cinsiant.com Open in urlscan Pro
85.17.80.16 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://userupload.net/h9npt0hs2hpl
Effective URL:
https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff186bca&PLACEMENT_ID=20...
Submission: On October 29 via manual (October 29th 2023, 8:42:52 pm UTC) from GY — Scanned from CH

Summary HTTP 84 Redirects Behaviour Indicators

Summary

This website contacted 27 IPs in 4 countries across 25 domains to perform 84 HTTP transactions. The main IP is 85.17.80.16, located in Wolvega, Netherlands and belongs to LEASEWEB-NL-AMS-01 Netherlands, NL. The main domain is cinsiant.com.
TLS certificate: Issued by R3 on October 5th 2023. Valid for: 3 months.

This is the only time cinsiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	51.89.234.230 51.89.234.230	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
7	192.243.59.20 192.243.59.20	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
3	2600:9000:249... 2600:9000:2491:e00:1c:63e0:eb40:21	16509 (AMAZON-02) (AMAZON-02)
1	13.32.27.7 13.32.27.7	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	35.157.63.144 35.157.63.144	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1 2	173.233.139.164 173.233.139.164	7979 (SERVERS-COM) (SERVERS-COM)
2 4	192.243.59.13 192.243.59.13	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1 2	192.243.61.225 192.243.61.225	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	18.238.243.5 18.238.243.5	16509 (AMAZON-02) (AMAZON-02)
3	172.67.166.98 172.67.166.98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4 6	2a00:1450:400... 2a00:1450:4001:830::200d	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:ba00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	3.124.78.15 3.124.78.15	16509 (AMAZON-02) (AMAZON-02)
1	13.32.121.95 13.32.121.95	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:215... 2600:9000:2156:400:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
2	45.133.44.10 45.133.44.10	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	85.17.80.16 85.17.80.16	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
84	27

18 51.89.234.230 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ns31202426.ip-51-89-234.eu

userupload.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.243.59.20 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

bluffforester.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hazelhideous.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2491:e00:1c:63e0:eb40:21 (United States)

ASN16509 (AMAZON-02, US)

d1spc7iz1ls2b1.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.7 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-7.fra56.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.63.144 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-63-144.eu-central-1.compute.amazonaws.com

professionalswebcheck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.233.139.164 (United States) 1 redirects

ASN7979 (SERVERS-COM, US)

replicafixedly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.243.59.13 (Ashburn, United States) 2 redirects

ASN39572 (ADVANCEDHOSTERS-AS, NL)

judicialfizzysoftball.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secondquaver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.243.61.225 (Ashburn, United States) 1 redirects

ASN39572 (ADVANCEDHOSTERS-AS, NL)

fountaingreat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

pogothere.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.238.243.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-243-5.ams58.r.cloudfront.net

townrusisedprivat.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.166.98 (United States)

ASN13335 (CLOUDFLARENET, US)

ivedmanyyea.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::200d (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:ba00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.78.15 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-78-15.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.121.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-95.fra60.r.cloudfront.net

count-server.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2156:400:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.133.44.10 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

cdn.cloudimagesb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.17.80.16 (Wolvega, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

cinsiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	userupload.net userupload.net	445 KB
11	gstatic.com fonts.gstatic.com www.gstatic.com	709 KB
10	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4214 buttons-config.sharethis.com — Cisco Umbrella Rank: 4712 l.sharethis.com — Cisco Umbrella Rank: 4359 count-server.sharethis.com — Cisco Umbrella Rank: 10437 platform-cdn.sharethis.com — Cisco Umbrella Rank: 9006	54 KB
10	google.com 4 redirects www.google.com — Cisco Umbrella Rank: 2 accounts.google.com — Cisco Umbrella Rank: 24	39 KB
5	bluffforester.com bluffforester.com	55 KB
3	ivedmanyyea.org ivedmanyyea.org	1 KB
3	townrusisedprivat.info townrusisedprivat.info	4 KB
3	cloudfront.net d1spc7iz1ls2b1.cloudfront.net	69 KB
2	cloudimagesb.com cdn.cloudimagesb.com — Cisco Umbrella Rank: 26568	171 KB
2	pogothere.xyz pogothere.xyz — Cisco Umbrella Rank: 31227	101 KB
2	secondquaver.com 1 redirects secondquaver.com — Cisco Umbrella Rank: 101816	4 KB
2	hazelhideous.com hazelhideous.com — Cisco Umbrella Rank: 222841	30 KB
2	fountaingreat.com 1 redirects fountaingreat.com — Cisco Umbrella Rank: 103820	4 KB
2	judicialfizzysoftball.com 1 redirects judicialfizzysoftball.com — Cisco Umbrella Rank: 102349	6 KB
2	replicafixedly.com 1 redirects replicafixedly.com — Cisco Umbrella Rank: 100639	4 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
1	cinsiant.com cinsiant.com Failed	2 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 110
1	professionalswebcheck.com professionalswebcheck.com — Cisco Umbrella Rank: 14693	300 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	253 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 223	7 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	91 KB
0	largepeering.com Failed largepeering.com Failed
0	friendshipmale.com Failed friendshipmale.com Failed
0	astoemobilohy.com Failed astoemobilohy.com Failed
84	25

	Domain	Requested by
18	userupload.net	userupload.net
6	platform-cdn.sharethis.com	userupload.net
6	accounts.google.com	4 redirects userupload.net
6	www.gstatic.com	www.google.com www.gstatic.com
5	fonts.gstatic.com	userupload.net www.google.com fonts.googleapis.com
5	bluffforester.com	userupload.net
4	www.google.com	userupload.net www.gstatic.com www.google.com
3	ivedmanyyea.org	userupload.net
3	townrusisedprivat.info	d1spc7iz1ls2b1.cloudfront.net
3	d1spc7iz1ls2b1.cloudfront.net	userupload.net townrusisedprivat.info
2	cdn.cloudimagesb.com	userupload.net
2	pogothere.xyz	d1spc7iz1ls2b1.cloudfront.net
2	secondquaver.com	1 redirects
2	hazelhideous.com	bluffforester.com
2	fountaingreat.com	1 redirects userupload.net
2	judicialfizzysoftball.com	1 redirects userupload.net
2	replicafixedly.com	1 redirects
1	fonts.googleapis.com	cinsiant.com
1	cinsiant.com	userupload.net
1	count-server.sharethis.com	platform-api.sharethis.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	www.facebook.com	userupload.net
1	professionalswebcheck.com	bluffforester.com
1	www.google-analytics.com	www.googletagmanager.com
1	cdnjs.cloudflare.com	userupload.net
1	platform-api.sharethis.com	userupload.net
1	www.googletagmanager.com	userupload.net
0	largepeering.com Failed
0	friendshipmale.com Failed	hazelhideous.com
0	astoemobilohy.com Failed	userupload.net
84	31

This site contains no links.

Subject Issuer	Validity	Valid
userupload.net cPanel, Inc. Certification Authority	`2023-10-17` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
bluffforester.com R3	`2023-10-24` - `2024-01-22`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
sharethis.com Amazon RSA 2048 M02	`2023-05-20` - `2024-06-17`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
professionalswebcheck.com Amazon RSA 2048 M03	`2023-08-30` - `2024-09-27`	a year	crt.sh
hazelhideous.com R3	`2023-09-23` - `2023-12-22`	3 months	crt.sh
townrusisedprivat.info Amazon RSA 2048 M03	`2023-10-12` - `2024-11-09`	a year	crt.sh
ivedmanyyea.org E1	`2023-10-22` - `2024-01-20`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-08-08` - `2023-11-06`	3 months	crt.sh
cdn.cloudimagesb.com R3	`2023-09-24` - `2023-12-23`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
cinsiant.com R3	`2023-10-05` - `2024-01-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff186bca&PLACEMENT_ID=20332934&CAMPAIGN_ID=779837&PUBLISHER_ID=93576&ZONE_ID=116639
Frame ID: 4B227CF5B5101827FA95ACE0B04ABA79
Requests: 70 HTTP requests in this frame

Frame: https://townrusisedprivat.info/YmZWc0gDBDUedwNbNFU9EAprVnokQ2Q1LFMVJhB/CxxnHztQBGddKw4JIxcuEAk4B2YMAyJWeiQNMicgUShkKh80HjohHzMgBDY/Ej4EIiAlIjpGCyoOZzYLMBIfICUjExIEcAE+AioKAAEbIQ0FXzUgLzgnESUjODMQBxw6NDomH1I3MzUkLyMFMjAwNy4qKTdWJhUOMCwOMiQvKRImASwjBD4dIDQmKgAgHgM0eTgiBEB9ISEAKRkhDTUVDTAeATZ5BTQUG3kkJCEUCiozAzseUjMBITAoMBgLeSQkLjYrNA0TNxlSPGAmLzQxEiJ9Ji49PQAhJHspACQOOhcJJC8TOyQnIhMfGRgiAyIJMSMPPB0FMAErHi8ABwQ7OC4DJXgzVjU6D1NSGDYKUyAUBA0zMS4LETZXFzgaUzcZMXkBBwMYBioAPSoPOgolOh8zLDAnCRY8FB8sIS4DJgAkNAQWDgkzBiYJDR4XHx4hID0iCjMnFzUaBUA8ACcMFmskABhRPRkYFjAi
Frame ID: DD6CFB1E754DF85785565BEB3CC5A385
Requests: 2 HTTP requests in this frame

Frame: https://townrusisedprivat.info/eEcyaW0ZJVEEUhl6UE8YCisPTF8+YgAvCUk0QgpaET0DBR5KJQNHDhQoRw0LCihcHUMWIkZMXz4OYAQdKxJmJAE6E0VaKTwOdicADwRWBR0SJnMZXiwDVQA1OyBTCxcMAnQRGjwFAw4cIHRjBT4rDWowXhwheB48SSVwPAc6A3QaLBUGficHNQhRAhoWCnNdHzoUVV01ASh+DV82dlFZPxEjcy9fKS5nXTUrDnQjPjEQVi8CQA1gM10vKnwBJSAdYjA/NRBWLwIUCHRYGiApVgAOLwlrMAQTAVECI0seRSQDPy57UDsSAmIkKQgmfwJUHwFFM1wgHx8RBDoQfDA0FitrJQVMYgAvPSodAiI1HC1zEAI8CGY4OhwBXVgjPgZGKzUMd3MxNDIIWycOMzALWjRLEQE+XwhiAC8sSi9UCF8fBlMvGRIdWjNdLy53HjsrJGsmXikFcy9UEB1aWFwgD2MCKRYkFAMeFylCVAcPFkQ4OxMrBw
Frame ID: C5323A039FC1AD56E2EE6334A6378D52
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX&co=aHR0cHM6Ly91c2VydXBsb2FkLm5ldDo0NDM.&hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&size=normal&cb=r1t4ag8070x6
Frame ID: AC0E06F9CE47C174312891457285ADF1
Requests: 8 HTTP requests in this frame

Frame: https://cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png
Frame ID: 13D1637437E7F9DDDD6447BA62DEC61A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX
Frame ID: B75C349864DB341D298F8E874B45EA44
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Adblocker

Page URL History Show full URLs

https://userupload.net/h9npt0hs2hpl Page URL
https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff18... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

