play.google.com
2a00:1450:4001:829::200e Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
https://lzw.ufo.verona.it/Axa_Login.html 4yr old
Effective URL:
https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en&gl=US 10yr old
Submission: On September 29 via manual (September 29th 2022, 1:53:09 pm UTC) from FR — Scanned from FR

Summary HTTP 48 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 6 countries across 14 domains to perform 48 HTTP transactions. The main IP is 2a00:1450:4001:829::200e, located in and belongs to . The main domain is play.google.com. 10yr old
TLS certificate: Issued by GTS CA 1C3 on September 12th 2022. Valid for: 3mo.

This is the only time play.google.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3030::6815:7cd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
1	188.114.96.12 188.114.96.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 7	46.148.125.182 46.148.125.182	35277 (LLHOST-IN...) (LLHOST-INC-SRL)
12	116.202.184.109 116.202.184.109	24940 (HETZNER-AS) (HETZNER-AS)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
4	2a00:1450:400... 2a00:1450:400d:807::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700:303... 2606:4700:3034::ac43:8a40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	54.37.2.177 54.37.2.177	16276 (OVH) (OVH)
1 2	5.188.51.87 5.188.51.87	() ()
1	2a00:1450:400... 2a00:1450:4001:829::200e	() ()
48	12

2 2606:4700:3030::6815:7cd (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

lzw.ufo.verona.it 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 88.212.201.204 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru

counter.yadro.ru 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 188.114.96.12 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

antibotcloud.com 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 46.148.125.182 (Haarlem, Netherlands) 1 redirects

ASN35277 (LLHOST-INC-SRL, RO)
PTR: har57.srv.llhost-inc.com

nxtpsh.top 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
js.nextpsh.top 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

12 116.202.184.109 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.109.184.202.116.clients.your-server.de

week-tale.xyz 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 2a00:1450:400d:807::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 2606:4700:3034::ac43:8a40 (United States)

ASN13335 (CLOUDFLARENET, US)

money.amimed.nl 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 54.37.2.177 (France) 1 redirects

ASN16276 (OVH, FR)

2913.tooltheysen.live 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 5.188.51.87 (None, ) 1 redirects

ASN- ()

repappcloud.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2a00:1450:4001:829::200e (None, )

ASN- ()

play.google.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
12	week-tale.xyz week-tale.xyz — Cisco Umbrella Rank: 321427 4yr old	28 KB
6	nextpsh.top js.nextpsh.top — Cisco Umbrella Rank: 164561 4yr old	32 KB
4	gstatic.com www.gstatic.com 10yr old	35 KB
2	repappcloud.com 1 redirects repappcloud.com 4yr old	727 B
2	tooltheysen.live 1 redirects 2913.tooltheysen.live 4yr old	1 KB
2	amimed.nl money.amimed.nl 4yr old	41 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 663 13yr old	58 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9240 13yr old	1 KB
2	ufo.verona.it 1 redirects lzw.ufo.verona.it 4yr old	4 KB
1	google.com play.google.com 10yr old
1	nxtpsh.top 1 redirects nxtpsh.top — Cisco Umbrella Rank: 203198 4yr old	332 B
1	antibotcloud.com antibotcloud.com — Cisco Umbrella Rank: 378826 5yr old	635 B
0	googleusercontent.com Failed play-lh.googleusercontent.com Failed 7yr old
0	ytimg.com Failed i.ytimg.com Failed 10yr old
48	14

	Domain	Requested by
12	week-tale.xyz	lzw.ufo.verona.it week-tale.xyz js.nextpsh.top
6	js.nextpsh.top	week-tale.xyz js.nextpsh.top
4	www.gstatic.com	js.nextpsh.top play.google.com
2	repappcloud.com	1 redirects 2913.tooltheysen.live
2	2913.tooltheysen.live	1 redirects money.amimed.nl
2	money.amimed.nl	js.nextpsh.top money.amimed.nl
2	code.jquery.com	week-tale.xyz
2	counter.yadro.ru	1 redirects
2	lzw.ufo.verona.it	1 redirects
1	play.google.com	repappcloud.com
1	nxtpsh.top	1 redirects
1	antibotcloud.com	lzw.ufo.verona.it
0	play-lh.googleusercontent.com Failed	play.google.com
0	i.ytimg.com Failed	play.google.com
48	14

This site contains no links.

Subject Issuer	Validity	Valid
*.ufo.verona.it E1	`2022-09-11` - `2022-12-10`	3mo	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-11-21` - `2022-11-20`	1yr	crt.sh
week-tale.xyz R3	`2022-09-12` - `2022-12-11`	3mo	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	1yr	crt.sh
js.nextpsh.top R3	`2022-08-10` - `2022-11-08`	3mo	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3mo	crt.sh
*.amimed.nl E1	`2022-09-20` - `2022-12-19`	3mo	crt.sh
*.tooltheysen.live R3	`2022-09-25` - `2022-12-24`	3mo	crt.sh
repappcloud.com R3	`2022-09-22` - `2022-12-21`	3mo	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3mo	crt.sh

This page contains 2 frames:

Primary Page: https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en&gl=US
Frame ID: 0C667EDDEF277AEC2BE0E31BAA81CBF6
Requests: 48 HTTP requests in this frame

Frame: https://money.amimed.nl/media/mainstream/frame.html
Frame ID: F3E0797F6995F65D2E70FE91B28E2AF4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://lzw.ufo.verona.it/Axa_Login.html Page URL
https://lzw.ufo.verona.it/Axa_Login.html HTTP 301
https://nxtpsh.top/?pl=C3C59c0la0ehjB2xXB1JeQ HTTP 302
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6r... Page URL
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6r... Page URL
https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz Page URL
https://2913.tooltheysen.live/ptjmthbd/?u=dubkd0x&o=vk2gyuz&f=1&sid=t1~ztjukgkebnsdjhlca3wg1csn&fp=M1EkKNh... Page URL
https://2913.tooltheysen.live/web/?sid=t1~ztjukgkebnsdjhlca3wg1csn HTTP 302
https://repappcloud.com/?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBlt... HTTP 302
https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJm... Page URL
https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en&gl=US Page URL

