ihanaloma.ru.com Open in urlscan Pro
103.150.31.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Effective URL:
https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Submission: On March 25 via manual (March 25th 2024, 5:10:09 pm UTC) from IT — Scanned from SG

Summary HTTP 32 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 14 IPs in 5 countries across 10 domains to perform 32 HTTP transactions. The main IP is 103.150.31.10, located in Singapore, Singapore and belongs to HOST-AS-AP Host Universal Pty Ltd, AU. The main domain is ihanaloma.ru.com.
TLS certificate: Issued by R3 on March 10th 2024. Valid for: 3 months.

This is the only time ihanaloma.ru.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Libero (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	103.150.31.10 103.150.31.10	136557 (HOST-AS-A...) (HOST-AS-AP Host Universal Pty Ltd)
1	213.209.30.161 213.209.30.161	8660 (MATRIX-AS) (MATRIX-AS)
1	74.125.130.95 74.125.130.95	15169 (GOOGLE) (GOOGLE)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.194.95 172.217.194.95	15169 (GOOGLE) (GOOGLE)
2	64.233.170.94 64.233.170.94	15169 (GOOGLE) (GOOGLE)
1	3.124.55.180 3.124.55.180	16509 (AMAZON-02) (AMAZON-02)
5	74.125.24.155 74.125.24.155	15169 (GOOGLE) (GOOGLE)
2	142.251.175.156 142.251.175.156	15169 (GOOGLE) (GOOGLE)
1	142.251.175.132 142.251.175.132	15169 (GOOGLE) (GOOGLE)
1	13.33.33.73 13.33.33.73	16509 (AMAZON-02) (AMAZON-02)
3	74.125.200.132 74.125.200.132	15169 (GOOGLE) (GOOGLE)
1	172.217.194.99 172.217.194.99	15169 (GOOGLE) (GOOGLE)
32	14

9 103.150.31.10 (Singapore, Singapore)

ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU)

ihanaloma.ru.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.209.30.161 (Assago, Italy)

ASN8660 (MATRIX-AS, IT)

www.iolam.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.130.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sb-in-f95.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.194.95 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.233.170.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sg-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.55.180 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-55-180.eu-central-1.compute.amazonaws.com

italiaonline.profiles.tagger.opecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 74.125.24.155 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f155.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.175.156 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: sh-in-f156.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.175.132 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: sh-in-f132.1e100.net

19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.33.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-33-73.sin2.r.cloudfront.net

i3.plug.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.125.200.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sa-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.194.99 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ru.com ihanaloma.ru.com	271 KB
6	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 138 19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 199	242 KB
5	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 269	181 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 728 fonts.googleapis.com — Cisco Umbrella Rank: 112	32 KB
1	google.com www.google.com — Cisco Umbrella Rank: 5
1	plug.it i3.plug.it	924 B
1	opecloud.com italiaonline.profiles.tagger.opecloud.com — Cisco Umbrella Rank: 345445
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 389	8 KB
1	iolam.it www.iolam.it — Cisco Umbrella Rank: 364127	152 KB
32	10

	Domain	Requested by
9	ihanaloma.ru.com	ihanaloma.ru.com
5	securepubads.g.doubleclick.net	ihanaloma.ru.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
2	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
2	fonts.gstatic.com	fonts.googleapis.com
1	www.google.com	tpc.googlesyndication.com
1	i3.plug.it
1	19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	italiaonline.profiles.tagger.opecloud.com	ihanaloma.ru.com
1	fonts.googleapis.com	ihanaloma.ru.com
1	cdnjs.cloudflare.com	ihanaloma.ru.com
1	ajax.googleapis.com	ihanaloma.ru.com
1	www.iolam.it	ihanaloma.ru.com
32	13

