urlscan.io logo urlscan.io
SecurityTrails logo

1wgafz.top Open in urlscan Pro
190.115.24.78  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://shorturl.at/tABY7
Effective URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Submission: On January 17 via manual from GB — Scanned from AT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 6 countries across 18 domains to perform 41 HTTP transactions. The main IP is 190.115.24.78, located in Belize and belongs to IQWEB, AE. The main domain is 1wgafz.top.
TLS certificate: Issued by R3 on December 12th 2023. Valid for: 3 months.
This is the only time 1wgafz.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 104.26.9.129 13335 (CLOUDFLAR...)
2 3.120.230.228 16509 (AMAZON-02)
2 2 69.172.200.185 19324 (DOSARREST)
2 2 198.55.106.36 8100 (ASN-QUADR...)
20 190.115.24.78 59692 (IQWEB)
1 151.101.130.137 54113 (FASTLY)
2 172.217.16.200 15169 (GOOGLE)
2 4 172.217.18.6 15169 (GOOGLE)
1 18.66.97.49 16509 (AMAZON-02)
3 7 87.250.251.119 13238 (YANDEX)
1 216.239.34.36 15169 (GOOGLE)
1 13.32.27.54 16509 (AMAZON-02)
2 142.250.184.194 15169 (GOOGLE)
1 3.160.212.84 16509 (AMAZON-02)
2 142.250.186.98 15169 (GOOGLE)
2 44.229.210.160 16509 (AMAZON-02)
41 13
2    104.26.9.129 (None, )

ASN13335 (CLOUDFLARENET, US)
shorturl.at
www.shorturl.at
2    3.120.230.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-230-228.eu-central-1.compute.amazonaws.com
expearsbectorlds.com
2    69.172.200.185 (Canada)

ASN19324 (DOSARREST, US)
PTR: maxbounty.com
afflat3a1.com
ffatric1.com
2    198.55.106.36 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 198.55.106.36.static.quadranet.com
djnl.decisionnowlive.com
djnl.spinfastconnected.com
20    190.115.24.78 (Belize)

ASN59692 (IQWEB, AE)
PTR: ddos-guard.net
1wgafz.top
1    151.101.130.137 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    172.217.16.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f8.1e100.net
www.googletagmanager.com
4    172.217.18.6 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f6.1e100.net
12688802.fls.doubleclick.net
12572451.fls.doubleclick.net
1    18.66.97.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-49.fra56.r.cloudfront.net
static.hotjar.com
7    87.250.251.119 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: mc.yandex.ru
mc.yandex.ru
mc.yandex.com
1    216.239.34.36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    13.32.27.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-54.fra56.r.cloudfront.net
script.hotjar.com
2    142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net
adservice.google.com
1    3.160.212.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-160-212-84.mxp53.r.cloudfront.net
vc.hotjar.io
2    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
adservice.google.at
2    44.229.210.160 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-229-210-160.us-west-2.compute.amazonaws.com
api2.amplitude.com
Apex Domain
Subdomains		 Transfer
20 1wgafz.top
1wgafz.top
2 MB
5 yandex.com
mc.yandex.com — Cisco Umbrella Rank: 8747
3 KB
4 doubleclick.net
12688802.fls.doubleclick.net — Cisco Umbrella Rank: 377654
12572451.fls.doubleclick.net — Cisco Umbrella Rank: 380669
2 KB
2 amplitude.com
api2.amplitude.com — Cisco Umbrella Rank: 1350
309 B
2 google.at
adservice.google.at — Cisco Umbrella Rank: 87334
665 B
2 google.com
adservice.google.com — Cisco Umbrella Rank: 98
1 KB
2 yandex.ru
mc.yandex.ru — Cisco Umbrella Rank: 3982
71 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 681
script.hotjar.com — Cisco Umbrella Rank: 996
59 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 37
172 KB
2 expearsbectorlds.com
expearsbectorlds.com
2 KB
2 shorturl.at
shorturl.at — Cisco Umbrella Rank: 81535
www.shorturl.at — Cisco Umbrella Rank: 91454
1 KB
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 2633
259 B
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2029
250 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 760
30 KB
1 spinfastconnected.com
djnl.spinfastconnected.com
680 B
1 decisionnowlive.com
djnl.decisionnowlive.com
705 B
1 ffatric1.com
ffatric1.com
503 B
1 afflat3a1.com
afflat3a1.com — Cisco Umbrella Rank: 465964
513 B
41 18
Domain Requested by
20 1wgafz.top expearsbectorlds.com
1wgafz.top
5 mc.yandex.com 2 redirects 1wgafz.top
2 api2.amplitude.com 1wgafz.top
2 adservice.google.at adservice.google.com
2 adservice.google.com 12688802.fls.doubleclick.net
12572451.fls.doubleclick.net
2 mc.yandex.ru 1 redirects expearsbectorlds.com
2 12572451.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 12688802.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.googletagmanager.com 1wgafz.top
www.googletagmanager.com
2 expearsbectorlds.com expearsbectorlds.com
1 vc.hotjar.io script.hotjar.com
1 script.hotjar.com static.hotjar.com
1 region1.google-analytics.com www.googletagmanager.com
1 static.hotjar.com expearsbectorlds.com
1 code.jquery.com 1wgafz.top
1 djnl.spinfastconnected.com 1 redirects
1 djnl.decisionnowlive.com 1 redirects
1 ffatric1.com 1 redirects
1 afflat3a1.com 1 redirects
1 www.shorturl.at 1 redirects
1 shorturl.at 1 redirects
41 21

This site contains no links.