84
Requests

83 %
HTTPS

46 %
IPv6

25
Domains

31
Subdomains

27
IPs

4
Countries

1787 kB
Transfer

3806 kB
Size

49
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://userupload.net/h9npt0hs2hpl Page URL
https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff186bca&PLACEMENT_ID=20332934&CAMPAIGN_ID=779837&PUBLISHER_ID=93576&ZONE_ID=116639 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1 HTTP 307
https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=c24ad0c2a95218dd0d7c2b8274f004a1446d767b4609e15cc1874fd7c4c0621c63b92b515b28de317dba2d7a78713e3524c69d46827e079bca2cc60a65e44b996f4d618ea1c1a097cf2b377a58e7a43028a09089cf1e2b2321a27e14f94a43&pst=1698612227&rmtc=t

Request Chain 28

https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1 HTTP 307
https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=f86dbe1639e849c59b66b5702d7fac51ce4eaf5485af37cc7edf13b857c5166b848e7c2865fd8662d1bdae49edf1e7a4f11c60bbb8636095622e9d60dad1e8d3b666175dfeb4f29844d8f867032ccd58b89b4257f8dfb62d999daa6ee2a788&pst=1698612227&rmtc=t

Request Chain 30

https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1 HTTP 307
https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=af870741e83d3dbf112f19fc9b1988cd2f887c5db92448dc8e33dfb66cbb1a16796f74709a132b163b2fcee6ddf87ba31d2e1108c48207156f840ade2c223448ed93f821d7a0b329834edcaabf3ae4ac3da6d40f2744aaf70acfa8719711ac&pst=1698612227&rmtc=t

Request Chain 35

https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1 HTTP 307
https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=9b57b974b46068df6b8282daaac2dbc7c1ac4d9c0968bd4f45b6753780bd44576fe69f83c314711b3f28c1e2fb2da0ffcb835f70e18c44c5775d93aea2f0a8c5ce533d47af7df88f321b909d536478f09a1656a191c2dc3bcdcdb36f1f1e53&pst=1698612227&rmtc=t

Request Chain 43

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP 302
https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AVQVeyyir5f6o0rqZqJXDLTSgdpSmkPocch_nrPaKFQDxzhe02N2ZYDOX7AVPETYnWu1dL1ezNUlfw HTTP 302
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyyclsc6PIQzStzARhLGzd14tV40bBk49sTKzmmbkpXu1eC8Z0O5-_Tiy6zvda-CmUi2aCExpw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S151959732%3A1698612167405840&theme=glif

Request Chain 44

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP 302
https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AVQVeyzUriV_cSVZk-0SuZqgvTO5dwxhZjFuFMTcLugSMhoFWROtwYFSUr2MMbv8zS9ycsMeTM9yeQ HTTP 302
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyz4hqyNYv2EZQRHff7gd3RbgyzJgFTER7Dx_5fuF3wyCvQHLEuFI1UGheVu-YmQVFGYe7ByGA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1928947429%3A1698612167453492&theme=glif

84 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK h9npt0hs2hpl Show response
userupload.net/ 18 KB
8 KB 261ms
152ms Document
text/html 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ns31202426.ip-51-89-234.eu

Software

Apache /

Resource Hash

b8c94f1ada7a847bf264caaa511735bd46ba84e4599e3a4541e733c08cda65b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0;includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 7976
Content-Type: text/html; charset=UTF-8
Date: Sun, 29 Oct 2023 20:42:44 GMT
Expires: Sat, 28 Oct 2023 20:42:44 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Strict-Transport-Security: max-age=0;includeSubDomains;
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK jquery-1.9.1.min.js Show response
userupload.net/ds2/js/ 90 KB
32 KB 65ms
64ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/jquery-1.9.1.min.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Sep 2017 22:09:54 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 32775

GET
H/1.1 200
OK jquery.paging.js Show response
userupload.net/ds2/js/ 19 KB
5 KB 134ms
48ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/jquery.paging.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Sep 2017 22:09:56 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4362

GET
H/1.1 200
OK jquery.cookie.js Show response
userupload.net/ds2/js/ 3 KB
2 KB 135ms
46ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/jquery.cookie.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Sep 2017 22:09:56 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1365

GET
H/1.1 200
OK paging.js Show response
userupload.net/ds2/js/ 2 KB
975 B 135ms
47ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/paging.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: e1d4f21db649ec5795e70cb72e59fdec97af300c64b5d8abbc67f00688eb0ecd

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Sep 2017 22:09:57 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 662

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 276 KB
91 KB 116ms
48ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TH960MSE9Y

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3dc0cd49b944e32271118b0148e231acafdbf2b4ef1be7a411da306481076c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93126
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 29 Oct 2023 20:42:44 GMT

GET
H/1.1 200
OK style.min.css
userupload.net/ds2/css/ 179 KB
35 KB 154ms
69ms Stylesheet
text/css 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 2df25ed583d39ca73718949dd3c20036cdfba57ce4725b2a4564a47071b8be9c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 Feb 2021 19:11:32 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 35078

GET
H/1.1 200
OK logo.png
userupload.net/ds2/img/ 3 KB
3 KB 133ms
45ms Image
image/png 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://userupload.net/ds2/img/logo.png
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 57ee478f48f0c5119a65bcab51b18ab6e7db8cb4db90a0fc8a6bfbb4c1af2d23

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Last-Modified: Mon, 01 Mar 2021 06:10:59 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2979

GET
H/1.1 200
OK countdown.js Show response
userupload.net/ds2/js/ 640 B
665 B 45ms
45ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/countdown.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 6b1116dbdcc8665059c0163cb6cd034a949402f5bc6294390e8ffee39952f6ae

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Sep 2017 05:59:30 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 353

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 110ms
41ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b6ec7b998324bc41dbd7b3610f9cb6c649b0db416a9f1b567a7136d440478428

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 29 Oct 2023 20:42:44 GMT

GET
H/1.1 200
OK invoke.js Show response
bluffforester.com/da658283644b19b2a89bf86c11c02af4/ 24 KB
10 KB 2163ms
122ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bluffforester.com/da658283644b19b2a89bf86c11c02af4/invoke.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

677df6ea3169eb2b465dff06855446e884a8edbdeff56dd3cfbd6123d6fa4df2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:46 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: 848c5085b55c55673b5c946cd06b10a5
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 / Show response
d1spc7iz1ls2b1.cloudfront.net/ 205 KB
68 KB 270ms
195ms Script
text/plain 2600:9000:2491:e00:1c:63e0:eb40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:e00:1c:63e0:eb40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 3fae9561912cd3b529dea4c2c6534ba552f57cbcfd8de56937d8c95e7e008008

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Oct 2023 20:42:44 GMT
content-encoding: gzip
via: 1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-length: 69441
x-amz-cf-id: SYxnAkKJh3f7_AoTXy2C5Tq-YnUG-ATw-5OGGWOsjF-kaSoN9YzGWw==

GET
H/1.1 200
OK bootstrap.min.js Show response
userupload.net/ds2/js/ 57 KB
15 KB 49ms
48ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/bootstrap.min.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Aug 2019 22:42:17 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 15437

GET
H/1.1 200
OK clipboard.min.js Show response
userupload.net/ds2/js/ 11 KB
4 KB 45ms
44ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/clipboard.min.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Sep 2017 22:09:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3397

GET
H/1.1 200
OK main.js Show response
userupload.net/ds2/js/ 423 B
562 B 44ms
43ms Script
application/javascript 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/js/main.js
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: c1bd88cc54165fd50700598361e7484401e4cc1525866fa5a73e8a463df5c226

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/h9npt0hs2hpl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 Oct 2019 22:11:55 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 250

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 206 KB
46 KB 117ms
35ms Script
text/javascript 13.32.27.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-7.fra56.r.cloudfront.net

Software

Resource Hash

e8fb66ed72a123035a7db66792a79a2d9a29a5964d5f535c453134724a492ad3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:36:23 GMT
content-encoding: gzip
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-C2
age: 381
etag: W/"33972-CrRmRc8sAnbpegWjlvDK48kZ17k"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: 4ulef4Uv-k4eHjuvlc6De4L49UH_KZilqJOONG7QyOfoeCPoytbhCg==

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ 21 KB
7 KB 149ms
52ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2052525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6646
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-520c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g1oFW0QvrQrFisYTkw8ol%2BuV1xoMFF%2BhXcjMP5FsS5rngbk6o3%2Bwa5AP4oTcqVNVOLgcL7dV8HaNZAEnf3DWp2T2bEpw8%2BlBF0owVfz%2BRIsN0DqufTBfdbXss0SaO4Pxh1uJibWlcf%2FV01mPsZ3x8tzh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 81de3f2cdfb0f1a4-CDG
expires: Fri, 18 Oct 2024 20:42:44 GMT

GET
H/1.1 200
OK bootstrap.min.css
userupload.net/ds2/css/ 152 KB
23 KB 63ms
63ms Stylesheet
text/css 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/css/bootstrap.min.css
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Aug 2019 22:42:18 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 23238

GET
H/1.1 200
OK brandon_bld-webfont.woff2
userupload.net/ds2/fonts/ 27 KB
27 KB 55ms
54ms Font
font/woff2 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/fonts/brandon_bld-webfont.woff2
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: c56fd6b910ca93a3fb1875e35074b8ce8501c319ebaa0e8b7252f7e4a7023fe6

Request headers

Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Sat, 07 Sep 2019 21:56:34 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 27492

GET
H/1.1 200
OK fa-duotone-900.woff2
userupload.net/ds2/fa/webfonts/ 162 KB
161 KB 57ms
56ms Font
font/woff2 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/fa/webfonts/fa-duotone-900.woff2
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 3477023d8b7129eb517abf377492a608f2469ae91405fa62974e6771751e04ae

Request headers

Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:44 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Aug 2019 23:45:51 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98

GET
H2 200 va9E4kDNxMZdWfMOD5Vvl4jO.ttf
fonts.gstatic.com/s/firasans/v10/ 54 KB
27 KB 171ms
52ms Font
font/ttf 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v10/va9E4kDNxMZdWfMOD5Vvl4jO.ttf

Requested by

Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08d4e6308d4549372380e8a8d6b3de7613d304b43c2e6f50053af0338e5e0f67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://userupload.net/
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 10:50:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 467560
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26757
x-xss-protection: 0
last-modified: Mon, 22 Jul 2019 19:21:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Oct 2024 10:50:04 GMT

GET
H/1.1 200
OK invoke.js Show response
bluffforester.com/2a52451ddfaa9a4d7003093ee8c350f8/ 29 KB
11 KB 1940ms
120ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bluffforester.com/2a52451ddfaa9a4d7003093ee8c350f8/invoke.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

6993ec542e2c2c04b399fed082b8f3b809b1e055a22ba1cdabde732561f7a27f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

Referer: https://userupload.net/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sun, 29 Oct 2023 20:42:46 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: 2d5c6d0d933e8cde4493fbffc4f00800
Expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
253 B 164ms
52ms Ping
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TH960MSE9Y&gtm=45je3ap0v9112166607&_p=1003679690&gcd=11l1l1l1l1&cid=1182492278.1698612165&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1698612164&sct=1&seg=0&dl=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&dt=Download%20Odin3%20Patched%20User%20Upload%20zip&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TH960MSE9Y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Oct 2023 20:42:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://userupload.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 stats Show response
professionalswebcheck.com/ 40 B
300 B 112ms
31ms XHR
text/html 35.157.63.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://professionalswebcheck.com/stats
Requested by: Host: bluffforester.com
URL: https://bluffforester.com/2a52451ddfaa9a4d7003093ee8c350f8/invoke.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.63.144 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-63-144.eu-central-1.compute.amazonaws.com
Software: fasthttp /
Resource Hash: f62bc5facadc1f4b1433d4ab07cfd085ae85f855b5e53e519261e0f114e72c19

