibSI6IjAifQ
.paypal.com/	1970-01-20 02:09:23	Name: l7_az Value: dcg01.phx
.paypalobjects.com/	1970-01-20 02:10:48	Name: paypal-offers--cust Value: null:null:null
www.winterduet.com/	1970-01-20 02:10:33	Name: XSRF-TOKEN Value: eyJpdiI6IjlpanBQT1wvNGlrNSt4Z0VEclk2XC93QT09IiwidmFsdWUiOiJSV0w3c3dPaDBHVU8rSDFpK1RTQ2dGbnZTUUUwTmRwTmZ1WVRcLzgxd0V0aTNFdUpQZ2JEc09PajBhWWt3TVwvVnNnMGZ5UDlBbThjOTdpNDVPK083dTRFV2ptTWNGaXNMbE1zY1FoczFLSHFYRjRjYkFHS29uU205ZVJCU2RmMGU4IiwibWFjIjoiM2U5YzhlNWM3MzYxMWY5M2FmODRjMGRlYTkxODUwY2Q2MTdkZjZhMmMyNDZmODZhMmE3NDZlMmE2N2UxNmUxMyJ9
www.winterduet.com/	1970-01-20 02:10:33	Name: jitosra53_session Value: eyJpdiI6ImNCbVdDM2tWd3hsNksrWjJWK2xiSlE9PSIsInZhbHVlIjoiUjVYVTd3VzhtRENrZkNxeWc0c09yS3c1Q2xyV2s1NUNoclFiMCtqRldTYWMxcHhYckZ0QUgrcDJcL0dON241Yjg3eXR5WUxDSldvTGpEOVR1c0QyUmtmODJJQlk5bnpSTjRFOVBpMG9vRzkrRUFcL0FFT1Z0RXhUXC83Wk9ReENNcksiLCJtYWMiOiI0ODVhYzIxMjA1NzhjODY4ZWQzMzkwYzk0ZjAxM2EyMjhkNzUzNmJmYjJiODRhZjhlYjAwMDZkZGRlODgwZWIwIn0%3D
.paypal.com/	1970-01-20 02:13:40	Name: tsrce Value: loggernodeweb
.paypal.com/	1970-01-21 04:26:09	Name: ts Value: vreXpYrS%3D1744056116%26vteXpYrS%3D1649363516%26vr%3D059e770e1800a7a067a9b549fdad137c%26vt%3D059e770e1800a7a067a9b549fdad137b%26vtyp%3Dnew
.c.paypal.com/	1970-01-21 21:57:21	Name: sc_f Value: XREGlRjpG9y62SVPYWLWIibpYgmECiRZQVxo_Y2xqy-s0nulMfqqUIzbaeZ6w5QQfNGozgslLTrXwalBkTZnmtm3CkWwR3loFBA9v0
.paypal.com/	1970-01-27 09:21:21	Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: z5WQKeyjOSVGIHCWNk1uTrZku4IOddbHKb5b6XQ5KpO0fE8ojWg_Q2hEhGv0oK_f92dccnNQ9KGY8RFM

