voucher-25000.hqivirals.com Open in urlscan Pro
2606:4700:3036::ac43:d15e  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response voucher-25000.hqivirals.com/	152 KB 39 KB	319ms 91ms	Document text/html	2606:4700:3036::ac43:d15e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:d15e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fe1a084f763cccd21ac69b08fa93ed8a2fe56abca3100efdda9d10d6b03c97f Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 893719b18b6f3642-FRA content-encoding br content-type text/html date Fri, 14 Jun 2024 03:05:43 GMT last-modified Thu, 13 Jun 2024 04:16:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUzIPoWP2QHN%2Fmjr3runZpnC9JEHp8rQkAUktf26C6vy8GeHCMFmTGSF3zzWztddJUu94ot1x1vHB9vetvjx6179vgn0QKcagXPeVZs%2FLiqyrIXMbPubBzTaJYRZIB8sceuW5klz6lO6ICecLxZ8AiGJkYEJRj1y6h0%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	myopayxmas.css voucher-25000.hqivirals.com/	14 KB 3 KB	97ms 95ms	Stylesheet text/css	2606:4700:3036::ac43:d15e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://voucher-25000.hqivirals.com/myopayxmas.css Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:d15e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13c99e8992fb4d18ffeff9cdd2b922160392e2f72cd6a7c1ce13381c29358fc7 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT content-encoding br cf-cache-status MISS last-modified Thu, 13 Jun 2024 04:16:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bUmpkTZMpvUAkIdTKXDkDtzR2PMF7HJ6wIyZJaSNCG7x%2Fn27EhWY49o0lnMeaf1ED2tyKR98e4cW9eNrkfPXzIWm4nXiNbpWYo%2F12OfArmKFZSkzogl4DHvp3xZ%2Fz5iNlSYzOvuS6%2FT5AjCq22%2Baj%2BZlVo7%2FcuirzF8%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 893719b23bdd3642-FRA alt-svc h3=":443"; ma=86400
GET H2	404	alladz.js voucher-25000.hqivirals.com/	0 0	88ms 87ms	Script text/html	2606:4700:3036::ac43:d15e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://voucher-25000.hqivirals.com/alladz.js Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:d15e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UaeLlH6fZoiMbiIQtRBS1skPjOF9xTrmmSgrxOr7j3LG7iXHWbbwP3ohiPfTTece82XHVQzSkpEfh7qXqH4KSt6ZgXq255XHJjQlSbLZxdHVLlSOd3bTdPAMz%2FPMuUOELgZh1LS7K0pgqiKhcKHfjwK9hQ1CH%2BuYANw%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 893719b23bde3642-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Opay.png voucher-25000.hqivirals.com/	49 KB 50 KB	132ms 132ms	Image image/png	2606:4700:3036::ac43:d15e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://voucher-25000.hqivirals.com/Opay.png Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:d15e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43215e20bbbff43abc4afcf47136cb42692c31747aa5bde63af404c4ef641b6e Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT cf-cache-status MISS last-modified Thu, 13 Jun 2024 04:16:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b4VbCD13TcvCJhvNEsZLKjBmfiGfyZrt8T5bhkTM5OgeAreUbLBdV%2FysqZdMB4BTwqp0%2BqYNzF6c7J%2B5KUERcPFtzpizLA2YtU%2FA4cWhKk4qtaGg7tYcxBfQ%2BId0i2Okte%2BfVaMnxiSxlmhbtcO3oM%2Bhb49ImTuGQC8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 893719b23bdf3642-FRA alt-svc h3=":443"; ma=86400 content-length 50465
GET H3	200	online_t.js Show response widget.supercounters.com/ssl/	2 KB 1 KB	112ms 48ms	Script application/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://widget.supercounters.com/ssl/online_t.js Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f56b0bd9e5cd22334b47cc1d10e2cf1ae6a2fd95c16ed5534e925f6dfae331ed Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Mar 2022 11:50:46 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 3650 etag W/"6220ab96-6b4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M8LenJSoT78w4XuwkMOf6vR%2Bx%2FIyJWdUm9x65wT8zLbOQ%2BIzyWALUEtycDTJ09OdJ%2FROw8eWlN5%2FEUKMavh07tWQ8ABsOYbf1XCDNfmM1m2pT1lZjrAzQn%2B6PTDGpY0pxOqSiAUnP2bfGmM%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=300 cf-ray 893719b2af5d9975-FRA alt-svc h3=":443"; ma=86400