Subject Issuer Validity Valid
expearsbectorlds.com
R3		 2023-11-28 -
2024-02-26		 3 months crt.sh
1wgafz.top
R3		 2023-12-12 -
2024-03-11		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01		 2023-03-09 -
2024-04-06		 a year crt.sh
mc.yandex.ru
GlobalSign ECC OV SSL CA 2018		 2023-12-26 -
2024-06-05		 5 months crt.sh
*.google.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
*.hotjar.io
Amazon ECDSA 256 M01		 2023-03-09 -
2024-04-06		 a year crt.sh
*.google.at
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
*.amplitude.com
COMODO RSA Domain Validation Secure Server CA		 2023-01-23 -
2024-02-14		 a year crt.sh

This page contains 7 frames:

Primary Page: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Frame ID: E56B3862F3D6704B7EC57807879D851F
Requests: 34 HTTP requests in this frame

Frame: https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Frame ID: E3ACD0E26CC019DFFC339A8F7A141C4E
Requests: 1 HTTP requests in this frame

Frame: https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955
Frame ID: 2B07CECC2C1DCDDF513B3D051A0C320F
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Frame ID: 43494A3028C1D6BACC592A0582B1925C
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955;~oref=https://1wgafz.top/
Frame ID: 644EA3B7227E717C9EE59FDE77E939F0
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.at/ddm/fls/i/dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Frame ID: 844F82417EC49B9E98A891F6A0A2492A
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.at/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955;~oref=https://1wgafz.top/
Frame ID: 837AB2FA099F36D242248BFB6425FE67
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

1win

Page URL History Show full URLs

  1. https://shorturl.at/tABY7 HTTP 301
    https://www.shorturl.at/tABY7 HTTP 302
    https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d Page URL
  2. https://expearsbectorlds.com/redirect?target=BASE64aHR0cHM6Ly9hZmZsYXQzYTEuY29tL3Ryay9sbmsvMUE3RjlGRDQtQj... Page URL
  3. https://afflat3a1.com/trk/lnk/1A7F9FD4-B10B-4BA6-8BA5-06E1D1CBB62A/?o=21349&c=918277&a=584627&k=11... HTTP 302
    https://ffatric1.com/def.cfm?i=584627&o=21349&c=AT&d=D HTTP 302
    https://djnl.decisionnowlive.com/?kw=584627&s1=21349&s2=147150&s3=AT&s4=D HTTP 302
    https://djnl.spinfastconnected.com/o/OSOGSWEW/d82638a6-b563-11ee-a78f-7facea208684/d82e165c-b563-11ee-8658-bbc4... HTTP 302
    https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374& Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

41
Requests

95 %
HTTPS

0 %
IPv6

18
Domains

21
Subdomains

13
IPs

6
Countries

2574 kB
Transfer

3726 kB
Size

34
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://shorturl.at/tABY7 HTTP 301
    https://www.shorturl.at/tABY7 HTTP 302
    https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d Page URL
  2. https://expearsbectorlds.com/redirect?target=BASE64aHR0cHM6Ly9hZmZsYXQzYTEuY29tL3Ryay9sbmsvMUE3RjlGRDQtQjEwQi00QkE2LThCQTUtMDZFMUQxQ0JCNjJBLz9vPTIxMzQ5JmM9OTE4Mjc3JmE9NTg0NjI3Jms9MTFCRDMyNEUwREU0ODNFNjY3MzIwQzYwNDU4NUQ4N0QmbD0yMjU1NSZTMj13NTBxYjkwaWtudjhwYWh1MnQ5OHJjODQ&ts=1705515090842&hash=fNy8lrtB8YJURG0fStZAmUXA5Zhl1QDAgb_JZHLh6Tc&rm=DJ Page URL
  3. https://afflat3a1.com/trk/lnk/1A7F9FD4-B10B-4BA6-8BA5-06E1D1CBB62A/?o=21349&c=918277&a=584627&k=11BD324E0DE483E667320C604585D87D&l=22555&S2=w50qb90iknv8pahu2t98rc84 HTTP 302
    https://ffatric1.com/def.cfm?i=584627&o=21349&c=AT&d=D HTTP 302
    https://djnl.decisionnowlive.com/?kw=584627&s1=21349&s2=147150&s3=AT&s4=D HTTP 302
    https://djnl.spinfastconnected.com/o/OSOGSWEW/d82638a6-b563-11ee-a78f-7facea208684/d82e165c-b563-11ee-8658-bbc49d5be09d HTTP 302
    https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://shorturl.at/tABY7 HTTP 301
  • https://www.shorturl.at/tABY7 HTTP 302
  • https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
Request Chain 24
  • https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26 HTTP 302
  • https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Request Chain 25
  • https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955 HTTP 302
  • https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955
Request Chain 35
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10251.IJ23xN-LRLxGdGPz728J0YYUswNU9uyivTp85bN-oRIvbfzcSjJEOLkHMizKoFnL.YQE24RPJTr0MTI6eCvRbTX1dNr4%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=10251.6lnNqa6wLyQwleYD9ziBDomZhF2wr3XTgS2ELHtacS58S7KRROizkvm4Qth7C-a4ahobRUWrhaN2Dg3fhbIsaAUgZk3OAIYm3dB25H2GjIfwQGTiRud6HhWh7g2rpAFtAGs_jHvKLwmPIpaMr_1UCJlEEnBiIT9d08Btv4q6xndZCSQjWa7wW8a6HzCZ2Jq6RhO3Y2xWnpFsVmPCOL9NhUDEJ4DHKOf-D1ZWcPhQt24%2C.oKQnSMO6etBkFm0jBqgf5xq9JRM%2C
Request Chain 37
  • https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1201%3Acn%3A1%3Adp%3A0%3Als%3A1234771803553%3Ahid%3A445667281%3Az%3A60%3Ai%3A20240117191135%3Aet%3A1705515095%3Ac%3A1%3Arn%3A1017395292%3Arqn%3A1%3Au%3A1705515095820624567%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C111%2C98%2C13%2C2899%2C0%2C%2C330%2C0%2C%2C%2C%2C3692%3Aco%3A0%3Acpf%3A1%3Ans%3A1705515090984%3Agi%3AR0ExLjEuMTQ1MDczODM0Mi4xNzA1NTE1MDk1%3Afp%3A3437%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1705515095%3At%3A1win&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)rcm(1)ti(1) HTTP 302
  • https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1201%3Acn%3A1%3Adp%3A0%3Als%3A1234771803553%3Ahid%3A445667281%3Az%3A60%3Ai%3A20240117191135%3Aet%3A1705515095%3Ac%3A1%3Arn%3A1017395292%3Arqn%3A1%3Au%3A1705515095820624567%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C111%2C98%2C13%2C2899%2C0%2C%2C330%2C0%2C%2C%2C%2C3692%3Aco%3A0%3Acpf%3A1%3Ans%3A1705515090984%3Agi%3AR0ExLjEuMTQ1MDczODM0Mi4xNzA1NTE1MDk1%3Afp%3A3437%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1705515095%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29ti%281%29

