urlscan.io logo urlscan.io
SecurityTrails logo

0vcxs.offersforetoday.com Open in urlscan Pro
154.16.205.113  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://a0.mytvids.com/
Effective URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Submission: On March 22 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 6 domains to perform 42 HTTP transactions. The main IP is 154.16.205.113, located in Buffalo, United States and belongs to NEXEON, US. The main domain is 0vcxs.offersforetoday.com.
TLS certificate: Issued by R3 on March 4th 2024. Valid for: 3 months.
This is the only time 0vcxs.offersforetoday.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
6 2606:4700:303... 13335 (CLOUDFLAR...)
7 2606:4700:e0:... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 25 154.16.205.113 20278 (NEXEON)
1 2607:f8b0:400... 15169 (GOOGLE)
42 5
6    2606:4700:3030::ac43:a046 (United States)

ASN13335 (CLOUDFLARENET, US)
a0.mytvids.com
b1.mytvids.com
c1.mytvids.com
7    2606:4700:e0::ac40:6a24 (United States)

ASN13335 (CLOUDFLARENET, US)
trk-keingent.com
event.trk-keingent.com
1    2606:4700:3031::6815:21ab (United States)

ASN13335 (CLOUDFLARENET, US)
click.trackwora.com
25    154.16.205.113 (Buffalo, United States)

ASN20278 (NEXEON, US)
0vcxs.linkstonow.com
0vcxs.offersforetoday.com
1    2607:f8b0:4006:824::200a (United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
Apex Domain
Subdomains		 Transfer
24 offersforetoday.com
0vcxs.offersforetoday.com
396 KB
7 trk-keingent.com
trk-keingent.com — Cisco Umbrella Rank: 23624
event.trk-keingent.com — Cisco Umbrella Rank: 64457 Failed
9 KB
6 mytvids.com
a0.mytvids.com
b1.mytvids.com
c1.mytvids.com
49 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 716
30 KB
1 linkstonow.com
0vcxs.linkstonow.com
708 B
1 trackwora.com
click.trackwora.com — Cisco Umbrella Rank: 527266
575 B
42 6
Domain Requested by
24 0vcxs.offersforetoday.com c1.mytvids.com
0vcxs.offersforetoday.com
a0.mytvids.com
4 event.trk-keingent.com trk-keingent.com
3 trk-keingent.com a0.mytvids.com
b1.mytvids.com
c1.mytvids.com
2 c1.mytvids.com b1.mytvids.com
c1.mytvids.com
2 b1.mytvids.com a0.mytvids.com
b1.mytvids.com
2 a0.mytvids.com a0.mytvids.com
1 ajax.googleapis.com 0vcxs.offersforetoday.com
1 0vcxs.linkstonow.com 1 redirects
1 click.trackwora.com 1 redirects
42 9

This site contains no links.

Subject Issuer Validity Valid
mytvids.com
GTS CA 1P5		 2024-03-20 -
2024-06-18		 3 months crt.sh
trk-keingent.com
GTS CA 1P5		 2024-01-29 -
2024-04-28		 3 months crt.sh
offersforetoday.com
R3		 2024-03-04 -
2024-06-02		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2024-02-26 -
2024-05-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Frame ID: 5B6FC0B0C9883F47E5670B17CEF5E675
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Win Free Spins

Page URL History Show full URLs

  1. https://a0.mytvids.com/ Page URL
  2. https://b1.mytvids.com/?cnv_id=undefined Page URL
  3. https://c1.mytvids.com/?cnv_id=undefined Page URL
  4. https://click.trackwora.com/in/01HRA82VFM6GKE7Y0966JZ66CF?source=redirectDenied HTTP 302
    https://0vcxs.linkstonow.com/?kw=106304&s1=939f8972-e64e-4e5b-b09c-bd94020c77c3 HTTP 302
    https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • livewire(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