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net

Subject Issuer	Validity	Valid
ihanaloma.ru.com R3	`2024-03-10` - `2024-06-08`	3 months	crt.sh
iolam.it Sectigo RSA Organization Validation Secure Server CA	`2024-01-23` - `2025-01-22`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
*.profiles.tagger.opecloud.com Amazon RSA 2048 M02	`2023-11-27` - `2024-12-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
*.plug.it Sectigo RSA Organization Validation Secure Server CA	`2023-12-15` - `2024-12-14`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Frame ID: 270B041DAEA11FD275ABD3D4E5CC1119
Requests: 25 HTTP requests in this frame

Frame: https://19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 4A2DAEC61675A8F43B4747D28C558665
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssutVBoeW8zIyywN-d3apsJ5rYiOPwf7AZiWC3EiTiCZ7A28o4QuWF7kKnRyTHGP35B3fotdGokZ9R4Uciu_KlZ0Ew-rQajOPvhlVB4dE1_36MKC7HcARWWO3IkILPCN0IRftJ30gpHuJBR-MLb4nLesmztINkjcgOaP1xmn4bAsD8FaSfCWz30gMh9fh89l3eaYxZc1TE0Fwr1DtOHMxh3bqYVLhXW_Cg3SKD-NdkrdRHyb625OKjdD3y3dtSgU9CiZO7O2NGNrdHDSgXKUhU6BYFzQ2wBqDv6I9Km34ectEmDrxTwiwW-GNFC8gvGx86f51O7EIByaAULmLxAGCH_jFno0hMOflg3OrYr14ZPb16ndBziTUc&sai=AMfl-YRt0yebVK8_4HLynz7lks_Z8rjVEzJhqHzuyKdgcivF9o3zTT-YdIZF2AUbS0NxRzwpkAf9Q1Y0Kffuk2IPxWp_xIeSPfQOZ2LTmCRl8BPRziq9HWnSpupRqKwBIDqvgLwNpNmdahojsBRgRiIsDcE&sig=Cg0ArKJSzLeEvrqyeSFiEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: FC498773CD14CB63444502757AD2C1B0
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 24D3CF02B4D941B3B877E932EF51D679
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D6D48B0C1D6CD399025E72E13EF62502
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Libero Mail - login

Page URL History Show full URLs

http://ihanaloma.ru.com/ilibero/italia/libero2024/index.php HTTP 307
https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

/prebid\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

91 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

14
IPs

5
Countries

918 kB
Transfer

1848 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstNa0Z2ZVSyGiNrhdlWN0upiK2Ou_m0zUdMTwF3XMTVqiA-XoE7fNAhj296YyaC8AZIHhadVNkWnc2oFPM4nh_OuRuKSs_NdCLrA0F3zvsFNuevCzWzUSLLwVynOjSl3FHBi1Kz0ZuKk_cw_0e3zYBYGaW0Vttua4FsTHw6sEHxgVoAifB_VTbVeVDuuPblrG0qpbfDs3oRZ6Q8fCMvmUI0PbQIjgOGNdWB5gNEGO5zRefaD0xzJjsSFVSxZb2D8KztbqZ01uFfnQAor3NTQB7kwmwTsWkfD8nGsHcTRDiUK_EugQhB1GcExioOPTgOneswcU2ETOaIgxpcP0P5a9_6SQbA5myLEIhxWNTDLZGt2R1w6x5nmw&sai=AMfl-YQabAUBZOxrMnJTawEpHVkXrKxTXfeQaeKQxCgOvAmZSxosp6TNh6oLo7dq4Rw5hmlXgkuh-7ZWt_oeBcNAtTdzySHxu74ucxit9E1flBTV3CZrlLqj9STQgQnGhv6FSsQ5xSCcOOFMMF7ayn_rXro&sig=Cg0ArKJSzDOeiY7TR90fEAE&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=https://mailpersonal.libero.it/%3Fo%3Dau

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ihanaloma.ru.com/ilibero/italia/libero2024/index.php HTTP 307
https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.php Show response
ihanaloma.ru.com/ilibero/italia/libero2024/
Redirect Chain

http://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php

6 KB
7 KB

147ms
90ms

Document
text/html

103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: 1e7271f832628acc449ce087d6d75f51739b98094a637c4169940287705ba497