41 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
95686ca3-08c1-4a98-b139-f9faf0f6272d
expearsbectorlds.com/voluum/
Redirect Chain
  • https://shorturl.at/tABY7
  • https://www.shorturl.at/tABY7
  • https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.120.230.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-120-230-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

cache-control
no-store, no-cache, pre-check=0, post-check=0
content-type
text/html;charset=UTF-8
date
Wed, 17 Jan 2024 18:11:30 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
84708fa42fa1c23b-VIE
content-type
text/html; charset=UTF-8
date
Wed, 17 Jan 2024 18:11:30 GMT
location
https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FtA45MOTsGGvm175mnrdFE1TGw0SREYFw%2BFodTGu%2FXCgB4a7qjz63hGYK4nCDnlVcREjt0bLw4wuR%2F2HbpoAIArwP284OxeRd62MATTF%2FJel04oZfB2vlsejdbJGOcvReA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-nginx-upstream-cache-status
EXPIRED
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
redirect
expearsbectorlds.com/ 		666 B
831 B 		Document
General
Check archive.org
Download Go to
Full URL
https://expearsbectorlds.com/redirect?target=BASE64aHR0cHM6Ly9hZmZsYXQzYTEuY29tL3Ryay9sbmsvMUE3RjlGRDQtQjEwQi00QkE2LThCQTUtMDZFMUQxQ0JCNjJBLz9vPTIxMzQ5JmM9OTE4Mjc3JmE9NTg0NjI3Jms9MTFCRDMyNEUwREU0ODNFNjY3MzIwQzYwNDU4NUQ4N0QmbD0yMjU1NSZTMj13NTBxYjkwaWtudjhwYWh1MnQ5OHJjODQ&ts=1705515090842&hash=fNy8lrtB8YJURG0fStZAmUXA5Zhl1QDAgb_JZHLh6Tc&rm=DJ
Requested by
Host: expearsbectorlds.com
URL: https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.120.230.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-120-230-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

cache-control
no-store, no-cache, pre-check=0, post-check=0
content-type
text/html;charset=UTF-8
date
Wed, 17 Jan 2024 18:11:30 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx
Primary Request landing-fortune-wheel
1wgafz.top/
Redirect Chain
  • https://afflat3a1.com/trk/lnk/1A7F9FD4-B10B-4BA6-8BA5-06E1D1CBB62A/?o=21349&c=918277&a=584627&k=11BD324E0DE483E667320C604585D87D&l=22555&S2=w50qb90iknv8pahu2t98rc84
  • https://ffatric1.com/def.cfm?i=584627&o=21349&c=AT&d=D
  • https://djnl.decisionnowlive.com/?kw=584627&s1=21349&s2=147150&s3=AT&s4=D
  • https://djnl.spinfastconnected.com/o/OSOGSWEW/d82638a6-b563-11ee-a78f-7facea208684/d82e165c-b563-11ee-8658-bbc49d5be09d
  • https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
172 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Requested by
Host: expearsbectorlds.com
URL: https://expearsbectorlds.com/redirect?target=BASE64aHR0cHM6Ly9hZmZsYXQzYTEuY29tL3Ryay9sbmsvMUE3RjlGRDQtQjEwQi00QkE2LThCQTUtMDZFMUQxQ0JCNjJBLz9vPTIxMzQ5JmM9OTE4Mjc3JmE9NTg0NjI3Jms9MTFCRDMyNEUwREU0ODNFNjY3MzIwQzYwNDU4NUQ4N0QmbD0yMjU1NSZTMj13NTBxYjkwaWtudjhwYWh1MnQ5OHJjODQ&ts=1705515090842&hash=fNy8lrtB8YJURG0fStZAmUXA5Zhl1QDAgb_JZHLh6Tc&rm=DJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
05976cc7c686a8e30c1679efad2190f00a240841c2f5003a64156a6890552215

Request headers

Referer
https://expearsbectorlds.com/redirect?target=BASE64aHR0cHM6Ly9hZmZsYXQzYTEuY29tL3Ryay9sbmsvMUE3RjlGRDQtQjEwQi00QkE2LThCQTUtMDZFMUQxQ0JCNjJBLz9vPTIxMzQ5JmM9OTE4Mjc3JmE9NTg0NjI3Jms9MTFCRDMyNEUwREU0ODNFNjY3MzIwQzYwNDU4NUQ4N0QmbD0yMjU1NSZTMj13NTBxYjkwaWtudjhwYWh1MnQ5OHJjODQ&ts=1705515090842&hash=fNy8lrtB8YJURG0fStZAmUXA5Zhl1QDAgb_JZHLh6Tc&rm=DJ
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Wed, 17 Jan 2024 18:11:34 GMT
etag
W/"64e78076-2ae24"
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard

Redirect headers

cache-control
no-cache, private
content-encoding
br
content-length
281
content-type
text/html; charset=UTF-8
date
Wed, 17 Jan 2024 18:11:33 GMT
location
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true
main.31018b03adaae4e1c230.css
1wgafz.top/landing-fortune-wheel/ 		68 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
92ffadf792ea89aedeac3d59913333fbc12b3705fe6d92d8a2d1768ed6db0e85

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:07 GMT
content-encoding
br
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523050
etag
"64e78076-11095"
vary
Accept-Encoding
content-type
text/css
ddg-cache-status
HIT
content-length
10228
logotype.svg
1wgafz.top/landing-fortune-wheel/img/ 		4 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/logotype.svg
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
a6f801bf0f497d550f9c10fb1e13356718b91ca165c4b8b3ee7dd2275fd69d7e

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:04 GMT
content-encoding
br
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523050
etag
"64e78076-e37"
vary
Accept-Encoding
content-type
image/svg+xml
ddg-cache-status
HIT
content-length
1123
circle.png
1wgafz.top/landing-fortune-wheel/img/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/circle.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
649beb3470e4794e7b986e480ec236507d6339cff202c3ea6925ba151c88b1f5