GET H3	200	Opay.jpeg voucher-25000.hqivirals.com/	52 KB 52 KB	113ms 112ms	Image image/jpeg	172.67.209.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://voucher-25000.hqivirals.com/Opay.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.209.94 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8611fb15b007f36c1fb1923586ff4ef1a6c9c008faa6ec01122eddc13337a3e3 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT cf-cache-status MISS last-modified Thu, 13 Jun 2024 04:16:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FDfPmVtHqbn0dYSjeDTZ1jaaabCFYu8vjZUKiC6NytLn0qMoXSJvY7hO5%2BWqmbmZEIWFSJR33UEDEjFAt59vSD3ZtcjYCGfvpg6iVvJ9ehWhXAU0%2FMLpC4h7At5%2BuP7fqgTVYYK9lfMDGe7wMx0%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 893719b2ded318fd-FRA alt-svc h3=":443"; ma=86400 content-length 52956
GET H2	200	C860437D-45B2-4138-82AE-21D6759C7A55.jpeg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioZhNgtq69vVIInNDU0tRhIeriPLNxsbEtWJ-Cl8BXJbl4l6ikGBZpTbW2YU-5_DO1q0drRQK8UeDtakktbh1KjScl8k7qodUFcgu4C0sTrh751FWuA6fFv32N9eMeyHUb-pb56NgfBkSYSJ_l...	21 KB 21 KB	514ms 363ms	Image image/jpeg	2a00:1450:4001:810::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioZhNgtq69vVIInNDU0tRhIeriPLNxsbEtWJ-Cl8BXJbl4l6ikGBZpTbW2YU-5_DO1q0drRQK8UeDtakktbh1KjScl8k7qodUFcgu4C0sTrh751FWuA6fFv32N9eMeyHUb-pb56NgfBkSYSJ_l_QBTudXOKSlqE5XG6JxTEpP6YOVvc7uf33-ef_MY6Z4t/s320/C860437D-45B2-4138-82AE-21D6759C7A55.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 2f621b8fa63cf8b1e182d1ea74ed73fc46b7e8b38b042a28cbcc201ff615605c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT x-content-type-options nosniff server fife etag "ve63" vary Origin content-type image/jpeg access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="C860437D-45B2-4138-82AE-21D6759C7A55.jpeg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21565 x-xss-protection 0 expires Sat, 15 Jun 2024 03:05:44 GMT
GET H2	200	F9BAB13F-D164-461B-B6B8-0ECEF087E4C5.jpeg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiR4fmrWDRs9IWVJb4G5JOQ5JVjyRbTHxugSVtPiz8fckHX4MysJNurV068VrUlSQc56MD5MLmaEFz73fDMl_GCzKASxFtpSfQWxPjKrN9Ngo9027GTrQcBJW6KMiRKtUxVwdYoIAs7hsXbW6W...	40 KB 40 KB	565ms 414ms	Image image/jpeg	2a00:1450:4001:810::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiR4fmrWDRs9IWVJb4G5JOQ5JVjyRbTHxugSVtPiz8fckHX4MysJNurV068VrUlSQc56MD5MLmaEFz73fDMl_GCzKASxFtpSfQWxPjKrN9Ngo9027GTrQcBJW6KMiRKtUxVwdYoIAs7hsXbW6WQab1i9SZL9qe-XkAQ3fy49kA0h-SDh677PJ62vOFYwsW/s320/F9BAB13F-D164-461B-B6B8-0ECEF087E4C5.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 88d8ff4fc0b3b61ee01af6b70a82114725a755c37e1e3e2a7422bff7f2a8cd7d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT x-content-type-options nosniff server fife etag "ve63" vary Origin content-type image/jpeg access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="F9BAB13F-D164-461B-B6B8-0ECEF087E4C5.jpeg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 40675 x-xss-protection 0 expires Sat, 15 Jun 2024 03:05:44 GMT
GET H2	200	C1506572-3CCD-4A79-827D-A7772585A5C6.jpeg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi55zNxW84BuMVoSd8yUVmWLmbklv5j1aOtlalgeEc1W1xrLtUp2hyphenhyphenE_pkbYv-QDNNCuTW681CWQB3ZfAbBeyYWpo0gnomaJv_Yt_dPfa8Umk7croHk7kwnz2KCByW-BToFmKLWFe...	21 KB 21 KB	531ms 381ms	Image image/jpeg	2a00:1450:4001:810::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi55zNxW84BuMVoSd8yUVmWLmbklv5j1aOtlalgeEc1W1xrLtUp2hyphenhyphenE_pkbYv-QDNNCuTW681CWQB3ZfAbBeyYWpo0gnomaJv_Yt_dPfa8Umk7croHk7kwnz2KCByW-BToFmKLWFezVmFbqGutTGzsCnj3vM6BbW4wX6L_CNOIIE6Oytk37u-yqiH7FLTWM/s320/C1506572-3CCD-4A79-827D-A7772585A5C6.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 18aca432d64fe1baadd294be39702da0c92a3edd8af7750b3adbb67e857be993 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT x-content-type-options nosniff server fife etag "ve63" vary Origin content-type image/jpeg access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="C1506572-3CCD-4A79-827D-A7772585A5C6.jpeg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21112 x-xss-protection 0 expires Sat, 15 Jun 2024 03:05:44 GMT
