fc.lc Open in urlscan Pro
2606:4700:3035::6815:4e94 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432
Effective URL:
https://fc.lc/1mGvRGW6
Submission: On July 17 via manual (July 17th 2021, 1:03:01 am UTC) from NL

Summary HTTP 61 Redirects Behaviour Indicators

Summary

This website contacted 24 IPs in 7 countries across 23 domains to perform 61 HTTP transactions. The main IP is 2606:4700:3035::6815:4e94, located in United States and belongs to CLOUDFLARENET, US. The main domain is fc.lc.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 8th 2021. Valid for: a year.

This is the only time fc.lc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	95.217.129.163 95.217.129.163	24940 (HETZNER-AS) (HETZNER-AS)
2	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::ac43:697	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	149.56.15.44 149.56.15.44	16276 (OVH) (OVH)
7	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
5	2606:4700:303... 2606:4700:3035::6815:4e94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.255.6.150 172.255.6.150	7979 (SERVERS-COM) (SERVERS-COM)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
2	139.45.197.236 139.45.197.236	9002 (RETN-AS) (RETN-AS)
1	5.135.94.138 5.135.94.138	16276 (OVH) (OVH)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	139.45.197.15 139.45.197.15	9002 (RETN-AS) (RETN-AS)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
2	139.45.197.239 139.45.197.239	9002 (RETN-AS) (RETN-AS)
2	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
2	139.45.197.188 139.45.197.188	9002 (RETN-AS) (RETN-AS)
61	24

2 95.217.129.163 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.163.129.217.95.clients.your-server.de

go.leechpremium.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
short.slink.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:697 (United States)

ASN13335 (CLOUDFLARENET, US)

ouo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 149.56.15.44 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: 44.ip-149-56-15.net

leechpremium.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::6815:4e94 (United States)

ASN13335 (CLOUDFLARENET, US)

fc.lc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.255.6.150 (Netherlands)

ASN7979 (SERVERS-COM, US)

chirkacylal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.197.236 (United Kingdom)

ASN9002 (RETN-AS, GB)

phooreew.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.135.94.138 (France)

ASN16276 (OVH, FR)
PTR: ip138.ip-5-135-94.eu

gabblerpawners.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.197.15 (United Kingdom)

ASN9002 (RETN-AS, GB)

in-page-push.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.197.239 (United Kingdom)

ASN9002 (RETN-AS, GB)

toglooman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
itgiblean.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.197.188 (United Kingdom)

ASN9002 (RETN-AS, GB)

static.cdnativepush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	255 KB
9	doubleclick.net googleads.g.doubleclick.net	28 KB
5	fc.lc fc.lc	49 KB
3	in-page-push.com in-page-push.com	32 KB
3	google.com 1 redirects adservice.google.com www.google.com	1 KB
2	cdnativepush.com static.cdnativepush.com	7 KB
2	rtmark.net my.rtmark.net	1 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	cloudflare.com cdnjs.cloudflare.com	30 KB
2	phooreew.net phooreew.net	21 KB
2	googletagservices.com www.googletagservices.com	65 KB
2	gstatic.com fonts.gstatic.com	33 KB
2	googleapis.com fonts.googleapis.com	1 KB
2	leechpremium.link go.leechpremium.link leechpremium.link	7 KB
1	itgiblean.com itgiblean.com	326 B
1	toglooman.com toglooman.com
1	gabblerpawners.com gabblerpawners.com
1	googletagmanager.com www.googletagmanager.com	39 KB
1	chirkacylal.com chirkacylal.com	1 KB
1	google.de adservice.google.de	853 B
1	googleadservices.com partner.googleadservices.com	661 B
1	slink.bid short.slink.bid	2 KB
1	ouo.io ouo.io	19 KB
61	23

	Domain	Requested by
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
7	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
7	pagead2.googlesyndication.com	go.leechpremium.link pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
5	fc.lc	fc.lc
3	in-page-push.com	fc.lc in-page-push.com
2	static.cdnativepush.com	in-page-push.com
2	my.rtmark.net	phooreew.net in-page-push.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cdnjs.cloudflare.com	fc.lc
2	phooreew.net	fc.lc phooreew.net
2	www.google.com	1 redirects tpc.googlesyndication.com
2	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	go.leechpremium.link fc.lc
1	itgiblean.com
1	toglooman.com	phooreew.net
1	gabblerpawners.com	fc.lc
1	www.googletagmanager.com	fc.lc
1	chirkacylal.com	fc.lc
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	leechpremium.link	go.leechpremium.link
1	short.slink.bid	go.leechpremium.link
1	ouo.io	go.leechpremium.link
1	go.leechpremium.link
61	26

This site contains no links.

Subject Issuer	Validity	Valid
go.leechpremium.link R3	`2021-06-08` - `2021-09-06`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-22` - `2021-09-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-17` - `2021-08-17`	a year	crt.sh
short.slink.bid R3	`2021-06-15` - `2021-09-13`	3 months	crt.sh
leechpremium.link R3	`2021-06-10` - `2021-09-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
fc.lc Cloudflare Inc ECC CA-3	`2021-06-08` - `2022-06-07`	a year	crt.sh
chirkacylal.com R3	`2021-05-19` - `2021-08-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
phooreew.net R3	`2021-06-29` - `2021-09-27`	3 months	crt.sh
gabblerpawners.com R3	`2021-05-12` - `2021-08-10`	3 months	crt.sh
in-page-push.com R3	`2021-05-22` - `2021-08-20`	3 months	crt.sh
toglooman.com R3	`2021-07-09` - `2021-10-07`	3 months	crt.sh
*.rtmark.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-27` - `2021-11-26`	a year	crt.sh
cdnativepush.com R3	`2021-07-14` - `2021-10-12`	3 months	crt.sh
itgiblean.com R3	`2021-05-17` - `2021-08-15`	3 months	crt.sh

This page contains 13 frames:

