subsbanrural.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ayudas-banrurals.liveblog365.com/
Effective URL:
https://subsbanrural.webcindario.com/gt.html?=prests
Submission: On September 13 via api (September 13th 2023, 10:29:14 pm UTC) from GT — Scanned from GB

Summary HTTP 70 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 20 IPs in 6 countries across 17 domains to perform 70 HTTP transactions. The main IP is 5.57.226.202, located in Madrid, Spain and belongs to SERVIHOSTING-AS AireNetworks, ES. The main domain is subsbanrural.webcindario.com.
TLS certificate: Issued by R3 on June 24th 2023. Valid for: 3 months.

This is the only time subsbanrural.webcindario.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banrural (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 3	185.27.134.117 185.27.134.117	34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
17	5.57.226.202 5.57.226.202	29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks)
10	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
1	173.231.16.77 173.231.16.77	18450 (WEBNX) (WEBNX)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:13e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
16	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:217... 2600:9000:2176:e00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c07::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:80b::2003	15169 (GOOGLE) (GOOGLE)
70	20

3 185.27.134.117 (United Kingdom) 1 redirects

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)

ayudas-banrurals.liveblog365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 5.57.226.202 (Madrid, Spain)

ASN29119 (SERVIHOSTING-AS AireNetworks, ES)

subsbanrural.webcindario.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

hosting.miarroba.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.231.16.77 (United States)

ASN18450 (WEBNX, US)
PTR: 173-231-16-77.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:13e5 (United States)

ASN13335 (CLOUDFLARENET, US)

bancavirtual.banrural.com.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:7eb1:3826:be7e:d981 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2176:e00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:80b::2003 (Australia)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1542 www.google.com — Cisco Umbrella Rank: 2	65 KB
17	webcindario.com subsbanrural.webcindario.com	404 KB
11	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 105 tpc.googlesyndication.com — Cisco Umbrella Rank: 152	286 KB
4	gstatic.com fonts.gstatic.com csi.gstatic.com	24 KB
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 47 stats.g.doubleclick.net — Cisco Umbrella Rank: 98	10 KB
3	liveblog365.com 1 redirects ayudas-banrurals.liveblog365.com	32 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1343 pixel.quantserve.com — Cisco Umbrella Rank: 1130	10 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 44	21 KB
2	miarroba.info hosting.miarroba.info	2 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 56 ajax.googleapis.com — Cisco Umbrella Rank: 419	32 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1183	605 B
1	google.ru www.google.ru — Cisco Umbrella Rank: 9401	408 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1253	632 B
1	banrural.com.gt bancavirtual.banrural.com.gt — Cisco Umbrella Rank: 729772	133 KB
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 6828	516 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2903	222 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 63	66 KB
70	17

	Domain	Requested by
17	subsbanrural.webcindario.com	ayudas-banrurals.liveblog365.com subsbanrural.webcindario.com
16	fundingchoicesmessages.google.com	pagead2.googlesyndication.com subsbanrural.webcindario.com
8	pagead2.googlesyndication.com	subsbanrural.webcindario.com pagead2.googlesyndication.com tpc.googlesyndication.com
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
3	fonts.gstatic.com	fonts.googleapis.com
3	ayudas-banrurals.liveblog365.com	1 redirects ayudas-banrurals.liveblog365.com
2	www.google.com	subsbanrural.webcindario.com tpc.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	hosting.miarroba.info	subsbanrural.webcindario.com
1	csi.gstatic.com	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google.ru	subsbanrural.webcindario.com
1	pixel.quantserve.com	subsbanrural.webcindario.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	www.googletagmanager.com
1	bancavirtual.banrural.com.gt	subsbanrural.webcindario.com
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	www.googletagmanager.com	subsbanrural.webcindario.com
1	ajax.googleapis.com	subsbanrural.webcindario.com
1	fonts.googleapis.com	subsbanrural.webcindario.com
70	23

This site contains links to these domains. Also see Links.