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

PHP (Programming languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

48
Requests

65 %
HTTPS

45 %
IPv6

14
Domains

14
Subdomains

12
IPs

6
Countries

201 kB
Transfer

1280 kB
Size

15
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lzw.ufo.verona.it/Axa_Login.html Page URL
https://lzw.ufo.verona.it/Axa_Login.html HTTP 301
https://nxtpsh.top/?pl=C3C59c0la0ehjB2xXB1JeQ HTTP 302
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890 Page URL
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890 Page URL
https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz Page URL
https://2913.tooltheysen.live/ptjmthbd/?u=dubkd0x&o=vk2gyuz&f=1&sid=t1~ztjukgkebnsdjhlca3wg1csn&fp=M1EkKNh5rwPfH0rTEiGHaSBaujVYpjZl3BEWwSeni8JHeo1%2FBMu5sDRsTA9N%2F6Rwf%2FAMXln7Yi8BHyzrj%2FVw37LLBfsi115Bwg7tvXS94RFVCN3fPhqLeS4uBl3D9L8ZW3PyghaXne5RE7nPKspZ3uybNaJ3vyLKMzyY47CbCA%2BJMoylRh%2BwQOB9NSjLsAC4YHvsuyBzLRvgzggKTtNuZUlLqKwNVOBWNX3B8%2BJaR3LNKfKcn68SVP%2BCzB7XI1mGB7rVCBR10Byu2e%2BkdZVllXjWCHt%2BQb57hK2TjpTZtZUIv9BSk4zZiWfHmtmnPgw1NiHSgfsS4iD1uAz4mIixnwkI%2BkbKlIKdZx%2Flx5roTlHKr0M5rnw0aYggtINn2OU3zwtfFP13Cxe0%2ByltNA4fkzPCRF7gQvuoE%2BW3Qy2YDocIhLU94gvKCV83glcOddcR0L4nD%2BdTKuqFwPsqOxMUCS3hJElKvpSW8Io%2BUPycOkeis8%2Bl8eJ%2FQMRoG6qdKWHyayts3TkCn2Tgf4ClW85APjQX6D%2Beyxib7GxUD5Zi888dnvEgxgFuON97x7Z6%2FdqJ23sasd7SAtBXjgURjKCQLqDGfhuQAwB5O5x7vpyx8OKG512U6QTxtsf%2Bq4af4i3u6I3Ujau%2BlyJSF7s5GniH97DhCduMpVpuh0XoE8ikainiy6UQvkq45ZhQFdRKRgGVz%2B6KY51jqhyaM0rLfqo%2ByTtmwnUmEwGnr6KvHlhzd1hszCjTjPDdT3pArh1pcvOsOyFpaTEqVMAG1aOZksvKPJbCHasqsARoykC%2FWraDRPuD%2Bq%2BKU8fEcCiO0U6XWfGtp%2Fi35gB6eWgqKKV38kf73hdq3aPOvXRCFEB0Eck8Wewm73oZRu2yp%2Bay%2Fr0kRVPy0dk%2BNyyMvvpbhGq2FWBtjQeFCn7pr7JcuWuQzAzI%2BhZNOGdEb%2BPmOsYafNzQ%2Fbvc%2Fk3fkjZAkAyZPSboW27ryoibJH9CFyjcZlrA2RdMYAAjRHknceRcTLR83xvBWoBuZZLj%2BM3PqGSdMt4mP36anYcaTHh5%2BkiJoUuPJEhsK78Zk2Z%2BLf4JB8k63qdvxEOvlfExzZTpD%2B0%2FI5NkHcosjaF3DdZPwxq5amLmgD%2FA8LH3ThSAsi%2BI%2FE5sRLRkEQ3JzzhoRK7NCkhkQQBatZwyOUZGO%2FUs4ddEl6ns0U6vBu6h2UgfzhR2V3gKWEBXg%2FfxqtastKjJxOkL3s%2BMqdi0lrARpvY0ZNfyWQSLnf2QZ%2BFoLTn6xHQyTcfrjutnJicVF3iLpO0yGde9lFcBYJr5IYdTUds6GRiN%2BV%2FYSa7ni75qS2pCBfSmDG4mO3JrzS5P467%2BWF9wltklgCgazJFKIwFZ1LxQ%2B3c6gcDdjTdkDuEce1bMPgRzWkt9Jt1GqbHn%2Bqhw16zG%2F%2Fhl6XhSH8f1U0QQMGSbo%2FtBKuUuz3E9lPCfQLH74ZcbhgtZWN5Beqx%2FnxBqvXVBz7fJbw2ji4Vk2V%2FCp2ForD3MzhO%2Fqn07siA1AAEt0JwJSKjWqB566NMkNt5NDiMNa5HaXTPUeVpj7NBh7yjDJmY7KvDxAICjXaiZD4Q7aMr4mH8EcwB3XCV6k30G%2FbwNzCo2P0SNVYBkR2wzZp3%2FJsqEUdvb5FuNsOkdYEP2b4uZWNDS%2FGJg%2BENgrczP0fkO5b4wgtI%2B9cI%2FD03bhkhJlZbbGUmGPSq8WeiHdUhdbYX5EK6gEv%2FCdvv10CsslK4UmMWDRLrCTOHQSnfO534laG2%2FOBWZ9PBBSsSu%2B9qsGYDoeDodlBjnL1Ts0UmkXX%2BlSyoQQ1%2FeydQTnhwHC3Rr%2FQIXyZ58db%2BVlGY47PDzyiKXjAllcBT4ajZ2YqTO04AWeYdMAVH%2BpBSHhfyWsB9lcSwdEK%2Fj8mr0i19OKB%2BdtVwzN9Ud70V78jc1MUDsOX4XtostZOlAwPhpJvvlft1EUQHmbnlDds7Sahh1mvtKSA4EFRkTdBZnC6JQQBatDYEKg1rstf4TjkzxsA%3D%3D Page URL
https://2913.tooltheysen.live/web/?sid=t1~ztjukgkebnsdjhlca3wg1csn HTTP 302
https://repappcloud.com/?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D HTTP 302
https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D Page URL
https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en&gl=US Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://counter.yadro.ru/hit;Vlod?t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383 HTTP 302
https://counter.yadro.ru/hit;Vlod?q;t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383

Request Chain 4

https://lzw.ufo.verona.it/Axa_Login.html HTTP 301
https://nxtpsh.top/?pl=C3C59c0la0ehjB2xXB1JeQ HTTP 302
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Request Chain 31

https://2913.tooltheysen.live/web/?sid=t1~ztjukgkebnsdjhlca3wg1csn HTTP 302
https://repappcloud.com/?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D HTTP 302
https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D

48 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Axa_Login.html Show response
lzw.ufo.verona.it/ 6 KB
4 KB 359ms
271ms Document
text/html 2606:4700:3030::6815:7cd
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://lzw.ufo.verona.it/Axa_Login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:7cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f25ebdaab02043c878d5486876e26e4e8b79bbe7409a7e1203271debdfe3524

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 75253412efc299f1-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 29 Sep 2022 13:53:09 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <https://antibotcloud.com/antibot7.php>; rel=dns-prefetch
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qyPgHwECyL%2FJg4PD3%2BGc7TZTl917nxbrc55J8nKNBFCaNmrHRRXdQnFQZjx9FF9IvgdydPOYxsiiVN8x4c0GdCrNIUebjbFbZdF%2F0Npd%2FDnEPUDMDXoTpGVR6EN1dqU3%2FREt0landFqdJ5%2FABhwhSg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-robots-tag: noindex

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://lzw.ufo.verona.it/Axa_Login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1

200
OK

hit;Vlod
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;Vlod?t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383
https://counter.yadro.ru/hit;Vlod?q;t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383

132 B
618 B

68ms
68ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Download Go to Show image

Full URL

https://counter.yadro.ru/hit;Vlod?q;t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://lzw.ufo.verona.it/Axa_Login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 132
Expires: Tue, 28 Sep 2021 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit;Vlod?q;t44.18;r;s1600*1200*24;uhttps%3A//lzw.ufo.verona.it/Axa_Login.html;hAttendez.;0.8157423224957383
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Tue, 28 Sep 2021 21:00:00 GMT