Primary Page: https://fc.lc/1mGvRGW6
Frame ID: 76E507CA79BBF4FF10A4FDCC9E09CAEB
Requests: 36 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html
Frame ID: AF449533AC222E87B0BE928F0832EEB4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=90&slotname=8301374343&adk=2692090041&adf=548317953&pi=t.ma~as.8301374343&w=728&lmt=1626483763&psa=0&format=728x90&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763595&bpp=34&bdt=144&idt=94&shv=r20210712&ptt=9&saldr=aa&abxe=1&correlator=1482795545452&frm=20&pv=2&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=627&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1024&bc=31&ifi=1&uci=a!1&fsb=1&xpc=LwLx5BSxTS&p=https%3A//go.leechpremium.link&dtd=112
Frame ID: B91C6C82ADE917E112B4768AA9FFDF85
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85
Frame ID: 45215A5651B85841905B1F9E4C8E6A03
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=280&slotname=6479546233&adk=2705649982&adf=3574913033&pi=t.ma~as.6479546233&w=735&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=735x280&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763633&bpp=2&bdt=181&idt=85&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=451&ady=195&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&fsb=1&xpc=R3bkvhnniA&p=https%3A//go.leechpremium.link&dtd=88
Frame ID: AEFC12D3805BCD75E802B75556497C5A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=3175363789&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763635&bpp=22&bdt=184&idt=88&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1251&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=KljZi2E4hk&p=https%3A//go.leechpremium.link&dtd=90
Frame ID: 3E3A8CF43F21E4911C58193A7B290591
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&adk=1812271804&adf=3025194257&lmt=1626483763&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763658&bpp=1&bdt=207&idt=69&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280%2C306x250&nras=1&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=5&uci=a!5&fsb=1&dtd=73
Frame ID: 812E92CD7CE70657F647825E5163AACB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 666BEC6522CF11C234D6951D8F55CEFD
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/s-OE46cnkXGFQoo4r8zhnqxzG88VmeLG6mk72mZMPyg.js
Frame ID: 5EFECD34783DFAD591E43C38ADA5B7F0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 503900DE593E67446E6A329D70CAB27E
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 75719217EBE3D553AD9DF721EE0D2C61
Requests: 1 HTTP requests in this frame

Frame: https://phooreew.net/fac.php
Frame ID: E66EB6F09069F445029F8A9B6E5BB548
Requests: 2 HTTP requests in this frame

Frame: https://static.cdnativepush.com/contents/s/48/15/4b/38ca44eafd323cd4fd273702f6/0625425773465.png
Frame ID: 038D34CD111D9BBD5B3892843272FB05
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432 Page URL
https://fc.lc/1mGvRGW6 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

61
Requests

98 %
HTTPS

58 %
IPv6

23
Domains

26
Subdomains

24
IPs

7
Countries

613 kB
Transfer

1602 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432 Page URL
https://fc.lc/1mGvRGW6 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

61 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
go.leechpremium.link/Next/ 4 KB
1 KB 166ms
80ms Document
text/html 95.217.129.163
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.217.129.163 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.163.129.217.95.clients.your-server.de
Software: nginx / PHP/5.3.29 PleskLin
Resource Hash: c484670baf7864465e8032b6ea9b2f40880bba770c7f965e674ea14ac76bb21e

Request headers

:method: GET
:authority: go.leechpremium.link
:scheme: https
:path: /Next/?id=959a00d8bb0cc1626483432
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Sat, 17 Jul 2021 01:02:43 GMT
content-type: text/html
x-powered-by: PHP/5.3.29 PleskLin
refresh: 7; url=https://fc.lc/1mGvRGW6
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 1020 B
511 B 14ms
13ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Questrial

Requested by

Host: go.leechpremium.link
URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0bfa9b1629f8060bbddfae32fbd6dfd8b9b18c0d39ef5041b4ea12469712fff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 17 Jul 2021 00:14:29 GMT
server: ESF
date: Sat, 17 Jul 2021 01:02:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 17 Jul 2021 01:02:43 GMT

GET
H2 200 bootstrap.css
ouo.io/css/ 107 KB
19 KB 41ms
25ms Stylesheet
text/css 2606:4700:10::ac43:697
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ouo.io/css/bootstrap.css

Requested by

Host: go.leechpremium.link
URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:697 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92bee51ee5dbafaff82c524f7629314d069107bc30913a93b181e4c631a58a0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 27013
cf-polished: origSize=109522
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Sat, 14 Feb 2015 06:58:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"54def1fc-1abd2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=86400
cf-ray: 66ff8be1ab65d6c5-FRA
expires: Sat, 17 Jul 2021 05:32:30 GMT

GET
H2 200 style.css
short.slink.bid/ 6 KB
2 KB 136ms
49ms Stylesheet
text/css 95.217.129.163
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://short.slink.bid/style.css
Requested by: Host: go.leechpremium.link
URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.217.129.163 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.163.129.217.95.clients.your-server.de
Software: nginx / PleskLin
Resource Hash: bef6c0a541d5e688a05cbcef6df9449126854f1f4f0cf84ff923bc9223bd11eb

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: br
etag: W/"5ee51c71-1833"
last-modified: Sat, 13 Jun 2020 18:35:29 GMT
server: nginx
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 logo.png
leechpremium.link/assets/img/ 5 KB
6 KB 293ms
96ms Image
image/png 149.56.15.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://leechpremium.link/assets/img/logo.png
Requested by: Host: go.leechpremium.link
URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 149.56.15.44 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: 44.ip-149-56-15.net
Software: nginx / PleskLin
Resource Hash: 177ee528fcc20d400db4259fad6c41ef58f4ed471857438b3997419af3c53a03

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:01:42 GMT
last-modified: Thu, 06 Aug 2020 09:59:41 GMT
server: nginx
x-powered-by: PleskLin
etag: "5f2bd48d-15ea"
content-type: image/png
accept-ranges: bytes
content-length: 5610

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 41ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: go.leechpremium.link
URL: https://go.leechpremium.link/Next/?id=959a00d8bb0cc1626483432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bff7d7daab7b0e2e15cfb4777e0a550049554e9b391d519f9f2f3196275d5f34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48389
x-xss-protection: 0
server: cafe
etag: 7904118586112407981
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 17 Jul 2021 01:02:43 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/ Frame AF44 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210712/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 16 Jul 2021 03:29:55 GMT
expires: Fri, 30 Jul 2021 03:29:55 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 77568
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/ 244 KB
90 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6024123809614566&plah=go.leechpremium.link&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5ecfcec3e27fe9897118aabcbd06b14a055e27fdff3fbfd82e4b35336c3f7fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92395
x-xss-protection: 0
server: cafe
etag: 7826786853314341384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 17 Jul 2021 01:02:43 GMT

GET
H2 200 QdVUSTchPBm7nuUeVf70viFl.woff2
fonts.gstatic.com/s/questrial/v13/ 19 KB
19 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/questrial/v13/QdVUSTchPBm7nuUeVf70viFl.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Questrial