Domain
www.banrural.com.gt
bancavirtual.banrural.com.gt

Subject Issuer	Validity	Valid
*.webcindario.com R3	`2023-06-24` - `2023-09-22`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
miarroba.info E1	`2023-08-11` - `2023-11-09`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
ipinfo.io R3	`2023-08-09` - `2023-11-07`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.banrural.com.gt DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-18` - `2024-06-15`	a year	crt.sh
quantserve.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.google.com.ru GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://subsbanrural.webcindario.com/gt.html?=prests
Frame ID: 2D4669EAF6F77449BC7DDA68E9B42EDE
Requests: 62 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/zrt_lookup.html
Frame ID: 2CDE10561EA0367C25A0C7354813E087
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1694640546&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x540_l%7C500x540_r&format=0x0&url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&ea=0&pra=5&wgl=1&easpi=1&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1694644145654&bpp=3&bdt=329&idt=352&shv=r20230912&mjsv=m202309120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4362404685913&rume=1&frm=20&pv=2&ga_vid=1852003485.1694644146&ga_sid=1694644146&ga_hid=443327569&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44798879%2C31077774%2C44795922%2C44801485%2C31077838%2C44798322%2C21065725%2C31061691%2C31061693&oid=2&pvsid=1995844241833690&tmod=66020851&uas=0&nvt=1&fsapi=1&ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=724
Frame ID: DA894E2CD427275B3E8A48DB7E3AA876
Requests: 1 HTTP requests in this frame

Frame: https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Frame ID: 20B1086672371AB844E7A816F8A1C6E5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7F722907909E131E53AB55EC686FF3F2
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 25D1E1CE354FE498EE5792CE39C83D85
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banrural

Page URL History Show full URLs

http://ayudas-banrurals.liveblog365.com/ Page URL
http://ayudas-banrurals.liveblog365.com/?i=1 HTTP 301
https://subsbanrural.webcindario.com/gt.html?=prests Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

70
Requests

97 %
HTTPS

80 %
IPv6

17
Domains

23
Subdomains

20
IPs

6
Countries

1086 kB
Transfer

2162 kB
Size

13
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.banrural.com.gt/
Title: Inicio

Search URL Search Domain Scan URL

URL: https://www.banrural.com.gt/site/BanruralCorp/GestionesFormulario.html?paginaAnterior=Personas.html
Title: Olvidé mi usuario

Search URL Search Domain Scan URL

URL: https://bancavirtual.banrural.com.gt/cb/pages/jsp-ns/login-cons.jsp
Title: close

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ayudas-banrurals.liveblog365.com/ Page URL
http://ayudas-banrurals.liveblog365.com/?i=1 HTTP 301
https://subsbanrural.webcindario.com/gt.html?=prests Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

70 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
ayudas-banrurals.liveblog365.com/ 843 B
838 B 140ms
56ms Document
text/html 185.27.134.117
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://ayudas-banrurals.liveblog365.com/
Protocol: HTTP/1.1
Server: 185.27.134.117 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: b33c1beac6fcf2bba0cc6ff41e1b25a982e583e739836c50571aba48e0c40530

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 13 Sep 2023 22:29:04 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK aes.js Show response
ayudas-banrurals.liveblog365.com/ 30 KB
31 KB 56ms
56ms Script
application/javascript 185.27.134.117
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://ayudas-banrurals.liveblog365.com/aes.js
Requested by: Host: ayudas-banrurals.liveblog365.com
URL: http://ayudas-banrurals.liveblog365.com/
Protocol: HTTP/1.1
Server: 185.27.134.117 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ayudas-banrurals.liveblog365.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Date: Wed, 13 Sep 2023 22:29:04 GMT
Last-Modified: Sat, 08 Aug 2015 08:32:49 GMT
Server: nginx
ETag: "55c5beb1-79e6"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31206

GET
H2

200

Primary Request gt.html Show response
subsbanrural.webcindario.com/
Redirect Chain

http://ayudas-banrurals.liveblog365.com/?i=1
https://subsbanrural.webcindario.com/gt.html?=prests