POST
H2 200 antibot7.php
antibotcloud.com/ 72 B
635 B 216ms
140ms XHR
text/html 188.114.96.12
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://antibotcloud.com/antibot7.php
Requested by: Host: lzw.ufo.verona.it
URL: https://lzw.ufo.verona.it/Axa_Login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.12 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://lzw.ufo.verona.it/Axa_Login.html
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-type: application/x-www-form-urlencoded;

Response headers

date: Thu, 29 Sep 2022 13:53:10 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VVOzuG%2F9wgw5%2F2h0CzyhX5t%2BQWylVk6vEUsHZ%2BbB3cpImJekFOVWgrrZi8PhM4ljNaaW9mb8OI0hp9LSP%2BoOJwaONsg9CU7BWEjcQy3g6nfTHioRYTZf%2F82jl2ho8PtDFdL1"}],"group":"cf-nel","max_age":604800}
cache-control: no-store, no-cache, must-revalidate
cf-ray: 752534155e24d682-CDG
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

/ Show response
week-tale.xyz/space-robot/
Redirect Chain

https://lzw.ufo.verona.it/Axa_Login.html
https://nxtpsh.top/?pl=C3C59c0la0ehjB2xXB1JeQ
https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

13 KB
4 KB

138ms
38ms

Document
text/html

116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Requested by

Host: lzw.ufo.verona.it
URL: https://lzw.ufo.verona.it/Axa_Login.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

635dbe23fe4cc16e0ffb3a9c420f66b8e6a34d22b6a27bd054cf065757d26003

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://lzw.ufo.verona.it/Axa_Login.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 29 Sep 2022 13:53:10 GMT
ETag: W/"62de636b-3486"
Last-Modified: Mon, 25 Jul 2022 09:33:31 GMT
Server: nginx
Strict-Transport-Security: max-age=63072000
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 29 Sep 2022 13:53:10 GMT
location: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
server: nginx

GET
H/1.1 200
OK trls.js Show response
week-tale.xyz/space-robot/assets/ 8 KB
4 KB 27ms
26ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/trls.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

e2bb1401d6b8d6038ff8411fd0f6280890ecd1f32e3e90f4c7fededf28301339

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-1ea7"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK fnr.js Show response
week-tale.xyz/shared-js/assets/ 6 KB
3 KB 82ms
27ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/shared-js/assets/fnr.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

71e79f46be6883cb94673cb02041031b186ef525e8d4a15ae86dc4f11cdfb206

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-165c"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK style.css
week-tale.xyz/space-robot/assets/ 9 KB
2 KB 54ms
26ms Stylesheet
text/css 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/style.css

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

ffbc9a90757bba679af7f0ff813ce5168d68f98f9e752b194f8d05b02d5445f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-251e"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK corner.png
week-tale.xyz/space-robot/assets/ 300 B
576 B 39ms
26ms Image
image/png 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to Show image

Full URL

https://week-tale.xyz/space-robot/assets/corner.png

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

3059be4046e0315ad1c0d1cb163d9daaf759bdf16e906e908842fac07e5608a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=63072000
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: "62d11a1d-12c"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 300

GET
H2 200 jquery-2.1.4.min.js Show response
code.jquery.com/ 82 KB
29 KB 111ms
21ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Download Go to

Full URL: https://code.jquery.com/jquery-2.1.4.min.js
Requested by: Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:10 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-14979"
vary: Accept-Encoding
x-hw: 1664459590.dop216.pa1.t,1664459590.cds205.pa1.hn,1664459590.cds042.pa1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29519

GET
H/1.1 200
OK main.js Show response
week-tale.xyz/space-robot/assets/ 2 KB
855 B 35ms
35ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/main.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

f392f08652d464570cdc9c514ba60a5fa93b8837d6e12fe1b225e700cde8fa72

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:10 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-702"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H2 200 pl.js Show response
js.nextpsh.top/ps/ 2 KB
3 KB 162ms
49ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/pl.js
Requested by: Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 4050470e08475ebe795ce01d60825e6bd656417b83f2ec4d4aa3ffa0d6e88d91

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:10 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 2500
content-type: application/javascript

GET
H2 200 ps.js Show response
js.nextpsh.top/ps/ 13 KB
13 KB 49ms
48ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=
Requested by: Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/pl.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 30d197e0754e070e4bf6e47b830481fc0c8b01a3fa2ab52c15f20b324426e67f

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:10 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 12978
content-type: application/javascript

GET
H2 200 config.js Show response
js.nextpsh.top/ps/ 356 B
482 B 47ms
47ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/config.js?id=C3C59c0la0ehjB2xXB1JeQ
Requested by: Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 4bf1777c3c1d9d24854d539b4f86ddec7b0c54798dcafd440161903efbc8e04a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:10 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 356
content-type: application/javascript

GET
H2 200 firebase-app.js Show response
www.gstatic.com/firebasejs/8.4.1/ 21 KB
7 KB 145ms
42ms Script
text/javascript 2a00:1450:400d:807::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.4.1/firebase-app.js

Requested by

Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4d5669220045e130b79770e93dc7dca5fdfa00c9d7047639dbb15c4f28eb2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 17:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6763
x-xss-protection: 0
last-modified: Tue, 13 Apr 2021 06:56:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 26 Sep 2023 17:02:58 GMT

GET
H3 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/8.4.1/ 40 KB
11 KB 124ms
42ms Script
text/javascript 2a00:1450:400d:807::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.4.1/firebase-messaging.js

Requested by

Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8d6389e6811b9fea7ff683cb31a57a6e0b29781407d7f5d45994aae1b5725b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 08:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106913
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10908
x-xss-protection: 0
last-modified: Tue, 13 Apr 2021 06:56:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="firebase-js"
expires: Thu, 28 Sep 2023 08:11:18 GMT

GET
H/1.1 200
OK / Show response
week-tale.xyz/space-robot/ 13 KB
4 KB 27ms
27ms Document
text/html 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Requested by

Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

635dbe23fe4cc16e0ffb3a9c420f66b8e6a34d22b6a27bd054cf065757d26003

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 29 Sep 2022 13:53:11 GMT
ETag: W/"62de636b-3486"
Last-Modified: Mon, 25 Jul 2022 09:33:31 GMT
Server: nginx
Strict-Transport-Security: max-age=63072000
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK trls.js Show response
week-tale.xyz/space-robot/assets/ 8 KB
4 KB 30ms
29ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/trls.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

e2bb1401d6b8d6038ff8411fd0f6280890ecd1f32e3e90f4c7fededf28301339

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:11 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-1ea7"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK fnr.js Show response
week-tale.xyz/shared-js/assets/ 6 KB
3 KB 41ms
40ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/shared-js/assets/fnr.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

71e79f46be6883cb94673cb02041031b186ef525e8d4a15ae86dc4f11cdfb206

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:11 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-165c"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK style.css
week-tale.xyz/space-robot/assets/ 9 KB
2 KB 30ms
30ms Stylesheet
text/css 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/style.css

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

ffbc9a90757bba679af7f0ff813ce5168d68f98f9e752b194f8d05b02d5445f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:11 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-251e"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK corner.png
week-tale.xyz/space-robot/assets/ 300 B
576 B 32ms
32ms Image
image/png 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to Show image

