leon.casino Open in urlscan Pro
3.33.158.153 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/
Effective URL:
https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e
Submission: On December 29 via api (December 29th 2023, 4:05:49 pm UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 6 domains to perform 17 HTTP transactions. The main IP is 3.33.158.153, located in United States and belongs to AMAZON-02, US. The main domain is leon.casino.
TLS certificate: Issued by R3 on November 10th 2023. Valid for: 3 months.

This is the only time leon.casino was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3032::6815:5b3b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3036::6815:1f77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3033::6815:2dce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.33.158.153 3.33.158.153	16509 (AMAZON-02) (AMAZON-02)
16	2a03:90c0:41:... 2a03:90c0:41:2801::62	199524 (GCORE) (GCORE)
17	2

2 2606:4700:3032::6815:5b3b (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

spin-the-wheel-app-pokemon-899421.expertinvisalign.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::6815:1f77 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tds.flakozt.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

go.elbe1lif.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:2dce (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ksa5lu5y3o.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.158.153 (United States)

ASN16509 (AMAZON-02, US)
PTR: a74c9b096c06d2617.awsglobalaccelerator.com

leon.casino	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a03:90c0:41:2801::62 (Frankfurt am Main, Germany)

ASN199524 (GCORE, LU)

landingpageslb.gcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	gcdn.co landingpageslb.gcdn.co	1 MB
2	expertinvisalign.ru 2 redirects spin-the-wheel-app-pokemon-899421.expertinvisalign.ru	1 KB
1	leon.casino leon.casino	2 KB
1	ksa5lu5y3o.com 1 redirects ksa5lu5y3o.com	758 B
1	elbe1lif.xyz 1 redirects go.elbe1lif.xyz	668 B
1	flakozt.ru 1 redirects tds.flakozt.ru	643 B
17	6

	Domain	Requested by
16	landingpageslb.gcdn.co	leon.casino landingpageslb.gcdn.co
2	spin-the-wheel-app-pokemon-899421.expertinvisalign.ru	2 redirects
1	leon.casino
1	ksa5lu5y3o.com	1 redirects
1	go.elbe1lif.xyz	1 redirects
1	tds.flakozt.ru	1 redirects
17	6

This site contains no links.

Subject Issuer	Validity	Valid
leon.casino R3	`2023-11-10` - `2024-02-08`	3 months	crt.sh
*.gcdn.co DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2023-07-07` - `2024-07-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e
Frame ID: 860BF11C8A2714120A7B92B1104BEAA2
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LEON

Page URL History Show full URLs

http://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 301
https://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 302
https://tds.flakozt.ru/1?q=index.php-spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 302
https://go.elbe1lif.xyz/click?pid=21102&offer_id=4210&sub1=2a01:4a0:5a::4-de-erlangen-index.php-spin... HTTP 302
https://ksa5lu5y3o.com/?serial=34074&creative_id=543&anid=21102_658eee0f39813200018db71e HTTP 302
https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39... Page URL