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62a17bc7232cf7af5c41ff98ec5a59d300d586773b5850e460aea5387f60c8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://go.leechpremium.link
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 12:17:04 GMT
x-content-type-options: nosniff
age: 305139
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19404
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:43:25 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 12:17:04 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 207 B
661 B 38ms
16ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=go.leechpremium.link&callback=_gfp_s_&client=ca-pub-6024123809614566

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6024123809614566&plah=go.leechpremium.link&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

77a3d1637a30c2531b7a7a5f1f8fc069242a5e4a9d4ba3bc30bfcfb4f199263e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 34ms
14ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=go.leechpremium.link

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 34ms
15ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=go.leechpremium.link

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B91C 436 B
235 B 191ms
190ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=90&slotname=8301374343&adk=2692090041&adf=548317953&pi=t.ma~as.8301374343&w=728&lmt=1626483763&psa=0&format=728x90&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763595&bpp=34&bdt=144&idt=94&shv=r20210712&ptt=9&saldr=aa&abxe=1&correlator=1482795545452&frm=20&pv=2&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=627&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1024&bc=31&ifi=1&uci=a!1&fsb=1&xpc=LwLx5BSxTS&p=https%3A//go.leechpremium.link&dtd=112

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8dbfb4c31866ed42aa4ea43b48cf04f4a0b1de6c36885a86c1f96469c9c83804

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6024123809614566&output=html&h=90&slotname=8301374343&adk=2692090041&adf=548317953&pi=t.ma~as.8301374343&w=728&lmt=1626483763&psa=0&format=728x90&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763595&bpp=34&bdt=144&idt=94&shv=r20210712&ptt=9&saldr=aa&abxe=1&correlator=1482795545452&frm=20&pv=2&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=627&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1024&bc=31&ifi=1&uci=a!1&fsb=1&xpc=LwLx5BSxTS&p=https%3A//go.leechpremium.link&dtd=112
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Jul 2021 01:02:43 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Jul-2021 01:17:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:43 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee07009e9fe79b9909bafdb282106c95dac83f905c6ac665e1257ac862ed50e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:43 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434913869424"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28061
x-xss-protection: 0
expires: Sat, 17 Jul 2021 01:02:43 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4521 57 KB
22 KB 334ms
333ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b5b2f81a4b1c196b9c02b6c3044ff23b6e9e8eb9b0aed98c3b8e02c0a542825

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Jul 2021 01:02:44 GMT
server: cafe
content-length: 22132
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Jul-2021 01:17:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:44 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AEFC 436 B
235 B 162ms
161ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=280&slotname=6479546233&adk=2705649982&adf=3574913033&pi=t.ma~as.6479546233&w=735&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=735x280&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763633&bpp=2&bdt=181&idt=85&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=451&ady=195&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&fsb=1&xpc=R3bkvhnniA&p=https%3A//go.leechpremium.link&dtd=88

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ed1058fa9599babfa419bbbee2c283127e998f94580b5b4b1ad61291c4e1414

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6024123809614566&output=html&h=280&slotname=6479546233&adk=2705649982&adf=3574913033&pi=t.ma~as.6479546233&w=735&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=735x280&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763633&bpp=2&bdt=181&idt=85&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=451&ady=195&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=3&uci=a!3&fsb=1&xpc=R3bkvhnniA&p=https%3A//go.leechpremium.link&dtd=88
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Jul 2021 01:02:43 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Jul-2021 01:17:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:43 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3E3A 436 B
235 B 145ms
145ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=3175363789&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763635&bpp=22&bdt=184&idt=88&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1251&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=KljZi2E4hk&p=https%3A//go.leechpremium.link&dtd=90

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a324b929727cfcb4053b8d1f939a7831ba17d8a75760efd937b58bbe207e82a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=3175363789&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763635&bpp=22&bdt=184&idt=88&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1251&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=4&uci=a!4&fsb=1&xpc=KljZi2E4hk&p=https%3A//go.leechpremium.link&dtd=90
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Jul 2021 01:02:43 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Jul-2021 01:17:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:43 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 812E 3 KB
617 B 60ms
59ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&adk=1812271804&adf=3025194257&lmt=1626483763&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763658&bpp=1&bdt=207&idt=69&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280%2C306x250&nras=1&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=5&uci=a!5&fsb=1&dtd=73

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d60c95ac438e1d7847f13dfed8e079876d9d75999fadae39cebe4a7ed3f67a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6024123809614566&output=html&adk=1812271804&adf=3025194257&lmt=1626483763&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763658&bpp=1&bdt=207&idt=69&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C306x250%2C735x280%2C306x250&nras=1&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=5&uci=a!5&fsb=1&dtd=73
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 17 Jul 2021 01:02:43 GMT
server: cafe
content-length: 594
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 17-Jul-2021 01:17:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:43 GMT
cache-control: private

GET
H2 200 7150982879602357449
tpc.googlesyndication.com/daca_images/simgad/ Frame 4521 45 KB
46 KB 33ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/7150982879602357449

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a65e82bc53a78f177ecea2ba5e361c539e5f42262f1e0ca3ff94c38fdf53dca3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Jul 2021 11:22:25 GMT
x-content-type-options: nosniff
age: 49219
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46578
x-xss-protection: 0
last-modified: Fri, 16 Jul 2021 08:43:30 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Jul 2022 11:22:25 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame 4521 18 KB
8 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 00:30:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1916
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 31 Jul 2021 00:30:48 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 4521 2 KB
1 KB 23ms
11ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 00:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 31 Jul 2021 00:31:06 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4521 124 KB
37 KB 32ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:44 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sat, 17 Jul 2021 01:02:44 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 4521 14 KB
6 KB 22ms
9ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 00:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 855
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 31 Jul 2021 00:48:29 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 4521 26 KB
11 KB 30ms
18ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a56c62be9652c7b6b85be1e24dab707f15623d73cde436958c4ef74e3b5b68d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Jul 2021 18:47:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10748
x-xss-protection: 0
server: cafe
etag: 11229175930449698035
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Jul 2021 18:47:47 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4521 0
0 43ms
43ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5TDFMyzyYMfULJHG7_UPn5Gr4AnL1MnlY-mO9966DtrZHhABIIzE2nJglQKgAYOwnZ8CyAECqAMByAPJBKoE1AFP0MnPxKvxvVdF1LmAAzW_gzrHOSvahgrx3j31ERKCrJWmTk3MUElz2D7MwnvsP8xXdGC-BX34edGaxI3j76FKjj4XrmxthP2Pcpb7EfiBtZslP9PZyaoeFbYwa1SMSqN-kbUvEOhVHvRjvR0ktoqvkFrOA0uAiApA_q3OOZ1gyISbP9ilhvVTm36X6EtR89WdQFQ5IiKgBjb2AMaCb8pjQHMZO3iXnpn0fSgpBEdyHRI7PP4C-j8W4Ht2q9cyW4-DWRt3cePGX0uD1BfMaAsaNAScp8AE9Jnrx9EDkgUECAQYAZIFBAgFGASgBgKAB9es_q8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEELL3AdIICQiA4YAQEAEYH4AKAcgLAdgTAtAVAYAXAbIXGgoYCAASFHB1Yi02MDI0MTIzODA5NjE0NTY2&sigh=PMv-wuTf_F8