Full URL

https://week-tale.xyz/space-robot/assets/corner.png

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

3059be4046e0315ad1c0d1cb163d9daaf759bdf16e906e908842fac07e5608a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:11 GMT
Strict-Transport-Security: max-age=63072000
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: "62d11a1d-12c"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 300

GET
H2 200 jquery-2.1.4.min.js Show response
code.jquery.com/ 82 KB
29 KB 26ms
23ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Download Go to

Full URL: https://code.jquery.com/jquery-2.1.4.min.js
Requested by: Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:11 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-14979"
vary: Accept-Encoding
x-hw: 1664459591.dop216.pa1.t,1664459591.cds205.pa1.hn,1664459591.cds042.pa1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29519

GET
H/1.1 200
OK main.js Show response
week-tale.xyz/space-robot/assets/ 2 KB
855 B 26ms
26ms Script
application/javascript 116.202.184.109
HETZNER-AS

General

Check archive.org

Download Go to

Full URL

https://week-tale.xyz/space-robot/assets/main.js

Requested by

Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.109.184.202.116.clients.your-server.de

Software

nginx /

Resource Hash

f392f08652d464570cdc9c514ba60a5fa93b8837d6e12fe1b225e700cde8fa72

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Thu, 29 Sep 2022 13:53:11 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Last-Modified: Fri, 15 Jul 2022 07:41:17 GMT
Server: nginx
ETag: W/"62d11a1d-702"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H2 200 pl.js Show response
js.nextpsh.top/ps/ 2 KB
3 KB 63ms
62ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/pl.js
Requested by: Host: week-tale.xyz
URL: https://week-tale.xyz/space-robot/?pl=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&hash=bUyCcYNTw5YPVoZ6rCfHjA&exp=1664459890
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 4050470e08475ebe795ce01d60825e6bd656417b83f2ec4d4aa3ffa0d6e88d91

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:11 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 2500
content-type: application/javascript

GET
H2 200 ps.js Show response
js.nextpsh.top/ps/ 13 KB
13 KB 55ms
54ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=
Requested by: Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/pl.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 30d197e0754e070e4bf6e47b830481fc0c8b01a3fa2ab52c15f20b324426e67f

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:11 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 12978
content-type: application/javascript

GET
H2 200 config.js Show response
js.nextpsh.top/ps/ 356 B
482 B 48ms
48ms Script
application/javascript 46.148.125.182
LLHOST-INC-SRL

General

Check archive.org

Download Go to

Full URL: https://js.nextpsh.top/ps/config.js?id=C3C59c0la0ehjB2xXB1JeQ
Requested by: Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 46.148.125.182 Haarlem, Netherlands, ASN35277 (LLHOST-INC-SRL, RO),
Reverse DNS: har57.srv.llhost-inc.com
Software: nginx /
Resource Hash: 4bf1777c3c1d9d24854d539b4f86ddec7b0c54798dcafd440161903efbc8e04a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 13:53:11 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
server: nginx
content-length: 356
content-type: application/javascript

GET
H3 200 firebase-app.js Show response
www.gstatic.com/firebasejs/8.4.1/ 21 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:400d:807::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.4.1/firebase-app.js

Requested by

Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4d5669220045e130b79770e93dc7dca5fdfa00c9d7047639dbb15c4f28eb2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 17:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6763
x-xss-protection: 0
last-modified: Tue, 13 Apr 2021 06:56:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 26 Sep 2023 17:02:58 GMT

GET
H3 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/8.4.1/ 40 KB
11 KB 40ms
40ms Script
text/javascript 2a00:1450:400d:807::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.4.1/firebase-messaging.js

Requested by

Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8d6389e6811b9fea7ff683cb31a57a6e0b29781407d7f5d45994aae1b5725b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://week-tale.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 08:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106913
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10908
x-xss-protection: 0
last-modified: Tue, 13 Apr 2021 06:56:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="firebase-js"
expires: Thu, 28 Sep 2023 08:11:18 GMT

GET
H2 200 / Show response
money.amimed.nl/ 88 KB
40 KB 255ms
143ms Document
text/html 2606:4700:3034::ac43:8a40
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz
Requested by: Host: js.nextpsh.top
URL: https://js.nextpsh.top/ps/ps.js?pl=true&id=C3C59c0la0ehjB2xXB1JeQ&sm=space-robot&click_id=&sub_id=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:8a40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21f79c33621716622f467556e148bde1a032a839fbb43ba107b4146f35fad028

Request headers

Referer: https://week-tale.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private no-transform
cf-cache-status: DYNAMIC
cf-ray: 752534217c6478b2-VIE
content-encoding: gzip
content-length: 40411
content-type: text/html
date: Thu, 29 Sep 2022 13:53:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zu6DEMGWifYdxMpI3LbdDFMIEGO7eGQl8wUZR3Ln1poHcnQTdRuRAr%2FmRaYOACna5XiKrRoaieGRwkrFyZYUF07s%2BB6W%2BiCenvwqD8DBXDR%2BCiuaLJ3WX4ez8xXKnuJku7YH7XCyvbF6iKLL7Oo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 frame.html
money.amimed.nl/media/mainstream/ Frame F3E0 39 B
561 B 167ms
70ms Document
text/html 2606:4700:3034::ac43:8a40
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://money.amimed.nl/media/mainstream/frame.html
Requested by: Host: money.amimed.nl
URL: https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:8a40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-transform
cf-cache-status: DYNAMIC
cf-ray: 752534232f05003c-WAW
content-length: 39
content-type: text/html
date: Thu, 29 Sep 2022 13:53:12 GMT
etag: "60a50ff7-27"
last-modified: Wed, 19 May 2021 13:17:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gALeKGjwgrbAYKWshGStHMBC9MGHBgV3CruY6PlNOmBYymYEe63KSIlPbbWcSASrTzOVST4Zld7o%2BGpBQgt0U2I46xkKcnVpFl2BGtW0rJOLVPT%2B7nCkQ1iycDv6pQ9LGkvG8jWLdMKYmzoLyOE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK /
2913.tooltheysen.live/ptjmthbd/ 1 KB
1 KB 1169ms
101ms Document
text/html 54.37.2.177
OVH

