secuspolcusre.servecounterstrike.com Open in urlscan Pro
192.185.115.160 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://appurl.io/_o-WlQG6eJ
Effective URL:
https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Submission: On May 30 via manual (May 30th 2021, 7:38:40 pm UTC) from US

Summary HTTP 54 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 15 domains to perform 54 HTTP transactions. The main IP is 192.185.115.160, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is secuspolcusre.servecounterstrike.com.
TLS certificate: Issued by R3 on May 30th 2021. Valid for: 3 months.

This is the only time secuspolcusre.servecounterstrike.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fifth Third Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3033::6815:3d80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
1	185.66.69.200 185.66.69.200	6697 (BELPAK-AS...) (BELPAK-AS BELPAK)
3 16	192.185.115.160 192.185.115.160	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
4	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
54	18

3 2606:4700:3033::6815:3d80 (United States)

ASN13335 (CLOUDFLARENET, US)

appurl.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.66.69.200 (Polatsk, Belarus)

ASN6697 (BELPAK-AS BELPAK, BY)
PTR: cpanel09.helpdesk.by

lbar.lesnoi.by	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 192.185.115.160 (United States) 3 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-115-160.unifiedlayer.com

secuspolcusre.servecounterstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	servecounterstrike.com 3 redirects secuspolcusre.servecounterstrike.com	530 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com	369 KB
7	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	158 KB
6	google.com adservice.google.com www.google.com	37 KB
3	twitter.com platform.twitter.com syndication.twitter.com	132 KB
3	doubleclick.net googleads.g.doubleclick.net	6 KB
3	appurl.io appurl.io	10 KB
2	google-analytics.com www.google-analytics.com	20 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	24 KB
1	googleapis.com fonts.googleapis.com	903 B
1	lesnoi.by lbar.lesnoi.by	607 B
1	googletagservices.com www.googletagservices.com	28 KB
1	google.de adservice.google.de	799 B
1	googleadservices.com partner.googleadservices.com	638 B
1	jquery.com code.jquery.com	23 KB
54	15

	Domain	Requested by
16	secuspolcusre.servecounterstrike.com	3 redirects secuspolcusre.servecounterstrike.com
5	fonts.gstatic.com	www.google.com fonts.googleapis.com
5	www.google.com	tpc.googlesyndication.com secuspolcusre.servecounterstrike.com www.gstatic.com www.google.com
5	pagead2.googlesyndication.com	appurl.io pagead2.googlesyndication.com tpc.googlesyndication.com
4	www.gstatic.com	www.google.com www.gstatic.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
3	appurl.io	appurl.io
2	platform.twitter.com	secuspolcusre.servecounterstrike.com platform.twitter.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	www.google-analytics.com	appurl.io www.google-analytics.com
2	maxcdn.bootstrapcdn.com	appurl.io
1	syndication.twitter.com	platform.twitter.com
1	fonts.googleapis.com	secuspolcusre.servecounterstrike.com
1	lbar.lesnoi.by	appurl.io
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	code.jquery.com	appurl.io
54	19

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-25` - `2021-07-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
lbar.lesnoi.by R3	`2021-03-28` - `2021-06-26`	3 months	crt.sh
secuspolcusre.servecounterstrike.com R3	`2021-05-30` - `2021-08-28`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh

This page contains 8 frames:

Primary Page: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Frame ID: 424AFA8C96741BA31000DDC28081CCEA
Requests: 38 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/zrt_lookup.html
Frame ID: 8B8D88D556462D7E479F639C02E37DDF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&h=280&slotname=1787055170&adk=646328967&adf=4134371643&pi=t.ma~as.1787055170&w=660&fwrn=4&fwrnh=100&lmt=1622389193&rafmt=1&psa=0&format=660x280&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488035&bpp=4&bdt=132&idt=61&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=2717445976495&frm=20&pv=2&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=470&ady=515&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=OFX1GFNdqk&p=https%3A//appurl.io&dtd=78
Frame ID: EC23E64B43AC94D2C2D62F63639DDC4E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&adk=1812271804&adf=3025194257&lmt=1622389193&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488048&bpp=1&bdt=145&idt=70&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=660x280&nras=1&correlator=2717445976495&frm=20&pv=1&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=74
Frame ID: 904660748F55C03FA97A9AC0D959BDCD
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 2C88D2B5DF0F095D653EFD584167A77E
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 21BE043C3C77322203557F5184F1670A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw
Frame ID: E0C185ABD5EC5500E6E3BCEE0EE73164
Requests: 8 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fsecuspolcusre.servecounterstrike.com
Frame ID: 3ED85DE0B9A189EB2C19815933CDD274
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://appurl.io/_o-WlQG6eJ Page URL
https://lbar.lesnoi.by/Check/net.html Page URL
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?referrer=ZW1haWxAZG9tYWluLm5ldA== HTTP 302
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMT... Page URL
https://secuspolcusre.servecounterstrike.com/manger/Redirection/check.php Page URL
https://secuspolcusre.servecounterstrike.com/manger/auth?email=email%40domain.net HTTP 301
https://secuspolcusre.servecounterstrike.com/manger/auth/?email=email%40domain.net HTTP 302
https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index Page URL

