642retrieval.ga
2606:4700:3031::6815:47f8  Malicious Activity!

URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Submission: On June 11 via api from JP

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 166 HTTP transactions. The main IP is 2606:4700:3031::6815:47f8, located in United States and belongs to CLOUDFLARENET, US. The main domain is 642retrieval.ga.
TLS certificate: Issued by R3 on June 9th 2021. Valid for: 3 months.
This is the only time 642retrieval.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

Domain Requested by
96 642retrieval.ga 642retrieval.ga
25 fonts.gstatic.com fonts.googleapis.com
10 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
642retrieval.ga
10 stackpath.bootstrapcdn.com 642retrieval.ga
10 maxcdn.bootstrapcdn.com 642retrieval.ga
maxcdn.bootstrapcdn.com
10 fonts.googleapis.com 642retrieval.ga
5 www.googletagmanager.com 642retrieval.ga
166 7

This site contains no links.

Subject Issuer Validity Valid
*.642retrieval.ga
R3
2021-06-09 -
2021-09-07
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2021-05-10 -
2021-08-02
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-03-01 -
2022-02-28
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
*.google.com
GTS CA 1O1
2021-05-10 -
2021-08-02
3 months crt.sh

This page contains 1 frames:

Primary Page: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Frame ID: 3077FA09BE6AA5B6C1ACFD560DDC63BF
Requests: 171 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  2. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  3. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  4. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  5. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

166
Requests

100 %
HTTPS

100 %
IPv6

6
Domains

7
Subdomains

9
IPs

2
Countries

3250 kB
Transfer

5263 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  2. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  3. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  4. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL
  5. https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

166 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
27 KB
11 KB
Document
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
838be9174158c44d15a2558ec3ec8ef346d59a3409ebbdd4003a2213fff94c26

Request headers

:method
GET
:authority
642retrieval.ga
:scheme
https
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-type
text/html
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
0a9af7f8dd0000c2efa7a26000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Klf%2FLnSqVBMT7MiOsf%2F9SNhS7A7dZkPpVIsnI2JvGkktuEIi3fygxFaoEMP6630DfaO%2Bka%2BNmulC707QASGVuvv6lHOyASHmrWX451Y236jheM3BS0zAp3VXPN6Fjq91KefBNMF40YG1"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
65d82907c958c2ef-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
css?family=Titillium+Web:400,700
fonts.googleapis.com/
1 KB
514 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1d14552be6ee4946f37aab45221783569a7de93bf04647d430d36102b4dcd748
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:22:18 GMT
server
ESF
date
Fri, 11 Jun 2021 04:40:15 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 11 Jun 2021 04:40:15 GMT
style.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
75d0898af3d149b79084e1e6cfa046da47d3dbcc6c103bf35932c4d7c9618480

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9b50000177ac8baf000000001
last-modified
Thu, 10 Jun 2021 23:19:17 GMT
server
cloudflare
etag
W/"60c29df5-7c8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=n7%2BiziSxouBYuC4rcJ4F1tQ7S3pSpsyZU3Ik3pDbQmQRE9BJnQHAi%2ByBwwmjX95wJAoCdMcc%2BZ0ZUoTxZWTuOL%2FWZ281i%2B86KBttObuiap0lpDoJu46AyAiZA%2BOeKMXm2fX4acqp7CHc"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8290928cc177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/
27 KB
6 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
565, 617, 617
age
6939583
cdn-cachedat
2021-03-11 11:58:04
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9ab00004df45a876000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
af3097212757f6b13d804a73f5f188bc
cf-ray
65d8290918d84df4-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/
157 KB
21 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
6
cdn-cachedat
2021-06-08 16:51:35
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9ab00004e19e09a8000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
7767b72206874bab7cadfa75736ed7a6
cf-ray
65d829091de04e19-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/
59 KB
14 KB
Script
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
6
cdn-cachedat
2021-06-08 20:50:11
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9ab00004e192a086000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
479a46410b7b613e44b5c7c7a10efb74
cf-ray
65d829091de24e19-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
pop.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
10 KB
3 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0685c4b3332ef18d007ce13a6543d7ede43d6b748419a038e7bd783c9e4a72db

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9b60000177ac99b1000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
W/"60c29df8-2805"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hcT%2FOawOLdcqM%2BiCeN3kFgco17kjMLf09lMnP8fndzkVRYcZWwwEzcNmFNqjpcR3xQQyHAFJF%2FLl%2F3mZgG%2FI9FeMww55uBD%2FfCFRTZBWhYPjh03lNLonNNuUZPrvBUyQdRTAA%2Fc%2FjtX%2B"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8290928d1177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
85 KB
29 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6333ca0936bbf247b1c47eb69f76e19eef3aeff5a8a1b592f31c17f254bfef8c

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9b60000177aeb3d8000000001
last-modified
Thu, 10 Jun 2021 23:19:21 GMT
server
cloudflare
etag
W/"60c29df9-1539a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dZmEz1tetG9OoIJz3r1wytUYNbB3C8HiKpNZwCoUadPybhc6xnEOQvq7uCjS72oV0Hy2Er4qtoF%2BxKmYNE64Gz4pYBbdQJ9MzjcoN%2FMQ31dGwICfRFJ4My73%2FfCS%2BHI6SZE8snwPx18A"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8290928d0177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
screenfull.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16861757a5b0d72f3333bc0955f7d3447b6bcb15254308d47893659802b8457e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7f9b60000177a9504c000000001
last-modified
Thu, 10 Jun 2021 23:19:19 GMT
server
cloudflare
etag
W/"60c29df7-7e2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yCN7gHa12vkaiMQQU5rIaHqNypzurut9BTnZ8O45eOqoBdqYWANV6eeGVOxSgpzfVPmjUR1zMZbO%2FiIKcSFVmbf84I8j17MLr0XAtY4R%2F9Z2yZP4amJ7%2FYXgub%2FUyDkq6qoMqG7gYJq2"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8290928ce177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft.jpg
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f70249b342aecd9e3d2367aea39df606e92562f9d7945ad8849b36cd3e3a85a1