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:07 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523050
etag
"64e78076-51da"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
20954
pointer.png
1wgafz.top/landing-fortune-wheel/img/ 		140 KB
141 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/pointer.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
3e3bc361fb625b129336e0c374822281455cf03ddeac8a68f87b2d3d15d8b943

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:04 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523050
etag
"64e78076-231b4"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
143796
present.png
1wgafz.top/landing-fortune-wheel/img/ 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/present.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
a6bef65d01d51ecbdf84a077bfbff74f6e2b5e94560b0867aaa593349d5e052d

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 10:17:14 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
374060
etag
"64e78076-12936"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
76086
rectangle2.png
1wgafz.top/landing-fortune-wheel/img/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/rectangle2.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
18648125f49f75d41fb7e0a5a8799ef094d6c3912e6562b54cf571764b884d0c

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 15 Jan 2024 13:26:43 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
189891
etag
"64e78076-60b3"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
24755
rectangle2x.png
1wgafz.top/landing-fortune-wheel/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/rectangle2x.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
d8f21f83a45dc9877acb2aee096a156ecd2b3e98b209a1229634b3cfd03a2c3a

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 15 Jan 2024 06:43:03 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
214111
etag
"64e78076-143d"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
5181
flags.svg
1wgafz.top/landing-fortune-wheel/img/ 		15 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/img/flags.svg
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
fca3eb53c5ed22817c3cc1a116facfe9c80f06aa908823cd9028bdf7f8f11fd7

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:59:40 GMT
content-encoding
br
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
522714
etag
"64e78076-3aa0"
vary
Accept-Encoding
content-type
image/svg+xml
ddg-cache-status
HIT
content-length
3853
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
7060407
x-cache
HIT, HIT
content-length
30879
x-served-by
cache-lga13628-LGA, cache-vie6326-VIE
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1705515094.430047,VS0,VE0
etag
W/"28feccc0-15d84"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
50, 44560
runtime.1d8119ef67f002bbb18e.bundle.js
1wgafz.top/landing-fortune-wheel/ 		1 KB
883 B 		Script
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/runtime.1d8119ef67f002bbb18e.bundle.js
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
3b25aa6f5dbaa6f7f54bd609eeee7bc29b71c496d29effe1f05cc28c0e09eac0

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:05 GMT
content-encoding
br
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523049
etag
"64e78076-5eb"
vary
Accept-Encoding
content-type
application/javascript
ddg-cache-status
HIT
content-length
788
main.b1a2f64360405694ed7b.bundle.js
1wgafz.top/landing-fortune-wheel/ 		289 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/main.b1a2f64360405694ed7b.bundle.js
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
bd38ab3cd19028c911bfa25af668af57e4f6b0f785e77edbac355ee89315b26f

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:54:05 GMT
content-encoding
br
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523049
etag
"64e78076-48521"
vary
Accept-Encoding
content-type
application/javascript
ddg-cache-status
HIT
content-length
86140
background.jpg
1wgafz.top/landing-fortune-wheel/img/ 		210 KB
211 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/background.jpg
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
7ad898a53be8160240496f802ce90bdf62709fdfdabd2f2f4d9b5e80c0a2d1e1

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 16:52:05 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
523169
etag
"64e78076-349bb"
content-type
image/jpeg
ddg-cache-status
HIT
accept-ranges
bytes
content-length
215483
giftbox.png
1wgafz.top/landing-fortune-wheel/img/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/giftbox.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
0525ae40435a1d9d4719e9e7d4e03be4702df1c2e97c5ff1f29908da31c991fa

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 14:32:27 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
704347
etag
"64e78076-aa57"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
43607
rectangle.png
1wgafz.top/landing-fortune-wheel/img/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1wgafz.top/landing-fortune-wheel/img/rectangle.png
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
b5531100cf20a4b3ed57c6ca16a0e47889238ff2b7abca819f8d40fdaadb533f

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 08:41:05 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
639033
etag
"64e78076-1ed2"
content-type
image/png
ddg-cache-status
HIT
accept-ranges
bytes
content-length
7890
SFProDisplay-Heavy.ttf
1wgafz.top/landing-fortune-wheel/fonts/ 		328 KB
328 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/fonts/SFProDisplay-Heavy.ttf
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
1a346f2afd5296905dcf2944ba2d489d8583faf887ef0acc30e71da644b55102

Request headers

Referer
https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Origin
https://1wgafz.top
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 15 Jan 2024 06:52:35 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
213539
etag
"64e78076-51fe0"
content-type
application/octet-stream
ddg-cache-status
HIT
accept-ranges
bytes
content-length
335840
SFProDisplay-Regular.ttf
1wgafz.top/landing-fortune-wheel/fonts/ 		404 KB
405 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/fonts/SFProDisplay-Regular.ttf
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
fe5ff5f484e03e3d9d53f75675d52370708aed4c817eeefe32357bb6b2c6bcd8

Request headers

Referer
https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Origin
https://1wgafz.top
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 15:03:00 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
270514
etag
"64e78076-650e4"
content-type
application/octet-stream
ddg-cache-status
HIT
accept-ranges
bytes
content-length
413924
SFProDisplay-Bold.ttf
1wgafz.top/landing-fortune-wheel/fonts/ 		426 KB
426 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/fonts/SFProDisplay-Bold.ttf
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
b3510b59711babb6cb36bd68ef389e1fa735531dada8496802621c2f64170f46

Request headers

Referer
https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Origin
https://1wgafz.top
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 15:03:05 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
270512
etag
"64e78076-6a6c0"
content-type
application/octet-stream
ddg-cache-status
HIT
accept-ranges
bytes
content-length
435904
SFProDisplay-Medium.ttf
1wgafz.top/landing-fortune-wheel/fonts/ 		423 KB
424 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/landing-fortune-wheel/fonts/SFProDisplay-Medium.ttf
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
5d1423c958ca2ecfe2815bc663132b6e6c4680da56922e072940872f864e12a7