15 KB
4 KB

244ms
67ms

Document
text/html

5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/gt.html?=prests
Requested by: Host: ayudas-banrurals.liveblog365.com
URL: http://ayudas-banrurals.liveblog365.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: a10e06a176e9108d8a496ef2e088f826fc6a62e14aed68182256b4279c0d5de9

Request headers

Referer: http://ayudas-banrurals.liveblog365.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 13 Sep 2023 22:29:05 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: Webcindario Hosting Service

Redirect headers

Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 260
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 13 Sep 2023 22:29:04 GMT
Expires: Wed, 13 Sep 2023 22:29:04 GMT
Location: https://subsbanrural.webcindario.com/gt.html?=prests
Server: nginx

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 237ms
102ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc363a10d38799359dd365c81fae895eee6011595a095c4acc25c3db243a0392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50700
x-xss-protection: 0
server: cafe
etag: 2660857555825734621
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:29:05 GMT

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 187ms
64ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83ac7e6ff86bc619881d5afba113b6cc42c02d52987e8d4c6bc6d4fb07ab018a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/ro
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 21:10:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Sep 2023 22:29:05 GMT

GET
H2 200 jquery-ui.css
subsbanrural.webcindario.com/pape/ 57 KB
9 KB 76ms
71ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/jquery-ui.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 6439cc87266daaff74ba9fd244c4b6a5e5b4e0273a782ea26acb08dffb8ba440

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:40 GMT
server: nginx
etag: W/"650181b8-e4bd"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 normalize.css
subsbanrural.webcindario.com/pape/ 8 KB
3 KB 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/normalize.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: c8945609a935ce0e38ce4f3eaac75e764738bcffafe9a68e647055b2c516f1da

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:44 GMT
server: nginx
etag: W/"650181bc-21c6"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 font-futura.css
subsbanrural.webcindario.com/pape/ 915 B
1 KB 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/font-futura.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 2b8748b21696872317d6f518ee2f34fd01dc9e92ae5f836e3d0a872bc75eeb26

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
last-modified: Wed, 13 Sep 2023 09:32:38 GMT
server: nginx
etag: "650181b6-393"
x-powered-by: Webcindario Hosting Service
content-type: text/css
accept-ranges: bytes
content-length: 915

GET
H2 200 FF.min.css
subsbanrural.webcindario.com/pape/ 12 KB
2 KB 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/FF.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: b94497936e2ff5deea225626cb5029d5dbf640a34f3a267751f5af1db008b99e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:37 GMT
server: nginx
etag: W/"650181b5-2f5e"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 login.css
subsbanrural.webcindario.com/pape/ 33 KB
7 KB 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/login.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: e0ee71ccf8903462f77a37c75d04c49fa633c58a4b2cf152776bbb914dcfd477

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:42 GMT
server: nginx
etag: W/"650181ba-8549"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 layout.css
subsbanrural.webcindario.com/pape/ 13 KB
4 KB 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/layout.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: f4722046a6261fbad08665f4fb34bbcda5d881da85c331c1ad493d09aee5f651

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:40 GMT
server: nginx
etag: W/"650181b8-35cc"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 showLoading.min.css
subsbanrural.webcindario.com/pape/ 508 B
658 B 76ms
72ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/showLoading.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 7f25e98925c35509f28eac7b335392c5a43dfdcc2fa0ed80171e59a3c0756ad0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
last-modified: Wed, 13 Sep 2023 09:32:46 GMT
server: nginx
etag: "650181be-1fc"
x-powered-by: Webcindario Hosting Service
content-type: text/css
accept-ranges: bytes
content-length: 508

GET
H2 200 ui.selectmenu.min.css
subsbanrural.webcindario.com/pape/ 2 KB
742 B 75ms
73ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/ui.selectmenu.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 52d26165b37d436d7544d574dfeb5a810c66c85985dce2e26e334bb19fa7101b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:47 GMT
server: nginx
etag: W/"650181bf-876"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 186ms
55ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 16:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Sep 2024 16:18:49 GMT