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2004
cf-request-id
0a9af7fa860000177a9e97a000000001
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
server
cloudflare
etag
"60c29df1-7d4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=l%2B5ynr5afRx1LI3Vi7k2YXN8fNBmKfD1eMOZ8PPXPDgBh1dOkvI2cGuO1W3W5Q%2BSHjN4ccc3A1IzFrAcgDswg1DH0JTAj0Nx2YMwpab8L%2F00aRFiyNCYxACD1VaUAEcsoLr78a5IETtc"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290a6aa9177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
cut.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
1 KB
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d25cf2403704d5208d662af4ef703d424cedeac253a43a1aec6e60e0db43837f

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
1192
cf-request-id
0a9af7fb420000177aa309a000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-4a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JGvzCMOgw9ljH%2B6fbVq9xcGJhHKTSIqp%2Bd%2FtTPzwKS85W6bfgE7JVqHZLNSt7FvlEtkDbFE4bHPVg4%2B07JGyR1X2sd5sxE3Rrpw4GRc9d9z5Jpe6RKTzBkjXBrv2DOS%2B8ayFtwb%2BroLk"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290b9c4a177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
minus.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
945 B
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b6c8e23b2a2c49ac71393cb3e1740b7e2fccaa310ee06b68ca27b693d133f8e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
945
cf-request-id
0a9af7fb4d0000177a71824000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-3b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2Fj64iA4GRkMtMML6PlPiw%2BfzHX21clFqSdKWEVjLuL6L6fglTMGyb3kYidg8baeEmp1F0qFmh%2FNrQfo32Y%2BBP8GxC8qXaFa4y6vTlSNdv9EluJaLzG8lvcRZZsWEMCYGCG3Lf5O3kTYF"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290bac63177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
background-2.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
378 KB
378 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9fbe2de348e17bd4948011260ef297c4102b69068692daaba02bf632acd291

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
386648
cf-request-id
0a9af7fb6e0000177aa309c000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
"60c29df8-5e658"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4AuUePaOorykhPORVjK%2FQ1DO2yxBBsvjTp2q5w%2BMea5l7g81JXO4hiYR%2B%2BbOZukXB9DGaul6OhHJp5yxE64Hwn0L%2BKbCZEHDXJa%2BReYEn%2BWGsp7Rgh6DS2TrCXhWYmng4%2FmU1DjP%2BHzV"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becb2177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
set.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
364 B
993 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
364
cf-request-id
0a9af7fb6e0000177a89b76000000001
last-modified
Thu, 10 Jun 2021 23:19:15 GMT
server
cloudflare
etag
"60c29df3-16c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QWmgRyC4xrUbFvQd2ie%2B7avKHHPnQ71YaHRGsWwRbSGI6HEG6YUz0BWQGlfTL7YkTw18%2B77VEpY9YDfGqN1%2B%2Bplf22o6OIQ5a3ZBTHu1w6YamvzXjkqt7mCjUs%2BudsuTuKfYgdknBYeN"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becb4177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
help.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
349 B
977 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
349
cf-request-id
0a9af7fb6f0000177a9a246000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-15d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UO7nMK09fxsEMod%2F%2BS15Eer4hswi98hbJFEElez6RXoPXhY3QSGS7VlVPpxz8AXI8l%2BX26DHWRx9bUE1AgSDpy1WEBZwW9Hhq5j6m4nbQW5TfRzPfxHHcrR%2FrHXHkp5M82irJ8ZDosPF"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becb5177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
scan.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
723 B
1 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/scan.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0f52d9433540bafa2f05fc3c04839b4990c2ce5ef718975a8d4eef9866f06be

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/scan.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
723
cf-request-id
0a9af7fb6f0000177a6c985000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-2d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3Ox%2BeqEPorEOCsqj4dRUmSRERHKU6r7BbxnNPTRM49B2LBQXHt1LcD3mGcHu3HVQPTV1b6bKgrGz0IbNOYiZJobRKS%2F0xsm5R8SJ%2BVeFJEGqI0yHPyySSDKLY%2BIY2HEWlLqjO1qkiJMR"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becb7177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
time.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
3 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/time.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a8b8ab6fef6a243e7a03d0c260a525a50df879953b26c34b83e97c61d36001b

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/time.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2760
cf-request-id
0a9af7fb6f0000177a738ba000000001
last-modified
Thu, 10 Jun 2021 23:19:17 GMT
server
cloudflare
etag
"60c29df5-ac8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2cDDNG7i7ITiLTDqUylqsXKThhaUSEfoVISyUk9HrFfGHk4E%2B19UmReRoOx%2BwSRnIUcG1Ddw2D4ni7%2FfkmnFbtUCzOaeYhQbOxTNbjpU3flnAI1muwcZkPM9L6qWMdAAo%2BjrU0LnulOu"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becb9177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
pro.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
3 KB
4 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pro.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da198edcbb6e4845e1b27930e433a0fa776f3a9eec26dabd758b0d3d06edab61

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pro.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
3028
cf-request-id
0a9af7fb700000177aaf332000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-bd4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=N3Kq7hI3l4MuhCulDEeB7A9%2FfpL8XYYR%2F8lHZ51DD48hSihr8g5PknFUnhTtE%2FTEf9bE5BSZBZP5DYmWcmcUpr1%2BFrl9LUhcNmS8WBdeRs3Btai1hW8b%2BWhWAOQONr1BxCxnj4xacucW"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becbb177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
mic.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/mic.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f63a29085e0086c93e316ac91ea971ca7ff5f925e0327ea9b006c15c793d38bb