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 17 Jul 2021 01:02:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 17 Jul 2021 01:02:44 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 666B 143 B
163 B 7ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6024123809614566&output=html&h=250&slotname=2465946931&adk=1696767751&adf=683863926&pi=t.ma~as.2465946931&w=306&fwrn=4&fwrnh=100&lmt=1626483763&rafmt=1&psa=0&format=306x250&url=https%3A%2F%2Fgo.leechpremium.link%2FNext%2F%3Fid%3D959a00d8bb0cc1626483432&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626483763630&bpp=3&bdt=179&idt=83&shv=r20210712&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=1482795545452&frm=20&pv=1&ga_vid=1644364585.1626483764&ga_sid=1626483764&ga_hid=578694517&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=45&ady=150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060972&oid=3&pvsid=120127827527552&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=1152&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Fwr5vE17eR&p=https%3A//go.leechpremium.link&dtd=85

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 17 Jul 2021 00:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1188
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 666B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlyg4zeAkbnBwbWFKdqSTc12OjmyWiqaWFCNI1I6hgFau4f3x3NZnYoxtVty-8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 17 Jul 2021 01:02:44 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 17-Jul-2021 02:02:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 17 Jul 2021 01:02:44 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 17 Jul 2021 01:02:44 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4521 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed1536d62fee5a13cbeb5c138af68eaeb8607dea18c40db59454a6d2745813cc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 31ms
18ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210712&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc20ef219f193a7c741f5de1fa5e74a19e8a790527aec084c937b3a4e97411cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 17 Jul 2021 01:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8407
x-xss-protection: 0

GET
H3-29 200 s-OE46cnkXGFQoo4r8zhnqxzG88VmeLG6mk72mZMPyg.js Show response
pagead2.googlesyndication.com/bg/ Frame 5EFE 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s-OE46cnkXGFQoo4r8zhnqxzG88VmeLG6mk72mZMPyg.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3e384e3a727917185428a38afcce19eac731bcf1599e2c6ea693bda664c3f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Jul 2021 14:22:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38435
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13247
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Jul 2022 14:22:09 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Sat, 17 Jul 2021 01:02:44 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 5039 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Fri, 16 Jul 2021 20:11:12 GMT
expires: Sat, 16 Jul 2022 20:11:12 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 17492
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7571 783 B
531 B 24ms
22ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9621a51624f328961da6e3e678864214c37532aee2f7585f654d16c625412c83

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7bawD8jvRPEdnEehRSBKPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

expires: Sat, 17 Jul 2021 01:02:44 GMT
date: Sat, 17 Jul 2021 01:02:44 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-7bawD8jvRPEdnEehRSBKPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s-OE46cnkXGFQoo4r8zhnqxzG88VmeLG6mk72mZMPyg.js Show response
pagead2.googlesyndication.com/bg/ Frame 5039 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s-OE46cnkXGFQoo4r8zhnqxzG88VmeLG6mk72mZMPyg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3e384e3a727917185428a38afcce19eac731bcf1599e2c6ea693bda664c3f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Jul 2021 14:22:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38435
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13247
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Jul 2022 14:22:09 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210712&jk=120127827527552&bg=!VlWlVRHNAAZjFomlYxY7ACkAdvg8WrWBF2UUqjMi8dP085BXVYA80UJHjwZEEtXE_LBGU6mSahG9ewIAAABZUgAAAAtoAQeZAnYl5FpBmilG2ks2FihkMloV6GSeiYmuVAyXP4tey2_K2bI1xBCQx8TV_6AGbldxG8TXsuyjEHnwxSolAbPKypuMTMWR27HqYJ1jg6EzKc51VAS9iP18XfgYw_gY002Zw_k58ciZZVX2dtLqls21NZGSEVMGjoajqU7GLDrlBKtkO4QKEFrNnhYiepgtcXgRpyyjNTr-rEeJWEz_RPamLMIynwhkDk46f_y6aDkkpoJ7pkQrF0H6Qrelu4fvWS0EhvG9K1vgdMdPmCmNexv2xmX7qJK2dR1iUbHqCLj0kL5oe1nO3ZIf0_q4z2rpg8Lh2mbpUJPayYqPo33Toahc3O2e_KGN3RyMwPld2QzIb3yYyjNd6ACs0QkgaQd2KQ2i3yN8LTCTzcB87bs7a0R54Y4rqN3fxfr0La3BanqfWJbd2QniaQR3pJrOHmnKVeLhiFWZKpLjSfCeoyhPDHWjt4pZBnLLUx5YgPCNISk0errKuhFQiPzBKpJoJoHR6M1qYsSQSMy3sQIuf83PqYwhxbzWWeU6A-LwHCq2RyxYTTAXzYi_Be6TsgN1xnMcT9ZpL4Jp7mFt6doSAKrdJGzSZyDAyLlkKjx1Mp-8eNx8YpifD_sQEpc669EWWTzLBPC0lzM5cmRoGIg4CgFdKIbVTiejTR264fFG5-V-6EJQvgrTtN1U-6oEPwBSan6Rt9YWIUHffDu2AwmD34HROvCFPNoP9ybJ0djOseJ9qrH9KF9UX2dQ8AaAsb92VqDGs--UxfhXyZ-fQi30DXw3TnySqMvIaIQDnXJrn8ZIWeHJ9W9pEKNXXybXcehfACob4pMj8VMNQ2RdVJM