42
Requests

90 %
HTTPS

80 %
IPv6

6
Domains

9
Subdomains

5
IPs

1
Countries

483 kB
Transfer

587 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://a0.mytvids.com/ Page URL
  2. https://b1.mytvids.com/?cnv_id=undefined Page URL
  3. https://c1.mytvids.com/?cnv_id=undefined Page URL
  4. https://click.trackwora.com/in/01HRA82VFM6GKE7Y0966JZ66CF?source=redirectDenied HTTP 302
    https://0vcxs.linkstonow.com/?kw=106304&s1=939f8972-e64e-4e5b-b09c-bd94020c77c3 HTTP 302
    https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

42 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
a0.mytvids.com/ 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://a0.mytvids.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86870582b88167db-MIA
content-encoding
br
content-type
text/html
date
Fri, 22 Mar 2024 14:55:14 GMT
last-modified
Tue, 19 Mar 2024 18:56:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OAsM0%2BYQfr6pLqs%2BrTkNhg3l5GJ2nl3yEFZy7oZGATTOs5kpzRF8yDr%2Bi0zkiu7OHWMQ5KDrZX84wzAWwu%2FR9m0DZccNBIFtCsoKGQhJVvAGq38aj6VhWilWH%2FahmN9alOsmk8R1sUVnRA%2Fz2A%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
57dknm4dw8
trk-keingent.com/scripts/push/script/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-keingent.com/scripts/push/script/57dknm4dw8?url=a0.mytvids.com&alturl=/
Requested by
Host: a0.mytvids.com
URL: https://a0.mytvids.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://a0.mytvids.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:14 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3013
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 22 Mar 2024 14:05:01 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SqiOn6QszcvW%2BR%2B2CVgzIkTiBmo9gqsKVPa%2BNYHHI85Ve%2B9JJXtbQdsDQppWYkLEVZasEAc67BOdcCxW7rd7PvkA1ycuW4vpB0o64wkmYGXof%2FkFgLB0GKhcKk%2Bd884A5q04OTCxbcI5EaVq8o6s"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
86870584cbe431d4-MIA
expires
0
play.png
a0.mytvids.com/images/play/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a0.mytvids.com/images/play/play.png
Requested by
Host: a0.mytvids.com
URL: https://a0.mytvids.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://a0.mytvids.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:14 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
248664
alt-svc
h3=":443"; ma=86400
content-length
11015
last-modified
Thu, 14 Mar 2019 13:22:18 GMT
server
cloudflare
etag
"5c8a558a-2b07"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0mo7u6A%2FH3NgO%2BaP1Fj%2F0YwCn7A%2B84tJjK8sbAx7txCvOpKu8fxlA5Ipiju1KtxgW2WjBbG3tOODjxxYUBRXs9rnVV%2BIO%2FPX1KOc8tRae%2B6EdLSCsU0KUs2yCtAxbE3HdgMBJBaGoeFMdkt6ng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
868705843b6567db-MIA
expires
Thu, 18 Apr 2024 17:50:50 GMT
/
b1.mytvids.com/ 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://b1.mytvids.com/?cnv_id=undefined
Requested by
Host: a0.mytvids.com
URL: https://a0.mytvids.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://a0.mytvids.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
868705848bee67db-MIA
content-encoding
br
content-type
text/html
date
Fri, 22 Mar 2024 14:55:14 GMT
last-modified
Tue, 19 Mar 2024 18:56:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GzdZkOi0pkJ9JoIutCoiFEdXEfJN2iccGnJ9pC9Lh0CUMNstwkNg5w8378Gg%2BogZc2crcT%2Bz66rImGLpLzRTVOcAAki5uVJRY5GIhbUYFJfNWYycedl0jdZ8IUeJtVeJ9vV7RCrd1wL9lcpMww%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
57dknm4dw8
trk-keingent.com/scripts/push/script/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-keingent.com/scripts/push/script/57dknm4dw8?url=b1.mytvids.com&alturl=/
Requested by
Host: b1.mytvids.com
URL: https://b1.mytvids.com/?cnv_id=undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://b1.mytvids.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:14 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2132
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 22 Mar 2024 14:19:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1wClkvpBbELFUOKMrYnBgQzYPfzVFsYZ1ezlQWqodPqtD0CcOkJoMYIRv2Nn7%2FpfTA5NaUets9LEo438qE%2Bl6qsGsq33A33JUZlI%2FoPO9fiflle8NDadEYSL7PpRJBmy38FuFVrKWrWE8k4HGDU"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