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/mic.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2555
cf-request-id
0a9af7fb700000177ac01a2000000001
last-modified
Thu, 10 Jun 2021 23:19:15 GMT
server
cloudflare
etag
"60c29df3-9fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JAg4nDDdwHG2ImrHL7o%2FvnLniBzLqVtzGv5h6BmgnzHkubHgntKGPMX4LVZBB%2Fxe25Oa1o3GzG80Vc6jhyezUQvMO2bUQEZQz8dPm2UQ3GSi06atKVt1iT3PJF69E0NwoRSbjos%2BMJyR"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becbe177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
977 B
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
977
cf-request-id
0a9af7fb700000177a71826000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-3d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZZcz6Bdn6xxU%2FWb6pdZg%2FjLcHAwK1Ph9MH3jZ3XFJ%2FPSXZNL%2BIsTaBh%2BbWQJdOW%2FCqbXulz3zbid2%2BI45OzZ%2FYQiKNd7FdhXQoEIqqa9jY4Y8DPq%2BVQhV75Dw1Ub72gHJYVadMTnpd4P"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8290becc0177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
js?id=UA-179488279-1
www.googletagmanager.com/gtag/
89 KB
35 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-179488279-1
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
cf62f979316b022634fc2c671ff6f8c731cf6205bb70e5069bf0dfc3c6ebb6ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36062
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 11 Jun 2021 04:40:15 GMT
css.css
642retrieval.ga/
0
0
Stylesheet
General
Full URL
https://642retrieval.ga/css.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:path
/css.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:15 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 10 Jun 2021 23:18:01 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=j%2B29AcU5G2qbPtru%2BpuYLQuzN503tlAKQM4E%2BSDAmMJRFHgOoqFZrVN18bycc7A25UBChHvfm%2BTbZNKIKbk84H9u5AgAkUZAQpLN7LB5tqfvjd12YH8Ol1UbErGRc6P7DOGglJMEvvJF"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
65d8290a6aaa177a-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af7fa860000177ab1b6f000000001
css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
fonts.googleapis.com/
19 KB
907 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
05a55848815c20ac9e0c5df2732b2ce6b0c12018dec636956bd3f792c06c4aeb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:26:36 GMT
server
ESF
date
Fri, 11 Jun 2021 04:40:15 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 11 Jun 2021 04:40:15 GMT
data:truncated
data:truncated
309 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0531410bc1f8a477f7305af86f43dabcd10be9a3742e6e26ce6d3ed4f6a8425

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 18:25:12 GMT
x-content-type-options
nosniff
age
209703
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7776
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:55 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 18:25:12 GMT
pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3834f0a520d623453cdb6b03b88331bc0394367eb18809f1037ea18c699ebded
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 21:48:38 GMT
x-content-type-options
nosniff
age
197497
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7848
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:23 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 21:48:38 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 21:28:26 GMT
x-content-type-options
nosniff
age
198709
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7900
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:02:01 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 21:28:26 GMT
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 14:59:05 GMT
x-content-type-options
nosniff
age
222070
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7988
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:02:10 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 14:59:05 GMT
pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 17:02:10 GMT
x-content-type-options
nosniff
age
214686
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7832
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:48 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 17:02:10 GMT
fontawesome-webfont.woff2?v=4.5.0
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/
65 KB
66 KB
Font
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
723, 617, 617, 617
access-control-allow-origin
*
cdn-cachedat
2021-06-08 21:35:39
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
66624
cf-request-id
0a9af7fbb400002ba162814000000001
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
e9724039cf930044db00c3fe573acbf5
accept-ranges
bytes
cf-ray
65d8290c4d3e2ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
alertmicrosoft.mp3
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
66 KB
0
Media
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
pragma
no-cache
accept-encoding
identity;q=1, *;q=0
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
audio
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
range
bytes=0-
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-216737/216738
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Content-Length
216738
cf-request-id
0a9af7fbba0000177aa2258000000001
last-modified
Thu, 10 Jun 2021 23:19:18 GMT
server
cloudflare
etag
"60c29df6-34ea2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=j3Ck%2FN27KjR5bxZC875jE%2FCDlLnFN25XyWWRr0c6ZcqyPHk8S3%2BKhbWfU8Pmk6W3O6sDL1ou9BB1yXiCRWOxzgs091zPVxTIY2GelJQYycHFBQXAlKQ0g8cATePQAGxCspeYg3zvr4nh"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
max-age=315360000
cf-ray
65d8290c5d8d177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
warning.mp3
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
13 KB
14 KB
Media
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/warning.mp3
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4d5cae00178437f63e868ded066dde7503207230142ab3c37ef8ca70a03574d