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-origin: https://userupload.net
date: Sun, 29 Oct 2023 20:42:46 GMT
access-control-allow-credentials: true
server: fasthttp
content-length: 40
vary: Origin
content-type: text/html; charset=UTF-8

GET
H2 200 recaptcha__de_ch.js Show response
www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/ 464 KB
186 KB 99ms
31ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/recaptcha__de_ch.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f8a69b2a2b34f9ad653d8d8627fb36573303a4442a5aff2699707a5ccebf033

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://userupload.net/
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 19:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524215
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190291
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 04:01:46 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 22 Oct 2024 19:05:51 GMT

GET
H/1.1 200
OK invoke.js Show response
bluffforester.com/6471ee1beab1464ffb43e4c3cd392ad9/ 29 KB
11 KB 120ms
119ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bluffforester.com/6471ee1beab1464ffb43e4c3cd392ad9/invoke.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

ef871f82f06a667cfe9a0ec8f3763bbfa168a93483f7a3ba688a8fbb621d7e9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

Referer: https://userupload.net/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sun, 29 Oct 2023 20:42:46 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: d7ac964350b6678a859daaa042088130
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 va9B4kDNxMZdWfMOD5VnLK3eRhf_.ttf
fonts.gstatic.com/s/firasans/v10/ 58 KB
28 KB 31ms
30ms Font
font/ttf 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v10/va9B4kDNxMZdWfMOD5VnLK3eRhf_.ttf

Requested by

Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1ed14c8d4e5852e773d44304a3a33507ff993a4b6b70ea1d9fb8c6f68e7318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://userupload.net/
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 23:26:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 162955
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
last-modified: Mon, 22 Jul 2019 19:22:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 23:26:51 GMT

GET
H/1.1

200
OK

watch.577143801586.js Show response
replicafixedly.com/
Redirect Chain

https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F...
https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F...

2 KB
2 KB

135ms
131ms

XHR
text/html

173.233.139.164
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=c24ad0c2a95218dd0d7c2b8274f004a1446d767b4609e15cc1874fd7c4c0621c63b92b515b28de317dba2d7a78713e3524c69d46827e079bca2cc60a65e44b996f4d618ea1c1a097cf2b377a58e7a43028a09089cf1e2b2321a27e14f94a43&pst=1698612227&rmtc=t

Protocol

HTTP/1.1

Server

173.233.139.164 , United States, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

1f0f827adcce430b779f777fa60fb738ee29ab0a14cb78a79a5f3ea8b4268ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: d1c547fcdb94d34b7d479ff97fb5903f
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Redirect headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Location: https://replicafixedly.com/watch.577143801586.js?key=2a52451ddfaa9a4d7003093ee8c350f8&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=c24ad0c2a95218dd0d7c2b8274f004a1446d767b4609e15cc1874fd7c4c0621c63b92b515b28de317dba2d7a78713e3524c69d46827e079bca2cc60a65e44b996f4d618ea1c1a097cf2b377a58e7a43028a09089cf1e2b2321a27e14f94a43&pst=1698612227&rmtc=t
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
X-Request-ID: 51001ed5ebe07964edd3a4417b78152f
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1

200
OK

watch.796775905094.js Show response
judicialfizzysoftball.com/
Redirect Chain

https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=http...
https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=http...

3 KB
3 KB

130ms
130ms

XHR
text/html

192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=f86dbe1639e849c59b66b5702d7fac51ce4eaf5485af37cc7edf13b857c5166b848e7c2865fd8662d1bdae49edf1e7a4f11c60bbb8636095622e9d60dad1e8d3b666175dfeb4f29844d8f867032ccd58b89b4257f8dfb62d999daa6ee2a788&pst=1698612227&rmtc=t

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

705098458437cc0b2e20cf4605a95288c776ad5f5480d99cdd90d96d083eab5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: b06374e8348ab080f1426edd0aa99545
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Redirect headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Location: https://judicialfizzysoftball.com/watch.796775905094.js?key=6471ee1beab1464ffb43e4c3cd392ad9&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=f86dbe1639e849c59b66b5702d7fac51ce4eaf5485af37cc7edf13b857c5166b848e7c2865fd8662d1bdae49edf1e7a4f11c60bbb8636095622e9d60dad1e8d3b666175dfeb4f29844d8f867032ccd58b89b4257f8dfb62d999daa6ee2a788&pst=1698612227&rmtc=t
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
X-Request-ID: 5a38d815ded89e6b8e5cb5f9c56ad35c
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK invoke.js Show response
bluffforester.com/7772365077de4e3fc3be259331d35bd0/ 29 KB
11 KB 120ms
120ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bluffforester.com/7772365077de4e3fc3be259331d35bd0/invoke.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

977e6947fd01cae743facbd0862fc7b7866cf35b6c031b2515ea854bc177a8e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

Referer: https://userupload.net/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sun, 29 Oct 2023 20:42:46 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: c1f0552992f896cdf09b8fe5c4d74aaa
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1

200
OK

watch.757505697144.js Show response
fountaingreat.com/
Redirect Chain

https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%...
https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%...

2 KB
2 KB

153ms
148ms

XHR
text/html

192.243.61.225
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=af870741e83d3dbf112f19fc9b1988cd2f887c5db92448dc8e33dfb66cbb1a16796f74709a132b163b2fcee6ddf87ba31d2e1108c48207156f840ade2c223448ed93f821d7a0b329834edcaabf3ae4ac3da6d40f2744aaf70acfa8719711ac&pst=1698612227&rmtc=t

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Server

192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.21.6 /

Resource Hash

0bd4270ec2383b5693ad8be7c262cbcc70b1fa8597f3dad996ce6c170b000e1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: 754fd271fc635b584fcdb02bd2424423
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Redirect headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.21.6
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Location: https://fountaingreat.com/watch.757505697144.js?key=7772365077de4e3fc3be259331d35bd0&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=af870741e83d3dbf112f19fc9b1988cd2f887c5db92448dc8e33dfb66cbb1a16796f74709a132b163b2fcee6ddf87ba31d2e1108c48207156f840ade2c223448ed93f821d7a0b329834edcaabf3ae4ac3da6d40f2744aaf70acfa8719711ac&pst=1698612227&rmtc=t
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
X-Request-ID: 668c4ad392f330bfa0019ca1bd267246
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK invoke.js Show response
bluffforester.com/46c32dd61a2116860dacdff2d0b50b7b/ 29 KB
11 KB 122ms
121ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bluffforester.com/46c32dd61a2116860dacdff2d0b50b7b/invoke.js

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

672b69ed3eca9f82e9de5c80674fdb9b800fdd54367dc152251b2ba5ec8d3179

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

Referer: https://userupload.net/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: 41291cdb60768b620864bdf97abb7235
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK ntv.json
hazelhideous.com/ 4 KB
6 KB 952ms
249ms XHR
application/json 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hazelhideous.com/ntv.json?key=da658283644b19b2a89bf86c11c02af4&vstc=1&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&custom=%7B%22d37e3bc4%22%3A%22a%22%7D

Requested by

Host: bluffforester.com
URL: https://bluffforester.com/da658283644b19b2a89bf86c11c02af4/invoke.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: application/json
Access-Control-Allow-Origin: https://userupload.net
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 4399
X-Request-ID: 23cae64070f6ebb63b582cb0292f2ac3
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK brandon_med-webfont.woff2
userupload.net/ds2/fonts/ 27 KB
28 KB 46ms
45ms Font
font/woff2 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/fonts/brandon_med-webfont.woff2
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 8bedd3a9d3d20f71aa28c17e75c18ddc9a323b823275ae9bec6a1b673ea646f5

Request headers

Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 07 Sep 2019 21:56:34 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 28003

GET
H/1.1 200
OK brandon_blk-webfont.woff2
userupload.net/ds2/fonts/ 26 KB
27 KB 46ms
46ms Font
font/woff2 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/fonts/brandon_blk-webfont.woff2
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: f13d4a23664d1a212e275c7ccd6073d3751cd3554820a78fbf697a1fd6e251a3

Request headers

Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 07 Sep 2019 21:56:34 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 26941

GET
H/1.1

200
OK

watch.354534408455.js
secondquaver.com/
Redirect Chain

https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2...
https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2...

2 KB
2 KB

167ms
167ms

XHR
text/html

192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=9b57b974b46068df6b8282daaac2dbc7c1ac4d9c0968bd4f45b6753780bd44576fe69f83c314711b3f28c1e2fb2da0ffcb835f70e18c44c5775d93aea2f0a8c5ce533d47af7df88f321b909d536478f09a1656a191c2dc3bcdcdb36f1f1e53&pst=1698612227&rmtc=t

Protocol

HTTP/1.1

Server

192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Content-Encoding: gzip
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Request-ID: c6187553d49e3e10c6cea1ad2ae01523
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Redirect headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Custom-Referer: https://userupload.net
Strict-Transport-Security: max-age=0; includeSubdomains
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Access-Control-Allow-Origin: https://userupload.net
Location: https://secondquaver.com/watch.354534408455.js?key=46c32dd61a2116860dacdff2d0b50b7b&kw=%5B%22download%22%2C%22odin3%22%2C%22patched%22%2C%22user%22%2C%22upload%22%2C%22zip%22%5D&refer=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&tz=1&dev=r&res=14.31&uuid=65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1&shu=9b57b974b46068df6b8282daaac2dbc7c1ac4d9c0968bd4f45b6753780bd44576fe69f83c314711b3f28c1e2fb2da0ffcb835f70e18c44c5775d93aea2f0a8c5ce533d47af7df88f321b909d536478f09a1656a191c2dc3bcdcdb36f1f1e53&pst=1698612227&rmtc=t
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
X-Request-ID: f4742d21823c0f2d8c01641c3b462f9d
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 asd100.bin Show response
pogothere.xyz/ 100 KB
101 KB 116ms
49ms Fetch
binary/octet-stream 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pogothere.xyz/asd100.bin
Requested by: Host: d1spc7iz1ls2b1.cloudfront.net
URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5076
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 29 Oct 2023 19:18:11 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: https://userupload.net
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YdQHcfm49b4aR7IV62qDzNxP0GbcoRMzPIWgavkh6HWklikWfkVfOJXvaO9rQSVIwc%2BFbirkHKJtVTUVrtSPa5SJZC1IxoZYpKN4vHoDQXinrDJE0AoTzgJYuMYvuQrs"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 81de3f3d5c3c3b5d-GVA
access-control-allow-headers: X-Requested-With, content-type

GET
H2 200 / Show response
pogothere.xyz/ 27 B
369 B 314ms
247ms Fetch
text/plain 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pogothere.xyz/
Requested by: Host: d1spc7iz1ls2b1.cloudfront.net
URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01d91977befeb9f282f4b13170416c22e8b3f1e8570e79a362c975352f57e5b1

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LKijT%2Fky5m1fKI1m4C3fe9%2Bywu1dHFeyd9BRr%2FWyuBO%2Fz1mTYm8eHLDY9O1TtKSo1074oAjGKAy7FBEZOmBaIQPdYiF6ePOEVfvHHpDJOByrJ2BUf1Pc51UCdmo5Jm5l"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
access-control-allow-origin: https://userupload.net
content-type: text/plain
access-control-allow-credentials: true
cf-ray: 81de3f3d5c3b3b5d-GVA
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400