Detected technologies

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

54
Requests

100 %
HTTPS

78 %
IPv6

15
Domains

19
Subdomains

18
IPs

4
Countries

1339 kB
Transfer

3382 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://appurl.io/_o-WlQG6eJ Page URL
https://lbar.lesnoi.by/Check/net.html Page URL
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?referrer=ZW1haWxAZG9tYWluLm5ldA== HTTP 302
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw== Page URL
https://secuspolcusre.servecounterstrike.com/manger/Redirection/check.php Page URL
https://secuspolcusre.servecounterstrike.com/manger/auth?email=email%40domain.net HTTP 301
https://secuspolcusre.servecounterstrike.com/manger/auth/?email=email%40domain.net HTTP 302
https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24

https://secuspolcusre.servecounterstrike.com/manger/Redirection/?referrer=ZW1haWxAZG9tYWluLm5ldA== HTTP 302
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==

54 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 _o-WlQG6eJ Show response
appurl.io/ 5 KB
2 KB 168ms
148ms Document
text/html 2606:4700:3033::6815:3d80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://appurl.io/_o-WlQG6eJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3d80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f810fb379aac9237cfdcf1ebd8bd2d801667649db7fe35e7e9b3b3dc7beaf57

Request headers

:method: GET
:authority: appurl.io
:scheme: https
:path: /_o-WlQG6eJ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
content-type: text/html
x-amz-replication-status: COMPLETED
last-modified: Sun, 30 May 2021 15:39:53 GMT
x-amz-version-id: d3Z7Zyv_7ulTpD2Ss9doDfjsClxfPpGh
cache-control: max-age=60
x-cache: RefreshHit from cloudfront
via: 1.1 84f381696dd33e92960b92250106e465.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: kNoIs7lXKEF50C5TcodMQryp3kUXb1ASLdAc3N87S14iiqRtO8IGLw==
cf-cache-status: DYNAMIC
cf-request-id: 0a6061b0040000dfa988bb6000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=utLYgNrVo4LbyXJzW%2F1Gf397Qx3Z%2Bv5zVDd2WxEsII2z9LhoGse8lrcMdkGb5RBNcjj6j9HccrW0rFQL3xz5WOStm8tQkvqmSCqNL%2BGh1uVvEPJvJyZf2D6Pn2Z96jmAIWqE"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 657a6bc66c05dfa9-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
18 KB 49ms
20ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617
age: 5956458
cdn-cachedat: 2021-03-11 11:57:53
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a6061b0c10000dfef78122000000001
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: a31dd7f18bc0fe8277e68a4489d4861a
cf-ray: 657a6bc79da0dfef-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 26 KB
6 KB 58ms
30ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

Requested by

Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617
age: 5956369
cdn-cachedat: 2021-03-11 11:57:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a6061b0c20000dfef3f8f7000000001
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 56c2b46c7a8e813a43f229e1920a3ed4
cf-ray: 657a6bc79da1dfef-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 42ms
22ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48356
x-xss-protection: 0
server: cafe
etag: 3890051329819667200
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 30 May 2021 19:38:07 GMT

GET
H2 200 jquery-3.1.1.slim.min.js Show response
code.jquery.com/ 68 KB
23 KB 36ms
8ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.slim.min.js
Requested by: Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: fd222b36abfc87a406283b8da0b180e22adeb7e9327ac0a41c6cd5514574b217

Request headers

Origin: https://appurl.io
Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2016 22:32:34 GMT
server: nginx
etag: W/"57e45c02-10ebd"
vary: Accept-Encoding
x-hw: 1622403487.dop210.fr8.t,1622403487.cds240.fr8.hn,1622403487.cds201.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23709

GET
H3-29 200 ua-parser-min.js Show response
appurl.io/javascripts/vendor/min/ 10 KB
5 KB 49ms
23ms Script
text/javascript 2606:4700:3033::6815:3d80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://appurl.io/javascripts/vendor/min/ua-parser-min.js
Requested by: Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3d80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4a1e8dfe89632088e1ec8147765e5a1faf08f7414ede4c9f3cce701f8b85b2f