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/warning.mp3
pragma
no-cache
accept-encoding
identity;q=1, *;q=0
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
audio
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
range
bytes=0-
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 11 Jun 2021 04:40:16 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-13668/13669
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Content-Length
13669
cf-request-id
0a9af7fbbd0000177aac372000000001
last-modified
Thu, 10 Jun 2021 23:19:18 GMT
server
cloudflare
etag
"60c29df6-3565"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AqlU%2BdEN226j%2Feudb1HEqGlNhwLRzH%2FdnYmqKSncDDdExXwVJFI9988OdVoqK5nytJgW3XnT9B8cR9Zw4L6lbXZSeis5%2BpoUa3EttldwLfE9H5ofKNI4AxK4uk4eoX4bIreZaV%2BYJNqk"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
max-age=315360000
cf-ray
65d8290c5d8f177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-179488279-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
2375
date
Fri, 11 Jun 2021 04:00:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Fri, 11 Jun 2021 06:00:41 GMT
collect?v=1&_v=j90&a=951554081&t=pageview&_s=1&dl=https%3A%2F%2F642retrieval.ga%2FWin-E-22Oc0_2475_IEDGE08279-1.hhlyf88%2FPVkfsdbfMSdFFhfj1188%2F&ul=en-us&de=UTF-8&dt=%3Ctitle%3E**%20%E3%81%82%E3%8...
www.google-analytics.com/j/
1 B
21 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=951554081&t=pageview&_s=1&dl=https%3A%2F%2F642retrieval.ga%2FWin-E-22Oc0_2475_IEDGE08279-1.hhlyf88%2FPVkfsdbfMSdFFhfj1188%2F&ul=en-us&de=UTF-8&dt=%3Ctitle%3E**%20%E3%81%82%E3%81%AA%E3%81%9F%E3%81%AE%E3%82%B3%E3%83%B3%E3%83%94%E3%83%A5%E3%83%BC%E3%82%BF%E3%81%AF%E3%83%96%E3%83%AD%E3%83%83%E3%82%AF%E3%81%95%E3%82%8C%E3%81%A6%E3%81%84%E3%81%BE%E3%81%99%20**&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=102221743&gjid=1024934407&cid=1159906311.1623386416&tid=UA-179488279-1&_gid=1834396702.1623386416&_r=1&gtm=2ou690&z=1378489767
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 11 Jun 2021 04:40:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://642retrieval.ga
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
27 KB
11 KB
Document
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
838be9174158c44d15a2558ec3ec8ef346d59a3409ebbdd4003a2213fff94c26

Request headers

:method
GET
:authority
642retrieval.ga
:scheme
https
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/

Response headers

date
Fri, 11 Jun 2021 04:40:18 GMT
content-type
text/html
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
0a9af806660000177aa3145000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=FpwhAdxDNJ9UVrNCODTHTRLVSal9WU%2B%2B0tTexOAQ48VPbXNwCy2colnGFa2Okhh4eN4sfFP7yiu6RmWiWXMKo0ecj95auPitjvtoYxlMDqb4Qc%2F5DaXblWWbj8KXeCkY4qmJaBAuLJpL"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
65d8291d6f2a177a-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
css?family=Titillium+Web:400,700
fonts.googleapis.com/
1 KB
418 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1d14552be6ee4946f37aab45221783569a7de93bf04647d430d36102b4dcd748
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:16:31 GMT
server
ESF
date
Fri, 11 Jun 2021 04:40:18 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 11 Jun 2021 04:40:18 GMT
style.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
75d0898af3d149b79084e1e6cfa046da47d3dbcc6c103bf35932c4d7c9618480

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af807300000177a89826000000001
last-modified
Thu, 10 Jun 2021 23:19:17 GMT
server
cloudflare
etag
W/"60c29df5-7c8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8H3OlBqWE9VADNQVo%2Bfqw4vjWSz6udfPpXC3pm2wau2aJ0GVE6b2ec%2BMdyREsbfCejJ36%2BdDMI7xSOXIK%2Bzk2OWEsBkdKRhZAnB1BaGjQLeCj1nXhpCI8cr7RKEDVGZleUPo%2FRBqwRG2"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8291eb8e4177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/
27 KB
6 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
565, 617, 617
age
6939587
cdn-cachedat
2021-03-11 11:58:04
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af80739000097d2752ae000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
af3097212757f6b13d804a73f5f188bc
cf-ray
65d8291ecbd097d2-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/
157 KB
21 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
9
cdn-cachedat
2021-06-08 16:51:35
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af8073200002ba1b7369000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
7767b72206874bab7cadfa75736ed7a6
cf-ray
65d8291ebdfc2ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/
59 KB
15 KB
Script
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
9
cdn-cachedat
2021-06-08 20:50:11
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af8073200002ba157b4f000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
479a46410b7b613e44b5c7c7a10efb74
cf-ray
65d8291ebdfe2ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
pop.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
10 KB
3 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0685c4b3332ef18d007ce13a6543d7ede43d6b748419a038e7bd783c9e4a72db

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af807310000177a9ea41000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
W/"60c29df8-2805"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=guGWgKi88BwOrVqYIWKu68F5eUGQ3%2BfKXzjMl3igaL4LNAPCHC4BlrDlZDsO%2FKSjRJzY70oYqYLKs4H0RGSnRpjqW4cZjzP9Vh87wvvmPvQaAU3SlqMkWiLQXNjcWjdOAu1SJPUeael7"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8291eb8e6177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
85 KB
29 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6333ca0936bbf247b1c47eb69f76e19eef3aeff5a8a1b592f31c17f254bfef8c

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af807310000177accbd6000000001
last-modified
Thu, 10 Jun 2021 23:19:21 GMT
server
cloudflare
etag
W/"60c29df9-1539a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ArduAOupWJjjrrpyJUwhDtze9HY8WqnlsQzNist0fR%2FC24EzeMBpU61Yb1lrKp5dIVRKXpi7LPgCFBTp8nyRZyHBYaWJwbbpZ4sbu%2F60X52FFsFLkyRwksi1et6%2BftHbT1PkLm7WCjag"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8291eb8e8177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
screenfull.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16861757a5b0d72f3333bc0955f7d3447b6bcb15254308d47893659802b8457e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af807310000177a91b5a000000001
last-modified
Thu, 10 Jun 2021 23:19:19 GMT
server
cloudflare
etag
W/"60c29df7-7e2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=g0yHuryRd5VMKWrxk0FSZiBYajuG1INU%2FO1vKwXw8EkDzi43XPanH9AagwGqBQETDqdunrhGSwU%2FNrJpSSg3k91MOR4eg%2BGZ2wI15OhjpgZiGk%2BYCMyUd%2FaaSO1VSAkOi4p9deVaeOfm"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8291eb8eb177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft.jpg
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f70249b342aecd9e3d2367aea39df606e92562f9d7945ad8849b36cd3e3a85a1