General

Check archive.org

Download Go to

Full URL: https://2913.tooltheysen.live/ptjmthbd/?u=dubkd0x&o=vk2gyuz&f=1&sid=t1~ztjukgkebnsdjhlca3wg1csn&fp=M1EkKNh5rwPfH0rTEiGHaSBaujVYpjZl3BEWwSeni8JHeo1%2FBMu5sDRsTA9N%2F6Rwf%2FAMXln7Yi8BHyzrj%2FVw37LLBfsi115Bwg7tvXS94RFVCN3fPhqLeS4uBl3D9L8ZW3PyghaXne5RE7nPKspZ3uybNaJ3vyLKMzyY47CbCA%2BJMoylRh%2BwQOB9NSjLsAC4YHvsuyBzLRvgzggKTtNuZUlLqKwNVOBWNX3B8%2BJaR3LNKfKcn68SVP%2BCzB7XI1mGB7rVCBR10Byu2e%2BkdZVllXjWCHt%2BQb57hK2TjpTZtZUIv9BSk4zZiWfHmtmnPgw1NiHSgfsS4iD1uAz4mIixnwkI%2BkbKlIKdZx%2Flx5roTlHKr0M5rnw0aYggtINn2OU3zwtfFP13Cxe0%2ByltNA4fkzPCRF7gQvuoE%2BW3Qy2YDocIhLU94gvKCV83glcOddcR0L4nD%2BdTKuqFwPsqOxMUCS3hJElKvpSW8Io%2BUPycOkeis8%2Bl8eJ%2FQMRoG6qdKWHyayts3TkCn2Tgf4ClW85APjQX6D%2Beyxib7GxUD5Zi888dnvEgxgFuON97x7Z6%2FdqJ23sasd7SAtBXjgURjKCQLqDGfhuQAwB5O5x7vpyx8OKG512U6QTxtsf%2Bq4af4i3u6I3Ujau%2BlyJSF7s5GniH97DhCduMpVpuh0XoE8ikainiy6UQvkq45ZhQFdRKRgGVz%2B6KY51jqhyaM0rLfqo%2ByTtmwnUmEwGnr6KvHlhzd1hszCjTjPDdT3pArh1pcvOsOyFpaTEqVMAG1aOZksvKPJbCHasqsARoykC%2FWraDRPuD%2Bq%2BKU8fEcCiO0U6XWfGtp%2Fi35gB6eWgqKKV38kf73hdq3aPOvXRCFEB0Eck8Wewm73oZRu2yp%2Bay%2Fr0kRVPy0dk%2BNyyMvvpbhGq2FWBtjQeFCn7pr7JcuWuQzAzI%2BhZNOGdEb%2BPmOsYafNzQ%2Fbvc%2Fk3fkjZAkAyZPSboW27ryoibJH9CFyjcZlrA2RdMYAAjRHknceRcTLR83xvBWoBuZZLj%2BM3PqGSdMt4mP36anYcaTHh5%2BkiJoUuPJEhsK78Zk2Z%2BLf4JB8k63qdvxEOvlfExzZTpD%2B0%2FI5NkHcosjaF3DdZPwxq5amLmgD%2FA8LH3ThSAsi%2BI%2FE5sRLRkEQ3JzzhoRK7NCkhkQQBatZwyOUZGO%2FUs4ddEl6ns0U6vBu6h2UgfzhR2V3gKWEBXg%2FfxqtastKjJxOkL3s%2BMqdi0lrARpvY0ZNfyWQSLnf2QZ%2BFoLTn6xHQyTcfrjutnJicVF3iLpO0yGde9lFcBYJr5IYdTUds6GRiN%2BV%2FYSa7ni75qS2pCBfSmDG4mO3JrzS5P467%2BWF9wltklgCgazJFKIwFZ1LxQ%2B3c6gcDdjTdkDuEce1bMPgRzWkt9Jt1GqbHn%2Bqhw16zG%2F%2Fhl6XhSH8f1U0QQMGSbo%2FtBKuUuz3E9lPCfQLH74ZcbhgtZWN5Beqx%2FnxBqvXVBz7fJbw2ji4Vk2V%2FCp2ForD3MzhO%2Fqn07siA1AAEt0JwJSKjWqB566NMkNt5NDiMNa5HaXTPUeVpj7NBh7yjDJmY7KvDxAICjXaiZD4Q7aMr4mH8EcwB3XCV6k30G%2FbwNzCo2P0SNVYBkR2wzZp3%2FJsqEUdvb5FuNsOkdYEP2b4uZWNDS%2FGJg%2BENgrczP0fkO5b4wgtI%2B9cI%2FD03bhkhJlZbbGUmGPSq8WeiHdUhdbYX5EK6gEv%2FCdvv10CsslK4UmMWDRLrCTOHQSnfO534laG2%2FOBWZ9PBBSsSu%2B9qsGYDoeDodlBjnL1Ts0UmkXX%2BlSyoQQ1%2FeydQTnhwHC3Rr%2FQIXyZ58db%2BVlGY47PDzyiKXjAllcBT4ajZ2YqTO04AWeYdMAVH%2BpBSHhfyWsB9lcSwdEK%2Fj8mr0i19OKB%2BdtVwzN9Ud70V78jc1MUDsOX4XtostZOlAwPhpJvvlft1EUQHmbnlDds7Sahh1mvtKSA4EFRkTdBZnC6JQQBatDYEKg1rstf4TjkzxsA%3D%3D
Requested by: Host: money.amimed.nl
URL: https://money.amimed.nl/?u=dubkd0x&o=vk2gyuz
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.37.2.177 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://money.amimed.nl/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Length: 928
Content-Type: text/html
Date: Thu, 29 Sep 2022 13:53:13 GMT
Server: nginx
cache-control: private
content-encoding: gzip
vary: Accept-Encoding

GET
H/1.1

200
OK

away.php
repappcloud.com/
Redirect Chain

https://2913.tooltheysen.live/web/?sid=t1~ztjukgkebnsdjhlca3wg1csn
https://repappcloud.com/?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D
https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D