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 25 Mar 2024 17:10:02 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Location: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK style.css
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 26 KB
26 KB 48ms
47ms Stylesheet
text/css 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: 148c0dcd3eff6305eaffe3600d31334604cc02591259020e54d8835be0e20dfe

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:02 GMT
Last-Modified: Thu, 25 Aug 2022 14:13:24 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 26719

GET
H/1.1 200
OK jquery.min.js Show response
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 87 KB
88 KB 72ms
23ms Script
text/javascript 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/jquery.min.js
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:02 GMT
Last-Modified: Thu, 25 Aug 2022 12:41:28 GMT
Server: Apache
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 89493

GET
H/1.1 200
OK placeholders.min.js Show response
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 4 KB
4 KB 99ms
18ms Script
text/javascript 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/placeholders.min.js
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:02 GMT
Last-Modified: Thu, 25 Aug 2022 12:41:28 GMT
Server: Apache
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 3907

GET
H/1.1 200
OK iam2.0.js Show response
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 139 KB
139 KB 105ms
21ms Script
text/javascript 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/iam2.0.js
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: 6371356d9cb87a361f550a77f374e58eb68a25ab048440a04e11fba1cc575876

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:02 GMT
Last-Modified: Thu, 25 Aug 2022 12:41:28 GMT
Server: Apache
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 141862

GET
H2 200 prebid.js Show response
www.iolam.it/js/ 469 KB
152 KB 1276ms
225ms Script
application/javascript 213.209.30.161
MATRIX-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.iolam.it/js/prebid.js

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.209.30.161 Assago, Italy, ASN8660 (MATRIX-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

714ceeb7a00f469992815693f00100f9a225389238f074904ec1967783eb20a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:04 GMT
strict-transport-security: max-age=63072000;
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
x-robots-tag: noindex
expires: Tue, 26 Mar 2024 17:10:04 GMT

GET
H/1.1 200
OK AdvContent20x20.png
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 537 B
779 B 99ms
15ms Image
image/png 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/AdvContent20x20.png
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:02 GMT
Last-Modified: Mon, 14 Mar 2022 14:18:42 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 537

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 358ms
18ms Script
text/javascript 74.125.130.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sb-in-f95.1e100.net

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 24 Mar 2024 09:37:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113547
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 24 Mar 2025 09:37:36 GMT

GET
H2 200 jquery.validate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.5/ 24 KB
8 KB 367ms
27ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.5/jquery.validate.min.js

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 153669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 7032
last-modified: Fri, 01 Jul 2022 15:30:23 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62bf130f-1b78"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2FjwOqbsVmdNYSUHwW3Zb5qy82LhSv4fX2fPcPu8WhlOcJT7TRyo7LCstJOql3RFOQGInExTss86E2uude%2B%2FsJzqmLBSP9BdGj6aOeqdZrIOtFVX9nnuq6KPZJ4yIvjTnZX8eQcx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86a08320de3e40d4-SIN
expires: Sat, 15 Mar 2025 17:10:03 GMT

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 368ms
18ms Stylesheet
text/css 172.217.194.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f95.1e100.net

Software

ESF /

Resource Hash

694adc42b1e12c4edc69f43c2aaafea20e28d55d4ee73c3505cd1bf8b90e3452

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 25 Mar 2024 17:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 25 Mar 2024 15:13:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Mar 2024 17:10:03 GMT

GET
H/1.1 404
Not Found ;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top;
ihanaloma.ru.com/ilibero/italia/libero2024/ 315 B
315 B 14ms
14ms Image
text/html 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top;
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:03 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK logo.svg
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 5 KB
5 KB 16ms
15ms Image
image/svg+xml 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/logo.svg
Requested by: Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: 54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:03 GMT
Last-Modified: Mon, 14 Mar 2022 14:18:42 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4827

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 374ms
34ms Font
font/woff2 64.233.170.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sg-in-f94.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://ihanaloma.ru.com
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 22 Mar 2024 04:41:07 GMT
x-content-type-options: nosniff
age: 304137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Mar 2025 04:41:07 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 378ms
38ms Font
font/woff2 64.233.170.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sg-in-f94.1e100.net