Request headers

:path: /javascripts/vendor/min/ua-parser-min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: appurl.io
referer: https://appurl.io/_o-WlQG6eJ
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://appurl.io/_o-WlQG6eJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
via: 1.1 1d61815344be6df2eace7e0cbeebe716.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3616
x-cache: Hit from cloudfront
content-type: text/javascript
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a6061b0c600004a6d02b64000000001
last-modified: Mon, 07 Nov 2016 12:40:40 GMT
server: cloudflare
etag: W/"bb04355ce387383532230a11c09091aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=c7zsPYpVbqTajCl3dAix0AIyI9JsFeECixLitFNW%2FAiTGEkeZKzdKL%2Ba6s%2FM0J9s%2B5AvPQPpUQp%2BjNKetTesMkdKXD01fZP%2BD%2FUYbnyOWPENvDMxyBQIrd%2Bh1UtQ3J25s%2FqZ"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: null
cache-control: max-age=14400
x-amz-cf-pop: LHR62-C3
cf-ray: 657a6bc79d364a6d-FRA
x-amz-cf-id: JJ4DtioiP5BjyVfeNAU2TnZEtIjyfTye2VMmlblhepc3Y9scrZUMNg==

GET
H3-29 200 redirect-min.js Show response
appurl.io/javascripts/min/ 3 KB
2 KB 47ms
22ms Script
application/javascript 2606:4700:3033::6815:3d80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://appurl.io/javascripts/min/redirect-min.js?version=1.0.0.1622389192137
Requested by: Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3d80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e41a7428c89d172ea125c6b0bd7a3e04250d8a949f82a4dd7d8f84586192aa8

Request headers

:path: /javascripts/min/redirect-min.js?version=1.0.0.1622389192137
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: appurl.io
referer: https://appurl.io/_o-WlQG6eJ
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://appurl.io/_o-WlQG6eJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:07 GMT
via: 1.1 08b9c2fd11813ffdb8fa03129d0a465d.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 223
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a6061b0c600004a6deb240000000001
last-modified: Mon, 01 Feb 2021 01:26:50 GMT
server: cloudflare
etag: W/"10bb0164a9f84b027874e3f0efbe4b45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fFYPeTxVNqfVwCbHlFQU%2FeoxiJjsCdvNX4pB88Mt7epgvKI1YpAGHtO9Hx7%2F7kCJDj0qBGQeftyqWhufgIrk7ymnzpK%2BuU5t2wS%2B%2B8XAkqsDwQeMGnN2bg6hwWU%2FayOkVIv8"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 9M7B3iVhOibLRAgQIfsmO4Iy653N6J.p
cache-control: max-age=14400
x-amz-cf-pop: FRA56-C2
cf-ray: 657a6bc79d294a6d-FRA
x-amz-cf-id: zpWpfrkqNyg-mZVG0JkfiFEj6O1T80iY8i3kVKPQfrZhKGrkgjHQJQ==

GET
H2 200 analytics.js
www.google-analytics.com/ 48 KB
20 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: appurl.io
URL: https://appurl.io/_o-WlQG6eJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 4275
date: Sun, 30 May 2021 18:26:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Sun, 30 May 2021 20:26:52 GMT

POST
H3-29 200 collect
www.google-analytics.com/j/ 2 B
22 B 27ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1259183807&t=pageview&_s=1&dl=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=426099276&gjid=660567274&cid=1865269793.1622403488&tid=UA-1416913-22&_gid=2075052492.1622403488&_r=1&_slc=1&z=1448951138

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 May 2021 19:38:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://appurl.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/ 232 KB
86 KB 42ms
28ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6503947100737582&plah=appurl.io&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87658
x-xss-protection: 0
server: cafe
etag: 5316214545020586774
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 30 May 2021 19:38:08 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/ Frame 8B8D 10 KB
5 KB 24ms
5ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210524/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210524/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://appurl.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 29 May 2021 20:29:24 GMT
expires: Sat, 12 Jun 2021 20:29:24 GMT
content-type: text/html; charset=UTF-8
etag: 15349191498103243965
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4506
x-xss-protection: 0
age: 83324
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js
partner.googleadservices.com/gampad/ 199 B
638 B 214ms
90ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=appurl.io&callback=_gfp_s_&client=ca-pub-6503947100737582

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210524/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6503947100737582&plah=appurl.io&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js
adservice.google.de/adsid/ 107 B
799 B 35ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=appurl.io

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js
adservice.google.com/adsid/ 107 B
553 B 34ms
14ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=appurl.io

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads
googleads.g.doubleclick.net/pagead/ Frame EC23 405 B
229 B 107ms
93ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&h=280&slotname=1787055170&adk=646328967&adf=4134371643&pi=t.ma~as.1787055170&w=660&fwrn=4&fwrnh=100&lmt=1622389193&rafmt=1&psa=0&format=660x280&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488035&bpp=4&bdt=132&idt=61&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=2717445976495&frm=20&pv=2&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=470&ady=515&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=OFX1GFNdqk&p=https%3A//appurl.io&dtd=78