Page Statistics

17
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

2
IPs

2
Countries

1522 kB
Transfer

1522 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 301
https://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 302
https://tds.flakozt.ru/1?q=index.php-spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ HTTP 302
https://go.elbe1lif.xyz/click?pid=21102&offer_id=4210&sub1=2a01:4a0:5a::4-de-erlangen-index.php-spin-the-wheel-app-pokemon-899421.expertinvisalign.ru%2F&l=1700747712 HTTP 302
https://ksa5lu5y3o.com/?serial=34074&creative_id=543&anid=21102_658eee0f39813200018db71e HTTP 302
https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index_metrika.html Show response leon.casino/traff/de/dragon/ Redirect Chain http://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ https://spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ https://tds.flakozt.ru/1?q=index.php-spin-the-wheel-app-pokemon-899421.expertinvisalign.ru/ https://go.elbe1lif.xyz/click?pid=21102&offer_id=4210&sub1=2a01:4a0:5a::4-de-erlangen-index.php-spin-the-wheel-app-pokemon-899421.expertinvisalign.ru%2F&l=1700747712 https://ksa5lu5y3o.com/?serial=34074&creative_id=543&anid=21102_658eee0f39813200018db71e https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e	4 KB 2 KB	120ms 71ms	Document text/html	3.33.158.153 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.33.158.153 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a74c9b096c06d2617.awsglobalaccelerator.com Software nginx / Resource Hash `f06e607369dd4e0223346f3876cd70d1bee8671a31c174487c2affc3f3f9eeb0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html date Fri, 29 Dec 2023 16:04:31 GMT etag W/"65254348-1196" last-modified Tue, 10 Oct 2023 12:27:52 GMT server nginx Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-cache cf-cache-status DYNAMIC cf-ray 83d34780cdfc0a51-AMS content-type text/html; charset=utf-8 date Fri, 29 Dec 2023 16:04:31 GMT location https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7tmgCUq5Xp93BHx6xaUVxtJxpDKtyHJAeeXwMGKndl%2Fz94m1UAn8ZIJLiGa5nnUmozpWy%2Fw2d40%2FYP4Rvx%2Bs0zppQOwXuvV7UiFgZgP04TEsLQQCpcaiB6pNAXkL%2F31HAdYOudadEaTPguBVUw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Origin x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-permitted-cross-domain-policies none x-request-id f14ab1f229e6b35858a2b1e8f99378e4 x-runtime 0.021457 x-xss-protection 1; mode=block
GET H2	200	style.min.css landingpageslb.gcdn.co/wheel_de2/public/css/	21 KB 21 KB	101ms 9ms	Stylesheet text/css	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Full URL https://landingpageslb.gcdn.co/wheel_de2/public/css/style.min.css?v=56.438367377124024 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `c8e2354e893f2bb454538ecccdf4e059c737e42603d1a2ebd4d7a15326f1b0d5` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:42 GMT server nginx traceparent 00-653394fa88bc4ffbf2448170f4891690-6c366842850cddd4-01 etag "652542c6-548b" x-cached-since 2023-12-27T08:53:56+00:00 content-type text/css access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 21643
GET H2	200	logo.svg landingpageslb.gcdn.co/wheel_de2/public/img/	2 KB 2 KB	103ms 11ms	Image image/svg+xml	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/logo.svg?v=81.30897836730502 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `8888a631459933fda25c74f4c2397fb316b84d8d13662a4e52d1538d53b7cb66` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-af26336be11bd4d5db772f74b944c33b-fe864a8c6c1de7c4-01 etag "652542c8-62f" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/svg+xml access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 1583
GET H2	200	circle-1.png landingpageslb.gcdn.co/wheel_de2/public/img/	475 KB 476 KB	105ms 13ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/circle-1.png?v=90.42306724702303 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `5180278a81d2fadf713cc6db6f4f733396486c51179e0b390b7bfadd7b669809` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-76517ae2a363377304889c38d00fc649-c5b7578694d4391f-01 etag "652542c8-76b6c" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 486252
GET H2	200	circle-2.png landingpageslb.gcdn.co/wheel_de2/public/img/	15 KB 15 KB	21ms 20ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/circle-2.png?v=59.63403805887382 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `902dc44c8fc98aacd190557d62da026b4691582678553de6554b0223d5074a2a` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-2db3fd75c38596da0b93ae6d646b7ea4-5384646d98b3e3e6-01 etag "652542c8-3cc2" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 15554
GET H2	200	wheel-win-0.png landingpageslb.gcdn.co/wheel_de2/public/img/	32 KB 32 KB	22ms 10ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/wheel-win-0.png?v=49.40042503390447 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `60e3808a755889e222006c44835e3aa2b655c7131087d17679830591625dd11f` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-818bd44da87e2a1b3a1190cd6ca3b8df-9da8fd491213b619-01 etag "652542c8-8082" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 32898
GET H2	200	wheel-win.png landingpageslb.gcdn.co/wheel_de2/public/img/	20 KB 20 KB	22ms 11ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/wheel-win.png?v=14.95339575221497 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `6729fe016ce01f3f3d940362a3a9fbc6dd0d48570594acbf85259c46f570a2b5` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:43 GMT server nginx traceparent 00-c9560bb21d3f7cc8cedca40744b9d44c-e6e0df91f26587f7-01 etag "652542c7-4e7c" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 20092
GET H2	200	bandit.png landingpageslb.gcdn.co/wheel_de2/public/img/	470 KB 471 KB	24ms 15ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/bandit.png?v=82.76200999500148 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `af41296caaed28995224780ad79685bc0b31f0c753d795ea3febb4dc54f63399` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-3f9cd1fa86ce03d101d0f9b26643c240-ba8208160303d8b8-01 etag "652542c8-7599c" x-cached-since 2023-12-26T09:15:31+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 481692