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2004
cf-request-id
0a9af8074e0000177a77140000000001
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
server
cloudflare
etag
"60c29df1-7d4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=imjmXexuH2dO1NyswWgKdARmiU3AtrU8lHZtsPQSjp9O9qIHO96SMwyxyaUheEPWbEgRSFNsaos3K5DWXXdvvUhgRiIvjEZXX0JPPfwLuS8fM1brjdqUmeX7QXyXnUY5fFqS9zD6Rrva"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291ee93b177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
cut.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
1 KB
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d25cf2403704d5208d662af4ef703d424cedeac253a43a1aec6e60e0db43837f

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
1192
cf-request-id
0a9af807590000177ac025d000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-4a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7cAzbtEeo1wE5fCNmlJGmi5kh5gsF930EEvgrvmkTSOigWYBf9tJpvu3sj07aULEM5duxQte%2B8%2BdRbJerwhT5GkjmPuyX4epj90uN3TECcD8%2B8cBKwOCHGV14UdlKs7oYFE%2B2LN5Df9J"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291ef970177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
minus.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
945 B
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b6c8e23b2a2c49ac71393cb3e1740b7e2fccaa310ee06b68ca27b693d133f8e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
945
cf-request-id
0a9af807670000177ad1b02000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-3b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=oTVR2ppt%2FWW8hnAoE4Id7T1hGwoCIB948J6Uq3TaJzKuhA6CvjMSqHIVYu4E6PldEdhaG9fzylQIsCqYoL%2FLgTNHrexy0vqoiEQBq0gEjMG6Op4aGFNdvl24FyQvZBcReh0lL1d5gAWD"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f09b9177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
background-2.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
378 KB
378 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9fbe2de348e17bd4948011260ef297c4102b69068692daaba02bf632acd291

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
386648
cf-request-id
0a9af807670000177aaf3f3000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
"60c29df8-5e658"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EEswvcczrfaYf7ol3Td7g9XZMZY2V1MBEcp6CKFEziivoh%2FJkNGoPFd%2FMtnROZKQZeaTLQvfGBO93LF7omyu%2B333yeCvj1iLuHl%2BlPNjc8zzcOawoRxbzHCJ3jROmCUNqNuz1J7wf3bg"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f09bc177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
set.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
364 B
990 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
364
cf-request-id
0a9af807730000177ab6a3f000000001
last-modified
Thu, 10 Jun 2021 23:19:15 GMT
server
cloudflare
etag
"60c29df3-16c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=XC%2Bb7wXfxnwr7zTqDKZcEyqcuHkZZGwd1R4bT4cBJA9klnEyC7mD2PoZKQUcdJcIln8FHnS01v5ttjx9DUDVbhrYEeI2Xi0KoLLRdAunnGasrsl6XwgSENF7aUmE7OpMDHKRsuQvhzU5"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19e5177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
help.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
349 B
980 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
349
cf-request-id
0a9af807740000177ad6a6c000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-15d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SdpeGYweQvcY1nHbu2esdBU%2FMdkzanFa52%2BNJJv5%2BgomA1oAd%2FhN9oWXVAkRQT6wMiXJKjaQS9sczTCT4DWWU4WmLCQa0yA89w44DbIcnVyG5UV%2B9is92gAa6HOu58fSb7nRwoZ%2F5gkq"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19e6177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
scan.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
723 B
1 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/scan.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0f52d9433540bafa2f05fc3c04839b4990c2ce5ef718975a8d4eef9866f06be

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/scan.gif
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
723
cf-request-id
0a9af807740000177ac0261000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-2d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GRWWGl54FmHa9DrJpWmEQXL2OztE5JeLCQjHmfH%2BNRMDjOVMpMTAiil3%2FetehhPwKL61M7nXaq0awGKpPrLTOy8v6Jl%2BCkIWezDdIObFzyFq3CDeKucTMP6N4Dvca%2F6IpOevKq4LvXW5"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19e9177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
time.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
3 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/time.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a8b8ab6fef6a243e7a03d0c260a525a50df879953b26c34b83e97c61d36001b

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/time.gif
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2760
cf-request-id
0a9af807750000177a9ea48000000001
last-modified
Thu, 10 Jun 2021 23:19:17 GMT
server
cloudflare
etag
"60c29df5-ac8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ByuMqu3o%2FHojegJDcAMyZGSES2495ZGCr9EHoc1aa9hGl%2BkL7c5%2FaX8OfmYiGMWjnquAYg9OuIhinuh9xBqUZldBG%2B5QK5aIYQ0G6SOOcCh2ZXTSxGf9uqwkF0NMrw84r7XJu4XjyHL0"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19ea177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
pro.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
3 KB
4 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pro.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da198edcbb6e4845e1b27930e433a0fa776f3a9eec26dabd758b0d3d06edab61

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pro.gif
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
3028
cf-request-id
0a9af807750000177ad9120000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-bd4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Zp6K4I2V3UdW3fE9cxihTw2tZGRXhyokOEDd1YzJsSrpBb6LtE8YiFo%2FwiA6laj8pF9ooAdP4sAfAqUSi4Y7wtIcitGOz3maiPTPqikuqqGtB1M5EbOvig%2FoyPo%2BELvd7ELBGCYVCrIC"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19ed177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
mic.gif
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/mic.gif
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f63a29085e0086c93e316ac91ea971ca7ff5f925e0327ea9b006c15c793d38bb