GET H2	200	3A44975C-78A1-4D61-9510-95C19BD08B94.jpeg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYvZ7H_wv1_zUuyKz1SxPeP7VohHAfkpPzax_PlJd3CGjmOthXNrfDcz5NiRe8x4D4GBVqSuNiIjzv7lQBD0WVrfmV3oemdWB5n7PdJvUlgXz-9yMHUHR3YlsD0Z_AqA7yQ70vk94CVC2WPu2u...	46 KB 46 KB	707ms 557ms	Image image/jpeg	2a00:1450:4001:810::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYvZ7H_wv1_zUuyKz1SxPeP7VohHAfkpPzax_PlJd3CGjmOthXNrfDcz5NiRe8x4D4GBVqSuNiIjzv7lQBD0WVrfmV3oemdWB5n7PdJvUlgXz-9yMHUHR3YlsD0Z_AqA7yQ70vk94CVC2WPu2uTaTxt848Pf6U6n4r-LuaMKi5s8Qj7NELY8sI5o-P9m65/s320/3A44975C-78A1-4D61-9510-95C19BD08B94.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 43bc577a3f8c4a40137035d09b6ddac4444fde9c26b665a58d318ee7c2a8ed37 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT x-content-type-options nosniff server fife etag "ve63" vary Origin content-type image/jpeg access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="3A44975C-78A1-4D61-9510-95C19BD08B94.jpeg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 46594 x-xss-protection 0 expires Sat, 15 Jun 2024 03:05:44 GMT
GET H2	200	66E07ACA-1BFE-4BB1-8BB5-F29C925F08F9.jpeg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi92SoW3O15AWlveYuWMRjanoVa0cbZpRTyz932GG-4ckAgLNoTkGmYbUPG-URbM-U_o9LUXtABwF_3C1Q8t3g3SNP0s8nKLEX3oJP3LvTbLyF5eRc8lcjmdGSUcJFa9j8bcvQ8lVwtujo43k6Z...	17 KB 17 KB	577ms 427ms	Image image/jpeg	2a00:1450:4001:810::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi92SoW3O15AWlveYuWMRjanoVa0cbZpRTyz932GG-4ckAgLNoTkGmYbUPG-URbM-U_o9LUXtABwF_3C1Q8t3g3SNP0s8nKLEX3oJP3LvTbLyF5eRc8lcjmdGSUcJFa9j8bcvQ8lVwtujo43k6Zd_m07krjU4M2Dv77AYw1BWVU7Me42cBb_anUGQR_oRZJ/s320/66E07ACA-1BFE-4BB1-8BB5-F29C925F08F9.jpeg Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 9ad81081d7be324cc9171f2f258de1808f1f64e9f6693b880a6346e52fd181b3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT x-content-type-options nosniff server fife etag "ve63" vary Origin content-type image/jpeg access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="66E07ACA-1BFE-4BB1-8BB5-F29C925F08F9.jpeg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17308 x-xss-protection 0 expires Sat, 15 Jun 2024 03:05:44 GMT
GET H3	200	online_i.js Show response widget.supercounters.com/ssl/	4 KB 2 KB	46ms 46ms	Script application/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://widget.supercounters.com/ssl/online_i.js Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ee80e1799cfa522898910f9b955030eb967d87ff400bf423561b6fa8b05d666a Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Mar 2022 11:46:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 3374 etag W/"6220aa82-10a3" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MF6K3EjSmZCRU3SG98n94ga4mTv2iHdz40AEhJQpjPmSQDJp0yYZGVef3jNIVvaJoG9tWD%2Fs2eUkfoOYzsTxDhixWxHcRWpE7u3RKt1P1ECnehTQ3gK2bqb2NfSM88IJjm6oQY3U8JoJZg8%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=300 cf-ray 893719b2df789975-FRA alt-svc h3=":443"; ma=86400