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6503947100737582&output=html&h=280&slotname=1787055170&adk=646328967&adf=4134371643&pi=t.ma~as.1787055170&w=660&fwrn=4&fwrnh=100&lmt=1622389193&rafmt=1&psa=0&format=660x280&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488035&bpp=4&bdt=132&idt=61&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&correlator=2717445976495&frm=20&pv=2&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=470&ady=515&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=OFX1GFNdqk&p=https%3A//appurl.io&dtd=78
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://appurl.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 30 May 2021 19:38:08 GMT
server: cafe
content-length: 206
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 30-May-2021 19:53:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 30 May 2021 19:38:08 GMT
cache-control: private

GET
H2 200 osd.js
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622028727180027"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27990
x-xss-protection: 0
expires: Sun, 30 May 2021 19:38:08 GMT

GET
H3-29 200 ads
googleads.g.doubleclick.net/pagead/ Frame 9046 5 KB
814 B 74ms
69ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&adk=1812271804&adf=3025194257&lmt=1622389193&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488048&bpp=1&bdt=145&idt=70&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=660x280&nras=1&correlator=2717445976495&frm=20&pv=1&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=74

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6503947100737582&output=html&adk=1812271804&adf=3025194257&lmt=1622389193&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fappurl.io%2F_o-WlQG6eJ&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1622403488048&bpp=1&bdt=145&idt=70&shv=r20210524&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=660x280&nras=1&correlator=2717445976495&frm=20&pv=1&ga_vid=1865269793.1622403488&ga_sid=1622403488&ga_hid=1259183807&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C21066432&oid=3&pvsid=2017933951294997&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=74
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://appurl.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 30 May 2021 19:38:08 GMT
server: cafe
content-length: 791
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 30-May-2021 19:53:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 30 May 2021 19:38:08 GMT
cache-control: private

GET
H3-29 200 sodar
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 32ms
18ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210524&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7781
x-xss-protection: 0

GET
H2 200 sodar2.js
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 33ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Sun, 30 May 2021 19:38:08 GMT

GET
H3-29 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 2C88 12 KB
5 KB 20ms
5ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://appurl.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Sun, 30 May 2021 19:00:06 GMT
expires: Mon, 30 May 2022 19:00:06 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2282
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe
www.google.com/recaptcha/api2/ Frame 21BE 783 B
829 B 16ms
15ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9HnqKYTbBhYk71bUbFyKdw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://appurl.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

expires: Sun, 30 May 2021 19:38:08 GMT
date: Sun, 30 May 2021 19:38:08 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-9HnqKYTbBhYk71bUbFyKdw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js
pagead2.googlesyndication.com/bg/ Frame 2C88 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A_FDV7LeaVqlTDL2qmVdouMMODA1wM6tcjTIBRf3dAs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 14:23:39 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 17 May 2021 11:28:00 GMT
server: sffe
age: 18869
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5771
x-xss-protection: 0
expires: Mon, 30 May 2022 14:23:39 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210524&jk=2017933951294997&bg=!_v2l_bnNAAaMan2LjGo7ACkAdvg8WkVNG7M4cZwxrEoNRx4QaMz-OPAh5T7s42PTzCm_C4OglqDvlwIAAABeUgAAAA1oAQcKALdfLzPonyThDFLBW36cNt3oKiCxpLOhBi7J0aMLbLy_x2iR0My-1PHqhXEqzlwYhCNAF37X6SPJPkhqR2HzlaIuOz5TI4hWllHRmcAOaStRCEOw3aQcql6b1SqqCvH8DVCG00et50EbZIIFlK8A7ciLvTtDXY4J4mSvq1-q0eh0fJmsjnuAGM-oE1NWF6jPgiTqdeFyIXd9lQFkGL6yeDZkykigjiA3k6YUZ-AQ3XYP2Pf34PuTHjOZAjrX66gbcRay-UcojYguMEfxqbDbSnzRVnhTvdouJZmhptWESZIIlpqAFkntQ8lATqqSeeBeSYWrfcEfyvTq2edV4zO6Amz-TcuRTJiklhfsirTfks6xTiX_M0GsKXIJNDm385h2vs4m6NDz5grLg47p16k6Gl8dcmMcLlvJP6-xMdiPK3WqFvpOsRLRwS4Zo4bCTuSo75E7ngHJwdlPy6meqjGbzHghj4qeHx5xsaCMIiKti4V-K9IIsoxOXxQoXTpwrsN0d0j3Xtt275nx0mhNAW1em2rQcKz-wTmvyb3CJBXvyf-1vRoTE0fSoQy-s-9OApkgOtnrdTz3aKnSePZgKiIgrz6fmZdZDgZTp9tSVGjf_s1rddWfLz4HR97VD8_ziXoCM32bzc-c-76hwM9bhbURlwBATTfk_dnZldtTu9KXs9qzWgCAX4H5lM8sLEwahU2iMwBM-j7DzrmY2UcbSXv7KttYVIutHyV2SBcnwUjInMOZe-56G-PRH6naij3-a4I8aHQig27eysKJGCLvrr4Cq0q69jZlorg7HcVLEcCyKsZQak1kjWSio9gzQcWS_7-qkzQFFxmd8PEfiHHGVWklKm9FPNmP7GnXVKxtbLDcfWom3ewj-Lw1jXSJnTk8lDSE6v9EBCTvW3nTSvajm_PTMqauUaWP-u8T8tYTaLaP_W9L8lpPN8jTsAnqF5QDu1os1suyPdN5JOdhS7YKXDwCWQdKoIkvlzlyy4F8aWRXDFZF8vq8BYI