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/mic.gif
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2555
cf-request-id
0a9af807760000177a7b036000000001
last-modified
Thu, 10 Jun 2021 23:19:15 GMT
server
cloudflare
etag
"60c29df3-9fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=53Q6gOX6T4KhYqwjVttxNs%2B654mht1SAL6cLxN4c4bx7feqX1fR435V%2BGjdhI%2F5LBLgx1wk4e1I60Je2hbhLTurA4luBkjiV4v94GTKQyCvN83BZ0Zl2hTv058Dn0v2wOKboBVTCbpCX"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19ee177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
977 B
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
977
cf-request-id
0a9af807760000177abd365000000001
last-modified
Thu, 10 Jun 2021 23:19:14 GMT
server
cloudflare
etag
"60c29df2-3d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fKIiNT0x9f9fVh5HcjGzGq2b5V2i9AnLAZinaCJzkYGRX%2B5FjxlgWDUXcGOynEJAd0Nn4Ty8yPpxUtccwxOAzrn6Wr4%2BwQI3VfyR%2Bei5W4A3zD1q8gxyVVcHMtsMDLPJpjG%2BGTKy%2FvIb"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8291f19f0177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
js?id=UA-179488279-1
www.googletagmanager.com/gtag/
89 KB
35 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-179488279-1
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b59630aa8075df2e3a9ed299d54f02dbe8b35998a0ef8414ff0caeb2137920bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36065
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 11 Jun 2021 04:40:19 GMT
css.css
642retrieval.ga/
0
0
Stylesheet
General
Full URL
https://642retrieval.ga/css.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:path
/css.css
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 10 Jun 2021 23:18:01 GMT
server
cloudflare
age
4
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TI7Tdp2h%2FaetSEh5SBkNmU1VPmSju%2BC1XZneIaBSevyMj6fMIl9Zf4bN71D9HyRzcBSw%2FTEua%2FIiMYu%2BY%2BxTs5s2QB%2Fg6SRS3XZ56OlpvOSgJhtwWyNtEMYxQqJ3OVoFuYZRGVPD%2BVsM"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
65d8291ed92d177a-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af807480000177aab8b2000000001
css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
fonts.googleapis.com/
19 KB
907 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
05a55848815c20ac9e0c5df2732b2ce6b0c12018dec636956bd3f792c06c4aeb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:21:40 GMT
server
ESF
date
Fri, 11 Jun 2021 04:40:19 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 11 Jun 2021 04:40:19 GMT
data:truncated
data:truncated
309 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0531410bc1f8a477f7305af86f43dabcd10be9a3742e6e26ce6d3ed4f6a8425

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 18:25:12 GMT
x-content-type-options
nosniff
age
209707
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7776
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:55 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 18:25:12 GMT
pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3834f0a520d623453cdb6b03b88331bc0394367eb18809f1037ea18c699ebded
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 21:48:38 GMT
x-content-type-options
nosniff
age
197501
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7848
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:23 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 21:48:38 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 21:28:26 GMT
x-content-type-options
nosniff
age
198713
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7900
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:02:01 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 21:28:26 GMT
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 14:59:05 GMT
x-content-type-options
nosniff
age
222074
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7988
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:02:10 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 14:59:05 GMT
pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://642retrieval.ga
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 08 Jun 2021 17:02:10 GMT
x-content-type-options
nosniff
age
214689
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7832
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:01:48 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 Jun 2022 17:02:10 GMT
fontawesome-webfont.woff2?v=4.5.0
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/
65 KB
66 KB
Font
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723, 617, 617, 617
age
3
cdn-cachedat
2021-06-08 21:35:39
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
66624
cf-request-id
0a9af8077f00002ba180adb000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
e9724039cf930044db00c3fe573acbf5
accept-ranges
bytes
cf-ray
65d8291f3ebd2ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
alertmicrosoft.mp3
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
6 KB
0
Media
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-fetch-mode
no-cors
accept-encoding
identity;q=1, *;q=0
accept-language
en-US
sec-fetch-dest
audio
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
range
bytes=0-
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-216737/216738
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Content-Length
216738
cf-request-id
0a9af8077f0000177a6c21a000000001
last-modified
Thu, 10 Jun 2021 23:19:18 GMT
server
cloudflare
etag
"60c29df6-34ea2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ez4u1kVsT5OAYVBuq2rEznIvC1enSef7GLtUHr%2BxfyEQILJKY6AuMdymOUKPYjrTq688%2B5uhp24mx9q9zqSKyAx2S1LVzk1aS8jDqLnj%2F2EpzcAGGWQiset6gQ7NuVVzpCwknfJmeBlD"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
max-age=315360000
cf-ray
65d8291f2a0e177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
warning.mp3
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
6 KB
0
Media
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/warning.mp3
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-fetch-mode
no-cors
accept-encoding
identity;q=1, *;q=0
accept-language
en-US
sec-fetch-dest
audio
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/warning.mp3
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
range
bytes=0-
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-13668/13669
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Content-Length
13669
cf-request-id
0a9af8077f0000177ad6a6d000000001
last-modified
Thu, 10 Jun 2021 23:19:18 GMT
server
cloudflare
etag
"60c29df6-3565"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BMUiJY3zRahPijrXJ%2BXmtrGt7jXEbE3PMXF5FUlZp6c5j8%2FZqjSXs4tPDugwt6VEXPFo8AN%2B0QqhEfNL0WnCbb5QGabZOgbSOczpuq1Fdd50eCgRCWsOdDyFRp7BEpe5W9jzU%2FIpDR%2F5"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
max-age=315360000
cf-ray
65d8291f2a11177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-179488279-1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
2378
date
Fri, 11 Jun 2021 04:00:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Fri, 11 Jun 2021 06:00:41 GMT
collect?v=1&_v=j90&a=332142490&t=pageview&_s=1&dl=https%3A%2F%2F642retrieval.ga%2FWin-E-22Oc0_2475_IEDGE08279-1.hhlyf88%2FPVkfsdbfMSdFFhfj1188%2F&ul=en-us&de=UTF-8&dt=%3Ctitle%3E**%20%E3%81%82%E3%8...
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j90&a=332142490&t=pageview&_s=1&dl=https%3A%2F%2F642retrieval.ga%2FWin-E-22Oc0_2475_IEDGE08279-1.hhlyf88%2FPVkfsdbfMSdFFhfj1188%2F&ul=en-us&de=UTF-8&dt=%3Ctitle%3E**%20%E3%81%82%E3%81%AA%E3%81%9F%E3%81%AE%E3%82%B3%E3%83%B3%E3%83%94%E3%83%A5%E3%83%BC%E3%82%BF%E3%81%AF%E3%83%96%E3%83%AD%E3%83%83%E3%82%AF%E3%81%95%E3%82%8C%E3%81%A6%E3%81%84%E3%81%BE%E3%81%99%20**&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAUAB~&jid=&gjid=&cid=1159906311.1623386416&tid=UA-179488279-1&_gid=1834396702.1623386416&gtm=2ou690&z=1857704127
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Jun 2021 19:44:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
32139
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
alertmicrosoft.mp3
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
34 KB
0
Media
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-fetch-mode
no-cors
accept-encoding
identity;q=1, *;q=0
accept-language
en-US
sec-fetch-dest
audio
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/alertmicrosoft.mp3
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
range
bytes=65536-
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=65536-