GET H2	200	/ Show response voucher-25000.hqivirals.com/	152 KB 0	0ms 0ms	Script text/html	2606:4700:3036::ac43:d15e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://voucher-25000.hqivirals.com/ Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:d15e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fe1a084f763cccd21ac69b08fa93ed8a2fe56abca3100efdda9d10d6b03c97f Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:43 GMT content-encoding br cf-cache-status DYNAMIC last-modified Thu, 13 Jun 2024 04:16:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUzIPoWP2QHN%2Fmjr3runZpnC9JEHp8rQkAUktf26C6vy8GeHCMFmTGSF3zzWztddJUu94ot1x1vHB9vetvjx6179vgn0QKcagXPeVZs%2FLiqyrIXMbPubBzTaJYRZIB8sceuW5klz6lO6ICecLxZ8AiGJkYEJRj1y6h0%3D"}],"group":"cf-nel","max_age":604800} content-type text/html cf-ray 893719b18b6f3642-FRA alt-svc h3=":443"; ma=86400
OPTIONS H/1.1	200 OK	getextparams tdsjsext3.com/ExtService.svc/	0 0	150ms 57ms	Preflight text/html	199.59.243.226 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tdsjsext3.com/ExtService.svc/getextparams Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.59.243.226 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Method GET.html Origin https://voucher-25000.hqivirals.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Accept-Ch sec-ch-prefers-color-scheme Cache-Control no-store, max-age=0 Connection close Content-Length 1150 Content-Type text/html; charset=utf-8 Critical-Ch sec-ch-prefers-color-scheme Date Fri, 14 Jun 2024 03:05:43 GMT Vary sec-ch-prefers-color-scheme X-Adblock-Key MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_aqait4ktMkB5TIrLvmzJSPUEWs23LgS1i4C2ikrMURPWPeWuauYgTjIKsr4ZQhJCFjeSNirk1dC18oaw6HUXig== X-Request-Id f1b87bfc-7422-472d-834d-8d5119706dd7
GET H/1.1	200 OK	fc.php Show response service.supercounters.com/	58 B 303 B	352ms 114ms	Script application/x-javascript	172.104.29.90 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://service.supercounters.com/fc.php?id=1690079&w=1&v=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&url=https%3A%2F%2Fvoucher-25000.hqivirals.com%2F&ref=&sw=1600&sh=1200&rand=17&label=&fcolor=ffffff Requested by Host: widget.supercounters.com URL: https://widget.supercounters.com/ssl/online_t.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 172.104.29.90 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS li1848-90.members.linode.com Software nginx/1.20.1 / PHP/7.4.13 Resource Hash 46fd31603fb20affd014b37eeb65b4490d06a94d0a61a24f7be1ece6e62fc315 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 14 Jun 2024 03:05:44 GMT Content-Encoding gzip Server nginx/1.20.1 Connection keep-alive X-Powered-By PHP/7.4.13 Transfer-Encoding chunked Content-Type application/x-javascript
GET.html		getextparams tdsjsext3.com/ExtService.svc/	0 0
GET H/1.1	200 OK	fc.php Show response service.supercounters.com/	28 B 279 B	340ms 115ms	Script application/x-javascript	172.104.29.90 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://service.supercounters.com/fc.php?id=1690068&w=1&v=2&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&ref=&url=https%3A%2F%2Fvoucher-25000.hqivirals.com%2F&sw=1600&sh=1200&rand=64 Requested by Host: widget.supercounters.com URL: https://widget.supercounters.com/ssl/online_i.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 172.104.29.90 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS li1848-90.members.linode.com Software nginx/1.20.1 / PHP/7.4.13 Resource Hash 816309c7b292bb94ab58aca7dd94cfe74cf268cdd857ffc85aaf33c4c5ea55a6 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 14 Jun 2024 03:05:44 GMT Content-Encoding gzip Server nginx/1.20.1 Connection keep-alive X-Powered-By PHP/7.4.13 Transfer-Encoding chunked Content-Type application/x-javascript