GET
H2 204 utx Show response
townrusisedprivat.info/ 0
538 B 200ms
119ms XHR
text/plain 18.238.243.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://townrusisedprivat.info/utx?cb=v9f4gxJfJdah&top=userupload.net&tid=1001987
Requested by: Host: d1spc7iz1ls2b1.cloudfront.net
URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-5.ams58.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Oct 2023 20:42:47 GMT
via: 1.1 7b082441eaf35142a6f7785a74fb7a50.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-amz-cf-pop: AMS58-P1
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://userupload.net
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
x-amz-cf-id: 8Rbbck1llXPi8vPwUnQAiPkZXOdqPm9yL-4Mn00LBy_ajlBcrkpF6Q==

GET
H2 200 Ej4EIiAlIjpGCyoOZzYLMBIfICUjExIEcAE+AioKAAEbIQ0FXzUgLzgnESUjODMQBxw6NDomH1I3MzUkLyMFMjAwNy4qKTdWJhUOMCwOMiQvKRImASwjBD4dIDQmKgAgHgM0eTgiBEB9ISEAKRkhDTUVDTAeATZ5BTQUG3kkJCEUCiozAzseUjMBITAoMBgLeSQkL... Show response
townrusisedprivat.info/YmZWc0gDBDUedwNbNFU9EAprVnokQ2Q1LFMVJhB/CxxnHztQBGddKw4JIxcuEAk4B2YMAyJWeiQNMicgUShkKh80HjohHzMgBDY/ Frame DD6C 3 KB
2 KB 301ms
240ms Document
text/html 18.238.243.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://townrusisedprivat.info/YmZWc0gDBDUedwNbNFU9EAprVnokQ2Q1LFMVJhB/CxxnHztQBGddKw4JIxcuEAk4B2YMAyJWeiQNMicgUShkKh80HjohHzMgBDY/Ej4EIiAlIjpGCyoOZzYLMBIfICUjExIEcAE+AioKAAEbIQ0FXzUgLzgnESUjODMQBxw6NDomH1I3MzUkLyMFMjAwNy4qKTdWJhUOMCwOMiQvKRImASwjBD4dIDQmKgAgHgM0eTgiBEB9ISEAKRkhDTUVDTAeATZ5BTQUG3kkJCEUCiozAzseUjMBITAoMBgLeSQkLjYrNA0TNxlSPGAmLzQxEiJ9Ji49PQAhJHspACQOOhcJJC8TOyQnIhMfGRgiAyIJMSMPPB0FMAErHi8ABwQ7OC4DJXgzVjU6D1NSGDYKUyAUBA0zMS4LETZXFzgaUzcZMXkBBwMYBioAPSoPOgolOh8zLDAnCRY8FB8sIS4DJgAkNAQWDgkzBiYJDR4XHx4hID0iCjMnFzUaBUA8ACcMFmskABhRPRkYFjAi
Requested by: Host: d1spc7iz1ls2b1.cloudfront.net
URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-5.ams58.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 597f68e9fb6645b6289948b0b347377681784b420567a33a94038cb05ae2d9ee

Request headers

Referer: https://userupload.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
cache-control: no-store, no-cache, must-revalidate, no-transform
content-encoding: gzip
content-length: 1231
content-type: text/html
date: Sun, 29 Oct 2023 20:42:47 GMT
p3p: CP="NID DSP ALL COR"
pragma: no-cache
server: openresty/1.17.8.2
via: 1.1 7b082441eaf35142a6f7785a74fb7a50.cloudfront.net (CloudFront)
x-amz-cf-id: 6WIWbsOK4tbHjcogGZSd2x6CWMIuAqKLBfWwpIAs37dzSdmK_BCaKQ==
x-amz-cf-pop: AMS58-P1
x-cache: Miss from cloudfront

GET
H2 200 NRBWLwIUCHRYGiApVgAOLwlrMAQTAVECI0seRSQDPy57UDsSAmIkKQgmfwJUHwFFM1wgHx8RBDoQfDA0FitrJQVMYgAvPSodAiI1HC1zEAI8CGY4OhwBXVgjPgZGKzUMd3MxNDIIWycOMzALWjRLEQE+XwhiAC8sSi9UCF8fBlMvGRIdWjNdLy53HjsrJGsmXikFc... Show response
townrusisedprivat.info/eEcyaW0ZJVEEUhl6UE8YCisPTF8+YgAvCUk0QgpaET0DBR5KJQNHDhQoRw0LCihcHUMWIkZMXz4OYAQdKxJmJAE6E0VaKTwOdicADwRWBR0SJnMZXiwDVQA1OyBTCxcMAnQRGjwFAw4cIHRjBT4rDWowXhwheB48SSVwPAc6A3QaLB... Frame C532 3 KB
2 KB 162ms
121ms Document
text/html 18.238.243.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://townrusisedprivat.info/eEcyaW0ZJVEEUhl6UE8YCisPTF8+YgAvCUk0QgpaET0DBR5KJQNHDhQoRw0LCihcHUMWIkZMXz4OYAQdKxJmJAE6E0VaKTwOdicADwRWBR0SJnMZXiwDVQA1OyBTCxcMAnQRGjwFAw4cIHRjBT4rDWowXhwheB48SSVwPAc6A3QaLBUGficHNQhRAhoWCnNdHzoUVV01ASh+DV82dlFZPxEjcy9fKS5nXTUrDnQjPjEQVi8CQA1gM10vKnwBJSAdYjA/NRBWLwIUCHRYGiApVgAOLwlrMAQTAVECI0seRSQDPy57UDsSAmIkKQgmfwJUHwFFM1wgHx8RBDoQfDA0FitrJQVMYgAvPSodAiI1HC1zEAI8CGY4OhwBXVgjPgZGKzUMd3MxNDIIWycOMzALWjRLEQE+XwhiAC8sSi9UCF8fBlMvGRIdWjNdLy53HjsrJGsmXikFcy9UEB1aWFwgD2MCKRYkFAMeFylCVAcPFkQ4OxMrBw
Requested by: Host: d1spc7iz1ls2b1.cloudfront.net
URL: https://d1spc7iz1ls2b1.cloudfront.net/?icpsd=1001987
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-5.ams58.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 56348e148d50c4d4e805cae6fc68b2e1964a11306af9b4bdfc97fb021e7a5a57

Request headers

Referer: https://userupload.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
cache-control: no-store, no-cache, must-revalidate, no-transform
content-encoding: gzip
content-length: 1215
content-type: text/html
date: Sun, 29 Oct 2023 20:42:47 GMT
p3p: CP="NID DSP ALL COR"
pragma: no-cache
server: openresty/1.17.8.2
via: 1.1 7b082441eaf35142a6f7785a74fb7a50.cloudfront.net (CloudFront)
x-amz-cf-id: IbqfLpIgqtx-4nZ0Uo37rUSRCmCr9Bh6e5idnJW7KY9NtRNRuTZTbQ==
x-amz-cf-pop: AMS58-P1
x-cache: Miss from cloudfront

GET
H2 204 RWRuTzFqWw08DAohJCRVdD0jK2cHJww4CDI8O3pHASwKLGN3B0g7WCFZX38BdF1WeBc1DQpyAGMXGi5FMBdTfhcsCgggDGMSU34fdlBAfAVrVEg6DHRCGj9QIllfaUExEAJyAHNdVnkAd1VYeAB9UA
ivedmanyyea.org/ 0
245 B 218ms
152ms Image
text/plain 172.67.166.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ivedmanyyea.org/RWRuTzFqWw08DAohJCRVdD0jK2cHJww4CDI8O3pHASwKLGN3B0g7WCFZX38BdF1WeBc1DQpyAGMXGi5FMBdTfhcsCgggDGMSU34fdlBAfAVrVEg6DHRCGj9QIllfaUExEAJyAHNdVnkAd1VYeAB9UA
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.166.98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F9eIquHLjhcwaqBLtotLSkCw2dxK8VM8euDpY%2BdqoSPjLx99g9wLgDUQV93s0ibN4yxl9FUNqK%2FbVS2tz98iO%2BTa1Bsecm7rfYkxsYAsce%2BgQwa4MXiQymrBWJN0uMv2ib0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 81de3f3daa643b52-GVA
alt-svc: h3=":443"; ma=86400

GET
H2 200 login.php
www.facebook.com/ 0
0 371ms
303ms Image
text/html 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2

403

identifier
accounts.google.com/v3/signin/
Redirect Chain

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AVQVeyyir5f6o0rqZqJXDLTSgdpSmkPocch_nrPaKFQDxzhe02N2ZYDOX7AVPET...
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyyclsc6PIQzStzARhLGzd14tV40bBk49sTKzmmbkpXu1eC8Z0O5-_Tiy6zvda-CmUi2aCExpw&passiv...

0
0

57ms
51ms

Image
text/html

2a00:1450:4001:830::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyyclsc6PIQzStzARhLGzd14tV40bBk49sTKzmmbkpXu1eC8Z0O5-_Tiy6zvda-CmUi2aCExpw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S151959732%3A1698612167405840&theme=glif
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Server: 2a00:1450:4001:830::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Redirect headers

date: Sun, 29 Oct 2023 20:42:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'report-sample' 'nonce-Jjjoqbv9svcmliFc51cFBA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 404
x-xss-protection: 1; mode=block
pragma: no-cache
server: GSE
x-frame-options: DENY
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type: text/html; charset=UTF-8
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyyclsc6PIQzStzARhLGzd14tV40bBk49sTKzmmbkpXu1eC8Z0O5-_Tiy6zvda-CmUi2aCExpw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S151959732%3A1698612167405840&theme=glif
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

403

identifier
accounts.google.com/v3/signin/
Redirect Chain

https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AVQVeyzUriV_cSVZk-0SuZqgvTO5dwxhZjFuFMTcLugSMhoFWROtwYFSUr2...
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyz4hqyNYv2EZQRHff7gd3RbgyzJgFTER7Dx_5fuF3wyCvQHLEuFI1UGheVu-YmQVFGYe7ByGA&passi...