GET H2	200	el-1.png landingpageslb.gcdn.co/wheel_de2/public/img/elem/	8 KB 8 KB	26ms 18ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/elem/el-1.png?v=56.18535573377521 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `13807d3b9bbba5b5eeb0dc813b9423a66357389fc0808207d3d660b4296bddb7` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:47 GMT server nginx traceparent 00-4e58b8789e6f365b0f526770aa34a37a-5dc2697d66c6edc1-01 etag "652542cb-1ee9" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 7913
GET H2	200	el-2.png landingpageslb.gcdn.co/wheel_de2/public/img/elem/	12 KB 12 KB	17ms 11ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/elem/el-2.png?v=88.68074114701162 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `9d89afe161992ffca5891f8b731ec810d786bd2fa307fdd2873a979bdc00c0f1` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:47 GMT server nginx traceparent 00-9b4453e5c3cf91530d6989651a3dfbc1-f6f22ed49bd75bc6-01 etag "652542cb-2f47" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 12103
GET H2	200	el-3.png landingpageslb.gcdn.co/wheel_de2/public/img/elem/	15 KB 15 KB	18ms 12ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/elem/el-3.png?v=58.394300643171434 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `1646b20562bfbbee63d431690cf097e3cade7568feff508b348a4c732d6bd4d8` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:47 GMT server nginx traceparent 00-300096463854ba2983d71e2fd0b28d9f-f90be687c351f907-01 etag "652542cb-3ad9" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 15065
GET H2	200	popup-1.png landingpageslb.gcdn.co/wheel_de2/public/img/popup/	121 KB 121 KB	20ms 14ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/popup/popup-1.png?v=99.28861299221445 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `267b1781147d864815592282da85d5c349b0a12b7347c6ed07cfd2abe54c8786` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:47 GMT server nginx traceparent 00-51fd1d850cb63679def5b69cda89f294-c70eddc31519d62c-01 etag "652542cb-1e3bd" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 123837
GET H2	200	popup-2.png landingpageslb.gcdn.co/wheel_de2/public/img/popup/	168 KB 169 KB	22ms 16ms	Image image/png	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/popup/popup-2.png?v=83.68830370841496 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `beee58832085a77cf431b3152a77b42e0f69d8ab3faa11f30fdeba804c5f6b89` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:47 GMT server nginx traceparent 00-b776e285a4a64ac990bc0efa53bc3b30-138e55744de3d48d-01 etag "652542cb-2a1ef" x-cached-since 2023-12-26T02:59:02+00:00 content-type image/png access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 172527
GET H2	200	parallax.min.js Show response landingpageslb.gcdn.co/wheel_de2/public/js/	17 KB 17 KB	19ms 8ms	Script application/javascript	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Full URL https://landingpageslb.gcdn.co/wheel_de2/public/js/parallax.min.js Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `1aa4cad8b8c65ae062f64172ceb16f7eb02242cee0ec506f6a18390b650b98e3` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:42 GMT server nginx traceparent 00-49eaae7a35da110702c5fcea8ba3a0b3-833a3ea3d9e24119-01 etag "652542c6-43a1" x-cached-since 2023-12-26T02:59:02+00:00 content-type application/javascript access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 17313
GET H2	200	main.min.js Show response landingpageslb.gcdn.co/wheel_de2/public/js/	2 KB 3 KB	22ms 13ms	Script application/javascript	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Full URL https://landingpageslb.gcdn.co/wheel_de2/public/js/main.min.js?v=1 Requested by Host: leon.casino URL: https://leon.casino/traff/de/dragon/index_metrika.html?qtag=a27112_t34074_c543_s21102_658eee0f39813200018db71e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `d8569b58aa9af9a99b2397a84e0461e636af74284d6d9ddcf709bac55fed80b4` Request headers accept-language de-DE,de;q=0.9 Referer https://leon.casino/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:42 GMT server nginx traceparent 00-decf76ac50eca567cf6991c29e37c81f-c8849aba62af1d4c-01 etag "652542c6-9ab" x-cached-since 2023-12-26T02:59:02+00:00 content-type application/javascript access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 2475
GET H2	200	bg.jpg landingpageslb.gcdn.co/wheel_de2/public/img/	117 KB 117 KB	27ms 22ms	Image image/jpeg	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://landingpageslb.gcdn.co/wheel_de2/public/img/bg.jpg Requested by Host: landingpageslb.gcdn.co URL: https://landingpageslb.gcdn.co/wheel_de2/public/css/style.min.css?v=56.438367377124024 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `6e77d4e115f70e912d964fe68c07ff6555f96ec48e47f63c8d8beab18f8a6f0b` Request headers accept-language de-DE,de;q=0.9 Referer https://landingpageslb.gcdn.co/wheel_de2/public/css/style.min.css?v=56.438367377124024 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc60 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:44 GMT server nginx traceparent 00-2d903efee2dd626884283a24aaedc92e-5b925df1ef8feb82-01 etag "652542c8-1d213" x-cached-since 2023-12-26T09:15:31+00:00 content-type image/jpeg access-control-allow-origin * x-id-fe fr5-hw-edge-gc60 cache HIT accept-ranges bytes content-length 119315
GET H2	200	UniSansBold.woff2 landingpageslb.gcdn.co/wheel_de2/public/fonts/	23 KB 23 KB	35ms 13ms	Font application/octet-stream	2a03:90c0:41:2801::62 GCORE
General Check archive.org Show headers Download Go to Full URL https://landingpageslb.gcdn.co/wheel_de2/public/fonts/UniSansBold.woff2 Requested by Host: landingpageslb.gcdn.co URL: https://landingpageslb.gcdn.co/wheel_de2/public/css/style.min.css?v=56.438367377124024 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:90c0:41:2801::62 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS Software nginx / Resource Hash `ec4bd70634f7282ef39e69103f5e31d3ddde953b78c301f43878f9bd2b824193` Request headers Referer https://landingpageslb.gcdn.co/wheel_de2/public/css/style.min.css?v=56.438367377124024 Origin https://leon.casino accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-id fr5-hw-edge-gc37 date Fri, 29 Dec 2023 16:04:31 GMT last-modified Tue, 10 Oct 2023 12:25:46 GMT server nginx traceparent 00-72b2389b924c887a4c82dbade6b00747-18948fe985354c21-01 etag "652542ca-5b30" x-cached-since 2023-12-26T23:03:20+00:00 content-type application/octet-stream access-control-allow-origin * x-id-fe fr5-hw-edge-gc37 cache HIT accept-ranges bytes content-length 23344