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://ihanaloma.ru.com
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 22 Mar 2024 12:24:45 GMT
x-content-type-options: nosniff
age: 276319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Mar 2025 12:24:45 GMT

OPTIONS
H2 400 targeting
italiaonline.profiles.tagger.opecloud.com/v1/ Frame 0
0 857ms
416ms Preflight
text/plain 3.124.55.180
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.55.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-55-180.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: referrer-policy
Access-Control-Request-Method: GET
Origin: https://ihanaloma.ru.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/plain; charset=UTF-8
date: Mon, 25 Mar 2024 17:10:04 GMT

GET targeting
italiaonline.profiles.tagger.opecloud.com/v1/ 0
0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 89 KB
29 KB 385ms
25ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/iam2.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

3e392eb04d239f2404c6f463da5ab6599d5b9f14c474ae83d2b5a792f2675329

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29098
x-xss-protection: 0
server: cafe
etag: 298 / 19807 / m202403190101 / config-hash: 12520517130450304653
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 17:10:04 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/ 438 KB
138 KB 15ms
15ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

1fe53cf7f03d12af875315353f6ab8df7a936fa9e26cbe0c5e2f1dc7269652b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 00:35:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59683
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141049
x-xss-protection: 0
server: cafe
etag: 7927512453849819874
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 25 Mar 2025 00:35:21 GMT

GET
H/1.1 200
OK libero_favicon.ico
ihanaloma.ru.com/ilibero/italia/libero2024/files/ 1 KB
1 KB 18ms
17ms Other
image/x-icon 103.150.31.10
HOST-AS-AP Host U...

General

Check archive.org

Show headers Download Go to

Full URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/libero_favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU),
Reverse DNS
Software: Apache /
Resource Hash: fba1ebd847c9826cd1bb0482cb11ba739012cd4b4003af92ab28b8b559a8e8de

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 25 Mar 2024 17:10:03 GMT
Last-Modified: Mon, 14 Mar 2022 20:09:04 GMT
Server: Apache
Content-Type: image/x-icon
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1150

POST trk
www.iolam.it/service/ 0
0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 98ms
98ms Fetch
text/plain 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=877952364107853&correlator=3622984985976643&eid=31079957%2C31081969%2C31081978&output=ldjh&gdfp_req=1&vrg=202403190101&ptt=17&impl=fifs&npa=1&iu_parts=5180%2Clibero%2Cwebmail%2Clogin%2Cundefined&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=1540x1024&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1711386605920&lmt=1711386605&adxs=576&adys=50&biw=1600&bih=1113&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=600&u_w=800&u_ah=600&u_aw=800&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuNTgiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjEyMy4wLjYzMTIuNTgiXSxbIk5vdDpBLUJyYW5kIiwiOC4wLjAuMCJdLFsiQ2hyb21pdW0iLCIxMjMuMC42MzEyLjU4Il1dLDBd&url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&vis=1&psz=980x0&msz=1540x0&fws=0&ohw=0&ga_vid=976404199.1711386606&ga_sid=1711386606&ga_hid=1602438836&ga_fc=false&dlt=1711386603202&idt=913&cust_params=oe%3DUTF-8%26optout%3D1%26adv_infocus%3Dyes%26adv_referrer%3Dother%26adv_sgt%3D4%26is_native%3Dno%26xdid_user_ui%3Dfalse%26adv_sso1%3D0%26adv_sso2%3D0%26adv_sso3%3D0%26gdpr%3D0&adks=68688629&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

9dced40d6922218b9d05f680f3478b80a3c6c4a274ba76edd5dc7b9a3bc55cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14014
x-xss-protection: 0
google-lineitem-id: 6467915967
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138460512096
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ihanaloma.ru.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 413ms
26ms XHR
application/json 142.251.175.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202403190101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f156.1e100.net