0
0

78ms
77ms

Image
text/html

2a00:1450:4001:830::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyz4hqyNYv2EZQRHff7gd3RbgyzJgFTER7Dx_5fuF3wyCvQHLEuFI1UGheVu-YmQVFGYe7ByGA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1928947429%3A1698612167453492&theme=glif
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H3
Server: 2a00:1450:4001:830::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Redirect headers

date: Sun, 29 Oct 2023 20:42:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'report-sample' 'nonce-JibaUvCAk6vtLauZm_vQng' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 408
x-xss-protection: 1; mode=block
pragma: no-cache
server: GSE
x-frame-options: DENY
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type: text/html; charset=UTF-8
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyz4hqyNYv2EZQRHff7gd3RbgyzJgFTER7Dx_5fuF3wyCvQHLEuFI1UGheVu-YmQVFGYe7ByGA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1928947429%3A1698612167453492&theme=glif
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 204 RDkEAT8NaVYdIlY3TVI6DWleRGICdkRSOQ1pVgA8UT9NRWpALAQYcQFuSUx6AWpBQnsCaUU
ivedmanyyea.org/MFhwdEwfZxMHcVUPQRkZZTQgIwpUMhYxIGkAQjJpAhohMnVjAjgHakQxFEl9AGhBTXUBfgAdKA1pSFI/ 0
386 B 215ms
150ms Image
text/plain 172.67.166.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ivedmanyyea.org/MFhwdEwfZxMHcVUPQRkZZTQgIwpUMhYxIGkAQjJpAhohMnVjAjgHakQxFEl9AGhBTXUBfgAdKA1pSFI/RDkEAT8NaVYdIlY3TVI6DWleRGICdkRSOQ1pVgA8UT9NRWpALAQYcQFuSUx6AWpBQnsCaUU
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.166.98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N6McJH4whJQCPyL9HqFnBqddp7VDY3R2AfZRhbl3Xu0hxQOe19mchqd6vSA4jDGpckprOX1KCuM2mkLv3ez9aYpgB66puTCbRYNYkIfIcMWjgkCLNKPurDTyrWIkJ4xxmGk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 81de3f3daa623b52-GVA
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK get.php Show response
userupload.net/ds2/file_info/ 277 B
484 B 132ms
132ms XHR
text/html 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/file_info/get.php?ext=zip
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/js/jquery-1.9.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 1260903f7e4715f59ffdbe2025771ac7485dd12db8392592776ed781531ee5b0

Request headers

Accept: */*
Referer: https://userupload.net/h9npt0hs2hpl
X-Requested-With: XMLHttpRequest
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 5c3f7ca0c9830d001319a65d.js Show response
buttons-config.sharethis.com/js/ 975 B
1 KB 109ms
34ms Script
text/javascript 2600:9000:206f:ba00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5c3f7ca0c9830d001319a65d.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:ba00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

64ef1788e2c86fe9b9f65689843ec0d459ee8c1477b4fe26b88a3b3cc1e98c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:41:55 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e48.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-C1
age: 58
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 975
last-modified: Sat, 11 Apr 2020 08:06:55 GMT
server: AmazonS3
etag: "603d865a6a864b43f642e595a6f198f6"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
x-amz-cf-id: VDwNlxKQV8IwVFkUfAxn_DN58XwHESnpmGsjVHBRfTWCycBoDQa8oA==

GET
H/1.1 200
OK fa-brands-400.woff2
userupload.net/ds2/fa/webfonts/ 73 KB
73 KB 46ms
45ms Font
font/woff2 51.89.234.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://userupload.net/ds2/fa/webfonts/fa-brands-400.woff2
Requested by: Host: userupload.net
URL: https://userupload.net/ds2/css/style.min.css?v=0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.89.234.230 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns31202426.ip-51-89-234.eu
Software: Apache /
Resource Hash: 433d970f04c9cfdfe1eef18106807714cffa2ec96651af41c1be35d00a87bc1c

Request headers

Referer: https://userupload.net/ds2/css/style.min.css?v=0.2
Origin: https://userupload.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Aug 2019 23:45:51 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame AC0E 59 KB
34 KB 56ms
55ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX&co=aHR0cHM6Ly91c2VydXBsb2FkLm5ldDo0NDM.&hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&size=normal&cb=r1t4ag8070x6

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/recaptcha__de_ch.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

80fe0f5ee4879b98e44c8b824e999d2332fec17459bb13d408df795be2dd5fee

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kyMVtiucgaNLtM8j38K_sA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://userupload.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-kyMVtiucgaNLtM8j38K_sA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 29 Oct 2023 20:42:47 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
401 B 165ms
54ms XHR
text/plain 3.124.78.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=userupload.net&location=%2Fh9npt0hs2hpl&product=inline-share-buttons&url=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Download%20Odin3%20Patched%20User%20Upload%20zip&cms=unknown&publisher=5c3f7ca0c9830d001319a65d&sop=true&version=st_sop.js&lang=en&description=Datei%20herunterladen%20Odin3%20Patched%20User%20Upload%20zip&ua=&ua_mobile=false&ua_full_version_list=&uuid=9a677d7c-351a-4a55-8cec-5c63a6101d83

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.78.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-124-78-15.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:47 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://userupload.net
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/ Frame AC0E 55 KB
24 KB 95ms
33ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX&co=aHR0cHM6Ly91c2VydXBsb2FkLm5ldDo0NDM.&hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&size=normal&cb=r1t4ag8070x6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:40:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 04:01:46 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 28 Oct 2024 20:40:02 GMT

GET
H3 200 recaptcha__de_ch.js Show response
www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/ Frame AC0E 464 KB
186 KB 107ms
50ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/recaptcha__de_ch.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f8a69b2a2b34f9ad653d8d8627fb36573303a4442a5aff2699707a5ccebf033

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 19:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524216
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190291
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 04:01:46 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 22 Oct 2024 19:05:51 GMT

GET
H2 200 get_counts Show response
count-server.sharethis.com/v2.0/ 187 B
548 B 238ms
130ms Script
text/javascript 13.32.121.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb&url=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.121.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-121-95.fra60.r.cloudfront.net

Software

Resource Hash

8ea2719ce9e7bec2bf5a4f867549042f702da6c4fec22c97dc05ec75d4c71900

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:39 GMT
via: 1.1 6b17c6258978715ba0681e1d5589502c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P1
age: 8
etag: c2d5d284897e6cb7c515cb2025ea1c54
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=60
content-length: 187
apigw-requestid: NlOGAgYUIAMEJ2w=
x-amz-cf-id: Oaeb3NCbG0qXjTD56-LVA16WvdtT0bwsqI4vCDZopK1HxraxLTK0tQ==

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
727 B 138ms
31ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/facebook.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 02:45:41 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 1101427
etag: "c6e9be45643e197ce1db1d7e24a99adc"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 301
x-amz-cf-id: EaKDdFKlRdkuwk5OHKl66taWXV_nlPIIRDi89ViMzwUBDJfYj1CFUw==

GET
H2 200 whatsapp.svg
platform-cdn.sharethis.com/img/ 832 B
1 KB 139ms
32ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/whatsapp.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 02:45:25 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 410243
etag: "afe7fc60ed757db39a88d2950fce69c9"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 832
x-amz-cf-id: Y4W5n_Cc5VIAaMF4qh-uFQVGLIoe-SY24sWTbcKiE2I9zTnLAv8k0Q==

GET
H2 200 messenger.svg
platform-cdn.sharethis.com/img/ 372 B
797 B 140ms
33ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/messenger.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2986551fd9e82929eabb8cba7c44f74a28d8496c744893432f067b320dff55da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 02:45:41 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 1101427
etag: "a5aa43fa302867d3e888ac2f69b7b288"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 372
x-amz-cf-id: zDR2nsHzvs0XTKA9-fsiOALzS6zv_PRqUui2rHNetUNHLK9yDlq2lg==

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 368 B
779 B 141ms
34ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/twitter.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:40:47 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 15 Sep 2023 16:58:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 121
x-amz-server-side-encryption: AES256
etag: "2deb3d5121d475d195577a70b0a91a0c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 368
x-amz-cf-id: UJkTJTirnIOWI1WWMzMRhSuDi4XIVZJ4zWTU16l9E5cNw_xb8lZH4w==

GET
H2 200 telegram.svg
platform-cdn.sharethis.com/img/ 858 B
1 KB 140ms
36ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/telegram.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

03e42b95e9049816d901eabbe2a2247deda61a85972e3a50e3c8274e6c5fe39b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:37:53 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 12 Aug 2022 01:07:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 296
x-amz-server-side-encryption: AES256
etag: "e3f5e90fa57764cd951db1b1bc688edd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 858
x-amz-cf-id: 0c3lUsZJQYjXt3shdyu-FcP-sSE2c7w8LO0bBD1hDQRR-1OCyGoRLA==

GET
H2 200 sharethis.svg
platform-cdn.sharethis.com/img/ 514 B
955 B 139ms
35ms Image
image/svg+xml 2600:9000:2156:400:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/sharethis.svg

Requested by

Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 23:03:52 GMT
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA50-C1
age: 1028336
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 514
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
etag: "deecdaa377907db5cc1722fc831670a1"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
x-amz-cf-id: wxQJfS6OYmvAaSf327uMSs8i9rN2Gr3rIReRJe1TTzXNIlo5cgKfeg==

GET
H2 200 A2hfa2gAaFtjZhZ0WiEwVScYO3QBAF9hZh11XHQkDnc Show response
d1spc7iz1ls2b1.cloudfront.net/IRmpSUTMlBTw3DDIDNmwCdlpjaAp3TDgiXCgabztEFxwDB1gqX3QlSSJXY3dfJwQ1bBUjBDFsAmALNjMOckwnMA4rBSg4XyoLd2N1c0RidAF2QiU4XSIFJSIWdFo8JRZ0WmNhHXZPYRMWdFolOF1wXndicWNYYikFckN3Yw... Frame C532 197 B
467 B 198ms
182ms Script
text/plain 2600:9000:2491:e00:1c:63e0:eb40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1spc7iz1ls2b1.cloudfront.net/IRmpSUTMlBTw3DDIDNmwCdlpjaAp3TDgiXCgabztEFxwDB1gqX3QlSSJXY3dfJwQ1bBUjBDFsAmALNjMOckwnMA4rBSg4XyoLd2N1c0RidAF2QiU4XSIFJSIWdFo8JRZ0WmNhHXZPYRMWdFolOF1wXndicWNYYikFckN3YwMnGiI9VjEPMDpaMk9gFwZ1XX-xiBWNYYnlYLh4/PRZ0KXdjAyoDOTQWdFo1NFAtBXt0AXYJOiNcKw93Y3V3W2p/A2hfa2gAaFtjZhZ0WiEwVScYO3QBAF9hZh11XHQkDnc
Requested by: Host: townrusisedprivat.info
URL: https://townrusisedprivat.info/eEcyaW0ZJVEEUhl6UE8YCisPTF8+YgAvCUk0QgpaET0DBR5KJQNHDhQoRw0LCihcHUMWIkZMXz4OYAQdKxJmJAE6E0VaKTwOdicADwRWBR0SJnMZXiwDVQA1OyBTCxcMAnQRGjwFAw4cIHRjBT4rDWowXhwheB48SSVwPAc6A3QaLBUGficHNQhRAhoWCnNdHzoUVV01ASh+DV82dlFZPxEjcy9fKS5nXTUrDnQjPjEQVi8CQA1gM10vKnwBJSAdYjA/NRBWLwIUCHRYGiApVgAOLwlrMAQTAVECI0seRSQDPy57UDsSAmIkKQgmfwJUHwFFM1wgHx8RBDoQfDA0FitrJQVMYgAvPSodAiI1HC1zEAI8CGY4OhwBXVgjPgZGKzUMd3MxNDIIWycOMzALWjRLEQE+XwhiAC8sSi9UCF8fBlMvGRIdWjNdLy53HjsrJGsmXikFcy9UEB1aWFwgD2MCKRYkFAMeFylCVAcPFkQ4OxMrBw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:e00:1c:63e0:eb40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ae75025b741a80f5a9ae588fc0e3153bcc28d81b383e1a4fdd129fc1fccf138d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://townrusisedprivat.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
content-encoding: gzip
via: 1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 190
x-amz-cf-id: nNLN4WaFlK-vpE2eRgwzV2aCqpQyWtszNiJuQZnGrmdHvsf1b2BxKQ==