GET
H2 200 nilson.png
subsbanrural.webcindario.com/pape/ 3 KB
3 KB 70ms
69ms Image
image/png 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/nilson.png
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
last-modified: Wed, 13 Sep 2023 09:32:43 GMT
server: nginx
etag: "650181bb-ab7"
x-powered-by: Webcindario Hosting Service
content-type: image/png
accept-ranges: bytes
content-length: 2743

GET
H2 200 font-awesome.css
subsbanrural.webcindario.com/pape/ 29 KB
6 KB 67ms
67ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/font-awesome.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: cf0d27974608ac6ec8e4acd56b5d5eba00ae1d65ac1d6edfde4259f0cd0e9f96

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:38 GMT
server: nginx
etag: W/"650181b6-7521"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 tesla.png
subsbanrural.webcindario.com/pape/ 5 KB
5 KB 70ms
70ms Image
image/png 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/tesla.png
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 5fc0d5c960ca212b704d31a451fc2aea06a4a7b53ead3ef98ab7b1a3a21b1eb1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
last-modified: Wed, 13 Sep 2023 09:32:47 GMT
server: nginx
etag: "650181bf-14d0"
x-powered-by: Webcindario Hosting Service
content-type: image/png
accept-ranges: bytes
content-length: 5328

GET
H2 200 Telegram.js Show response
subsbanrural.webcindario.com/ 3 KB
894 B 70ms
69ms Script
application/javascript 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/Telegram.js
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 9bf79cc6c024b28ab0fc9cbf916e87d94942e0ab5d50ca4ca34c18615291fd16

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:30 GMT
server: nginx
etag: W/"650181ae-cae"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 / Show response
hosting.miarroba.info/ 1 KB
1 KB 3586ms
3458ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hosting.miarroba.info/?__muid=30d41b564ee3c6ca118ddd4dbb300cc4ca8d5d49&h=2142533&t=1694644145&k=841b25256ed56b4b01ac2cc59fc2fdd0
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1299a634ef90e58f8b94c8e58d07661d999c912bb1c6f8a995d8112a3e38b193

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:09 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 13 Sep 2023 22:29:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YN4J4qIAozZ4GVfTDqabYEVfVBwsBziWmNhDyN4XQYypfoxSSwMeXUsnXSbiY6gfZredCaOGs9M9wz%2FZqUAYOxQb12L9zAOYWgwD1nkQf8pIzLJsq6cbL36g3nBTY%2FXcLSUuVL95Rxs3uGHTE9kbpFN21%2F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=iso-8859-1
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache
cf-ray: 8063d3b6ed67068e-LHR
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 180 KB
66 KB 188ms
61ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2dc96935f05685463099c8fb26e222eaee7e0292fa5023e99ee178bd603f0ed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67375
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 21:21:55 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Sep 2023 22:29:05 GMT

GET
H2 200 icons.css
subsbanrural.webcindario.com/pape/ 48 KB
7 KB 72ms
70ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/icons.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 9c18722da234f453de03c0b6992c350628501160dee0d1c022198268af352cc0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:39 GMT
server: nginx
etag: W/"650181b7-c191"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 forms.css
subsbanrural.webcindario.com/pape/ 33 KB
6 KB 72ms
70ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/forms.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 3a7941e1d0a24e8551e50b4897372a865d4da0d4d7378aa0e8cfcd0ee893c548

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:39 GMT
server: nginx
etag: W/"650181b7-847e"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 commons.css
subsbanrural.webcindario.com/pape/ 18 KB
5 KB 72ms
70ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/commons.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 04272b51fed9af20e39ac1afb27c5ae5d93cce30b5b068bdb39b6bb7f8511ff9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:37 GMT
server: nginx
etag: W/"650181b5-47df"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 487ms
157ms XHR
application/json 173.231.16.77
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 173.231.16.77 , United States, ASN18450 (WEBNX, US),
Reverse DNS: 173-231-16-77.static.webnx.com
Software: nginx/1.25.1 /
Resource Hash: c0198ce329041bced9b0291d5e0ca0675cdf0a92a032faa0607ab87fedc47c22