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.stats.paypal.com
c.paypal.com
c6.paypal.com
cdn.cloudfastin.top
code.jquery.com
connect.facebook.net
conversion-assistant-apps.oss-cn-shenzhen.aliyuncs.com
d2n92a4bi8klzf.cloudfront.net
d3ud6u98s3z9ew.cloudfront.net
dub.stats.paypal.com
statics.cloudfastin.top
t.paypal.com
winterduet.com
wshop-s3.frp.codefriend.top
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.paypal.com
www.paypalobjects.com
www.winterduet.com
104.111.228.123
119.3.72.88
120.77.167.45
151.101.1.35
151.101.65.21
18.218.220.81
192.229.221.25
2001:4de0:ac18::1:a:1a
2600:9000:223d:6800:11:77ab:5a00:21
2600:9000:223d:7400:5:a2fb:12c0:93a1
2606:4700::6812:166
2a00:1450:4001:801::200e
2a00:1450:4001:830::2008
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
64.4.245.84
004bba045cbbc8deeef8c28ee4f970486000dcc677215c0b17a69b7d268010ac
0271ba731822bfe551c5f09e691493e82c4783ac928c063d6ff088dfd824b507
04cb2276e8c5a44105551612c0badfb0c12eee6c625f5b7940920f00c4e23c0a
086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e
0aa9cf2cc88305fa3e65923be5af18f326345ee181d85fa0a8bb9faad91cd1d5
0b107098fc8b361ce610dba0d1656c620c725311e51d4417c7c57c8bda369e52
0f64abbabbe75127379374bda209ef682d1d2d7833cc68b209abb15c617c3d35
0fe6ab65342bc7b5829ccead5e2260e34595a0787976a3bd9cf61c07a8142979
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
15b2387ada2be7754faeec500663fad42e94ee9e4ac06e1e20e84fb9602e196c
186852ceb393e8a3b6a1af32d80d4e1951e297276f1abd06e69cff5bb565ebbc
1b0f32db905a4fce90aad56fa3fccb59be5f6f2ce040da7742cc7802b5ec09de
1b8f3d676f1df1ca5867197fb16660fe565e70b9c6cd4176985a522df98e6d14
1f421b13bc9531d321d024932d750ba6287e68ee25e057603e0eaa41c8474ad5
25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b
269c253ba1ce1bcf23acdcce0e64d9333b797dc8f00f669e2aa2dc7dfc3ec9a1
2da24e0c345cd3c9216a60d279e428959e218c40a28b4e17130f6c62e03dd244
317f9a1d96344b724273945a2ef3b6f7f0e176f86b6c9ec17ddb78dcbb8a084c
31b3cd2cf6a2639f877dc768d171fe201a3a231d50acff6aa766192c2ff2eb5f
321a5c85154130c14ad46e100c1dfb99a9f693ff7b89b3287aa4f771a18fe0fc
33468d7a2084fb75051e5f57ce17d459dd3b54e490cb327ce64dd8f20361ba1c
398ad657b117c1145ae0f3f8a9c2c1e9255db09091bdedabc10c7e2a1f19a6b0
3b14e2a7eb86c2b888f03d81b55ca4d016d4a357a4ea047cbea2c412d7cb5f88
3ed1e9bab1e36eaeb766dc205f3c55ef4f0091bbce75f2e51aa603d4fad9e589
3fb9966c0ca2bcf98d4ad6e8943f767e0cd19f62fbca9afe67c62a9c418f3027
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47f1bf737f83f0054b66bf51c560205588a69a8e65d0c00961046d699d0e1afc
4d3ce0352108f82d591704af84ff984fd51135bcac0ecbfbd09ed89621aba3f6
55962f24f388eb8dcf4a122180dcfc9833f1b3758c545dee9633cd1832812755
5b3838dcf9b90e77aac2e13926915c894395cf37f2add983ed5e3541ace2c665
5d03dc629d49626c56fc0b9d6652254c376982f309e10de4b265c6be5ce3a869
5e76722ec1a2f9be8cdefb3de74a6c89f34be4926bc485dbe9e8dff698b51a53
5fcb0ce454382f554adaaa75be84a3413ec750b6c21fe35603a83760b41a7d6e
6364944534106aa963194d32acc463acb0e38f570fe04bd558c9576a14714763
69eede3e66ee10bfea0ff58eb8e9cc7bef76855f73a1d8e0e629fe541acb4755
6a301cbfab0d16279dd5a465768a39c89ff528edacecd9713bd3c3586d4f331f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6e117484f22003aba54255a70f93fbe60f9a24920d43a95305e7a6ea259e778e
72b0f4552ec214f7cf987c426f964687cf6709456553e53b9724fa3ca06ee5c9
73e7f048923162982a88292b23a3dbc78eff794e5bd5d31f91f7866b195c10c9
7aef8d535a0fe619eebe90f6c4368ad4dab5cf7ac9980354eae6d15555eecf1d
854748b07ed364acbee02407566eb20b9fb7170bf9c6b425ddbc6d1432a34fbc
86d41e4c5ab552819c73946b34186f67474c874761f4f0c5d21b36f13a6e27f2
8b45950cd536d5e9121ed5dc812cd8ca0d1195c438a2011d7b363ed1db5f2a13
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
9c00bbb221f79d8b7bb2992913bd122d1ca9efead93314a9cc011440c747868c
9f66cb165dbbf011418cff8a277801fe0aa86484b89809ee6825aeb9b0a34499
9ffb9a0e6c47ecb403e312b76a14957c32ad19ac85c0cf8aa445e3fbb9a92784
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a3e0ef9f198e3832e3470c87a787480bbf25bef1a4cd7ed156176152b42bcb5f
a4b749626aab6395c52aed1a8016aa5f6c4c8ca60cf771c0d8ce54202a53e725
a5d2d28a0fe40585b956c2c1d259a60ae0328d38b8199d1380226a9ff27692e4
a727c616a2ffdb9156eb07cd503a03ff97e8ec109fa6e8b9a153c412c597c23f
b83e7a4e4f0e9b03d95dd90d07b6ff3c77ecaf7b3199e1e00164708220f824a7
bb5376ab87b2c34aecca7518f2fa43c595c79a63eec6fc572f523d0eb8207203
bd9a2f55c628746eb0a5bb41e4e86b843dd8fc32df626c2a2d70a6c6a1aed1f6
c352ae7c7e28e8a29b2f1c8943473add7b8fe297837f86ac6ac70e535892eb12
c6f8d43be7577a98ad13e140d50b299bfb74b55139a0843345c0a1b81730a053
c92f1f225f3797d5f9871db6d13b4722fc108b45896128ab9550432c91afe143
c954d6f71089537dd993b791472192bd20cdbe29cd71dfeb8adf8dc24f61103d
cdd271b86f93710e10a49e074bacf5a5462ebad6af7ed4c9d2325682371960ae
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
cf5a57e9403107691b0ba9707c598605960f5a5d55c3228d68b660f6be7d4400
d38b1463006a40f99d400a527fdf067cf5cf9f0434381ce7b763806a561299b5
d44c1f2a6531d774fda6e6eba865f1ba8aed10f372fe97f395895a8a1e1fa2a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6e28a8fb9b74533ece152229dafcc3ebc0f4b3dcd62879df115706bce55927d
eac2431bd3d7cd438ab94518f7a3ab3023228665b5d865d673818fde75b13650
f2d4723f425de98b009505c1de48cfcb8943865886ae9a43fbb6b4631bd507db
fef4c5463ee7f7ecd0a369d08bb105b7be191dc9a0b87916f2633842360562d7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.winterduet.com Open in urlscan Pro 18.218.220.81 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

70 Requests

99 %HTTPS

50 %IPv6

12 Domains

20 Subdomains

17 IPs

4 Countries

3626 kBTransfer

8615 kBSize

21 Cookies

0 Outgoing links

Page URL History

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.winterduet.com Open in urlscan Pro
18.218.220.81 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

99 %
HTTPS

50 %
IPv6

12
Domains

20
Subdomains

17
IPs

4
Countries

3626 kB
Transfer

8615 kB
Size

21
Cookies

70 HTTP transactions
11 data transactions