Request headers

Referer
https://1wgafz.top/landing-fortune-wheel/main.31018b03adaae4e1c230.css
Origin
https://1wgafz.top
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 20:22:15 GMT
last-modified
Thu, 24 Aug 2023 16:08:22 GMT
server
ddos-guard
age
251359
etag
"64e78076-69db0"
content-type
application/octet-stream
ddg-cache-status
HIT
accept-ranges
bytes
content-length
433584
gtm.js
www.googletagmanager.com/ 		312 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
b227e096036034c102b0fcc0e587a782c25dcc155b1e2dce9e6dc71cfdabb4b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92418
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 17 Jan 2024 18:11:34 GMT
affiliate:link_visit
1wgafz.top/ 		15 B
1008 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/affiliate:link_visit?visit_domain=1wgafz.top&sub_ids=sub1%3Dd8b18442-b563-11ee-98d8-4b17d243677a%26sub2%3D93374
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.b1a2f64360405694ed7b.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard / Express
Resource Hash
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
Security Headers
Name Value
X-Frame-Options ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?&&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
gzip
server
ddos-guard
etag
W/"f-VaSQ4oDUiZblZNAEkkN+sX+q3Sg"
x-powered-by
Express
access-control-max-age
7200
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
undefined
access-control-expose-headers
Authorization
x-frame-options
ALLOW-FROM ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan, ALLOW-FROM 1win-partner.com ww.1win.run 1win.run www.1win.work 1win.work www.1w.run 1w.run www.1wip.best 1wip.best www.1wint.run 1wint.run www.1winr.run 1winr.run www.1wind.run 1wind.run www.1wins.run 1wins.run www.1w.fan 1w.fan www.1win.team 1win.team www.1win.partners 1win.partners 1wip.best www.1wip.best 1wint.run www.1wint.run 1winr.run www.1winr.run 1wind.run www.1wind.run 1wins.run www.1wins.run 1w.fan www.1w.fan
access-control-allow-credentials
true
vary
Accept-Encoding
access-control-allow-headers
Content-Type, Authorization, X-Origin
v2
1wgafz.top/lang-server/ 		4 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://1wgafz.top/lang-server/v2?keys=landings.fortune-wheel&keys=common.currency&langs=en
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.b1a2f64360405694ed7b.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.24.78 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
3e80b36f337d3f8aa02e2d2ad14d7d5bf52a63ed51293f776cd553921dbaaaed

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/landing-fortune-wheel?&&
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
gzip
server
ddos-guard
etag
W/"1111-y4EY9eP7/z1E/hb2s6f69+KmlP0"
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
js
www.googletagmanager.com/gtag/ 		232 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
36ed3901629972772e50b03779b37be773775a926b1262e111d979f8440d418e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
82919
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 17 Jan 2024 18:11:34 GMT
activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;u...
12688802.fls.doubleclick.net/ Frame E3AC
Redirect Chain
  • https://12688802.fls.doubleclick.net/activityi;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa...
  • https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=1...
613 B
527 B 		Document
General
Check archive.org
Download Go to
Full URL
https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f6.1e100.net
Software
cafe /
Resource Hash
697944b9376492b4a2bb527040bc1687fc3032be50f453217dbc340e622fe3cb
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://1wgafz.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
351
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;o...
12572451.fls.doubleclick.net/ Frame 2B07
Redirect Chain
  • https://12572451.fls.doubleclick.net/activityi;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
  • https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...
555 B
484 B 		Document
General
Check archive.org
Download Go to
Full URL
https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGKQDC7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f6.1e100.net
Software
cafe /
Resource Hash
78b6bf8253596dd9ce92b988920735a6a0a6f9ed917d00766e2a6ca5469a0e45
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://1wgafz.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
308
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:34 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
hotjar-2606090.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-2606090.js?sv=6
Requested by
Host: expearsbectorlds.com
URL: https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-49.fra56.r.cloudfront.net
Software
/
Resource Hash
ca39d19c8cfadca946560a3bdf8625a99ef6e6f58aecde721ab7d4552f0b2a56
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Wed, 17 Jan 2024 18:10:58 GMT
via
1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
age
36
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/35f2c137dcbd848baff38d81ee269c78
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
XEwJtSbUZ4iUNbtlFu1KAA6eV0Hvt04JpRfzKQUbJS1vOeExlLdW5Q==
tag.js
mc.yandex.ru/metrika/ 		202 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: expearsbectorlds.com
URL: https://expearsbectorlds.com/voluum/95686ca3-08c1-4a98-b139-f9faf0f6272d
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.250.251.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
f4d52b2f18ee8dd9761051674cb84dd5202b61ba4e8d7056b41a205791c7a61c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000
last-modified
Tue, 16 Jan 2024 15:34:32 GMT
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag
"65a6a208-11627"
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
timing-allow-origin
*
content-length
71207
expires
Wed, 17 Jan 2024 19:11:34 GMT
collect
region1.google-analytics.com/g/ 		0
250 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-548949LWLW&gtm=45je41a0v894728184z8894400803&_p=1705515094517&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1450738342.1705515095&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dp=%2Flanding-fortune-wheel&sid=1705515094&sct=1&seg=0&dl=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&dt=1win&en=page_view&_fv=1&_nsi=1&_ss=1&ep.page_url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&tfd=3854
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-548949LWLW&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Jan 2024 18:11:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://1wgafz.top
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
modules.2472296d2d26f0040059.js
script.hotjar.com/ 		219 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.2472296d2d26f0040059.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2606090.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-54.fra56.r.cloudfront.net
Software
/
Resource Hash
5bdaa2d2fac01a05dee8737ec7b70ad184651961d3a3998c1efa7cf147ae1ba1
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 15 Jan 2024 14:36:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 3fdf3aacaef6ec40c4eedb85c8144da2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
185728
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
55620
last-modified
Mon, 15 Jan 2024 14:36:02 GMT
etag
"5f2cc7c8ec157af965fb3409029f8b70"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
Pq6GTpxsgXI9qz42KZp4pCUcdXxlGTYxj5XD_b3HT1od-J7MpFqirA==
dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=...
adservice.google.com/ddm/fls/i/ Frame 4349 		612 B
725 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Requested by
Host: 12688802.fls.doubleclick.net
URL: https://12688802.fls.doubleclick.net/activityi;dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
82c0074b622afc9edf73ff3abe82bde8dc45b749a40e844f1c19473b40117506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://12688802.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
350
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:35 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
adservice.google.com/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7B... Frame 644E 		554 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955;~oref=https://1wgafz.top/
Requested by
Host: 12572451.fls.doubleclick.net
URL: https://12572451.fls.doubleclick.net/activityi;dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
0ce11f4418c2e8904ceae909dd329ac04923a23a7e1f0e1375c13d5902155e66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://12572451.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
309
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:35 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
2606090
vc.hotjar.io/sessions/ 		0
259 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/2606090?s=0.25&r=0.16976764898814523
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.2472296d2d26f0040059.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.160.212.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-160-212-84.mxp53.r.cloudfront.net
Software
Python/3.8 aiohttp/3.8.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:35 GMT
via
1.1 f51291c5ce592ab699c2b2ead5e58134.cloudfront.net (CloudFront)
server
Python/3.8 aiohttp/3.8.4
x-amz-cf-pop
MXP53-P3
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store
x-amz-cf-id
OQOFTHBStlXvwFzq3uTFQBMfXd6CQnmBMMqU3heQnTWVz7ysEiTuDw==
dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=...
adservice.google.at/ddm/fls/i/ Frame 844F 		194 B
515 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.at/ddm/fls/i/dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CKPOjuuC5YMDFbFCHgId898Ggw;src=12688802;type=actio0;cat=allpa0;ord=1;num=4287825192025;auiddc=677381787.1705515095;gtm=45He41a0v894400803;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:35 GMT
expires
Wed, 17 Jan 2024 18:11:35 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
adservice.google.at/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BG... Frame 837A 		194 B
150 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.at/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955;~oref=https://1wgafz.top/
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CJbsjuuC5YMDFWNlHgIdQW0KNg;src=12572451;type=1m0c10;cat=all_p0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1;num=7880265536063.3955;~oref=https://1wgafz.top/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 17 Jan 2024 18:11:35 GMT
expires
Wed, 17 Jan 2024 18:11:35 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10251.IJ23xN-LRLxGdGPz728J0YYUswNU9uyivTp85bN-oRIvbfzcSjJEOLkHMizKoFnL.YQE24RPJTr0MTI6eCvRbTX1dNr4%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=10251.6lnNqa6wLyQwleYD9ziBDomZhF2wr3XTgS2ELHtacS58S7KRROizkvm4Qth7C-a4ahobRUWrhaN2Dg3fhbIsaAUgZk3OAIYm3dB25H2GjIfwQGTiRud6HhWh7g2rpAFtAGs_jHvKLw...
43 B
674 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=10251.6lnNqa6wLyQwleYD9ziBDomZhF2wr3XTgS2ELHtacS58S7KRROizkvm4Qth7C-a4ahobRUWrhaN2Dg3fhbIsaAUgZk3OAIYm3dB25H2GjIfwQGTiRud6HhWh7g2rpAFtAGs_jHvKLwmPIpaMr_1UCJlEEnBiIT9d08Btv4q6xndZCSQjWa7wW8a6HzCZ2Jq6RhO3Y2xWnpFsVmPCOL9NhUDEJ4DHKOf-D1ZWcPhQt24%2C.oKQnSMO6etBkFm0jBqgf5xq9JRM%2C
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?&&
Protocol
H2
Server
87.250.251.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:35 GMT
strict-transport-security
max-age=31536000
content-length
43
x-xss-protection
1; mode=block
content-type
image/gif