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://appurl.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 May 2021 19:38:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK net.html
lbar.lesnoi.by/Check/ 365 B
607 B 233ms
76ms Document
text/html 185.66.69.200
BELPAK-AS BELPAK

General

Check archive.org

Show headers Download Go to

Full URL: https://lbar.lesnoi.by/Check/net.html
Requested by: Host: appurl.io
URL: https://appurl.io/javascripts/min/redirect-min.js?version=1.0.0.1622389192137
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.66.69.200 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY),
Reverse DNS: cpanel09.helpdesk.by
Software: Apache /
Resource Hash

Request headers

Host: lbar.lesnoi.by
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://appurl.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://appurl.io/

Response headers

Date: Sun, 30 May 2021 19:38:08 GMT
Server: Apache
Last-Modified: Sun, 30 May 2021 14:44:48 GMT
Accept-Ranges: bytes
Content-Length: 365
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H2

200

/ Show response
secuspolcusre.servecounterstrike.com/manger/Redirection/
Redirect Chain

https://secuspolcusre.servecounterstrike.com/manger/Redirection/?referrer=ZW1haWxAZG9tYWluLm5ldA==
https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==

1 KB
785 B

942ms
941ms

Document
text/html

192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 60241f9687c740856e904dc331b259730803c4a4b9aec326208620540a5cc204

Request headers

:method: GET
:authority: secuspolcusre.servecounterstrike.com
:scheme: https
:path: /manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://lbar.lesnoi.by/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=9b4ed169d562fde59084ceb2b9fffe55
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://lbar.lesnoi.by/Check/net.html

Response headers

date: Sun, 30 May 2021 19:38:10 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
content-length: 713
content-type: text/html; charset=UTF-8

Redirect headers

date: Sun, 30 May 2021 19:38:09 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=9b4ed169d562fde59084ceb2b9fffe55; path=/
location: ?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29 200 api.js Show response
www.google.com/recaptcha/ 884 B
605 B 16ms
16ms Script
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB

Requested by

Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d8fd0fc00d6c3b4da408a88f7706f739918cd0b478235b940b4783b4b35b6000

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secuspolcusre.servecounterstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 584
x-xss-protection: 1; mode=block
expires: Sun, 30 May 2021 19:38:11 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/ 342 KB
134 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33df66ca469e2de5ae4723c4944b20fd37d65daa2f095b6ec2ff0d70ed6c3d57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://secuspolcusre.servecounterstrike.com
Referer: https://secuspolcusre.servecounterstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 14:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103235
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136431
x-xss-protection: 0
last-modified: Tue, 25 May 2021 16:32:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 29 May 2022 14:57:36 GMT

GET
H3-29 200 anchor Show response
www.google.com/recaptcha/api2/ Frame E0C1 38 KB
19 KB 26ms
26ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e76172bc3b3df6806ad948477b9a77c689152dd42303789bc3d26055a9a55e6b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ibodV7557+3Y9ZNK/TVqGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secuspolcusre.servecounterstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://secuspolcusre.servecounterstrike.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 30 May 2021 19:38:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-ibodV7557+3Y9ZNK/TVqGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 19499
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/ Frame E0C1 52 KB
25 KB 20ms
7ms Stylesheet
text/css 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 17:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92654
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Tue, 25 May 2021 16:32:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 29 May 2022 17:53:57 GMT

GET
H3-29 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/ Frame E0C1 342 KB
133 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33df66ca469e2de5ae4723c4944b20fd37d65daa2f095b6ec2ff0d70ed6c3d57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 14:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103235
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136431
x-xss-protection: 0
last-modified: Tue, 25 May 2021 16:32:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 29 May 2022 14:57:36 GMT