GET
H2 200 1658920033.png
cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/ Frame 13D1 141 KB
141 KB 120ms
32ms Image
image/png 45.133.44.10
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.10 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: dbed482e5948ead5587d30a22306a5b611305f704de940bd22c76daf90e0a314

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires: Tue, 31 Oct 2023 20:42:47 GMT
date: Sun, 29 Oct 2023 20:42:47 GMT
last-modified: Wed, 27 Jul 2022 11:07:21 GMT
server: nginx/1.21.6
etag: "62e11c69-233fb"
content-type: image/png
cache-control: max-age=172800
accept-ranges: bytes
content-length: 144379
x-proxy-cache: HIT

GET
H2 200 kdTh3N2YWVxlRWQFREwpXRQhGDl5CHh1ECRtISmAuDw8cXTYBbgMREg9cSgZAGVkZUFtTXRlUW0QeFlMESAxRQxYaU0pfFRJXAlMODUINERMUBRpYHBxUG1ZDR35CGVZQCkcfERxWE1gRBh1FBwgBHUUHV0UWRxJVNx1FBxEcVkEDQ0Z6UgVWDQ5DHkNHCB-ZHFhl... Show response
d1spc7iz1ls2b1.cloudfront.net/ Frame DD6C 734 B
787 B 177ms
177ms Script
text/plain 2600:9000:2491:e00:1c:63e0:eb40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1spc7iz1ls2b1.cloudfront.net/kdTh3N2YWVxlRWQFREwpXRQhGDl5CHh1ECRtISmAuDw8cXTYBbgMREg9cSgZAGVkZUFtTXRlUW0QeFlMESAxRQxYaU0pfFRJXAlMODUINERMUBRpYHBxUG1ZDR35CGVZQCkcfERxWE1gRBh1FBwgBHUUHV0UWRxJVNx1FBxEcVkEDQ0Z6UgVWDQ5DHkNHCB-ZHFhldAFIEHlEDElQzDUQASEYOUgVWXVMfQwsZHUV0Q0cIG14NEB1FBwEQWxxYT1AKR1QOB1caUkNHfkYGXlsIWQJfTAtZBldCHUUHFRReFkUPUAoxAlVCFkQBQAAFRg
Requested by: Host: townrusisedprivat.info
URL: https://townrusisedprivat.info/YmZWc0gDBDUedwNbNFU9EAprVnokQ2Q1LFMVJhB/CxxnHztQBGddKw4JIxcuEAk4B2YMAyJWeiQNMicgUShkKh80HjohHzMgBDY/Ej4EIiAlIjpGCyoOZzYLMBIfICUjExIEcAE+AioKAAEbIQ0FXzUgLzgnESUjODMQBxw6NDomH1I3MzUkLyMFMjAwNy4qKTdWJhUOMCwOMiQvKRImASwjBD4dIDQmKgAgHgM0eTgiBEB9ISEAKRkhDTUVDTAeATZ5BTQUG3kkJCEUCiozAzseUjMBITAoMBgLeSQkLjYrNA0TNxlSPGAmLzQxEiJ9Ji49PQAhJHspACQOOhcJJC8TOyQnIhMfGRgiAyIJMSMPPB0FMAErHi8ABwQ7OC4DJXgzVjU6D1NSGDYKUyAUBA0zMS4LETZXFzgaUzcZMXkBBwMYBioAPSoPOgolOh8zLDAnCRY8FB8sIS4DJgAkNAQWDgkzBiYJDR4XHx4hID0iCjMnFzUaBUA8ACcMFmskABhRPRkYFjAi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:e00:1c:63e0:eb40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4015cacf8cd68f70f40071dd8dfa3c7faca1b795ecc52fef0c8a147d2d2786ff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://townrusisedprivat.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
content-encoding: gzip
via: 1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 510
x-amz-cf-id: ud2vjIZcr21PpW5HTtVlcy18GbT8kOd8e1WQbj8YNFSBKTmgokTAyw==

GET
DATA 200
OK truncated
/ Frame AC0E 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame AC0E 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame AC0E 2 KB
2 KB 30ms
30ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:15:26 GMT
x-content-type-options: nosniff
age: 278841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 02 Nov 2023 15:15:26 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame AC0E 15 KB
15 KB 30ms
30ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 03:12:15 GMT
x-content-type-options: nosniff
age: 235832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 03:12:15 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame AC0E 105 B
138 B 45ms
45ms Other
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9c3e617505f8bcbeb5e57313fddd9e3f848670a93b06a15bc57b1d658b2b4800

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX&co=aHR0cHM6Ly91c2VydXBsb2FkLm5ldDo0NDM.&hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&size=normal&cb=r1t4ag8070x6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 29 Oct 2023 20:42:47 GMT

GET click.php
astoemobilohy.com/ 0
0

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame B75C 7 KB
1 KB 39ms
39ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/recaptcha__de_ch.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bde210839b2c2a1f4d2f9cba56475757c556e3e219efab4552fa599216a32acd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uk7aLYDidpxTc8OZBzyGYQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://userupload.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-uk7aLYDidpxTc8OZBzyGYQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 29 Oct 2023 20:42:47 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 popunder.gif
ivedmanyyea.org/ 35 B
395 B 38ms
38ms Image
image/gif 172.67.166.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ivedmanyyea.org/popunder.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.166.98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: public
date: Sun, 29 Oct 2023 20:42:47 GMT
cf-cache-status: HIT
last-modified: Fri, 27 Oct 2023 13:34:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 198495
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BnBdSE6JFooWc7PrW%2FnGO1K6gvRaMmChO81sSiSYFBV6vmUNrk3dQQkBboSxcgb0p50%2Fd9E9oFk0neW1DmSU6gUxghayG2y6cFEsyaHI%2BcuiSEk1%2BedOlRX9PotG5pdCxhM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
cf-ray: 81de3f405bfe3b52-GVA
alt-svc: h3=":443"; ma=86400

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/ Frame B75C 55 KB
24 KB 31ms
31ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 20:40:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 04:01:46 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 28 Oct 2024 20:40:02 GMT

GET
H3 200 recaptcha__de_ch.js Show response
www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/ Frame B75C 464 KB
186 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vm_YDiq1BiI3a8zfbIPZjtF2/recaptcha__de_ch.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=vm_YDiq1BiI3a8zfbIPZjtF2&k=6LfG5EUUAAAAAE7XFZvJfM0HHeaV1tQQqzZ7BTiX

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f8a69b2a2b34f9ad653d8d8627fb36573303a4442a5aff2699707a5ccebf033

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 19:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 524216
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190291
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 04:01:46 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 22 Oct 2024 19:05:51 GMT

GET click.php
cinsiant.com/ 0
0

GET
H/1.1 200
OK 65aa283021630dfd9030555c4c61a78c.js
hazelhideous.com/65/aa/28/ 59 KB
24 KB 116ms
116ms Script
application/javascript 192.243.59.20
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hazelhideous.com/65/aa/28/65aa283021630dfd9030555c4c61a78c.js

Requested by

Host: bluffforester.com
URL: https://bluffforester.com/da658283644b19b2a89bf86c11c02af4/invoke.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.19.5 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sun, 29 Oct 2023 20:42:48 GMT
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
Server: nginx/1.19.5
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-Request-ID: 1f4f4ba143d747db722321caa4eec49a
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 1628586935.jpg
cdn.cloudimagesb.com/cti/51/bb/80/51bb807c8b914e3cc08eace2b0587473/ 29 KB
30 KB 37ms
37ms Image
image/jpeg 45.133.44.10
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.cloudimagesb.com/cti/51/bb/80/51bb807c8b914e3cc08eace2b0587473/1628586935.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.10 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://userupload.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires: Tue, 31 Oct 2023 20:42:48 GMT
date: Sun, 29 Oct 2023 20:42:48 GMT
last-modified: Tue, 10 Aug 2021 09:15:44 GMT
server: nginx/1.21.6
etag: "611243c0-75af"
content-type: image/jpeg
cache-control: max-age=172800
accept-ranges: bytes
content-length: 30127
x-proxy-cache: HIT

GET ren.gif
hazelhideous.com/ 0
0

GET impr.gif
hazelhideous.com/ 0
0

GET
H/1.1 200
OK Primary Request click.php Show response
cinsiant.com/ 4 KB
2 KB 220ms
218ms Document
text/html 85.17.80.16
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff186bca&PLACEMENT_ID=20332934&CAMPAIGN_ID=779837&PUBLISHER_ID=93576&ZONE_ID=116639
Requested by: Host: userupload.net
URL: https://userupload.net/h9npt0hs2hpl
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 85.17.80.16 Wolvega, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 448f55e6ec3d7f19fdc53a2d03f8e6826bea4cff417255d788253b45cae8440d

Request headers

Referer: https://userupload.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sun, 29 Oct 2023 20:42:41 GMT
Server: nginx/1.16.0
Transfer-Encoding: chunked

GET sfp.js
friendshipmale.com/ 0
0

GET purst
largepeering.com/pixel/ 0
0

POST collect
www.google-analytics.com/g/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 108ms
39ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: cinsiant.com
URL: https://cinsiant.com/click.php?key=qakkdandurvv6oxm0wqx&SUB_ID_SHORT=2dd693a2403a8173bb576161ff186bca&PLACEMENT_ID=20332934&CAMPAIGN_ID=779837&PUBLISHER_ID=93576&ZONE_ID=116639

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://cinsiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 29 Oct 2023 20:42:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 29 Oct 2023 19:06:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 29 Oct 2023 20:42:48 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 32ms
31ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cinsiant.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 13:37:19 GMT
x-content-type-options: nosniff
age: 111929
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 27 Oct 2024 13:37:19 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 36ms
34ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cinsiant.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 232556
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 04:06:52 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: astoemobilohy.com
URL: https://astoemobilohy.com/click.php?key=oynz6f3zf08r98j1gacy&SUB_ID_SHORT=2dd664f162a5feca43f8fec4f37bd966&PLACEMENT_ID=20332937&CAMPAIGN_ID=874612&PUBLISHER_ID=93576&ZONE_ID=116639

Domain: cinsiant.com
URL: https://cinsiant.com/click.php?key=anszy714lh4735iktpuv&SUB_ID_SHORT=2dd82b5fdaa0638ea26af6553efb9933&PLACEMENT_ID=20332935&CAMPAIGN_ID=779837&PUBLISHER_ID=93576&ZONE_ID=116639