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=10251.6lnNqa6wLyQwleYD9ziBDomZhF2wr3XTgS2ELHtacS58S7KRROizkvm4Qth7C-a4ahobRUWrhaN2Dg3fhbIsaAUgZk3OAIYm3dB25H2GjIfwQGTiRud6HhWh7g2rpAFtAGs_jHvKLwmPIpaMr_1UCJlEEnBiIT9d08Btv4q6xndZCSQjWa7wW8a6HzCZ2Jq6RhO3Y2xWnpFsVmPCOL9NhUDEJ4DHKOf-D1ZWcPhQt24%2C.oKQnSMO6etBkFm0jBqgf5xq9JRM%2C
date
Wed, 17 Jan 2024 18:11:35 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
advert.gif
mc.yandex.com/metrika/ 		43 B
502 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel?&&
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.250.251.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 18:11:35 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 16 Jan 2024 15:34:32 GMT
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag
"65a6a208-2b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
43
expires
Wed, 17 Jan 2024 19:11:35 GMT
1
mc.yandex.com/watch/92006234/
Redirect Chain
  • https://mc.yandex.com/watch/92006234?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3Afu...
  • https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3A...
427 B
546 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1201%3Acn%3A1%3Adp%3A0%3Als%3A1234771803553%3Ahid%3A445667281%3Az%3A60%3Ai%3A20240117191135%3Aet%3A1705515095%3Ac%3A1%3Arn%3A1017395292%3Arqn%3A1%3Au%3A1705515095820624567%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C111%2C98%2C13%2C2899%2C0%2C%2C330%2C0%2C%2C%2C%2C3692%3Aco%3A0%3Acpf%3A1%3Ans%3A1705515090984%3Agi%3AR0ExLjEuMTQ1MDczODM0Mi4xNzA1NTE1MDk1%3Afp%3A3437%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1705515095%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29ti%281%29
Protocol
H2
Server
87.250.251.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
66513c2c9cbc3956d30e52834191f907f908d5110b871d6504e7e683ce8eabee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://1wgafz.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Jan 2024 18:11:35 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Wed, 17-Jan-2024 18:11:35 GMT
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type
application/json; charset=utf-8
access-control-allow-origin
https://1wgafz.top
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
427
x-xss-protection
1; mode=block
expires
Wed, 17-Jan-2024 18:11:35 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Jan 2024 18:11:35 GMT
strict-transport-security
max-age=31536000
last-modified
Wed, 17-Jan-2024 18:11:35 GMT
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location
/watch/92006234/1?wmode=7&page-url=https%3A%2F%2F1wgafz.top%2Flanding-fortune-wheel%3F%26%26&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A6mv6as6uhfnj8xo3ikdxwgrf%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1201%3Acn%3A1%3Adp%3A0%3Als%3A1234771803553%3Ahid%3A445667281%3Az%3A60%3Ai%3A20240117191135%3Aet%3A1705515095%3Ac%3A1%3Arn%3A1017395292%3Arqn%3A1%3Au%3A1705515095820624567%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C111%2C98%2C13%2C2899%2C0%2C%2C330%2C0%2C%2C%2C%2C3692%3Aco%3A0%3Acpf%3A1%3Ans%3A1705515090984%3Agi%3AR0ExLjEuMTQ1MDczODM0Mi4xNzA1NTE1MDk1%3Afp%3A3437%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1705515095%3At%3A1win&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29ti%281%29
access-control-allow-origin
https://1wgafz.top
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Wed, 17-Jan-2024 18:11:35 GMT
httpapi
api2.amplitude.com/2/ 		94 B
309 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api2.amplitude.com/2/httpapi
Requested by
Host: 1wgafz.top
URL: https://1wgafz.top/landing-fortune-wheel/main.b1a2f64360405694ed7b.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.229.210.160 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-229-210-160.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
f28a6f8db0c9b13174ff70ca7ccb6f88c3bc30a36a7861a35f2985ce71e03cef
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Accept
*/*
Referer
https://1wgafz.top/
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 17 Jan 2024 18:11:36 GMT
strict-transport-security
max-age=15768000
access-control-max-age
86400
access-control-allow-methods
GET, POST
content-type
application/json
access-control-allow-origin
*
trace-id
Root=1-65a81858-13325219259916be7b3300f0
content-length
94
httpapi
api2.amplitude.com/2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api2.amplitude.com/2/httpapi
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.229.210.160 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-229-210-160.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://1wgafz.top
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET, POST
access-control-allow-origin
*
access-control-max-age
86400
content-length
0
date
Wed, 17 Jan 2024 18:11:36 GMT
strict-transport-security
max-age=15768000