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
tds.flakozt.ru/	1970-01-20 17:19:12	Name: 95622e70ccf25e97e0474310a2e55cb7 Value: 0.1
go.elbe1lif.xyz/	1970-01-21 02:03:21	Name: afclick Value: 658eee0f39813200018db71e
go.elbe1lif.xyz/	1970-01-21 02:03:21	Name: afoffers Value: {"4210":1703865871}
leon.casino/	1970-01-20 18:00:57	Name: qtag Value: a27112_t34074_c543_s21102_658eee0f39813200018db71e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

go.elbe1lif.xyz
ksa5lu5y3o.com
landingpageslb.gcdn.co
leon.casino
spin-the-wheel-app-pokemon-899421.expertinvisalign.ru
tds.flakozt.ru
2606:4700:3032::6815:5b3b
2606:4700:3033::6815:2dce
2606:4700:3036::6815:1f77
2a03:90c0:41:2801::62
2a06:98c1:3120::3
3.33.158.153
13807d3b9bbba5b5eeb0dc813b9423a66357389fc0808207d3d660b4296bddb7
1646b20562bfbbee63d431690cf097e3cade7568feff508b348a4c732d6bd4d8
1aa4cad8b8c65ae062f64172ceb16f7eb02242cee0ec506f6a18390b650b98e3
267b1781147d864815592282da85d5c349b0a12b7347c6ed07cfd2abe54c8786
5180278a81d2fadf713cc6db6f4f733396486c51179e0b390b7bfadd7b669809
60e3808a755889e222006c44835e3aa2b655c7131087d17679830591625dd11f
6729fe016ce01f3f3d940362a3a9fbc6dd0d48570594acbf85259c46f570a2b5
6e77d4e115f70e912d964fe68c07ff6555f96ec48e47f63c8d8beab18f8a6f0b
8888a631459933fda25c74f4c2397fb316b84d8d13662a4e52d1538d53b7cb66
902dc44c8fc98aacd190557d62da026b4691582678553de6554b0223d5074a2a
9d89afe161992ffca5891f8b731ec810d786bd2fa307fdd2873a979bdc00c0f1
af41296caaed28995224780ad79685bc0b31f0c753d795ea3febb4dc54f63399
beee58832085a77cf431b3152a77b42e0f69d8ab3faa11f30fdeba804c5f6b89
c8e2354e893f2bb454538ecccdf4e059c737e42603d1a2ebd4d7a15326f1b0d5
d8569b58aa9af9a99b2397a84e0461e636af74284d6d9ddcf709bac55fed80b4
ec4bd70634f7282ef39e69103f5e31d3ddde953b78c301f43878f9bd2b824193
f06e607369dd4e0223346f3876cd70d1bee8671a31c174487c2affc3f3f9eeb0

leon.casino Open in urlscan Pro 3.33.158.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

100 %HTTPS

83 %IPv6

6 Domains

6 Subdomains

2 IPs

2 Countries

1522 kBTransfer

1522 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

4 Cookies

Indicators

leon.casino Open in urlscan Pro
3.33.158.153 Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

2
IPs

2
Countries

1522 kB
Transfer

1522 kB
Size

4
Cookies

17 HTTP transactions
0 data transactions