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.leechpremium.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Jul 2021 01:02:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4521 42 B
64 B 41ms
40ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstsWM5vVeef5F7VXDBZ9N4uKgq9O-JSgPB5NAR3OyruVmPqHgVBElqFHhnCkngqhlUSblwsuVpnAJiviiuo_eD1LkXifbAvouEdFo3tJfVJqYWvjNm3xr4BBIhAxQ&sai=AMfl-YR5bjMC0hOVoLmah2DqeOdRqRDEwrByPBP5h8oFGc5nBqkUh_V8uC8biQD8RzAxqCw8X_doDwTEDHgP&sig=Cg0ArKJSzILgDEdBbySVEAE&id=lidar2&mcvt=1000&p=150,48,400,348&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210716&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1696767751&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1626483763717&dlt=344&rpt=50&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Jul 2021 01:02:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Primary Request 1mGvRGW6 Show response
fc.lc/ 8 KB
4 KB 358ms
335ms Document
text/html 2606:4700:3035::6815:4e94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.lc/1mGvRGW6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:4e94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49a98b00729462b3c876cc32f056bbd51733a190c4fcb5a4a1658e9a6f1ccfa6

Request headers

:method: GET
:authority: fc.lc
:scheme: https
:path: /1mGvRGW6
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://go.leechpremium.link/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.leechpremium.link/

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-type: text/html; charset=UTF-8
set-cookie: AppSession=rck0j9cbv7n2i8q1q79es8gvh5; path=/; HttpOnly visitor_cookie=YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AcEAOYbUwuxtntR0IF7GQWfmmNAlOJ%2BvWxI1ryh0MkWLushGxMno6uR%2B8pwyfQ3bTp2E1FKcYa%2FfM7Lz99%2F5KCJPS5JWwrZ%2FyyM0Qk80Gg9dR6DoFH1aMzmNLIb5NBGoC0GRqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 66ff8c121fafc28b-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 4521 0
0

GET
H2 200 css
fonts.googleapis.com/ 10 KB
903 B 17ms
15ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8083ccf1a360c84185bf8bd1894c4c69b5196659a3c57184551795d79f4ef86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 16 Jul 2021 23:50:05 GMT
server: ESF
date: Sat, 17 Jul 2021 01:02:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 17 Jul 2021 01:02:51 GMT

GET
H3-29 200 bootstrap.min.css
fc.lc/CustomTheme/css/ 108 KB
19 KB 27ms
17ms Stylesheet
text/css 2606:4700:3035::6815:4e94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.lc/CustomTheme/css/bootstrap.min.css
Requested by: Host: fc.lc
URL: https://fc.lc/1mGvRGW6
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:4e94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83521aad7c96625246ef4168f1d84d12b0652e8eb61ad0875066fee1fa797daf

Request headers

:path: /CustomTheme/css/bootstrap.min.css
pragma: no-cache
cookie: AppSession=rck0j9cbv7n2i8q1q79es8gvh5; visitor_cookie=YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: fc.lc
referer: https://fc.lc/1mGvRGW6
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fc.lc/1mGvRGW6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 15 Jan 2019 19:43:36 GMT
server: cloudflare
age: 58
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yWGJO%2B0%2FhnBpN1T%2BwmO8dyHEh2%2FHlKz2ZqswQgIUlerXZn0WsM0tyw04lSueUhSrFFfpe9V%2FFiXb5nmwf%2FSikvcH95ru9oPHeEp34NzSCl3NSOBvCyYtZDZUjd%2FoVbexosMOWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 66ff8c1459254e67-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 27 May 2021 15:40:27 GMT

GET
H3-29 200 main.css
fc.lc/CustomTheme/css/ 24 KB
6 KB 27ms
17ms Stylesheet
text/css 2606:4700:3035::6815:4e94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.lc/CustomTheme/css/main.css
Requested by: Host: fc.lc
URL: https://fc.lc/1mGvRGW6
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:4e94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89e38ae45e4ab6870530ad77bc793c32dcb03a600156b9930ffe3104f6702b25

Request headers

:path: /CustomTheme/css/main.css
pragma: no-cache
cookie: AppSession=rck0j9cbv7n2i8q1q79es8gvh5; visitor_cookie=YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: fc.lc
referer: https://fc.lc/1mGvRGW6
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fc.lc/1mGvRGW6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 33537
cf-polished: origSize=32501
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 7 Feb 2019 2:14:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=73yOeMaMPlT4gtrxB1MtYGskQoWPOyGmrNrAAtppWn58Q%2B8CE33KBfW99J7Cc99tU0AQItfKyED7Zis3ngVsESrRzjxVp%2Boy10gAdWzafX4J83a1mhyN7eqgsHF4bK1oyhxwFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 66ff8c1459234e67-FRA
expires: Sat, 17 Jul 2021 15:43:54 GMT

GET
H3-29 200 custom.css
fc.lc/CustomTheme/css/ 47 KB
19 KB 36ms
25ms Stylesheet
text/css 2606:4700:3035::6815:4e94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.lc/CustomTheme/css/custom.css
Requested by: Host: fc.lc
URL: https://fc.lc/1mGvRGW6
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:4e94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b62d3ff7ec9f5543b6d6a2429170ed375b550d869b90d9886464143cd89b83ef

Request headers

:path: /CustomTheme/css/custom.css
pragma: no-cache
cookie: AppSession=rck0j9cbv7n2i8q1q79es8gvh5; visitor_cookie=YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: fc.lc
referer: https://fc.lc/1mGvRGW6
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fc.lc/1mGvRGW6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 33537
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 25 Apr 2019 1:51:11 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=veoPvFgEYX%2FNkFNtNhMP4Qr5MDnZvHp2CZUYsfNU%2B1cN%2Bvnmqx4vXhtERJ3EldZKblfFUJl6B9jO%2FHgNfU3X%2FG%2B6BjMPDJkO1pfgY2%2BI0rWmpdoxwTEvrdqeFEKuncYaL86JbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 66ff8c1459264e67-FRA
expires: Sat, 17 Jul 2021 15:43:54 GMT

GET
H3-29 200 modernizr.min.js Show response
fc.lc/CustomTheme/js/vendor/ 1 KB
1 KB 26ms
16ms Script
application/javascript 2606:4700:3035::6815:4e94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.lc/CustomTheme/js/vendor/modernizr.min.js
Requested by: Host: fc.lc
URL: https://fc.lc/1mGvRGW6
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:4e94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 147b08aa6afaa0b704ebedb56d0b146a7e33600a971e5d20773b3371db70be11

Request headers

:path: /CustomTheme/js/vendor/modernizr.min.js
pragma: no-cache
cookie: AppSession=rck0j9cbv7n2i8q1q79es8gvh5; visitor_cookie=YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: fc.lc
referer: https://fc.lc/1mGvRGW6
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fc.lc/1mGvRGW6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 15 Jan 2019 20:08:05 GMT
server: cloudflare
age: 58
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MaZirTw5tucbIFHlWYdX1V1SI6w%2FM%2FlnXr80dyXQXA8llcPuuIYO5lnE72tLi1ohVGArmkKG4qI1%2B0ZhF7MQ4VI5NbHg562k%2FKklXQ1k57%2BE%2F2jQf6LQfUI4clOYpyvvOH%2FNfA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=86400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 66ff8c1459214e67-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 27 May 2021 15:40:27 GMT