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| $ function| jQuery object| dataLayer object| webpackJsonp object| amplitude object| gtm object| regeneratorRuntime function| IMask function| onClickRegister function| useLang object| analyticsConnectorInstances object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data string| axel number| a string| userId function| hj object| _hjSettings function| ym object| gaGlobal object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| Ya object| yaCounter92006234

34 Cookies

Domain/Path Name / Value
.expearsbectorlds.com/ Name: 95686ca3-08c1-4a98-b139-f9faf0f6272d-v4
Value: ZYnNTTJI8MUmL6hZqxRxhVt8_mh8TPpsRx7Asz55hpw
.expearsbectorlds.com/ Name: cc-v4
Value: 6b8NYLuXejYOgkgJuSGYBq0rYLUEyqj65sTdKzVGX%2Bsw77kc%2B638sMvBIYH%2FbEH%2FR4BRBU8Rtw2c4%2BYGbjiYoSmMEtnhaNYllsyxIn7qnssGn25dwTeO7Xfgjae43fb99T2N0Xn8ZelQMCE8RpeJ1g%3D%3D
afflat3a1.com/ Name: I
Value: 0
djnl.decisionnowlive.com/ Name: yredir_session
Value: eyJpdiI6ImtzQ3h5emQrOGxGeXN6NGpmNThIVUE9PSIsInZhbHVlIjoiKzRLdXpXQ0FKOFlTTDlOOHVNR1ZWczBqTU9PMkxrUjFwNlpaNm43RWdBYVJUdXNKT0lPellXUSthUWcwUFlSQ1ZadGZ4MTBuaHpnK1hzTWFWUW9lRk9JK3JlVDBSTlMreUpjS3B6eTVRbmJlVE5OeUJSTmdPS1lyMjI5bHRUcGoiLCJtYWMiOiI1YzlmY2E4MTgzZjJiOTNmY2FiNTA0NTZhODhiYWQyMzY3Yzc3MTQ0M2U5ZGRlODE0Yjk5MTkxYWY2NTQ5ZDlkIiwidGFnIjoiIn0%3D
djnl.spinfastconnected.com/ Name: yredir_session
Value: eyJpdiI6IjE5TEMyTkp2RmdQb0M2YzNZOUVNS2c9PSIsInZhbHVlIjoiWEhTSmJNVmZxcS9qME9zVUxaNm9jUlpmVlNuQnVCQURldXZpakZSSCtMRW9paTJLUDhqaFF3aE4wQ2IzdzhwaEoyaUR4cXN0OEZlWE44Y3RrSXBEMnlKaWMrR282aWxRRDd5MURQQ2NIRnY1Sm9XaXR3NU9oU2lXVzd2aG15UUQiLCJtYWMiOiJkNGY2YTAxMTdjMDE0YWIzZGMwYWU0Yzg3ZmU0MzgzNDIxNGMzMzk0Y2Q0ZjA5MGI2YTcwMjgwOGRkNWE1OGRmIiwidGFnIjoiIn0%3D
.1wgafz.top/ Name: __ddg1_
Value: veKTIsrnt1EeZ0WLtSHm
1wgafz.top/ Name: sub_ids
Value: sub1=d8b18442-b563-11ee-98d8-4b17d243677a&sub2=93374
1wgafz.top/ Name: visit_domain
Value: 1wgafz.top
.1wgafz.top/ Name: AMP_MKTG_494cccfe21
Value: JTdCJTdE
1wgafz.top/ Name: core-sticky
Value: http://10.233.108.243:80
.1wgafz.top/ Name: _gcl_au
Value: 1.1.677381787.1705515095
.1wgafz.top/ Name: AMP_494cccfe21
Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJiMmIzZjQ5OS1kMTliLTRkMmQtODVlYy00NjMzYTI4ODNkN2MlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzA1NTE1MDk0NjY3JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTcwNTUxNTA5NDc5OSUyQyUyMmxhc3RFdmVudElkJTIyJTNBMyU3RA==
.1wgafz.top/ Name: _ga_548949LWLW
Value: GS1.1.1705515094.1.0.1705515094.0.0.0
.1wgafz.top/ Name: _ga
Value: GA1.1.1450738342.1705515095
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.1wgafz.top/ Name: _hjSessionUser_2606090
Value: eyJpZCI6IjZkNDVmYjFkLTkwMmUtNTVjYS1hMzhhLThiZWE5NTMyYjU5MiIsImNyZWF0ZWQiOjE3MDU1MTUwOTUwNjEsImV4aXN0aW5nIjpmYWxzZX0=
.1wgafz.top/ Name: _hjIncludedInSessionSample_2606090
Value: 0
.1wgafz.top/ Name: _hjSession_2606090
Value: eyJpZCI6ImJmNzQ3YTY3LWU0YWUtNDFmMS05MmIxLTllMmM0OTNlMjkwOCIsImMiOjE3MDU1MTUwOTUwNjMsInMiOjAsInIiOjAsInNiIjoxLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
1wgafz.top/ Name: _hjHasCachedUserAttributes
Value: true
.yandex.ru/ Name: i
Value: BDEBHqoWvyzYkuw361PLBmZGz8eFWte6cCgX5k/ToOFgi/nNkUUh7v1DwnPk2T0oL2sZuFwOo6OW9VbC+UV9VE1BzyU=
.yandex.ru/ Name: yandexuid
Value: 3252779331705515094
.1wgafz.top/ Name: _ym_uid
Value: 1705515095820624567
.1wgafz.top/ Name: _ym_d
Value: 1705515095
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 4189061229fake
.1wgafz.top/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 1358554754fake