Response headers

date
Fri, 11 Jun 2021 04:40:19 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 65536-216737/216738
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Content-Length
151202
cf-request-id
0a9af8085d0000177ae8b5e000000001
last-modified
Thu, 10 Jun 2021 23:19:18 GMT
server
cloudflare
etag
"60c29df6-34ea2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2B%2F47A%2BH5whdjGavpMbLcRt3sBMwmslFafEaTiDa7p3%2BCrg8sgXaHZTBgskgmqSmfSWsBjYRFvFSVZa%2F0aPvVoF9KtP7TFkf7S3jltZDTJpVO1isYZbNBrAbCz00%2FwnUCtKpVkUVkBVPg"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
max-age=315360000
cf-ray
65d829209c03177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
27 KB
11 KB
Document
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
838be9174158c44d15a2558ec3ec8ef346d59a3409ebbdd4003a2213fff94c26

Request headers

:method
GET
:authority
642retrieval.ga
:scheme
https
:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-type
text/html
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
0a9af8101b0000177ae09c9000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=B2CSOYAQYi%2B5h789eyXn9%2Fa963X4vtQJPTpuuW3oDT4162lYynrC6yg3m216HDtnEmUYHXSuT2TeEDr4ZI%2BS18VVy8lcl2Jp7oIJwrhzaIYz8%2FY%2Fcc5gL67fbeuQ3q5waR966wSjEzF1"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
65d8292cfd69177a-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
css?family=Titillium+Web:400,700
fonts.googleapis.com/
1 KB
418 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1d14552be6ee4946f37aab45221783569a7de93bf04647d430d36102b4dcd748
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 11 Jun 2021 03:24:10 GMT
server
ESF
date
Fri, 11 Jun 2021 04:40:21 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 11 Jun 2021 04:40:21 GMT
style.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
75d0898af3d149b79084e1e6cfa046da47d3dbcc6c103bf35932c4d7c9618480

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/style.css
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e50000177aa31e0000000001
last-modified
Thu, 10 Jun 2021 23:19:17 GMT
server
cloudflare
etag
W/"60c29df5-7c8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=v6RIxg%2BhhVVNIjGO9LvwerCa22zMR7FtMYNFu%2FSXX%2Fucp7sgEqtiUHxx3QHeZZUVwxIKbdubAYJeiLVa8LQO3b1xgJ5mY3xbz0HWt1NN1wg%2FpJqYsUiRYO2UkDhmB1YJc%2FpoDRlGqlVK"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8292e3f53177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/
27 KB
6 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
565, 617, 617
age
6939589
cdn-cachedat
2021-03-11 11:58:04
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e4000097d28bb1b000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
af3097212757f6b13d804a73f5f188bc
cf-ray
65d8292e38d797d2-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/
157 KB
21 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
12
cdn-cachedat
2021-06-08 16:51:35
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e600002ba17f2e1000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
7767b72206874bab7cadfa75736ed7a6
cf-ray
65d8292e39612ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/
59 KB
15 KB
Script
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://642retrieval.ga
Referer
https://642retrieval.ga/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
12
cdn-cachedat
2021-06-08 20:50:11
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e700002ba1bb936000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
479a46410b7b613e44b5c7c7a10efb74
cf-ray
65d8292e39652ba1-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
pop.css
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
10 KB
3 KB
Stylesheet
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0685c4b3332ef18d007ce13a6543d7ede43d6b748419a038e7bd783c9e4a72db