86870585fe6731d4-MIA
expires
0
play.png
b1.mytvids.com/images/play/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b1.mytvids.com/images/play/play.png
Requested by
Host: b1.mytvids.com
URL: https://b1.mytvids.com/?cnv_id=undefined
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://b1.mytvids.com/?cnv_id=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:14 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
246658
alt-svc
h3=":443"; ma=86400
content-length
11015
last-modified
Thu, 14 Mar 2019 13:22:18 GMT
server
cloudflare
etag
"5c8a558a-2b07"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DIYluxAHB5fEnn1oRlPfoBgQ5GvScgjWYv3HZ2NpaPVEBw91MR1fXQhqG%2F1u0tgW5SB7ujwryH67WiksntQ8rUswP5Ef%2BIxNmtSm4f%2FkzJZlMu%2BIF02Sxke8k6%2BPRzxJ9XJNTefeaMKrjraSCw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
86870585fc2831d1-MIA
expires
Thu, 18 Apr 2024 18:24:16 GMT
/
c1.mytvids.com/ 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.mytvids.com/?cnv_id=undefined
Requested by
Host: b1.mytvids.com
URL: https://b1.mytvids.com/?cnv_id=undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://b1.mytvids.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
868705866f9e67db-MIA
content-encoding
br
content-type
text/html
date
Fri, 22 Mar 2024 14:55:15 GMT
last-modified
Tue, 19 Mar 2024 18:56:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uMkNsSBEj9gxJ0A%2FE8TK9XrQfVK%2B7JruqMb%2BCZ1ZpCENyd9fYEzOlWssYkAkyzV999bEk%2FCq%2F%2BVjm4XJOLKdtXSzw1Zima0ym6uSLFEtQQjXEgViYfAz9sDx%2BFTvsd8dtV9VrEfNg8AfgfaSGg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0
57dknm4dw8
trk-keingent.com/scripts/push/script/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-keingent.com/scripts/push/script/57dknm4dw8?url=c1.mytvids.com&alturl=/
Requested by
Host: c1.mytvids.com
URL: https://c1.mytvids.com/?cnv_id=undefined
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://c1.mytvids.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:15 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3733
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 22 Mar 2024 13:53:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=01kVJ5XFHRuKP1Y%2BSd1zYzIkFKkM%2FcZkecqtLP6IYaKdDcSn8OEk1EqKpdbIoJY7S%2FoMmvzodhEzCnTwyl2yDpwjSB4ExNfG9faKeC0OQ3NVjQ1Fwlgk6pujYsS0JLDU2cco2li9FJqmjwXWt17z"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
86870587ff8909ee-MIA
expires
0
play.png
c1.mytvids.com/images/play/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c1.mytvids.com/images/play/play.png
Requested by
Host: c1.mytvids.com
URL: https://c1.mytvids.com/?cnv_id=undefined
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:a046 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://c1.mytvids.com/?cnv_id=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:15 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
249296
alt-svc
h3=":443"; ma=86400
content-length
11015
last-modified
Thu, 14 Mar 2019 13:22:18 GMT
server
cloudflare
etag
"5c8a558a-2b07"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gafCsdJhHjvVyERBmXY5EyPjD%2Br%2FLzOH8mD5G8%2Fi0utYZ2%2FI4vTQgT4MBQvw%2BVS5q7dRgDMzeRNMUhPe3K8CFjKZviBjjTZzo5JJb60X%2FSaEgBWECFm%2BCGj0HtWnpLPA9O1G4LkW0SeQsGw9vg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
86870587ff7131d1-MIA
expires
Thu, 18 Apr 2024 17:40:19 GMT
Primary Request 3187549a-e85c-11ee-ae6a-75602872bbc7
0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/
Redirect Chain
  • https://click.trackwora.com/in/01HRA82VFM6GKE7Y0966JZ66CF?source=redirectDenied
  • https://0vcxs.linkstonow.com/?kw=106304&s1=939f8972-e64e-4e5b-b09c-bd94020c77c3
  • https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
26 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Requested by
Host: c1.mytvids.com
URL: https://c1.mytvids.com/?cnv_id=undefined
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
3e662a03340224ba899ece7346eba705503c0560fcf60b521310c06324e6b85f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://c1.mytvids.com/?cnv_id=undefined
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
br
content-length
5866
content-type
text/html; charset=UTF-8
date
Fri, 22 Mar 2024 14:55:16 GMT
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true