Domain: hazelhideous.com
URL: https://hazelhideous.com/ren.gif?sid=H4sIAAAAAAAC%2F1xSzYscxRuuTsLvJyJovAkijYgksDuZ6u7p6SFgyIcxIYn5lD1XdVXvllvT1VRVT28WD4kRyXH0pF7sfSYfmoSgf4Ais0KQ4MG5LchePPkX6FFmd2HF9%2FI%2B79tPw%2FM89X66UW%2BTLmq25S%2BZdaU1O9brdMMjS6oUpnHh%2BzdC2u10j4dLqkyT4%2BFamhwNT1aVlkuSX1D%2BWC%2Fud%2BI0PHLh3I1LFxdCrVZl%2BJ7MV83R8PSKNUN5jNKs0%2B30BoO4Q2k%2FvM4KZtXef1DVU5r1OnTQ6%2FRpJ6IZ1ux%2FN64O4FgAMdomr0KJ2UtvLFyGyqcoh9%2BdkW7Vm2rh3WGtmTcWI%2FHwg3K1NE2J4T4sbICifLjHhnEzQr44AFM%2B3HMKM7o3dwquZiT46yPw8sGuAfDRhNIMXENIcPEymtEUUk%2Bh2BS5uQMlFpALnD6Hcvj4eqP8urSalWKXwOaEGfkfrkI1M%2FL%2Fz7dQDh%2BdYZ45U9tcYq1oodamUMtTVPUm%2FHoA1Wwi9x9DCYJy2EKJrbfSXhylEY0XExGni0nSixZZIfuLgyLiWTTgA87ZTixKTaGKKbQcg7kDqF2AWgWoiwB1FWAotsJExCLOurToRv1%2BHLE0jWl3QHuS8iRNIok6n%2Bsew1dj5HqM3N5CZW9%2FI%2BK%2BjHmebDCsqjFs%2FRPcSgsnDsL5GQmu3sJItGgkQeMIGkbQKILGEzSj9r7QLnLtA6Fdzelej%2FZ63E6MX95g941fliXZqLbJ4Z3s%2FlgssSq3QsHSXhZlcZoknA54xLIBL7I0pzTvRqxI4FQL5Q6AuQDr84d89jWqeR%2FeBWebcHoTuToMVlOwZtKPumArkyTrYr18Wjtp60obJjql9BCmReUPwd8MNvQ2eW1HyZsHf4fMn5949PqTF%2BjbfyK3LSrb4kP1M8Gyvju5Zhpy75ppHPn%2BcuXVUK0zr0x53TMvDz66IG82xorzZ9z425P5%2FMMcPrkhnb%2FISqHKZUcen1JCSHvW2FySH867Jcmv1G7lVG3Lurp45fTZ88PKSueUKadg6rfLfyNXM3Lo9o87t%2FvKr59A2Sls3WJYPyd7BWU2kVe34Kp99c4QWL3P4VWApm4nNuL7S60ItNyfGW%2Fh%2FjXzfbzh7mLZBmD%2Bzs7VjmyLkW7B9BiufnHiK%2Fv8xC9fzusrcB1MuLbBPa6t%2Fmw3Wqe2wiQZZFQUBUuKblHIPI%2F7Ih1QVshB3MvyFN7N5Dubz%2F4BAAD%2F%2FwEAAP%2F%2F3TE8LbsEAAA%3D

Domain: hazelhideous.com
URL: https://hazelhideous.com/impr.gif?sid=H4sIAAAAAAAC%2F1xSzYscxRuuTsLvJyJovAkijYgksDuZ6u7pmSFgyIcxIYn5lD1XdVXvllvd1VRVT28WD4kRyXH0pF7sfSYfmoSgf4Ais0KQ4MG5LchePPkX6FFmd2HF9%2FI%2B79tPw%2FM89X66UW%2BTLmq25S%2BZdaU1O9brdMMjS6oUpnHh%2BzdC2u10j4dLqkyT4%2BFamhwNT1aVlkuSX1D%2BWC%2Fud%2BI0PHLh3I1LFxdCrVZl%2BJ7MVs3R8PSKNYU8Rumg0%2B30hsO4Q2k%2FvM5yZtXef1DVUzrodeiw1%2BnTTkQHWLP%2F3bg6gGMBxGibvAolZi%2B9sXAZKpuiLL47I92qN9XCu0WtmTcWI%2FHwg3K1NE2JYh%2FmNkBePtxjw7gZIV8cgCkf7jmFGd2bOwVXMxL89RF4%2BWDXAPhoQukAXENIcPEymtEUUk%2Bh2BSZuQMlFpAJnD6Hsnh8vVF%2BXVrNSrFLYHPCjPwPV6GaGfn%2F51soi0dnmGfO1DaTWMtbqLUp1PIUVb0Jvx5ANZvI%2FMdQgqAsWiix9Vbai6M0ovFiIuJ0MUl60SLLZX9xmEd8EA35kHO2E4tSU6h8Ci3HYO4AahegVgHqPEBdBSjEVpiIWMSDLs27Ub8fRyxNY9od0p6kPEmTSKLO5rrH8NUYmR4js7dQ2dvfiLgvY54lGwyragxb%2FwS30sKJg3B%2BRoKrtzASLRpJ0DiChhE0iqDxBM2ovS%2B0i1z7QGhXc7rXo70etxPjlzfYfeOXZUk2qm1yeCe7PxZLrMqtULC0N4gGcZoknA55xAZDng%2FSjNKsG7E8gVMtlDsA5gKszx%2Fy2deo5r24C8424fQmMnUYrKZgzaQfdcFWJsmgi%2FXyae2krSttmOiU0kOYFpU%2FBH8z2NDb5LUdJW8e%2FB0ye37i0etPXqBv%2F4nMtqhsiw%2FVzwTL%2Bu7kmmnIvWumceT7y5VXhVpnXpnyumdeHnx0Qd5sjBXnz7jxtyez%2BYc5fHJDOn%2BRlUKVy448PqWEkPassZkkP5x3S5Jfqd3KqdqWdXXxyumz54vKSueUKadg6rfLfyNTM3Lo9o87t%2FvKr59A2Sls3aKon5O9gjKbyKpbcNW%2BemcIrN7n8CpAU7cTG%2FH9pVYEWu7PjLdw%2F5r5Pt5wd7FsAzB%2FZ%2BdqR7bFSLdgegxXvzjxlX1%2B4pcv5%2FUVuA4mXNvgHtdWf7YbrVNbYY9RwWhv2JODJMpEnrI4Y2km5TCKWZSk8G4m39l89g8AAAD%2F%2FwEAAP%2F%2Fja7JjbsEAAA%3D

Domain: friendshipmale.com
URL: https://friendshipmale.com/sfp.js

Domain: largepeering.com
URL: https://largepeering.com/pixel/purst?dl=0&th=0&sc=0&rs=4133.5&rd=4133.5&fd=228.5&bv=23.10.v.30&tmpl=136

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TH960MSE9Y&gtm=45je3ap0v9112166607&_p=1003679690&gcd=11l1l1l1l1&cid=1182492278.1698612165&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&ngs=1&_s=2&sid=1698612164&sct=1&seg=0&dl=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&dt=Download%20Odin3%20Patched%20User%20Upload%20zip&en=scroll&epn.percent_scrolled=90&_et=17

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TH960MSE9Y&gtm=45je3ap0v9112166607&_p=1003679690&gcd=11l1l1l1l1&cid=1182492278.1698612165&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=3&sid=1698612164&sct=1&seg=0&dl=https%3A%2F%2Fuserupload.net%2Fh9npt0hs2hpl&dt=Download%20Odin3%20Patched%20User%20Upload%20zip&en=user_engagement&_et=3411

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

49 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.userupload.net/	1969-12-31 23:59:59	Name: lang Value: german
.userupload.net/	1970-01-20 16:10:21	Name: aff Value: 7678
.userupload.net/	1970-01-21 01:26:12	Name: _ga Value: GA1.1.1182492278.1698612165
professionalswebcheck.com/	1970-01-21 01:26:12	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
userupload.net/	1970-01-20 16:00:16	Name: dom3ic8zudi28v8lr6fgphwffqoz0j6c Value: 65326213-4d36-4452-afe7-9f2b829b9bba%3A2%3A1
judicialfizzysoftball.com/	1970-01-20 15:51:38	Name: u_pl Value: 20332936
judicialfizzysoftball.com/	1970-01-20 15:50:12	Name: ain Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDMzMjkzNiwiayI6IjY0NzFlZTFiZWFiMTQ2NGZmYjQzZTRjM2NkMzkyYWQ5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMTY2MzksInBpZCI6OTM1NzYsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTcsImFpZCI6NSwicHQiOjQsInBrIjoicTdxazdiNmUiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjAzMzA0MDE1LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTI4ODkyLCJibiI6IkNocm9tZSIsImJ2IjoiMTE4Iiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6NDQsImMiOiJDSCIsIm4iOiJTd2l0emVybGFuZCJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkRhdGFzb3VyY2UifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3VzZXJ1cGxvYWQubmV0L2g5bnB0MGhzMmhwbCJ9fQ.ahxN_2uM6MvNr-EthiLTJZ62UINy19yFrFHLe0YggaE
fountaingreat.com/	1970-01-20 15:51:38	Name: u_pl Value: 20332937
fountaingreat.com/	1970-01-20 15:50:12	Name: ain Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDMzMjkzNywiayI6Ijc3NzIzNjUwNzdkZTRlM2ZjM2JlMjU5MzMxZDM1YmQwIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMTY2MzksInBpZCI6OTM1NzYsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTcsImFpZCI6NSwicHQiOjQsInBrIjoiZmdqYzY0N2IiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjAzMzA0MDE1LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTI4ODkyLCJibiI6IkNocm9tZSIsImJ2IjoiMTE4Iiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6NDQsImMiOiJDSCIsIm4iOiJTd2l0emVybGFuZCJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkRhdGFzb3VyY2UifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3VzZXJ1cGxvYWQubmV0L2g5bnB0MGhzMmhwbCJ9fQ.GRGJvVOYeIcJn5-SCaDYqxHrykD8t6XFcfxzSCkWlGU
judicialfizzysoftball.com/	1970-01-20 16:00:16	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
judicialfizzysoftball.com/	1970-01-20 15:50:26	Name: iprcfcf62e74dd70a796b05791b7ade424c1 Value: 3569806
judicialfizzysoftball.com/	1970-01-20 15:51:38	Name: pdhtkv Value: true
judicialfizzysoftball.com/	1970-01-20 15:51:38	Name: uncs Value: 1
judicialfizzysoftball.com/	1970-01-20 15:51:38	Name: pdhtkv5 Value: true
judicialfizzysoftball.com/	1970-01-20 15:51:38	Name: uncs5 Value: 1
pogothere.xyz/	1970-01-21 00:28:36	Name: csu Value: 2162683691683363@1@1698612167
fountaingreat.com/	1970-01-20 16:00:16	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
fountaingreat.com/	1970-01-20 15:51:38	Name: iprc65cc0ebd224831c5ddfe93de9c7732b4 Value: 4680478
fountaingreat.com/	1970-01-20 15:51:38	Name: pdhtkv Value: true
fountaingreat.com/	1970-01-20 15:51:38	Name: uncs Value: 1
fountaingreat.com/	1970-01-20 15:51:38	Name: pdhtkv5 Value: true
fountaingreat.com/	1970-01-20 15:51:38	Name: uncs5 Value: 1
replicafixedly.com/	1970-01-20 15:51:38	Name: u_pl Value: 20332935
replicafixedly.com/	1970-01-20 15:50:12	Name: ain Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDMzMjkzNSwiayI6IjJhNTI0NTFkZGZhYTlhNGQ3MDAzMDkzZWU4YzM1MGY4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMTY2MzksInBpZCI6OTM1NzYsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTcsImFpZCI6NSwicHQiOjQsInBrIjoiZHV3YTUyOTJuIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjIwMzMwNDAxNSwiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyODg5MiwiYm4iOiJDaHJvbWUiLCJidiI6IjExOCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjQ0LCJjIjoiQ0giLCJuIjoiU3dpdHplcmxhbmQifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJEYXRhc291cmNlIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly91c2VydXBsb2FkLm5ldC9oOW5wdDBoczJocGwifX0.MXzgcrwFDXvCzClsBU80ePkYEate1HBcz2Qk6vr4wjI
secondquaver.com/	1970-01-20 15:51:38	Name: u_pl Value: 20332934
secondquaver.com/	1970-01-20 15:50:12	Name: ain Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDMzMjkzNCwiayI6IjQ2YzMyZGQ2MWEyMTE2ODYwZGFjZGZmMmQwYjUwYjdiIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMTY2MzksInBpZCI6OTM1NzYsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTcsImFpZCI6NSwicHQiOjQsInBrIjoiemdrbTd1Y2RyIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjIwMzMwNDAxNSwiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyODg5MiwiYm4iOiJDaHJvbWUiLCJidiI6IjExOCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjQ0LCJjIjoiQ0giLCJuIjoiU3dpdHplcmxhbmQifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJEYXRhc291cmNlIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly91c2VydXBsb2FkLm5ldC9oOW5wdDBoczJocGwifX0.Nudw1pXVombx3zh40BGg0ZNSrAzU10bfyS8x2BmCWKc
replicafixedly.com/	1970-01-20 16:00:16	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
replicafixedly.com/	1970-01-20 15:51:38	Name: iprc77f7f919965b957df9fc1329275b63c9 Value: 4680493
replicafixedly.com/	1970-01-20 15:51:38	Name: pdhtkv Value: true
replicafixedly.com/	1970-01-20 15:51:38	Name: uncs Value: 1
replicafixedly.com/	1970-01-20 15:51:38	Name: pdhtkv5 Value: true
replicafixedly.com/	1970-01-20 15:51:38	Name: uncs5 Value: 1
hazelhideous.com/	1970-01-20 15:51:38	Name: u_pl Value: 14888302
hazelhideous.com/	1970-01-20 16:00:16	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
hazelhideous.com/	1970-01-20 15:51:38	Name: pdhtkv Value: true
hazelhideous.com/	1970-01-20 15:51:38	Name: uncs Value: 1
hazelhideous.com/	1970-01-20 15:51:38	Name: pdhtkv49 Value: true
hazelhideous.com/	1970-01-20 15:51:38	Name: uncs49 Value: 1
hazelhideous.com/	1970-01-20 15:50:12	Name: nlecda658283644b19b2a89bf86c11c02af4 Value: [2229212]
userupload.net/	1970-01-20 15:50:12	Name: m5a4xojbcp2nx3gptmm633qal3gzmadn Value: hazelhideous.com
secondquaver.com/	1970-01-20 16:00:16	Name: uid_id2 Value: 65326213-4d36-4452-afe7-9f2b829b9bba:2:1
secondquaver.com/	1970-01-20 15:51:38	Name: iprc5b14362b77682e68f8609dad5e7baeef Value: 4680485
secondquaver.com/	1970-01-20 15:51:38	Name: pdhtkv Value: true
secondquaver.com/	1970-01-20 15:51:38	Name: uncs Value: 1
secondquaver.com/	1970-01-20 15:51:38	Name: pdhtkv5 Value: true
secondquaver.com/	1970-01-20 15:51:38	Name: uncs5 Value: 1
cinsiant.com/	1970-01-20 15:51:38	Name: uclick Value: 2tj2eje2d5
cinsiant.com/	1970-01-20 15:51:38	Name: uclickhash Value: 2tj2eje2d5-2tj2eje2d5-whe2-gma6dz-irj6i4-9zwfi4-9zwffe-f28e49
.userupload.net/	1970-01-21 01:26:12	Name: _ga_TH960MSE9Y Value: GS1.1.1698612164.1.0.1698612168.0.0.0