Software

cafe /

Resource Hash

62ca2bef6408b740a93f0457e494431d9e9cdf6577a54e28810071705ecc065e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12262
x-xss-protection: 0

GET
H2 200 container.html
19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4A2D 0
0 403ms
22ms Document
text/html 142.251.175.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ihanaloma.ru.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: zh-SG,zh;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Mar 2024 17:10:06 GMT
expires: Tue, 25 Mar 2025 17:10:06 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame FC49 0
0 60ms
59ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssutVBoeW8zIyywN-d3apsJ5rYiOPwf7AZiWC3EiTiCZ7A28o4QuWF7kKnRyTHGP35B3fotdGokZ9R4Uciu_KlZ0Ew-rQajOPvhlVB4dE1_36MKC7HcARWWO3IkILPCN0IRftJ30gpHuJBR-MLb4nLesmztINkjcgOaP1xmn4bAsD8FaSfCWz30gMh9fh89l3eaYxZc1TE0Fwr1DtOHMxh3bqYVLhXW_Cg3SKD-NdkrdRHyb625OKjdD3y3dtSgU9CiZO7O2NGNrdHDSgXKUhU6BYFzQ2wBqDv6I9Km34ectEmDrxTwiwW-GNFC8gvGx86f51O7EIByaAULmLxAGCH_jFno0hMOflg3OrYr14ZPb16ndBziTUc&sai=AMfl-YRt0yebVK8_4HLynz7lks_Z8rjVEzJhqHzuyKdgcivF9o3zTT-YdIZF2AUbS0NxRzwpkAf9Q1Y0Kffuk2IPxWp_xIeSPfQOZ2LTmCRl8BPRziq9HWnSpupRqKwBIDqvgLwNpNmdahojsBRgRiIsDcE&sig=Cg0ArKJSzLeEvrqyeSFiEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: ihanaloma.ru.com
URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 25 Mar 2024 17:10:06 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame FC49 206 KB
63 KB 347ms
15ms Script
text/javascript 142.251.175.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f156.1e100.net

Software

cafe /

Resource Hash

1a730cb34285c933a5839e656856a4eaac2449e49a997efe53d454b94ace676f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 16:10:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3583
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63909
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 25 Mar 2024 17:10:23 GMT

GET
H2 200 AdvContent20x20.png
i3.plug.it/banners/img/ 537 B
924 B 619ms
15ms Image
image/png 13.33.33.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i3.plug.it/banners/img/AdvContent20x20.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-73.sin2.r.cloudfront.net
Software: nginx /
Resource Hash: 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 04:11:02 GMT
via: 1.1 54d4d00f5a92073c1a23e29f92000462.cloudfront.net (CloudFront)
last-modified: Tue, 09 Jun 2020 08:23:45 GMT
server: nginx
x-amz-cf-pop: SIN2-P1
age: 46744
etag: "5edf4711-219"
vary: Origin
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=1200, public
accept-ranges: bytes
content-length: 537
x-amz-cf-id: oxi3tu65lmfaZhOS2nLFx8oEB90MAd4UUk11P3qkWHOHEUnpLeT0hw==
expires: Mon, 25 Mar 2024 04:31:02 GMT

GET
H2 200 17995558794122784697
tpc.googlesyndication.com/simgad/ 160 KB
160 KB 403ms
59ms Image
image/jpeg 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17995558794122784697?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f132.1e100.net

Software

sffe /

Resource Hash

62f2169c2bf5ea145ff947edf5ecffd4b5908b9e38338bd24b9fd98966e5e1aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

allow-fenced-frame-automatic-beacons: true
date: Mon, 25 Mar 2024 17:10:06 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 163389
x-xss-protection: 0
last-modified: Mon, 08 Jan 2024 14:41:09 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 25 Mar 2025 17:10:06 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 85ms
20ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Mar 2024 17:10:06 GMT