GET
H3-29 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame E0C1 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/styles__ltr.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 26 May 2021 19:52:31 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 344740
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Wed, 02 Jun 2021 19:52:31 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E0C1 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 29 May 2021 06:54:04 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
age: 132247
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
expires: Sun, 29 May 2022 06:54:04 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E0C1 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 26 May 2021 23:58:35 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
age: 329976
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
expires: Thu, 26 May 2022 23:58:35 GMT

GET
H3-29 200 webworker.js
www.google.com/recaptcha/api2/ Frame E0C1 102 B
132 B 17ms
16ms Other
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6eff65f2a8eb488e25dbca7a506949b599a8f05b522ee54edab296459f8efbcf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Sun, 30 May 2021 19:38:12 GMT

POST
H3-29 200 reload Show response
www.google.com/recaptcha/api2/ Frame E0C1 28 KB
16 KB 50ms
50ms XHR
application/json 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

deae731ff57a05a4b03c76f8ae38c60a4d69e17104ac3e416a642c3482275765

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le2i_8aAAAAAGpbi0RXUkrSdoWbVCwamKxvE-EB&co=aHR0cHM6Ly9zZWN1c3BvbGN1c3JlLnNlcnZlY291bnRlcnN0cmlrZS5jb206NDQz&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=cn7d95a3hkxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Sun, 30 May 2021 19:38:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16028
x-xss-protection: 1; mode=block
expires: Sun, 30 May 2021 19:38:12 GMT

POST
H2 200 check.php Show response
secuspolcusre.servecounterstrike.com/manger/Redirection/ 219 B
229 B 494ms
493ms Document
text/html 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/Redirection/check.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: bd7509fd616a6f6474077dadb590f30c3c299aec04bec9e0946343bd5cd109fe

Request headers

:method: POST
:authority: secuspolcusre.servecounterstrike.com
:scheme: https
:path: /manger/Redirection/check.php
content-length: 598
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://secuspolcusre.servecounterstrike.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=9b4ed169d562fde59084ceb2b9fffe55
Upgrade-Insecure-Requests: 1
Origin: https://secuspolcusre.servecounterstrike.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://secuspolcusre.servecounterstrike.com/manger/Redirection/?csrftoken=MTYyMjQwMzQ5MDU5NjNkMDJhMjdkYzM1ZTBiZWVmNmMyMTliNzNlNTg1ZmU0NzBhMTk3OWM3YjcxZDg2YmIzODRlMWEzZTc0YjMzZTliMWQ1Yw==

Response headers

date: Sun, 30 May 2021 19:38:14 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
content-length: 173
content-type: text/html; charset=UTF-8

GET
H2

200

Primary Request index Show response
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/
Redirect Chain

https://secuspolcusre.servecounterstrike.com/manger/auth?email=email%40domain.net
https://secuspolcusre.servecounterstrike.com/manger/auth/?email=email%40domain.net
https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index

47 KB
9 KB

2162ms
2161ms

Document
text/html

192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 0075065e131bd314797be6698265681f73a00535db04dce4c0cae3ed27ab3494

Request headers

:method: GET
:authority: secuspolcusre.servecounterstrike.com
:scheme: https
:path: /manger/auth/dashboard/index
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://secuspolcusre.servecounterstrike.com/manger/Redirection/check.php
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=9b4ed169d562fde59084ceb2b9fffe55
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://secuspolcusre.servecounterstrike.com/manger/Redirection/check.php

Response headers

date: Sun, 30 May 2021 19:38:15 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
content-length: 9369
content-type: text/html; charset=UTF-8

Redirect headers

date: Sun, 30 May 2021 19:38:14 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
location: dashboard/index
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 style.css
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/ 672 KB
246 KB 511ms
510ms Stylesheet
text/css 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/style.css
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: edf2500820ac7c9de5c4f998647c1c4bb31a66b6e7fd69328d1f7ef533c3027c

Request headers

:path: /manger/auth/dashboard/lib/css/style.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 01:45:42 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 cms.css
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/ 24 KB
7 KB 262ms
261ms Stylesheet
text/css 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/cms.css
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: d8e194442e61b57a84a530d5599a26b2db9e4670f3496fd950bf2580c3a06e43

Request headers

:path: /manger/auth/dashboard/lib/css/cms.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:19:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 7214

GET
H2 200 logo.svg
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/ 5 KB
5 KB 301ms
300ms Image
image/svg+xml 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/logo.svg
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 617518a4c1f153f1cbcb09ac14a8b3f4be01fb80dd86159b6b02bbee52622ed3

Request headers

:path: /manger/auth/dashboard/lib/img/logo.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
last-modified: Thu, 22 Oct 2020 01:23:48 GMT
server: Apache
accept-ranges: bytes
content-length: 4875
content-type: image/svg+xml