Redirect headers

cache-control
no-cache, private
content-encoding
br
content-length
282
content-type
text/html; charset=UTF-8
date
Fri, 22 Mar 2024 14:55:16 GMT
location
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Requested by
Host: trk-keingent.com
URL: https://trk-keingent.com/scripts/push/script/57dknm4dw8?url=c1.mytvids.com&alturl=/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c1.mytvids.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Fri, 22 Mar 2024 14:55:15 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5HgpD6o5WXixd4BuKtSqvH%2FeYabPm0mIX9L5dxwG6Cm3AjieyJWkvSVgquD2px3BgqMEIK%2BAi7yj%2FVQQlNBrGvOweUR4S8tgZsZtNrAwcck3KYsFUXMkC%2FG8Koh4%2FlIKwjzxS3evv25QWwGxQRQykLkvsp%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
86870589baa3d9e1-MIA
x-pushplatformapp-params
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://c1.mytvids.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
868705893d8421d3-MIA
content-length
0
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
date
Fri, 22 Mar 2024 14:55:15 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=quXYYp7otbdeE9NY64kU4hEX9Cq5rXkZWbI4JEC6k96NEkvrAIPx0ZH76UCvWieNxD8D5JemKPxhVLQYhn8Ygx7afYZ4jZuJStLRAhDnwNCfkUqp6YwJCWt6ks6GXHX%2BpusK8eLS%2FwDqntTG1B5oh9NXd2oI"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Requested by
Host: trk-keingent.com
URL: https://trk-keingent.com/scripts/push/script/57dknm4dw8?url=c1.mytvids.com&alturl=/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c1.mytvids.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Fri, 22 Mar 2024 14:55:15 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7XfoKT%2F2l%2FMaG4%2BetZMUQnrHp6498qnbXnIVPKAqDV8i2Mu584aFo%2FyiilEMAIADDWEqS9SwrlPtSUrcHuUfadzFtGBPDmMOICV1SEgiwI2tUHezlpCQi1HY42TGyicXw3iEoN%2FwvbyZTy0%2BQm5eb8aonef2"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
86870589baa4d9e1-MIA
x-pushplatformapp-params
q5ej252yg0
event.trk-keingent.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6a24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://c1.mytvids.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
868705893d8921d3-MIA
content-length
0
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
date
Fri, 22 Mar 2024 14:55:15 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8o5a5fZi2RGTCZlb4UrJLDsIk4kgbEz4iRAyVl84XqbHmRsYbUEtmRK3fKNbGvFcB36E55tJkbJCRu5s37PxvRQ5G03wL8x9jvvHKD9RHMMWoD3QNbMJCGVUzi2PxMdZXZYRlUT8xISX8hvM79qfM%2BmEjsFZ"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
style.css
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		14 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/style.css
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
d710e56c31f6e6697599766420b15dcef3fb328539f1381c1d2e2310db9b9e9a
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
568571 262160
content-type
text/css
accept-ranges
bytes
content-length
14284
push_na_push.js
0vcxs.offersforetoday.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0vcxs.offersforetoday.com/push_na_push.js?aff_id=1163&custom=v2&s2=31e61a20-e85c-11ee-99dc-ab04f1871f03
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
ccfb2dcf4787a5d040a57b95bb1f19f1bc1ec2cf8c1a319f825c2166a3ee6cf1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 14:55:16 GMT
content-encoding
gzip
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
0
vary
Accept-Encoding
content-type
application/javascript
x-varnish
236148
x-redir
true
cache-control
no-cache, private
accept-ranges
bytes
content-length
784
service-worker-allowed
/
slot-start.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		25 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/slot-start.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
269858 98343
content-type
image/png
accept-ranges
bytes
content-length
26084
slot-spin.gif
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		86 KB
86 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/slot-spin.gif
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
467066 458768
content-type
image/gif
accept-ranges
bytes
content-length
87599
slot-result-1.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/slot-result-1.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
467067 262162
content-type
image/png
accept-ranges
bytes
content-length
20370
slot-result-2.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/slot-result-2.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
467070 131125
content-type
image/png
accept-ranges
bytes
content-length
26733
slot-win.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/slot-win.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
236150 229448
content-type
image/png
accept-ranges
bytes
content-length
14391
red-arrow-left.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/red-arrow-left.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
568572 98345
content-type
image/png
accept-ranges
bytes
content-length
1334
red-arrow-right.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/red-arrow-right.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
534622 196696
content-type
image/png
accept-ranges
bytes
content-length
1362
img1Female.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img1Female.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
399779 327685
content-type
image/jpeg
accept-ranges
bytes
content-length
1315
img2Male.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img2Male.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