GET
DATA 200
OK truncated
/ Frame FC49 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 952ae90d4befe3d12cd0ff3f650c5ddf3c7c8c2707a9a4c7693b04d2540acbc0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame FC49 0
0 409ms
65ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvZ8JzszyEkliAj1E2-0-Sc2ftH5pkxgjd6VntSl-5UCel0RjbthCc9CUGAkrl5jk2hWeqAB963S3orZQVVGk4KLwSFfzwWyE9p1etzTXyGiad1fjTooJsv2_izNCr6lqdhg6Hv9OsWbn8Trfxk8eNmhDGmVflg2StibrJXHyKB30igzEX6DHCtUuUGm6KL8HT3SClMoYMz_3GKs5Ij5DN_1_WMrwhuY8mIZiDpQoZ1_Z_JXdHpT_z36ukpuVh6n7HTJHY40DbYS8j4OaNeL4EIkrhsGgF17y_AURQuwDcN6u9RXq6Z8M5j735pclD8rGAVSx6Xm0pPJROEd401FjF4bST-VkWN_Ho6Q9R1euZAh0H65hcLtuxQiw&sai=AMfl-YRt5ja2YKtMYwVsYF1t0T_oey1XXo9OKFwfSEMz4U9ZwR09swNFQL5KwrIFlBsQ43yA4-5fh6p51uregNG0wzKAX_zBo7QpfndmKTebvKd4GsQVshTCFgRYfS3Vmf3LG9sbG6RITk4-9XIPjXuQ650&sig=Cg0ArKJSzEdAtJvMIBsaEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ihanaloma.ru.com/
accept-language: zh-SG,zh;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:10:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 25 Mar 2024 17:10:06 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 24D3 0
0 354ms
19ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ihanaloma.ru.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: zh-SG,zh;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
age: 300856
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 22 Mar 2024 05:35:50 GMT
expires: Sat, 22 Mar 2025 05:35:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe
www.google.com/recaptcha/api2/ Frame D6D4 0
0 363ms
23ms Document
text/html 172.217.194.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f99.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-60WHlZjxZrCOxD0-Lq9HcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ihanaloma.ru.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: zh-SG,zh;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-60WHlZjxZrCOxD0-Lq9HcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 25 Mar 2024 17:10:06 GMT
expires: Mon, 25 Mar 2024 17:10:06 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: italiaonline.profiles.tagger.opecloud.com
URL: https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0

Domain: www.iolam.it
URL: https://www.iolam.it/service/trk

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202403190101&jk=877952364107853&bg=!1Nel15jNAAZaswqNerM7ADQBe5WfOFOuba3oLpu37zk-8tokZHXZRIu1SYZv1IOxY4YEI3XT6oVFhqmQS47okXavifVWAgAAAElSAAAABGgBB34ANWT7uOULTCPEhw6Ai00agCFLr8NEnk--30PgldY8s59S5C2vXNXLCAVYUFYJx2dEsdUcxsZsmQKh3SJuvXEA9rCiBlQk9ZNOORNqT5HZjDcJUflNxKByOlthylQtMpdJXXliZOb56J-nN-VBy65u9eVcjQwVAsNRV2bPO-r5jLVPzAoiLvUT6AG4bhyBcyncLQxbOSvIu2ozIZe9wqDcdxrtl-OHHYeJHrA9o4tGuRicbBJAQDCAl4ganFbiXYTK42wcNXmzUe_uzVSI9kP3XukEbC4ZMytmxP_5d-W-00Lkb29lWV4nowuQMEQjajx-aE9_NWtxM6ZOiLIGL-c2MWxLvdkA7WyOri2HBUNk_72ZV1j0fID7ZascjkPvTYNXpZ6aIkHGODfD_2W33BODM0LR_HHYEdwL1oerCumhAfoCcWfoi44o-FxxTAwK9nJS5y-t8dz6OyMrz6Xb4bGq7KNNylv1aNm6KXM0l6T0xAiU3oC-DAymxcz613TjGMY4y0QXYIWM0nizpSrheQZu-7GUTNqLhOa2LdvbJpCDhOOzK1NXIRVzfYMZrWbdW7rDnAkx_G23bfHF_iTcjSxZI4rEtlkxuHFGd9cI7qUslpuGS7kLbVphtjOazvJMkR_4XWm0vFHifbpdcctCM74ntdnrKUungHvTlnjDOJ_Wg5fUt4oh2C3xZJR2zgUbXx0vetA-oSAVFvi4ZCTl1Vzpq2GldgBEXO0iG9KFvQ3p1cJQVa5PimOTPL-fpqn6g0YAGRLk_ECFw54spixTfhAaSHNskhqpbo6XuxiTL1yW6QCexRdBbXTVj51m9B0Ezh2d9INoNJhuNAZxq_Dg_PyakVB8t5SoKNRaujlng35NDr6Z5FDdBLJbNenbRPaG99ZV7QRnz2gLzGaPjFl-Wfs4u2A44s42d8-N_NHpftmRBYPIkGVKpvZGxbF_U1lg-I53r2WyLr5P86jfBg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Libero (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ihanaloma.ru.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ce5cfcabdb93324e6a66a89f310d7a2e
			.doubleclick.net/	1970-01-21 04:59:06	Name: IDE Value: AHWqTUkbKY8wVockipokJC_rGyBzv7bBgU7hcoGFLuQhxFFUiGrvM9QmOWq38QnDG0g