.yandex.com/ Name: yandexuid
Value: 3252779331705515094
.yandex.com/ Name: yuidss
Value: 3252779331705515094
.yandex.com/ Name: i
Value: BDEBHqoWvyzYkuw361PLBmZGz8eFWte6cCgX5k/ToOFgi/nNkUUh7v1DwnPk2T0oL2sZuFwOo6OW9VbC+UV9VE1BzyU=
.yandex.com/ Name: yp
Value: 1705601495.yu.4667328501705515095
.mc.yandex.com/ Name: sync_cookie_ok
Value: synced
mc.yandex.com/ Name: yabs-sid
Value: 883489641705515095
.yandex.com/ Name: ymex
Value: 1708107095.oyu.4667328501705515095#1737051095.yrts.1705515095
.yandex.com/ Name: bh
Value: KgI/MA==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12572451.fls.doubleclick.net
12688802.fls.doubleclick.net
1wgafz.top
adservice.google.at
adservice.google.com
afflat3a1.com
api2.amplitude.com
code.jquery.com
djnl.decisionnowlive.com
djnl.spinfastconnected.com
expearsbectorlds.com
ffatric1.com
mc.yandex.com
mc.yandex.ru
region1.google-analytics.com
script.hotjar.com
shorturl.at
static.hotjar.com
vc.hotjar.io
www.googletagmanager.com
www.shorturl.at
104.26.9.129
13.32.27.54
142.250.184.194
142.250.186.98
151.101.130.137
172.217.16.200
172.217.18.6
18.66.97.49
190.115.24.78
198.55.106.36
216.239.34.36
3.120.230.228
3.160.212.84
44.229.210.160
69.172.200.185
87.250.251.119
0525ae40435a1d9d4719e9e7d4e03be4702df1c2e97c5ff1f29908da31c991fa
05976cc7c686a8e30c1679efad2190f00a240841c2f5003a64156a6890552215
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0ce11f4418c2e8904ceae909dd329ac04923a23a7e1f0e1375c13d5902155e66
18648125f49f75d41fb7e0a5a8799ef094d6c3912e6562b54cf571764b884d0c
1a346f2afd5296905dcf2944ba2d489d8583faf887ef0acc30e71da644b55102
36ed3901629972772e50b03779b37be773775a926b1262e111d979f8440d418e
3b25aa6f5dbaa6f7f54bd609eeee7bc29b71c496d29effe1f05cc28c0e09eac0
3e3bc361fb625b129336e0c374822281455cf03ddeac8a68f87b2d3d15d8b943
3e80b36f337d3f8aa02e2d2ad14d7d5bf52a63ed51293f776cd553921dbaaaed
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5bdaa2d2fac01a05dee8737ec7b70ad184651961d3a3998c1efa7cf147ae1ba1
5d1423c958ca2ecfe2815bc663132b6e6c4680da56922e072940872f864e12a7
649beb3470e4794e7b986e480ec236507d6339cff202c3ea6925ba151c88b1f5
66513c2c9cbc3956d30e52834191f907f908d5110b871d6504e7e683ce8eabee
697944b9376492b4a2bb527040bc1687fc3032be50f453217dbc340e622fe3cb
78b6bf8253596dd9ce92b988920735a6a0a6f9ed917d00766e2a6ca5469a0e45
7ad898a53be8160240496f802ce90bdf62709fdfdabd2f2f4d9b5e80c0a2d1e1
82c0074b622afc9edf73ff3abe82bde8dc45b749a40e844f1c19473b40117506
92ffadf792ea89aedeac3d59913333fbc12b3705fe6d92d8a2d1768ed6db0e85
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
a6bef65d01d51ecbdf84a077bfbff74f6e2b5e94560b0867aaa593349d5e052d
a6f801bf0f497d550f9c10fb1e13356718b91ca165c4b8b3ee7dd2275fd69d7e
b227e096036034c102b0fcc0e587a782c25dcc155b1e2dce9e6dc71cfdabb4b7
b3510b59711babb6cb36bd68ef389e1fa735531dada8496802621c2f64170f46
b5531100cf20a4b3ed57c6ca16a0e47889238ff2b7abca819f8d40fdaadb533f
bd38ab3cd19028c911bfa25af668af57e4f6b0f785e77edbac355ee89315b26f
ca39d19c8cfadca946560a3bdf8625a99ef6e6f58aecde721ab7d4552f0b2a56
d8f21f83a45dc9877acb2aee096a156ecd2b3e98b209a1229634b3cfd03a2c3a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f28a6f8db0c9b13174ff70ca7ccb6f88c3bc30a36a7861a35f2985ce71e03cef
f4d52b2f18ee8dd9761051674cb84dd5202b61ba4e8d7056b41a205791c7a61c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fca3eb53c5ed22817c3cc1a116facfe9c80f06aa908823cd9028bdf7f8f11fd7
fe5ff5f484e03e3d9d53f75675d52370708aed4c817eeefe32357bb6b2c6bcd8