GET
H/1.1 200
OK 34828 Show response
chirkacylal.com/1clkn/ 0
1 KB 80ms
26ms Script
application/javascript 172.255.6.150
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://chirkacylal.com/1clkn/34828

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

172.255.6.150 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Jul 2021 01:02:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=1
Keep-Alive: timeout=20

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-90563943-1

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

29668aa7f188f36995a10e199ab3049f2d9e9cf427201f10657ad5c599a3591d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39661
x-xss-protection: 0
last-modified: Sat, 17 Jul 2021 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 17 Jul 2021 01:02:51 GMT

GET
H2 200 apu.php Show response
phooreew.net/ 53 KB
21 KB 80ms
34ms Script
application/javascript 139.45.197.236
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://phooreew.net/apu.php?zoneid=3544249

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

bcaccbe557369e39b6a7918837ff9bd82dc1a4108998320bf1dd6924363237f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-trace-id: 37ce0d1fe36dbfdccfdd6beba6440c7b
pragma: no-cache
date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H/1.1 200
OK 32920 Show response
gabblerpawners.com/g0ifDEICMdEi6sh/ 0
0 275ms
18ms Script
text/html 5.135.94.138
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gabblerpawners.com/g0ifDEICMdEi6sh/32920
Requested by: Host: fc.lc
URL: https://fc.lc/1mGvRGW6
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 5.135.94.138 , France, ASN16276 (OVH, FR),
Reverse DNS: ip138.ip-5-135-94.eu
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://fc.lc
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
28 KB 33ms
16ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2507822
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 27748
cf-request-id: 0abe1b8a5f00002b35110d4000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bqn3nqKE1ZktP%2Fh1QuFivT0t3FM9gL5zx7mrEOPrYwmhPa7FzZ5IWh%2Bp3XaOp2Vw7hUO4roZtujs26SwrhPqrwEYc6FyOaFDnR8xs23I%2F3E87mxkDgU7IKNbQErDOIjBkpbNDhJSMTNMHJOSr%2BsP3A6g"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66ff8c146db72b71-FRA
expires: Thu, 07 Jul 2022 01:02:51 GMT

GET
H2 200 3072098 Show response
in-page-push.com/400/ 83 KB
30 KB 184ms
86ms Script
application/javascript 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://in-page-push.com/400/3072098

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

8f51ecf45f47a048a73531b89661d33ef5a3953e0cf4c0a11457907475ecc152

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-trace-id: 4cf6943afbb635170ed9d563fa15b995
pragma: no-cache
date: Sat, 17 Jul 2021 01:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
strict-transport-security: max-age=1
timing-allow-origin: *
expires: Wed, 31 Dec 1969 19:00:00 EST

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-90563943-1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 712
date: Sat, 17 Jul 2021 00:50:59 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Sat, 17 Jul 2021 02:50:59 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 12ms
12ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1429949794&t=pageview&_s=1&dl=https%3A%2F%2Ffc.lc%2F1mGvRGW6&dr=https%3A%2F%2Fgo.leechpremium.link%2F&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=945053395&gjid=573387422&cid=1686036725.1626483772&tid=UA-90563943-1&_gid=6570696.1626483772&_r=1&gtm=2ou7e0&z=987147686

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 17 Jul 2021 01:02:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fc.lc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 1
toglooman.com/ 0
0 63ms
24ms Script
text/plain 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://toglooman.com/1?z=3888945
Requested by: Host: phooreew.net
URL: https://phooreew.net/apu.php?zoneid=3544249
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
x-sc: 4KdnrdofxFOHMlcU
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: text/plain; charset=utf-8
access-control-allow-origin
access-control-expose-headers: X-Sc
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
content-length: 7

GET
H2 200 fac.php Show response
phooreew.net/ Frame E66E 203 B
647 B 18ms
18ms Document
text/html 139.45.197.236
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://phooreew.net/fac.php

Requested by

Host: phooreew.net
URL: https://phooreew.net/apu.php?zoneid=3544249

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

7a2149331be4d63738ffd1e3a24520c02599f50c5f5e4f8a43a2b7930325cf54

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: phooreew.net
:scheme: https
:path: /fac.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc.lc/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: OAID=1f1d02f5d98c4b1cbbd7a444891957f9; oaidts=1626483771
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc.lc/

Response headers

server: nginx
date: Sat, 17 Jul 2021 01:02:51 GMT
content-type: text/html; charset=utf8
content-length: 203
x-trace-id: cf55760eb3b4aa49828cd92ed1dba034
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
timing-allow-origin: * *
strict-transport-security: max-age=1
x-content-type-options: nosniff

GET
H2 200 img.gif
my.rtmark.net/ Frame E66E 43 B
492 B 66ms
17ms Image
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=1f1d02f5d98c4b1cbbd7a444891957f9

Requested by

Host: phooreew.net
URL: https://phooreew.net/fac.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://phooreew.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

GET
H3-29 200 fuckadblock.min.js Show response
cdnjs.cloudflare.com/ajax/libs/fuckadblock/3.2.1/ 5 KB
2 KB 18ms
17ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fuckadblock/3.2.1/fuckadblock.min.js

Requested by

Host: fc.lc
URL: https://fc.lc/1mGvRGW6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c63c0a518fcd8243e365904eb4ec5162d2b6d066aa4f05027fb598089d73ebdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://fc.lc
Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2509538
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1309
cf-request-id: 0abe015b720000d6b58e37e000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:19 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e6b-1285"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BfsSTOqZhKZei%2FSqyA3C2G1J7O1mj1Aw%2B9woeoN0%2F6WGxbe9cSgTzy84RHCymZ%2FuJA%2Bi3t7GeZOybYQyYLU1f%2FhdEjzb6su%2FxiQMrn1Gvo5GoSOJamChdBJYxSoZzz%2FfC53rmA6idjOiwWy0DZtWgJIV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66ff8c161cb42bce-FRA
expires: Thu, 07 Jul 2022 01:02:51 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://fc.lc
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Jul 2021 18:26:10 GMT
x-content-type-options: nosniff
age: 369401
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Jul 2022 18:26:10 GMT