283 B
407 B

47ms
47ms

Document
text/html

5.188.51.87

General

Check archive.org

Download Go to

Full URL: https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D
Requested by: Host: 2913.tooltheysen.live
URL: https://2913.tooltheysen.live/ptjmthbd/?u=dubkd0x&o=vk2gyuz&f=1&sid=t1~ztjukgkebnsdjhlca3wg1csn&fp=M1EkKNh5rwPfH0rTEiGHaSBaujVYpjZl3BEWwSeni8JHeo1%2FBMu5sDRsTA9N%2F6Rwf%2FAMXln7Yi8BHyzrj%2FVw37LLBfsi115Bwg7tvXS94RFVCN3fPhqLeS4uBl3D9L8ZW3PyghaXne5RE7nPKspZ3uybNaJ3vyLKMzyY47CbCA%2BJMoylRh%2BwQOB9NSjLsAC4YHvsuyBzLRvgzggKTtNuZUlLqKwNVOBWNX3B8%2BJaR3LNKfKcn68SVP%2BCzB7XI1mGB7rVCBR10Byu2e%2BkdZVllXjWCHt%2BQb57hK2TjpTZtZUIv9BSk4zZiWfHmtmnPgw1NiHSgfsS4iD1uAz4mIixnwkI%2BkbKlIKdZx%2Flx5roTlHKr0M5rnw0aYggtINn2OU3zwtfFP13Cxe0%2ByltNA4fkzPCRF7gQvuoE%2BW3Qy2YDocIhLU94gvKCV83glcOddcR0L4nD%2BdTKuqFwPsqOxMUCS3hJElKvpSW8Io%2BUPycOkeis8%2Bl8eJ%2FQMRoG6qdKWHyayts3TkCn2Tgf4ClW85APjQX6D%2Beyxib7GxUD5Zi888dnvEgxgFuON97x7Z6%2FdqJ23sasd7SAtBXjgURjKCQLqDGfhuQAwB5O5x7vpyx8OKG512U6QTxtsf%2Bq4af4i3u6I3Ujau%2BlyJSF7s5GniH97DhCduMpVpuh0XoE8ikainiy6UQvkq45ZhQFdRKRgGVz%2B6KY51jqhyaM0rLfqo%2ByTtmwnUmEwGnr6KvHlhzd1hszCjTjPDdT3pArh1pcvOsOyFpaTEqVMAG1aOZksvKPJbCHasqsARoykC%2FWraDRPuD%2Bq%2BKU8fEcCiO0U6XWfGtp%2Fi35gB6eWgqKKV38kf73hdq3aPOvXRCFEB0Eck8Wewm73oZRu2yp%2Bay%2Fr0kRVPy0dk%2BNyyMvvpbhGq2FWBtjQeFCn7pr7JcuWuQzAzI%2BhZNOGdEb%2BPmOsYafNzQ%2Fbvc%2Fk3fkjZAkAyZPSboW27ryoibJH9CFyjcZlrA2RdMYAAjRHknceRcTLR83xvBWoBuZZLj%2BM3PqGSdMt4mP36anYcaTHh5%2BkiJoUuPJEhsK78Zk2Z%2BLf4JB8k63qdvxEOvlfExzZTpD%2B0%2FI5NkHcosjaF3DdZPwxq5amLmgD%2FA8LH3ThSAsi%2BI%2FE5sRLRkEQ3JzzhoRK7NCkhkQQBatZwyOUZGO%2FUs4ddEl6ns0U6vBu6h2UgfzhR2V3gKWEBXg%2FfxqtastKjJxOkL3s%2BMqdi0lrARpvY0ZNfyWQSLnf2QZ%2BFoLTn6xHQyTcfrjutnJicVF3iLpO0yGde9lFcBYJr5IYdTUds6GRiN%2BV%2FYSa7ni75qS2pCBfSmDG4mO3JrzS5P467%2BWF9wltklgCgazJFKIwFZ1LxQ%2B3c6gcDdjTdkDuEce1bMPgRzWkt9Jt1GqbHn%2Bqhw16zG%2F%2Fhl6XhSH8f1U0QQMGSbo%2FtBKuUuz3E9lPCfQLH74ZcbhgtZWN5Beqx%2FnxBqvXVBz7fJbw2ji4Vk2V%2FCp2ForD3MzhO%2Fqn07siA1AAEt0JwJSKjWqB566NMkNt5NDiMNa5HaXTPUeVpj7NBh7yjDJmY7KvDxAICjXaiZD4Q7aMr4mH8EcwB3XCV6k30G%2FbwNzCo2P0SNVYBkR2wzZp3%2FJsqEUdvb5FuNsOkdYEP2b4uZWNDS%2FGJg%2BENgrczP0fkO5b4wgtI%2B9cI%2FD03bhkhJlZbbGUmGPSq8WeiHdUhdbYX5EK6gEv%2FCdvv10CsslK4UmMWDRLrCTOHQSnfO534laG2%2FOBWZ9PBBSsSu%2B9qsGYDoeDodlBjnL1Ts0UmkXX%2BlSyoQQ1%2FeydQTnhwHC3Rr%2FQIXyZ58db%2BVlGY47PDzyiKXjAllcBT4ajZ2YqTO04AWeYdMAVH%2BpBSHhfyWsB9lcSwdEK%2Fj8mr0i19OKB%2BdtVwzN9Ud70V78jc1MUDsOX4XtostZOlAwPhpJvvlft1EUQHmbnlDds7Sahh1mvtKSA4EFRkTdBZnC6JQQBatDYEKg1rstf4TjkzxsA%3D%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.188.51.87 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://2913.tooltheysen.live/ptjmthbd/?u=dubkd0x&o=vk2gyuz&f=1&sid=t1~ztjukgkebnsdjhlca3wg1csn&fp=M1EkKNh5rwPfH0rTEiGHaSBaujVYpjZl3BEWwSeni8JHeo1%2FBMu5sDRsTA9N%2F6Rwf%2FAMXln7Yi8BHyzrj%2FVw37LLBfsi115Bwg7tvXS94RFVCN3fPhqLeS4uBl3D9L8ZW3PyghaXne5RE7nPKspZ3uybNaJ3vyLKMzyY47CbCA%2BJMoylRh%2BwQOB9NSjLsAC4YHvsuyBzLRvgzggKTtNuZUlLqKwNVOBWNX3B8%2BJaR3LNKfKcn68SVP%2BCzB7XI1mGB7rVCBR10Byu2e%2BkdZVllXjWCHt%2BQb57hK2TjpTZtZUIv9BSk4zZiWfHmtmnPgw1NiHSgfsS4iD1uAz4mIixnwkI%2BkbKlIKdZx%2Flx5roTlHKr0M5rnw0aYggtINn2OU3zwtfFP13Cxe0%2ByltNA4fkzPCRF7gQvuoE%2BW3Qy2YDocIhLU94gvKCV83glcOddcR0L4nD%2BdTKuqFwPsqOxMUCS3hJElKvpSW8Io%2BUPycOkeis8%2Bl8eJ%2FQMRoG6qdKWHyayts3TkCn2Tgf4ClW85APjQX6D%2Beyxib7GxUD5Zi888dnvEgxgFuON97x7Z6%2FdqJ23sasd7SAtBXjgURjKCQLqDGfhuQAwB5O5x7vpyx8OKG512U6QTxtsf%2Bq4af4i3u6I3Ujau%2BlyJSF7s5GniH97DhCduMpVpuh0XoE8ikainiy6UQvkq45ZhQFdRKRgGVz%2B6KY51jqhyaM0rLfqo%2ByTtmwnUmEwGnr6KvHlhzd1hszCjTjPDdT3pArh1pcvOsOyFpaTEqVMAG1aOZksvKPJbCHasqsARoykC%2FWraDRPuD%2Bq%2BKU8fEcCiO0U6XWfGtp%2Fi35gB6eWgqKKV38kf73hdq3aPOvXRCFEB0Eck8Wewm73oZRu2yp%2Bay%2Fr0kRVPy0dk%2BNyyMvvpbhGq2FWBtjQeFCn7pr7JcuWuQzAzI%2BhZNOGdEb%2BPmOsYafNzQ%2Fbvc%2Fk3fkjZAkAyZPSboW27ryoibJH9CFyjcZlrA2RdMYAAjRHknceRcTLR83xvBWoBuZZLj%2BM3PqGSdMt4mP36anYcaTHh5%2BkiJoUuPJEhsK78Zk2Z%2BLf4JB8k63qdvxEOvlfExzZTpD%2B0%2FI5NkHcosjaF3DdZPwxq5amLmgD%2FA8LH3ThSAsi%2BI%2FE5sRLRkEQ3JzzhoRK7NCkhkQQBatZwyOUZGO%2FUs4ddEl6ns0U6vBu6h2UgfzhR2V3gKWEBXg%2FfxqtastKjJxOkL3s%2BMqdi0lrARpvY0ZNfyWQSLnf2QZ%2BFoLTn6xHQyTcfrjutnJicVF3iLpO0yGde9lFcBYJr5IYdTUds6GRiN%2BV%2FYSa7ni75qS2pCBfSmDG4mO3JrzS5P467%2BWF9wltklgCgazJFKIwFZ1LxQ%2B3c6gcDdjTdkDuEce1bMPgRzWkt9Jt1GqbHn%2Bqhw16zG%2F%2Fhl6XhSH8f1U0QQMGSbo%2FtBKuUuz3E9lPCfQLH74ZcbhgtZWN5Beqx%2FnxBqvXVBz7fJbw2ji4Vk2V%2FCp2ForD3MzhO%2Fqn07siA1AAEt0JwJSKjWqB566NMkNt5NDiMNa5HaXTPUeVpj7NBh7yjDJmY7KvDxAICjXaiZD4Q7aMr4mH8EcwB3XCV6k30G%2FbwNzCo2P0SNVYBkR2wzZp3%2FJsqEUdvb5FuNsOkdYEP2b4uZWNDS%2FGJg%2BENgrczP0fkO5b4wgtI%2B9cI%2FD03bhkhJlZbbGUmGPSq8WeiHdUhdbYX5EK6gEv%2FCdvv10CsslK4UmMWDRLrCTOHQSnfO534laG2%2FOBWZ9PBBSsSu%2B9qsGYDoeDodlBjnL1Ts0UmkXX%2BlSyoQQ1%2FeydQTnhwHC3Rr%2FQIXyZ58db%2BVlGY47PDzyiKXjAllcBT4ajZ2YqTO04AWeYdMAVH%2BpBSHhfyWsB9lcSwdEK%2Fj8mr0i19OKB%2BdtVwzN9Ud70V78jc1MUDsOX4XtostZOlAwPhpJvvlft1EUQHmbnlDds7Sahh1mvtKSA4EFRkTdBZnC6JQQBatDYEKg1rstf4TjkzxsA%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Sep 2022 13:53:14 GMT
Server: nginx
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Sep 2022 13:53:14 GMT
Location: /away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D
Server: nginx
Transfer-Encoding: chunked