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 149) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/2a52451ddfaa9a4d7003093ee8c350f8/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 149) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/2a52451ddfaa9a4d7003093ee8c350f8/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 176) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/6471ee1beab1464ffb43e4c3cd392ad9/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 176) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/6471ee1beab1464ffb43e4c3cd392ad9/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 197) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/7772365077de4e3fc3be259331d35bd0/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 197) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/7772365077de4e3fc3be259331d35bd0/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 239) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/46c32dd61a2116860dacdff2d0b50b7b/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://userupload.net/h9npt0hs2hpl(Line 239) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://bluffforester.com/46c32dd61a2116860dacdff2d0b50b7b/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyyclsc6PIQzStzARhLGzd14tV40bBk49sTKzmmbkpXu1eC8Z0O5-_Tiy6zvda-CmUi2aCExpw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S151959732%3A1698612167405840&theme=glif Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AVQVeyz4hqyNYv2EZQRHff7gd3RbgyzJgFTER7Dx_5fuF3wyCvQHLEuFI1UGheVu-YmQVFGYe7ByGA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1928947429%3A1698612167453492&theme=glif Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0;includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
astoemobilohy.com
bluffforester.com
buttons-config.sharethis.com
cdn.cloudimagesb.com
cdnjs.cloudflare.com
cinsiant.com
count-server.sharethis.com
d1spc7iz1ls2b1.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
fountaingreat.com
friendshipmale.com
hazelhideous.com
ivedmanyyea.org
judicialfizzysoftball.com
l.sharethis.com
largepeering.com
platform-api.sharethis.com
platform-cdn.sharethis.com
pogothere.xyz
professionalswebcheck.com
replicafixedly.com
secondquaver.com
townrusisedprivat.info
userupload.net
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
astoemobilohy.com
cinsiant.com
friendshipmale.com
hazelhideous.com
largepeering.com
www.google-analytics.com
13.32.121.95
13.32.27.7
172.67.166.98
173.233.139.164
18.238.243.5
188.114.96.3
192.243.59.13
192.243.59.20
192.243.61.225
2600:9000:206f:ba00:c:abe:f440:93a1
2600:9000:2156:400:1d:85c3:6640:93a1
2600:9000:2491:e00:1c:63e0:eb40:21
2606:4700::6811:180e
2a00:1450:4001:806::200e
2a00:1450:4001:810::200a
2a00:1450:4001:813::2003
2a00:1450:4001:828::2003
2a00:1450:4001:828::2008
2a00:1450:4001:830::2004
2a00:1450:4001:830::200d
2a03:2880:f176:84:face:b00c:0:25de
3.124.78.15
35.157.63.144
45.133.44.10
51.89.234.230
85.17.80.16
01d91977befeb9f282f4b13170416c22e8b3f1e8570e79a362c975352f57e5b1
03e42b95e9049816d901eabbe2a2247deda61a85972e3a50e3c8274e6c5fe39b
08d4e6308d4549372380e8a8d6b3de7613d304b43c2e6f50053af0338e5e0f67
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
0bd4270ec2383b5693ad8be7c262cbcc70b1fa8597f3dad996ce6c170b000e1e
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
1260903f7e4715f59ffdbe2025771ac7485dd12db8392592776ed781531ee5b0
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1f0f827adcce430b779f777fa60fb738ee29ab0a14cb78a79a5f3ea8b4268ce0
1f8a69b2a2b34f9ad653d8d8627fb36573303a4442a5aff2699707a5ccebf033
2986551fd9e82929eabb8cba7c44f74a28d8496c744893432f067b320dff55da
2df25ed583d39ca73718949dd3c20036cdfba57ce4725b2a4564a47071b8be9c
3477023d8b7129eb517abf377492a608f2469ae91405fa62974e6771751e04ae
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
3dc0cd49b944e32271118b0148e231acafdbf2b4ef1be7a411da306481076c4f
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3fae9561912cd3b529dea4c2c6534ba552f57cbcfd8de56937d8c95e7e008008
4015cacf8cd68f70f40071dd8dfa3c7faca1b795ecc52fef0c8a147d2d2786ff
433d970f04c9cfdfe1eef18106807714cffa2ec96651af41c1be35d00a87bc1c
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
448f55e6ec3d7f19fdc53a2d03f8e6826bea4cff417255d788253b45cae8440d
56348e148d50c4d4e805cae6fc68b2e1964a11306af9b4bdfc97fb021e7a5a57
57ee478f48f0c5119a65bcab51b18ab6e7db8cb4db90a0fc8a6bfbb4c1af2d23
597f68e9fb6645b6289948b0b347377681784b420567a33a94038cb05ae2d9ee
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
64ef1788e2c86fe9b9f65689843ec0d459ee8c1477b4fe26b88a3b3cc1e98c56
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
672b69ed3eca9f82e9de5c80674fdb9b800fdd54367dc152251b2ba5ec8d3179
677df6ea3169eb2b465dff06855446e884a8edbdeff56dd3cfbd6123d6fa4df2
6993ec542e2c2c04b399fed082b8f3b809b1e055a22ba1cdabde732561f7a27f
6b1116dbdcc8665059c0163cb6cd034a949402f5bc6294390e8ffee39952f6ae
705098458437cc0b2e20cf4605a95288c776ad5f5480d99cdd90d96d083eab5b
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7b1ed14c8d4e5852e773d44304a3a33507ff993a4b6b70ea1d9fb8c6f68e7318
80fe0f5ee4879b98e44c8b824e999d2332fec17459bb13d408df795be2dd5fee
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
8bedd3a9d3d20f71aa28c17e75c18ddc9a323b823275ae9bec6a1b673ea646f5
8ea2719ce9e7bec2bf5a4f867549042f702da6c4fec22c97dc05ec75d4c71900
977e6947fd01cae743facbd0862fc7b7866cf35b6c031b2515ea854bc177a8e9
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9c3e617505f8bcbeb5e57313fddd9e3f848670a93b06a15bc57b1d658b2b4800
ae75025b741a80f5a9ae588fc0e3153bcc28d81b383e1a4fdd129fc1fccf138d
b6ec7b998324bc41dbd7b3610f9cb6c649b0db416a9f1b567a7136d440478428
b8c94f1ada7a847bf264caaa511735bd46ba84e4599e3a4541e733c08cda65b1
bde210839b2c2a1f4d2f9cba56475757c556e3e219efab4552fa599216a32acd
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c1bd88cc54165fd50700598361e7484401e4cc1525866fa5a73e8a463df5c226
c4fb91befcf134b81ecfa1c586e1f9d6426c8f4fc1f6c130ac1fddb49ab5df96
c56fd6b910ca93a3fb1875e35074b8ce8501c319ebaa0e8b7252f7e4a7023fe6
c8ecfe747c979fbd87624913200a9237343679923b495885bced089b80fc84f6
dbed482e5948ead5587d30a22306a5b611305f704de940bd22c76daf90e0a314
e1d4f21db649ec5795e70cb72e59fdec97af300c64b5d8abbc67f00688eb0ecd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8fb66ed72a123035a7db66792a79a2d9a29a5964d5f535c453134724a492ad3
ef871f82f06a667cfe9a0ec8f3763bbfa168a93483f7a3ba688a8fbb621d7e9e
f13d4a23664d1a212e275c7ccd6073d3751cd3554820a78fbf697a1fd6e251a3
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
f62bc5facadc1f4b1433d4ab07cfd085ae85f855b5e53e519261e0f114e72c19
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

cinsiant.com Open in urlscan Pro 85.17.80.16 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

83 %HTTPS

46 %IPv6

25 Domains

31 Subdomains

27 IPs

4 Countries

1787 kBTransfer

3806 kBSize

49 Cookies

0 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

cinsiant.com Open in urlscan Pro
85.17.80.16 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

83 %
HTTPS

46 %
IPv6

25
Domains

31
Subdomains

27
IPs

4
Countries

1787 kB
Transfer

3806 kB
Size

49
Cookies

84 HTTP transactions
2 data transactions