GET
H2 200 1440x565-ftblue-other.jpg
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/ 64 KB
65 KB 303ms
303ms Image
image/jpeg 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/1440x565-ftblue-other.jpg
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: a41032b705f624b9e188124f35ffa60061fb90257f32e532f80fb51e109c8fae

Request headers

:path: /manger/auth/dashboard/lib/img/1440x565-ftblue-other.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
last-modified: Thu, 22 Oct 2020 00:57:46 GMT
server: Apache
accept-ranges: bytes
content-length: 65879
content-type: image/jpeg

GET
H2 200 equal_housing_logo.png
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/ 3 KB
3 KB 293ms
293ms Image
image/png 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/img/equal_housing_logo.png
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: c9874fdc3addc2b1da577088ec110c30e79e6afd4e89a20ac6ecff47cf1b3f45

Request headers

:path: /manger/auth/dashboard/lib/img/equal_housing_logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
last-modified: Thu, 22 Oct 2020 01:48:42 GMT
server: Apache
accept-ranges: bytes
content-length: 2758
content-type: image/png

GET
H2 200 patternlab.js Show response
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/js/ 412 KB
152 KB 508ms
508ms Script
application/javascript 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/js/patternlab.js
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 462faf6809d9efa417965f36896dce30c1596c6d6308fbee53475c5e447de0ea

Request headers

:path: /manger/auth/dashboard/lib/js/patternlab.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:17 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 01:27:04 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 cms.js Show response
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/js/ 25 KB
8 KB 493ms
492ms Script
application/javascript 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/js/cms.js
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 5bcf95a4354e94c95d0ef992af7fda40baa57a06eb96e5df18905d1f6636f7e6

Request headers

:path: /manger/auth/dashboard/lib/js/cms.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:18 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 01:26:54 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 8276

GET
H2 200 autocomplete.css
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/ 4 KB
1 KB 461ms
461ms Stylesheet
text/css 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/autocomplete.css
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: 798db83db0d827e4e2a0b2d872d7b0220320fb95d30f6194c0dc8d6204fa1c0f

Request headers

:path: /manger/auth/dashboard/lib/css/autocomplete.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:18 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:19:20 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1399

GET
H2 200 search.css
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/ 3 KB
1 KB 456ms
456ms Stylesheet
text/css 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/search.css
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: bf216c3c29cce1a81d8870c7d9fd4fbf71e14a2543d7cae07421539fc8363518

Request headers

:path: /manger/auth/dashboard/lib/css/search.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/index
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:18 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:19:22 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1003

GET
H2 200 css
fonts.googleapis.com/ 10 KB
903 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700

Requested by

Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8083ccf1a360c84185bf8bd1894c4c69b5196659a3c57184551795d79f4ef86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secuspolcusre.servecounterstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 30 May 2021 18:18:45 GMT
server: ESF
date: Sun, 30 May 2021 19:38:18 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 May 2021 19:38:18 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://secuspolcusre.servecounterstrike.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 21:31:36 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
age: 425202
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
expires: Wed, 25 May 2022 21:31:36 GMT

GET
H2 200 icomoon.ttf
secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/fonts/ 31 KB
31 KB 189ms
189ms Font
font/ttf 192.185.115.160
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/fonts/icomoon.ttf
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.115.160 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-115-160.unifiedlayer.com
Software: Apache /
Resource Hash: d7b10f6c9cbc8a3f931c867112393e3274a8ca0e1c3244839ecc7a6ffda64ee4

Request headers

:path: /manger/auth/dashboard/lib/fonts/icomoon.ttf
pragma: no-cache
origin: https://secuspolcusre.servecounterstrike.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: secuspolcusre.servecounterstrike.com
referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/style.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://secuspolcusre.servecounterstrike.com
Referer: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:18 GMT
last-modified: Thu, 22 Oct 2020 01:18:18 GMT
server: Apache
accept-ranges: bytes
content-length: 31544
content-type: font/ttf

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://secuspolcusre.servecounterstrike.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 21:32:06 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 21:21:50 GMT
server: sffe
age: 425172
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
expires: Wed, 25 May 2022 21:32:06 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://secuspolcusre.servecounterstrike.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 21:32:06 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 21:21:26 GMT
server: sffe
age: 425172
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
expires: Wed, 25 May 2022 21:32:06 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 27ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: secuspolcusre.servecounterstrike.com
URL: https://secuspolcusre.servecounterstrike.com/manger/auth/dashboard/lib/js/patternlab.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669E) /
Resource Hash: a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19