1223070 74
content-type
image/jpeg
accept-ranges
bytes
content-length
1297
img3f.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img3f.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
a7c86ca5470f7d68b4c5f1c87f29f7daf816d1bd95353091bba8753341bb6f5f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
826659 32814
content-type
image/jpeg
accept-ranges
bytes
content-length
2336
img5m.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img5m.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
40880 425992
content-type
image/jpeg
accept-ranges
bytes
content-length
1169
img42.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img42.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
84d7f0648aeba8d80bb0f47e781cba8955b8fa7425748d9830c7a8c9bc35e5e9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
1189531 491525
content-type
image/jpeg
accept-ranges
bytes
content-length
2037
img8m.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img8m.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
1189532 393224
content-type
image/jpeg
accept-ranges
bytes
content-length
1506
img9m.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1017 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img9m.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
9545948eefe774be5121de01ef9c14207891c35116bba14056471a59e4c212a1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
40881 360454
content-type
image/jpeg
accept-ranges
bytes
content-length
1017
img7m.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img7m.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
ba858c8ecc8f498253509a9251e5070ce3b3ad9950b704a22a9a1fb1efc62541
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:53 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46524
x-varnish
399780 524291
content-type
image/jpeg
accept-ranges
bytes
content-length
2264
img62.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/img62.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
388e1eb0cb648490ea1c4913f4ea3128f3fbfbda0608bf85e471d947db905302
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
826660 557059
content-type
image/jpeg
accept-ranges
bytes
content-length
2143
c7.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		885 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/c7.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
dee106bfd25bef41d50df51bf68521a5846e6f59e68f7494df98fcf8454d5ebc
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
269860 589827
content-type
image/jpeg
accept-ranges
bytes
content-length
885
c3.jpg
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/c3.jpg
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
cf1ec1a6ce1e4bf8ec7d58bc85d1f166d36646d05c65ea72697b12d1d001747c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:49 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
534623 622595
content-type
image/jpeg
accept-ranges
bytes
content-length
1457
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.0/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 07:50:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
198315
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30089
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Mar 2025 07:50:02 GMT
livewire.js
0vcxs.offersforetoday.com/livewire/ 		171 KB
171 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0vcxs.offersforetoday.com/livewire/livewire.js?id=90730a3b0e7144480175
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
38a4dc885f9d1267bbfaf361e24fbf51994bd7f6743784ec3e4a267bbe74a0be
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:37 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
last-modified
Fri, 11 Aug 2023 04:02:34 GMT
server
swoole-http-server
age
46539
content-type
application/javascript; charset=utf-8
x-varnish
269859 98318
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
174819
service-worker-allowed
/
expires
Sat, 22 Mar 2025 01:59:37 GMT
push_proxnapush.js
0vcxs.offersforetoday.com/ 		17 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0vcxs.offersforetoday.com/push_proxnapush.js?v=1&custom=true
Requested by
Host: a0.mytvids.com
URL: https://a0.mytvids.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
d97140baac38de7446121bd7fd8c6fd76194281fa0a9e4f1c636ce1cc1a0babe
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 02:00:57 GMT
content-encoding
gzip
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46459
vary
Accept-Encoding
content-type
application/javascript
x-varnish
568573 622606
x-redir
true
cache-control
no-cache, private
accept-ranges
bytes
content-length
8973
service-worker-allowed
/
arrow.png
0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/ 		154 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/arrow.png
Requested by
Host: 0vcxs.offersforetoday.com
URL: https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
154.16.205.113 Buffalo, United States, ASN20278 (NEXEON, US),
Reverse DNS
Software
swoole-http-server /
Resource Hash
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://0vcxs.offersforetoday.com/templates/templates/SPIN_casino-survey/src/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 22 Mar 2024 01:59:50 GMT
via
1.1 varnish (Varnish/7.4)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
46527
x-varnish
1223071 655363
content-type
image/png
accept-ranges
bytes
content-length
154