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/pop.css
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e50000177ab18d1000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
W/"60c29df8-2805"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=F83tWLHJ7U90yDuMSYKtu%2B%2BKn0tspJk8VM%2BDgA3tbLkJbqy%2ByASBTMWSiC%2BFViugZ7PTuxruStTpd4GRJJ6p0LRvViaytG51HW0BSBdU0%2BM6ZW46s8RNI5NfmBXJEho1E3VIS3djx%2Be5"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=315360000
cf-ray
65d8292e3f57177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
85 KB
29 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6333ca0936bbf247b1c47eb69f76e19eef3aeff5a8a1b592f31c17f254bfef8c

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/jquery.js
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e80000177ae8bda000000001
last-modified
Thu, 10 Jun 2021 23:19:21 GMT
server
cloudflare
etag
W/"60c29df9-1539a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Ktvr99Gup2SyyAkNIMCmArTd8fJ9cjxO5jql%2BQtB2dwtJtpLNygetm7HSy2HIN6DrE4pDqoTPYAz%2B34jYZ7gYEGMq%2FtqzGVL9cTc6U8%2ByDYzvRartDPuxqNbvpO00mDz%2FY0lxMe0ksYH"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8292e3f5a177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
screenfull.js
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
1 KB
Script
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16861757a5b0d72f3333bc0955f7d3447b6bcb15254308d47893659802b8457e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/screenfull.js
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0a9af810e60000177ade04c000000001
last-modified
Thu, 10 Jun 2021 23:19:19 GMT
server
cloudflare
etag
W/"60c29df7-7e2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2v24mrks%2FEgj79PsS%2FafoatBwI8btGsDZoO2LjGR1AL9RyFQepIrrp9aLnCo%2FVCmIcIC5T7RooaGpYXngQQ7qZXCZgrm0DLH7%2BIAjB3mk6o4DI8a2UOLv2EXWiCrPoG6YzO4eVRokhWD"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
65d8292e3f5c177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft.jpg
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
2 KB
3 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f70249b342aecd9e3d2367aea39df606e92562f9d7945ad8849b36cd3e3a85a1

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/microsoft.jpg
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2004
cf-request-id
0a9af811080000177aab93c000000001
last-modified
Thu, 10 Jun 2021 23:19:13 GMT
server
cloudflare
etag
"60c29df1-7d4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ORFGfI9HK8mpfX4UUgYliPDnmq9PDRArGX11PZBNgBK7ABv3XM%2Bxhlj6g53UNU%2F9ZbcN43S%2BTZEC%2FD9zJGW3pk76PcFKn77O7jZKdi3IvniUX6NGwPTxI%2F72Dz3nDuIwxorEjC4PTCVM"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8292e7fbc177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
cut.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
1 KB
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d25cf2403704d5208d662af4ef703d424cedeac253a43a1aec6e60e0db43837f

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/cut.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
1192
cf-request-id
0a9af8110a0000177ae8bde000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-4a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sRkMw1ayO8fteWrc8vcus1lr6VX9S5fXHT5gdNSq%2FAJs%2Fasdm1TTPEx2Te3If3735xGbIXB4EFBi6C8RlYv1DqbxZPdt6EDDW5%2BtEYXoxpuP9Ze4FaOSLxRC8oVLuWFkv8LX1I8h%2FMRa"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8292e7fbd177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
minus.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
945 B
2 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b6c8e23b2a2c49ac71393cb3e1740b7e2fccaa310ee06b68ca27b693d133f8e

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/minus.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
945
cf-request-id
0a9af8111f0000177a771ca000000001
last-modified
Thu, 10 Jun 2021 23:19:16 GMT
server
cloudflare
etag
"60c29df4-3b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=w7B6KTeXunMfOh7dL48b2S8MO60pwRjvfNaggAhs45iUtBiHzbbeaikTj8%2F733LNUQfDWm1NX0vSvvy6WpPIkkE%2FMBNwjsc5%2BDZNO08WNzIlWMOmeZc%2BX%2F9T7UJTTwdbwA17J2j7ZR9U"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8292e9feb177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
background-2.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
378 KB
378 KB
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9fbe2de348e17bd4948011260ef297c4102b69068692daaba02bf632acd291

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/background-2.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
386648
cf-request-id
0a9af8112b0000177ad91ab000000001
last-modified
Thu, 10 Jun 2021 23:19:20 GMT
server
cloudflare
etag
"60c29df8-5e658"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=FPaFoTES%2FWqJUNKaGO8MPG6E3iAYLrPDOoDELu%2F1WrdGb0l1QR9lpcy1JOfO7qRV%2B%2F5rcVzHUh32dwhrO38PBE4S3Nz0POD%2FtZGfrrdbZ5XVI1dWrzBAih4p8Seg6SYiJQJLLwKxAMoi"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8292ea800177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
set.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
364 B
991 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/set.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 04:40:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
364
cf-request-id
0a9af8112b0000177aa31e4000000001
last-modified
Thu, 10 Jun 2021 23:19:15 GMT
server
cloudflare
etag
"60c29df3-16c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hTDrkD8Cjed7zUAQGiSMcStUOKPXv2k5TTRiDUzfFuadn5Jx7EhEgBejEiG2kLao%2BB7ehF4a8n748tfhE6%2Fr5LrJ0tCpvmz0i4jfR%2FXY5Ouls81BMQbGkYMi9RRy8XXVN9HNCeJUBGIN"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
65d8292ea801177a-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
help.png
642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
349 B
978 B
Image
General
Full URL
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
Requested by
Host: 642retrieval.ga
URL: https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:47f8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

:path
/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/help.png
pragma
no-cache
cookie
_ga=GA1.2.1159906311.1623386416; _gid=GA1.2.1834396702.1623386416; _gat_gtag_UA_179488279_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
642retrieval.ga
referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSdFFhfj1188/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://642retrieval.ga/Win-E-22Oc0_2475_IEDGE08279-1.hhlyf88/PVkfsdbfMSd