Request headers

Referer: https://secuspolcusre.servecounterstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 30 May 2021 19:38:18 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 1173
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28779
x-tw-cdn: VZ
Last-Modified: Wed, 28 Apr 2021 17:57:32 GMT
Server: ECS (frb/669E)
Etag: "9eb59e5602fef4b3ebf6090856ff21db+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H/1.1 200
OK widget_iframe.06c6ee58c3810956b7509218508c7b56.html Show response
platform.twitter.com/widgets/ Frame 3ED8 319 KB
103 KB 6ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fsecuspolcusre.servecounterstrike.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67BA) /
Resource Hash: 5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://secuspolcusre.servecounterstrike.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://secuspolcusre.servecounterstrike.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 335831
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Sun, 30 May 2021 19:38:18 GMT
Etag: "dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:54 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67BA)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105298

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 3ED8 256 B
442 B 271ms
164ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=0e6c1ff86a2b58f271018f8930dc1eda2b6f5488

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fsecuspolcusre.servecounterstrike.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 19:38:18 GMT
content-encoding: gzip
last-modified: Sun, 30 May 2021 19:38:18 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: e4ae291e8dff7e0e4244666955fbeae0ec96a89f88978c4bd48835b955f92a14
content-length: 176

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fifth Third Bank (Banking)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
appurl.io
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
lbar.lesnoi.by
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
partner.googleadservices.com
platform.twitter.com
secuspolcusre.servecounterstrike.com
syndication.twitter.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
104.244.42.72
142.250.181.226
185.66.69.200
192.185.115.160
2001:4de0:ac18::1:a:2a
2606:2800:234:59:254c:406:2366:268c
2606:4700:3033::6815:3d80
2606:4700::6812:acf
2a00:1450:4001:802::200a
2a00:1450:4001:808::2002
2a00:1450:4001:809::2002
2a00:1450:4001:809::2003
2a00:1450:4001:809::2004
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:813::2001
2a00:1450:4001:827::2002
2a00:1450:4001:831::200e
0075065e131bd314797be6698265681f73a00535db04dce4c0cae3ed27ab3494
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
33df66ca469e2de5ae4723c4944b20fd37d65daa2f095b6ec2ff0d70ed6c3d57
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
462faf6809d9efa417965f36896dce30c1596c6d6308fbee53475c5e447de0ea
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5bcf95a4354e94c95d0ef992af7fda40baa57a06eb96e5df18905d1f6636f7e6
5e41a7428c89d172ea125c6b0bd7a3e04250d8a949f82a4dd7d8f84586192aa8
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
60241f9687c740856e904dc331b259730803c4a4b9aec326208620540a5cc204
617518a4c1f153f1cbcb09ac14a8b3f4be01fb80dd86159b6b02bbee52622ed3
6eff65f2a8eb488e25dbca7a506949b599a8f05b522ee54edab296459f8efbcf
798db83db0d827e4e2a0b2d872d7b0220320fb95d30f6194c0dc8d6204fa1c0f
7f810fb379aac9237cfdcf1ebd8bd2d801667649db7fe35e7e9b3b3dc7beaf57
8083ccf1a360c84185bf8bd1894c4c69b5196659a3c57184551795d79f4ef86d
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19
a41032b705f624b9e188124f35ffa60061fb90257f32e532f80fb51e109c8fae
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
bd7509fd616a6f6474077dadb590f30c3c299aec04bec9e0946343bd5cd109fe
bf216c3c29cce1a81d8870c7d9fd4fbf71e14a2543d7cae07421539fc8363518
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916
c9874fdc3addc2b1da577088ec110c30e79e6afd4e89a20ac6ecff47cf1b3f45
d7b10f6c9cbc8a3f931c867112393e3274a8ca0e1c3244839ecc7a6ffda64ee4
d8e194442e61b57a84a530d5599a26b2db9e4670f3496fd950bf2580c3a06e43
d8fd0fc00d6c3b4da408a88f7706f739918cd0b478235b940b4783b4b35b6000
deae731ff57a05a4b03c76f8ae38c60a4d69e17104ac3e416a642c3482275765
e4a1e8dfe89632088e1ec8147765e5a1faf08f7414ede4c9f3cce701f8b85b2f
e76172bc3b3df6806ad948477b9a77c689152dd42303789bc3d26055a9a55e6b
edf2500820ac7c9de5c4f998647c1c4bb31a66b6e7fd69328d1f7ef533c3027c
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fd222b36abfc87a406283b8da0b180e22adeb7e9327ac0a41c6cd5514574b217

secuspolcusre.servecounterstrike.com Open in urlscan Pro 192.185.115.160 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

54 Requests

100 %HTTPS

78 %IPv6

15 Domains

19 Subdomains

18 IPs

4 Countries

1339 kBTransfer

3382 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

54 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secuspolcusre.servecounterstrike.com Open in urlscan Pro
192.185.115.160 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

54
Requests

100 %
HTTPS

78 %
IPv6

15
Domains

19
Subdomains

18
IPs

4
Countries

1339 kB
Transfer

3382 kB
Size

0
Cookies

54 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!