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
537 B 52ms
52ms XHR
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js

Requested by

Host: in-page-push.com
URL: https://in-page-push.com/400/3072098

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

73ac15b16335c6b4f1e12b4b52b843077b8a0a36e3812f505b3f28e58ab13ff4

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 01:02:52 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://fc.lc
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 3072098 Show response
in-page-push.com/500/ 4 KB
3 KB 51ms
50ms XHR
application/javascript 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://in-page-push.com/500/3072098?excludes=&oaid=1f1d02f5d98c4b1cbbd7a444891957f9&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Ffc.lc%2F1mGvRGW6&drf=https%3A%2F%2Fgo.leechpremium.link%2F&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Requested by

Host: in-page-push.com
URL: https://in-page-push.com/400/3072098

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

97bc2ba1760c19433112e19181da6584d22c3651e981dca37aeab704cd889038

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: b35d90260eed19215c237a91e43b411c
pragma: no-cache
date: Sat, 17 Jul 2021 01:02:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://fc.lc
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *
expires: Wed, 31 Dec 1969 19:00:00 EST

OPTIONS
H2 200 3072098
in-page-push.com/500/ Frame 0
0 57ms
21ms Preflight 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://fc.lc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Sat, 17 Jul 2021 01:02:52 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET
access-control-allow-origin: https://fc.lc
access-control-max-age: 300
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *

GET
H/1.1 200
OK 0625425773465.png
static.cdnativepush.com/contents/s/48/15/4b/38ca44eafd323cd4fd273702f6/ 3 KB
4 KB 171ms
42ms Image
image/png 139.45.197.188
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/48/15/4b/38ca44eafd323cd4fd273702f6/0625425773465.png
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 139.45.197.188 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 8f18cf892dcf9bee9190d075020a1640ce96f012d399790af20a7c0d8bddb072

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Jul 2021 01:02:52 GMT
Last-Modified: Thu, 15 Oct 2020 17:21:16 GMT
Server: nginx
ETag: "5f88850c-bf3"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Content-Length: 3059

GET
H2 200 oWpJyfca_Ej4hAQ8hgJt34thOuAL9HASQ8IkkriPgRGm77jt_gLSQNfpFY7xA30D6hJhB_kbza3bcXdV7iVT3PJzc5KmTvUiMxY3plA4y3LG801NUF6IffVFIeVJ5PCbO0IxJXikJjEKz1-8H4zyCI7PrcMmEp9JipQ-VeiS93-6hV4QzKDZATBJZrcvYKX95sj-s...
itgiblean.com/impression/ 43 B
326 B 62ms
21ms Image
image/gif 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://itgiblean.com/impression/oWpJyfca_Ej4hAQ8hgJt34thOuAL9HASQ8IkkriPgRGm77jt_gLSQNfpFY7xA30D6hJhB_kbza3bcXdV7iVT3PJzc5KmTvUiMxY3plA4y3LG801NUF6IffVFIeVJ5PCbO0IxJXikJjEKz1-8H4zyCI7PrcMmEp9JipQ-VeiS93-6hV4QzKDZATBJZrcvYKX95sj-sA7PswCFXfPbMqN-HScLqlCVtVUnycwVPDHWhFJZonweFr-q2Y4bEa5fggf-g2brQXUOvC6WxSok_UjoQqOola0QKUZZjZT0h7edalbNGsrp1vgLf5woD6Q9zJsOhKXbxh-xDdD4QJPsMXwad_ppk3aQgLhb_-CWX1ESgp20KDz0mL38UwRJSwMAq_PVgFNtaPM3FXuIYY_lkdr1x-YRxzjP2EcBgjG4L_SkApxMi0z0MtfA9-haiL_EEoCbGQfuDeNR04ONvjZjYeI6G1LOWKv9adpFvWxhE2vlU1On9AA0T1QzQac59VgRtzPyl9LZ0xQlk_igldhQkzOz5Bl5OezGFKk4lBsQuc10lRBUk2zOSNsCj50SmEWdCN2mbRb0Hi3WmH1v5JFC15JqgwJpxrE4Adeu99ETgOItkwhXFRKf4s-madmFHL9v3mrjn_ZIXL5a3j_EJYbPprQ-5tv2pyWYyDCpQG7-szAhWeA1GsZVq1UnWmbQULyhDIkR2DZxiA==?_z=3072098&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Ffc.lc%2F1mGvRGW6&drf=https%3A%2F%2Fgo.leechpremium.link%2F&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://fc.lc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-trace-id: 2877fb8776e20fc390744720c131df64
pragma: no-cache
date: Sat, 17 Jul 2021 01:02:56 GMT
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
strict-transport-security: max-age=1
timing-allow-origin: *
content-length: 43
expires: Wed, 31 Dec 1969 19:00:00 EST

GET
H/1.1 200
OK 0625425773465.png
static.cdnativepush.com/contents/s/48/15/4b/38ca44eafd323cd4fd273702f6/ Frame 038D 3 KB
4 KB 44ms
44ms Image
image/png 139.45.197.188
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/48/15/4b/38ca44eafd323cd4fd273702f6/0625425773465.png
Requested by: Host: in-page-push.com
URL: https://in-page-push.com/400/3072098
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 139.45.197.188 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 17 Jul 2021 01:02:56 GMT
Last-Modified: Thu, 15 Oct 2020 17:21:16 GMT
Server: nginx
ETag: "5f88850c-bf3"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Content-Length: 3059

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstsWM5vVeef5F7VXDBZ9N4uKgq9O-JSgPB5NAR3OyruVmPqHgVBElqFHhnCkngqhlUSblwsuVpnAJiviiuo_eD1LkXifbAvouEdFo3tJfVJqYWvjNm3xr4BBIhAxQ&sai=AMfl-YR5bjMC0hOVoLmah2DqeOdRqRDEwrByPBP5h8oFGc5nBqkUh_V8uC8biQD8RzAxqCw8X_doDwTEDHgP&sig=Cg0ArKJSzILgDEdBbySVEAE&id=lidartos&mcvt=7385&p=150,48,400,348&mtos=7385,7385,7385,7385,7385&tos=7385,0,0,0,0&v=20210716&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1696767751&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosc=0&eosm=0&rst=1626483763717&dlt=344&rpt=50&isd=0&msd=0&r=u&ec=0