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
event.trk-keingent.com
URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Domain
event.trk-keingent.com
URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Domain
event.trk-keingent.com
URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0
Domain
event.trk-keingent.com
URL
https://event.trk-keingent.com/register/event_log/q5ej252yg0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

93 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _at function| _NeptuneAdsPushDeferred function| getUrlVars function| urlBase64ToUint8Array function| _NeptuneAdsPushGetDeviceType function| _NeptuneAdsPushGetPageDetails function| _NeptuneAdsPushGetReferrer function| _NeptuneAdsPushGetLanguage function| _NeptuneAdsPushGetResolution function| _NeptuneAdsPushGetBrowserInfo function| _NeptuneAdsPushGetSystemInfo function| _NeptuneAdsPushInitialize function| _NeptuneAdsPushGetSiteConfig function| _NeptuneAdsPushLoadPrompt function| _NeptuneAdsPushPromptApprove function| _NeptuneAdsPushPromptDeny function| _NeptuneAdsPushPromptCancel function| _NeptuneAdsPushRemovePoweredBy function| _NeptuneAdsPushShowPoweredBy function| _NeptuneAdsPushGetSubscriberID function| _NeptuneAdsPushSendTrackData function| _NeptuneAdsPushGetSubscriberIDFromToken function| _NeptuneAdsPushGenerateID function| _NeptuneAdsPushGetCookie function| _NeptuneAdsPushSetCookie function| _NeptuneAdsPushDeleteCookie function| _NeptuneAdsPushTrackAttributes function| _NeptuneAdsPushOptInResponse function| _NeptuneAdsPushPrompt function| _NeptuneAdsPushTrackEvent function| _NeptuneAdsPushAbandonedCart function| _NeptuneAdsPushGetPushToken function| _NeptuneAdsPushSupportsPush function| _NeptuneAdsPushCheckHTTPS function| _NeptuneAdsPushCheckPermissions function| _NeptuneAdsPushRunNative function| _NeptuneAdsPushSafariRun function| _NeptuneAdsPushChromeRun function| _NeptuneAdsPushSubscribe function| _NeptuneAdsPushExtractSubscriptionId function| _NeptuneAdsPushSendSubscriptionToServer function| _NeptuneAdsPushRegisterWorker function| _NeptuneAdsPushFetchSubscriberIDFromWorker function| _NeptuneAdsPushConsoleOutput function| _NeptuneAdsPushSendWorkerMessage function| _NeptuneAdsPushLoad string| domain string| owner string| idSite boolean| showDebug boolean| subscriberID_existed undefined| _NeptuneAdsPushPushToken string| _NeptuneAdsPushSubscriberID undefined| _NeptuneAdsPushCallResponse object| trackData string| currentPage string| _NeptuneAdsPushAPI boolean| _NeptuneAdsPushRanScript undefined| webURL undefined| logid string| uid number| width number| height object| browserInfo object| systemInfo string| refUrl string| refName object| referrer string| pageTitle string| pageURL object| pageDetails string| curPageURL string| configPageURL number| promptId number| auto_prompt function| $ function| jQuery function| clickMe function| injectPrizeString function| cleanAs function| countdown number| x object| momentOfTime number| myTimeSpan object| Livewire object| livewire string| livewire_app_url string| livewire_token function| deferLoadingAlpine object| powered_browserinfo string| powered_devicetype string| powered_top string| powered_left