GET
H2 200 Primary Request details
play.google.com/store/apps/ 791 KB
0 157ms
95ms Document
text/html 2a00:1450:4001:829::200e

General

Check archive.org

Download Go to

Full URL

https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en&gl=US

Requested by

Host: repappcloud.com
URL: https://repappcloud.com/away.php?url=I4WHKFughjIM4OSrD1FhgflBuuchpNyX022dpkYZcRKOs%2BnHIiVJuj9KMLIJmLpbmQBltWEJtmiCqo%2BCL3smdYsLZJxTOx4KKCslpeNP9Sk06hpPcywqTw%3D%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/PlayStoreUi/cspreport script-src 'report-sample' 'nonce-Kka-Mx1XORsLhEobZu2_hA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/PlayStoreUi/cspreport;worker-src 'self' script-src 'nonce-Kka-Mx1XORsLhEobZu2_hA' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://market.android.com https://clients2.google.com https://payments.sandbox.google.com https://payments.google.com https://maps.googleapis.com https://translate.googleapis.com https://translate.google.com https://support.google.com https://www.gstatic.cn https://families.google.com https://clients1.google.com https://myaccount.google.com https://accounts.google.com https://www.googletagmanager.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/PlayStoreUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/PlayStoreUi/cspreport script-src 'report-sample' 'nonce-Kka-Mx1XORsLhEobZu2_hA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/PlayStoreUi/cspreport;worker-src 'self' script-src 'nonce-Kka-Mx1XORsLhEobZu2_hA' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://market.android.com https://clients2.google.com https://payments.sandbox.google.com https://payments.google.com https://maps.googleapis.com https://translate.googleapis.com https://translate.google.com https://support.google.com https://www.gstatic.cn https://families.google.com https://clients1.google.com https://myaccount.google.com https://accounts.google.com https://www.googletagmanager.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/PlayStoreUi/cspreport
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://market.android.com https://clients2.google.com https://payments.sandbox.google.com https://payments.google.com https://maps.googleapis.com https://translate.googleapis.com https://translate.google.com https://support.google.com https://www.gstatic.cn https://families.google.com https://clients1.google.com https://myaccount.google.com https://accounts.google.com https://www.googletagmanager.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/PlayStoreUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: same-site
date: Thu, 29 Sep 2022 13:53:14 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-ua-compatible: IE=edge
x-xss-protection: 0

GET m=_b,_tp,_r
www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en.XQ0-8nsHTdg.2021.O/am=5mBMP4E7WQBA/d=1/excm=_b,_r,_tp,appdetailsview/ed=1/dg=0/wt=2/rs=AB1caFUhcC6mDcpT3wxVH5rYS3gzppkZnA/ 0
0

GET hqdefault.jpg
i.ytimg.com/vi/-d261W5Vb40/ 0
0

GET z5nin1RdQ4UZhv6fa1FNG7VE33imGqPgC4kKZIUjgf_up7E-Pj3AaojlMPwNNXaeGA=w240-h480-rw
play-lh.googleusercontent.com/ 0
0

GET z5nin1RdQ4UZhv6fa1FNG7VE33imGqPgC4kKZIUjgf_up7E-Pj3AaojlMPwNNXaeGA=s48-rw
play-lh.googleusercontent.com/ 0
0

GET mw_NfsvKM8m6RPv8Fz2GQawCOsqWv010saMnc7zbWalMxuaA9IY8h7E0VMieLxSxAFB98NFeYqbFrXXq=w48-h16-rw
play-lh.googleusercontent.com/ 0
0

GET qQhwrVXDA7HMyNrK5Gl91GiBATRcwY3hfuNIYjlVJpo5LE8aouvlmQohaaPNo_Y5gA=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET 0Quk7ItYKo75MuIHggXd2OsIU87647sUWJFlzEKzLdT0c29Em0ahUEwB1CMuLXk_BbA=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET L1lGajSNsrp6eom7k7ThNn4c49vcqB3ak3ume0uxfDX9siN1fGNJTmXpfkDJO14t3j4h=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET WBK3o6EPBGwX6auA0dFEmbPoQ_OALgzDAs5AyjzZIZwC5AXPrQthr8uL3rwgom3DhWE=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET 065CXfgBlqMOHZdm1U2uNP6TYbK7E6F2EVIg-pRcU-oYLUQbI69Zdz_13ZTP_NGyxw=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET plyGX_oOTlg3MePYVHEu3FUf1QwiMXQdBDexxjLhI9In6hl4Lg1j7Bft6t_FWAfVrUw=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET GghmJNEZwdkGxHffx6P9e3L2Nzvm__CfIp6Mw7VDLL4VWDARE51YgQKvtTCVW0il0_8=w526-h296-rw
play-lh.googleusercontent.com/ 0
0

GET iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw
play-lh.googleusercontent.com/ 0
0

GET 12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw
play-lh.googleusercontent.com/ 0
0

GET W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw
play-lh.googleusercontent.com/ 0
0

GET ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw
play-lh.googleusercontent.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.gstatic.com
URL: https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en.XQ0-8nsHTdg.2021.O/am=5mBMP4E7WQBA/d=1/excm=_b,_r,_tp,appdetailsview/ed=1/dg=0/wt=2/rs=AB1caFUhcC6mDcpT3wxVH5rYS3gzppkZnA/m=_b,_tp,_r