Verdicts & Comments Add Verdict or Comment

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
phooreew.net/	1970-01-20 04:33:39	Name: oaidts Value: 1626483771
phooreew.net/	1970-01-20 04:33:39	Name: OAID Value: 1f1d02f5d98c4b1cbbd7a444891957f9
.fc.lc/	1970-01-19 19:49:30	Name: _gid Value: GA1.2.6570696.1626483772
fc.lc/	1969-12-31 23:59:59	Name: visitor_cookie Value: YToyOntzOjI6ImlwIjtzOjIwOiIyYTAxOjRmODoxOTI6NTQxNDo6MiI7czo0OiJkYXRlIjtzOjE5OiIyMDIxLTA3LTE3IDAxOjAyOjUxIjt9
.fc.lc/	1970-01-19 19:48:03	Name: _gat_gtag_UA_90563943_1 Value: 1
.fc.lc/	1970-01-19 19:48:07	Name: __PPU_BACKCLCK_3544249 Value: true
.fc.lc/	1970-01-20 13:19:15	Name: _ga Value: GA1.2.1686036725.1626483772
fc.lc/	1969-12-31 23:59:59	Name: AppSession Value: rck0j9cbv7n2i8q1q79es8gvh5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
cdnjs.cloudflare.com
chirkacylal.com
fc.lc
fonts.googleapis.com
fonts.gstatic.com
gabblerpawners.com
go.leechpremium.link
googleads.g.doubleclick.net
in-page-push.com
itgiblean.com
leechpremium.link
my.rtmark.net
ouo.io
pagead2.googlesyndication.com
partner.googleadservices.com
phooreew.net
short.slink.bid
static.cdnativepush.com
toglooman.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
pagead2.googlesyndication.com
139.45.195.8
139.45.197.15
139.45.197.188
139.45.197.236
139.45.197.239
142.250.186.34
149.56.15.44
172.255.6.150
2606:4700:10::ac43:697
2606:4700:3035::6815:4e94
2606:4700::6810:135e
2a00:1450:4001:800::200a
2a00:1450:4001:809::2001
2a00:1450:4001:80e::2003
2a00:1450:4001:810::200e
2a00:1450:4001:813::2002
2a00:1450:4001:827::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2008
2a00:1450:4001:831::2002
5.135.94.138
95.217.129.163
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0bfa9b1629f8060bbddfae32fbd6dfd8b9b18c0d39ef5041b4ea12469712fff8
147b08aa6afaa0b704ebedb56d0b146a7e33600a971e5d20773b3371db70be11
177ee528fcc20d400db4259fad6c41ef58f4ed471857438b3997419af3c53a03
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
29668aa7f188f36995a10e199ab3049f2d9e9cf427201f10657ad5c599a3591d
2a324b929727cfcb4053b8d1f939a7831ba17d8a75760efd937b58bbe207e82a
2d60c95ac438e1d7847f13dfed8e079876d9d75999fadae39cebe4a7ed3f67a1
49a98b00729462b3c876cc32f056bbd51733a190c4fcb5a4a1658e9a6f1ccfa6
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
62a17bc7232cf7af5c41ff98ec5a59d300d586773b5850e460aea5387f60c8b2
6b5b2f81a4b1c196b9c02b6c3044ff23b6e9e8eb9b0aed98c3b8e02c0a542825
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ed1058fa9599babfa419bbbee2c283127e998f94580b5b4b1ad61291c4e1414
73ac15b16335c6b4f1e12b4b52b843077b8a0a36e3812f505b3f28e58ab13ff4
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181
77a3d1637a30c2531b7a7a5f1f8fc069242a5e4a9d4ba3bc30bfcfb4f199263e
7a2149331be4d63738ffd1e3a24520c02599f50c5f5e4f8a43a2b7930325cf54
8083ccf1a360c84185bf8bd1894c4c69b5196659a3c57184551795d79f4ef86d
8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c
83521aad7c96625246ef4168f1d84d12b0652e8eb61ad0875066fee1fa797daf
89e38ae45e4ab6870530ad77bc793c32dcb03a600156b9930ffe3104f6702b25
8dbfb4c31866ed42aa4ea43b48cf04f4a0b1de6c36885a86c1f96469c9c83804
8f18cf892dcf9bee9190d075020a1640ce96f012d399790af20a7c0d8bddb072
8f51ecf45f47a048a73531b89661d33ef5a3953e0cf4c0a11457907475ecc152
92bee51ee5dbafaff82c524f7629314d069107bc30913a93b181e4c631a58a0f
9621a51624f328961da6e3e678864214c37532aee2f7585f654d16c625412c83
97bc2ba1760c19433112e19181da6584d22c3651e981dca37aeab704cd889038
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a56c62be9652c7b6b85be1e24dab707f15623d73cde436958c4ef74e3b5b68d7
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a65e82bc53a78f177ecea2ba5e361c539e5f42262f1e0ca3ff94c38fdf53dca3
b3e384e3a727917185428a38afcce19eac731bcf1599e2c6ea693bda664c3f28
b62d3ff7ec9f5543b6d6a2429170ed375b550d869b90d9886464143cd89b83ef
b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
bcaccbe557369e39b6a7918837ff9bd82dc1a4108998320bf1dd6924363237f9
bef6c0a541d5e688a05cbcef6df9449126854f1f4f0cf84ff923bc9223bd11eb
bff7d7daab7b0e2e15cfb4777e0a550049554e9b391d519f9f2f3196275d5f34
c484670baf7864465e8032b6ea9b2f40880bba770c7f965e674ea14ac76bb21e
c63c0a518fcd8243e365904eb4ec5162d2b6d066aa4f05027fb598089d73ebdc
dc20ef219f193a7c741f5de1fa5e74a19e8a790527aec084c937b3a4e97411cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5ecfcec3e27fe9897118aabcbd06b14a055e27fdff3fbfd82e4b35336c3f7fe
ed1536d62fee5a13cbeb5c138af68eaeb8607dea18c40db59454a6d2745813cc
ee07009e9fe79b9909bafdb282106c95dac83f905c6ac665e1257ac862ed50e1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

fc.lc Open in urlscan Pro 2606:4700:3035::6815:4e94 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

61 Requests

98 %HTTPS

58 %IPv6

23 Domains

26 Subdomains

24 IPs

7 Countries

613 kBTransfer

1602 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

61 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

fc.lc Open in urlscan Pro
2606:4700:3035::6815:4e94 Public Scan

Screenshot
Live screenshot

Full Image

61
Requests

98 %
HTTPS

58 %
IPv6

23
Domains

26
Subdomains

24
IPs

7
Countries

613 kB
Transfer

1602 kB
Size

8
Cookies

61 HTTP transactions
1 data transactions