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top; Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Access to XMLHttpRequest at 'https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0' from origin 'https://ihanaloma.ru.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0 Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
javascript	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Access to XMLHttpRequest at 'https://www.iolam.it/service/trk' from origin 'https://ihanaloma.ru.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.iolam.it/service/trk Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

19a5821b01efbeb11c0b54995a475f29.safeframe.googlesyndication.com
ajax.googleapis.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
i3.plug.it
ihanaloma.ru.com
italiaonline.profiles.tagger.opecloud.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.google.com
www.iolam.it
italiaonline.profiles.tagger.opecloud.com
pagead2.googlesyndication.com
www.iolam.it
103.150.31.10
104.17.24.14
13.33.33.73
142.251.175.132
142.251.175.156
172.217.194.95
172.217.194.99
213.209.30.161
3.124.55.180
64.233.170.94
74.125.130.95
74.125.200.132
74.125.24.155
148c0dcd3eff6305eaffe3600d31334604cc02591259020e54d8835be0e20dfe
1a730cb34285c933a5839e656856a4eaac2449e49a997efe53d454b94ace676f
1e7271f832628acc449ce087d6d75f51739b98094a637c4169940287705ba497
1fe53cf7f03d12af875315353f6ab8df7a936fa9e26cbe0c5e2f1dc7269652b8
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
3e392eb04d239f2404c6f463da5ab6599d5b9f14c474ae83d2b5a792f2675329
54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62ca2bef6408b740a93f0457e494431d9e9cdf6577a54e28810071705ecc065e
62f2169c2bf5ea145ff947edf5ecffd4b5908b9e38338bd24b9fd98966e5e1aa
6371356d9cb87a361f550a77f374e58eb68a25ab048440a04e11fba1cc575876
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c
694adc42b1e12c4edc69f43c2aaafea20e28d55d4ee73c3505cd1bf8b90e3452
714ceeb7a00f469992815693f00100f9a225389238f074904ec1967783eb20a0
952ae90d4befe3d12cd0ff3f650c5ddf3c7c8c2707a9a4c7693b04d2540acbc0
9dced40d6922218b9d05f680f3478b80a3c6c4a274ba76edd5dc7b9a3bc55cc4
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fba1ebd847c9826cd1bb0482cb11ba739012cd4b4003af92ab28b8b559a8e8de
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

ihanaloma.ru.com Open in urlscan Pro 103.150.31.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

32 Requests

91 %HTTPS

0 %IPv6

10 Domains

13 Subdomains

14 IPs

5 Countries

918 kBTransfer

1848 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ihanaloma.ru.com Open in urlscan Pro
103.150.31.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

91 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

14
IPs

5
Countries

918 kB
Transfer

1848 kB
Size

2
Cookies

32 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!