3 Cookies

Domain/Path Name / Value
0vcxs.linkstonow.com/ Name: yredir_session
Value: eyJpdiI6InVSbU0rclNpd244RHhZeERTZFczd3c9PSIsInZhbHVlIjoiTm5odk1hNjhCekZxTjg0Q0U0S2pQeE1yaTBPQ1BvckRNb3ZOZTBBaERlLzRhU21tOTVYZDNJNm5IaVRpZGViVUVhZkY1S3NubGlrT0lhZDdyOXZWNUNyWDM3cm1uTjVTcE5tZFZHYnhQSlcyTUU0Nk1nWWxXR2hGZ25LMVFjcGEiLCJtYWMiOiJjMWMxNjYxZDFkNjZmZDkyMWFjNjMzODkwYTkxMGZhYjRiYzNkODc3YWU3YmNlMjhmMzVjNTk3NTIxOTRiZDJkIiwidGFnIjoiIn0%3D
0vcxs.offersforetoday.com/ Name: yredir_session
Value: eyJpdiI6IlkwZUMyVUVFbHE1VXI0eXFBeXlNRlE9PSIsInZhbHVlIjoielI2em90ek5ta25tQnp6U1ZuZnVYTC80MkgwdjFTZnhKbE9WcHJqa1F6WXFlTTN5OTJVcXlxSlFpTVJjV2hRVlRTOHp1WFVGZ3FSY3dDcnlZd2dQeXB1VU1EM3VsS0RsSlNkdXpUYllYWkZCV2NPSFQvaXZiUlZLR081KzFsemIiLCJtYWMiOiI5MDYxODM0ZjQ3NGMwZjNhMTRlNWI0YWYxMzYzOGQ0YzNmMGM0NmFhMDlkYWNjN2Y2OGQ4NzEwNTg4MzRmMTc3IiwidGFnIjoiIn0%3D
0vcxs.offersforetoday.com/ Name: _NeptuneAdsPushSubscriberID
Value: a16c547c-da41-a16c-abe4-0f0d94d33abc

3 Console Messages

Source Level URL
Text
other error URL: https://b1.mytvids.com/?cnv_id=undefined
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.
other error URL: https://c1.mytvids.com/?cnv_id=undefined
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.
other error URL: https://0vcxs.offersforetoday.com/t/fe312738ec36/317d0b8e-e85c-11ee-b32e-e988ec4143be/3187549a-e85c-11ee-ae6a-75602872bbc7
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0vcxs.linkstonow.com
0vcxs.offersforetoday.com
a0.mytvids.com
ajax.googleapis.com
b1.mytvids.com
c1.mytvids.com
click.trackwora.com
event.trk-keingent.com
trk-keingent.com
event.trk-keingent.com
154.16.205.113
2606:4700:3030::ac43:a046
2606:4700:3031::6815:21ab
2606:4700:e0::ac40:6a24
2607:f8b0:4006:824::200a
388e1eb0cb648490ea1c4913f4ea3128f3fbfbda0608bf85e471d947db905302
38a4dc885f9d1267bbfaf361e24fbf51994bd7f6743784ec3e4a267bbe74a0be
3e662a03340224ba899ece7346eba705503c0560fcf60b521310c06324e6b85f
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e
84d7f0648aeba8d80bb0f47e781cba8955b8fa7425748d9830c7a8c9bc35e5e9
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
9545948eefe774be5121de01ef9c14207891c35116bba14056471a59e4c212a1
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f
a7c86ca5470f7d68b4c5f1c87f29f7daf816d1bd95353091bba8753341bb6f5f
aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9
aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837
ba858c8ecc8f498253509a9251e5070ce3b3ad9950b704a22a9a1fb1efc62541
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963
ccfb2dcf4787a5d040a57b95bb1f19f1bc1ec2cf8c1a319f825c2166a3ee6cf1
cf1ec1a6ce1e4bf8ec7d58bc85d1f166d36646d05c65ea72697b12d1d001747c
d710e56c31f6e6697599766420b15dcef3fb328539f1381c1d2e2310db9b9e9a
d97140baac38de7446121bd7fd8c6fd76194281fa0a9e4f1c636ce1cc1a0babe
dee106bfd25bef41d50df51bf68521a5846e6f59e68f7494df98fcf8454d5ebc
e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d
fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205