Domain: i.ytimg.com
URL: https://i.ytimg.com/vi/-d261W5Vb40/hqdefault.jpg

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/z5nin1RdQ4UZhv6fa1FNG7VE33imGqPgC4kKZIUjgf_up7E-Pj3AaojlMPwNNXaeGA=w240-h480-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/z5nin1RdQ4UZhv6fa1FNG7VE33imGqPgC4kKZIUjgf_up7E-Pj3AaojlMPwNNXaeGA=s48-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/mw_NfsvKM8m6RPv8Fz2GQawCOsqWv010saMnc7zbWalMxuaA9IY8h7E0VMieLxSxAFB98NFeYqbFrXXq=w48-h16-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/qQhwrVXDA7HMyNrK5Gl91GiBATRcwY3hfuNIYjlVJpo5LE8aouvlmQohaaPNo_Y5gA=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/0Quk7ItYKo75MuIHggXd2OsIU87647sUWJFlzEKzLdT0c29Em0ahUEwB1CMuLXk_BbA=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/L1lGajSNsrp6eom7k7ThNn4c49vcqB3ak3ume0uxfDX9siN1fGNJTmXpfkDJO14t3j4h=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/WBK3o6EPBGwX6auA0dFEmbPoQ_OALgzDAs5AyjzZIZwC5AXPrQthr8uL3rwgom3DhWE=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/065CXfgBlqMOHZdm1U2uNP6TYbK7E6F2EVIg-pRcU-oYLUQbI69Zdz_13ZTP_NGyxw=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/plyGX_oOTlg3MePYVHEu3FUf1QwiMXQdBDexxjLhI9In6hl4Lg1j7Bft6t_FWAfVrUw=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/GghmJNEZwdkGxHffx6P9e3L2Nzvm__CfIp6Mw7VDLL4VWDARE51YgQKvtTCVW0il0_8=w526-h296-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw

Domain: play-lh.googleusercontent.com
URL: https://play-lh.googleusercontent.com/ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw

Verdicts & Comments Add Verdict or Comment

9 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
lzw.ufo.verona.it/	1970-01-20 15:06:35	Name: antibot_uid Value: 2c17707eebbfca6951b7b302e8c1bae4
lzw.ufo.verona.it/	1970-01-20 06:35:23	Name: antibot_country Value: FR
lzw.ufo.verona.it/	1970-01-20 06:35:23	Name: antibot_lang Value: fr
lzw.ufo.verona.it/	1970-01-20 06:35:23	Name: antibot_ptr Value: 2001%3A41d0%3A000d%3A364d%3A0000%3A0000%3A0000%3A0005
lzw.ufo.verona.it/	1970-01-20 06:35:23	Name: antibot_a4f51b10747b9d26abd296af7d284cdc Value: 7cf589a727394cc5b39e1e0eedf16e5b
.yadro.ru/	1970-01-20 15:05:34	Name: FTID Value: 1ZDQD62VS0uP1ZDQD6002PRS
.yadro.ru/	1970-01-20 15:05:34	Name: VID Value: 1LY7fW3U_XeP1ZDQD6002PRw
lzw.ufo.verona.it/	1970-01-20 06:22:25	Name: antibot_referer Value: https%3A%2F%2Flzw.ufo.verona.it%2FAxa_Login.html
lzw.ufo.verona.it/	1970-01-20 06:22:25	Name: antibot_hits Value: 2
nxtpsh.top/	1970-01-20 06:26:45	Name: C3C59c0la0ehjB2xXB1JeQ Value: 1
nxtpsh.top/	1970-01-20 15:56:59	Name: __pl Value: 83efca7c-46f8-4290-b479-bdff970335f9
js.nextpsh.top/	1970-01-20 15:56:59	Name: __psu Value: 226fb2c5-f8d3-4f7e-8b7b-154caf95f22a
money.amimed.nl/	1969-12-31 23:59:59	Name: sid Value: t1~ztjukgkebnsdjhlca3wg1csn
money.amimed.nl/	1969-12-31 23:59:59	Name: p1 Value: https://tooltheysen.live/ptjmthbd/
money.amimed.nl/	1969-12-31 23:59:59	Name: s1 Value: fzjqjigoy4yqginl

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2913.tooltheysen.live
antibotcloud.com
code.jquery.com
counter.yadro.ru
i.ytimg.com
js.nextpsh.top
lzw.ufo.verona.it
money.amimed.nl
nxtpsh.top
play-lh.googleusercontent.com
play.google.com
repappcloud.com
week-tale.xyz
www.gstatic.com
i.ytimg.com
play-lh.googleusercontent.com
www.gstatic.com
116.202.184.109
188.114.96.12
2001:4de0:ac18::1:a:1a
2606:4700:3030::6815:7cd
2606:4700:3034::ac43:8a40
2a00:1450:4001:829::200e
2a00:1450:400d:807::2003
46.148.125.182
5.188.51.87
54.37.2.177
88.212.201.204
0f25ebdaab02043c878d5486876e26e4e8b79bbe7409a7e1203271debdfe3524
21f79c33621716622f467556e148bde1a032a839fbb43ba107b4146f35fad028
3059be4046e0315ad1c0d1cb163d9daaf759bdf16e906e908842fac07e5608a2
30d197e0754e070e4bf6e47b830481fc0c8b01a3fa2ab52c15f20b324426e67f
4050470e08475ebe795ce01d60825e6bd656417b83f2ec4d4aa3ffa0d6e88d91
4bf1777c3c1d9d24854d539b4f86ddec7b0c54798dcafd440161903efbc8e04a
635dbe23fe4cc16e0ffb3a9c420f66b8e6a34d22b6a27bd054cf065757d26003
71e79f46be6883cb94673cb02041031b186ef525e8d4a15ae86dc4f11cdfb206
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a8d6389e6811b9fea7ff683cb31a57a6e0b29781407d7f5d45994aae1b5725b7
d4d5669220045e130b79770e93dc7dca5fdfa00c9d7047639dbb15c4f28eb2e2
e2bb1401d6b8d6038ff8411fd0f6280890ecd1f32e3e90f4c7fededf28301339
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c
f392f08652d464570cdc9c514ba60a5fa93b8837d6e12fe1b225e700cde8fa72
ffbc9a90757bba679af7f0ff813ce5168d68f98f9e752b194f8d05b02d5445f7

play.google.com 2a00:1450:4001:829::200e Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective URL Pivot

Effective IP

Summary

urlscan.io Verdict: No classification

Domain & IP information

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

48 Requests

65 %HTTPS

45 %IPv6

14 Domains

14 Subdomains

12 IPs

6 Countries

201 kBTransfer

1280 kBSize

15 Cookies

0 Outgoing links

Page URL History

Redirected requests

48 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

play.google.com
2a00:1450:4001:829::200e Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

48
Requests

65 %
HTTPS

45 %
IPv6

14
Domains

14
Subdomains

12
IPs

6
Countries

201 kB
Transfer

1280 kB
Size

15
Cookies

48 HTTP transactions
1 data transactions