GET H3	200	e8e8e8.png widget.supercounters.com/images/online/	468 B 929 B	139ms 139ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://widget.supercounters.com/images/online/e8e8e8.png Requested by Host: voucher-25000.hqivirals.com URL: https://voucher-25000.hqivirals.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 99d61b300cb0395cd9b48a969ad57d95cb5ab25c5e31e5aa569c3d3f70445fed Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT cf-cache-status HIT last-modified Sun, 19 Feb 2012 22:53:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "4f417d55-1d4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hivrh7%2FS%2B9DRb1c%2Bz0jeb%2FJGaoggS1F7wmeOXgf5ONXDbbzKkKyp%2BsOjDRHvxXwQA%2FRQCsBNhb%2BLQbcaF4SR69RUNMb1haF6fJHXB2PybAJOfLvTDrBz9To22xEv7LZkleF9oRUqHA3YbFU%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=300 accept-ranges bytes cf-ray 893719b548ab9975-FRA alt-svc h3=":443"; ma=86400 content-length 468
GET H3	404	favicon.ico voucher-25000.hqivirals.com/	315 B 659 B	88ms 88ms	Other text/html	172.67.209.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://voucher-25000.hqivirals.com/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.209.94 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://voucher-25000.hqivirals.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 14 Jun 2024 03:05:44 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FJJqy6U5QZmcxijtcZrwoAf3JAPOs8yEp4e%2Bg%2F7P6zSBPkFHPM6WuQP0D9sQiphPaf96dsRhFwA5v%2BCQbWu5Ozc%2F7MRlceHA17cOIA2SoaTXenNwI2GRBL3HNFPUjjLC3uZKtFpC02B9zmYDTo%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 893719b769d818fd-FRA alt-svc h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

tdsjsext3.com

URL

https://tdsjsext3.com/ExtService.svc/getextparams

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| set_Cookie function| get_Cookie function| showNextNotification function| prevent function| sc_online_t function| sc_onlinetext function| ct_insert object| DOMString object| objServer string| landingDomain string| adsLink function| deadline function| enviar function| doreq function| tip_text function| messageToSend function| operatorData number| counter number| counter2 number| seconds function| getTextNodesIn string| language undefined| textNode undefined| k undefined| textNodes object| sc_olimg_var function| sc_online_i function| sc_onlineimage function| drawText_online function| errorMsg

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://voucher-25000.hqivirals.com/alladz.js Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://voucher-25000.hqivirals.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://voucher-25000.hqivirals.com/ Message: Access to XMLHttpRequest at 'https://tdsjsext3.com/ExtService.svc/getextparams' from origin 'https://voucher-25000.hqivirals.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://tdsjsext3.com/ExtService.svc/getextparams Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://voucher-25000.hqivirals.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogger.googleusercontent.com
service.supercounters.com
tdsjsext3.com
voucher-25000.hqivirals.com
widget.supercounters.com
tdsjsext3.com
172.104.29.90
172.67.209.94
188.114.96.3
199.59.243.226
2606:4700:3036::ac43:d15e
2a00:1450:4001:810::2001
13c99e8992fb4d18ffeff9cdd2b922160392e2f72cd6a7c1ce13381c29358fc7
18aca432d64fe1baadd294be39702da0c92a3edd8af7750b3adbb67e857be993
2f621b8fa63cf8b1e182d1ea74ed73fc46b7e8b38b042a28cbcc201ff615605c
43215e20bbbff43abc4afcf47136cb42692c31747aa5bde63af404c4ef641b6e
43bc577a3f8c4a40137035d09b6ddac4444fde9c26b665a58d318ee7c2a8ed37
46fd31603fb20affd014b37eeb65b4490d06a94d0a61a24f7be1ece6e62fc315
5fe1a084f763cccd21ac69b08fa93ed8a2fe56abca3100efdda9d10d6b03c97f
816309c7b292bb94ab58aca7dd94cfe74cf268cdd857ffc85aaf33c4c5ea55a6
8611fb15b007f36c1fb1923586ff4ef1a6c9c008faa6ec01122eddc13337a3e3
88d8ff4fc0b3b61ee01af6b70a82114725a755c37e1e3e2a7422bff7f2a8cd7d
99d61b300cb0395cd9b48a969ad57d95cb5ab25c5e31e5aa569c3d3f70445fed
9ad81081d7be324cc9171f2f258de1808f1f64e9f6693b880a6346e52fd181b3
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ee80e1799cfa522898910f9b955030eb967d87ff400bf423561b6fa8b05d666a
f56b0bd9e5cd22334b47cc1d10e2cf1ae6a2fd95c16ed5534e925f6dfae331ed