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 13 Sep 2023 22:29:06 GMT
Server: nginx/1.25.1
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET
H2 200 / Show response
ipinfo.io/ 253 B
516 B 280ms
165ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

cb7c9c787038f0f5c07bde040c3de6e2369fc19bb4a95fccdd9583bd413b92cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 bg-login-1.jpg
subsbanrural.webcindario.com/pape/ 340 KB
341 KB 70ms
70ms Image
image/jpeg 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/bg-login-1.jpg
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: e2bc7402cff9d4252634885c4541611db2482b56e2fc03c1a6475e2ec81564ea

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
last-modified: Wed, 13 Sep 2023 09:32:36 GMT
server: nginx
etag: "650181b4-55077"
x-powered-by: Webcindario Hosting Service
content-type: image/jpeg
accept-ranges: bytes
content-length: 348279

GET
H2 200 pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 175ms
56ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 04:01:29 GMT
x-content-type-options: nosniff
age: 152856
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7840
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:51:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Sep 2024 04:01:29 GMT

GET
H2 200 icons-new.png
bancavirtual.banrural.com.gt/cb/web/images/ 132 KB
133 KB 827ms
702ms Image
image/png 2606:4700::6812:13e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bancavirtual.banrural.com.gt/cb/web/images/icons-new.png

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/icons.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:13e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Servlet/3.0

Resource Hash

006bc55beae308cdb1965abc2f7a382d92bf0c4138469ffaafbb9db0d1df5c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:06 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 24 Aug 2023 21:47:52 GMT
server: cloudflare
x-powered-by: Servlet/3.0
x-frame-options: SAMEORIGIN
content-type: image/png
content-language: en-US
cache-control: public,max-age=86400, must-revalidate
cf-ray: 8063d3b6ff8d887a-LHR
content-length: 135508
retry-after: Thu, 14 Sep 2023 02:29:06 GMT
expires: Thu, 14 Sep 2023 02:29:06 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/ 380 KB
129 KB 225ms
119ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7294310421616689&plah=subsbanrural.webcindario.com&bust=31077838

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3a6769b590ee6ec86b1d82d009f70c94cfd710eec909e2cdee243db9cedf655

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131919
x-xss-protection: 0
server: cafe
etag: 1488192122628911794
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:29:05 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/ Frame 2CDE 10 KB
5 KB 174ms
55ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 2025
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4438
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 21:55:20 GMT
etag: 8554266389219770021
expires: Wed, 27 Sep 2023 21:55:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 104ms
62ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 05:30:43 GMT
x-content-type-options: nosniff
age: 406702
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Sep 2024 05:30:43 GMT

GET
H2 200 pxiByp8kv8JHgFVrLDD4Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 112ms
70ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDD4Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 04:06:56 GMT
x-content-type-options: nosniff
age: 498129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7824
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:52:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Sep 2024 04:06:56 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 173ms
55ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Sep 2023 21:49:43 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2363
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 13 Sep 2023 23:49:43 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 202ms
64ms Script
application/javascript 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:06 GMT
content-encoding: gzip
etag: "6ioqmyHWSWLYz5hkRjy8Uw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 20 Sep 2023 22:29:06 GMT

GET
H2 200 ca-pub-7294310421616689 Show response
fundingchoicesmessages.google.com/i/ 154 KB
51 KB 227ms
93ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-7294310421616689?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7294310421616689&plah=subsbanrural.webcindario.com&bust=31077838

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ba8a2bf4378d7358c9cfbbc3001f4e4f518510e24f7489c557ab61b4c783f25

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-poSm-BM5U5fgfb6WlX2ReQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-poSm-BM5U5fgfb6WlX2ReQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rum_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20230912/r20110914/ 54 KB
21 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230912/r20110914/rum_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3c725b1dea64704c14ac3bd6d2932ad23ce30328a5d9f42fa8452b3a5382be9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 11:32:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39383
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21167
x-xss-protection: 0
server: cafe
etag: 3087508523068474104
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 27 Sep 2023 11:32:43 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
218 B 62ms
62ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=443327569&t=pageview&_s=1&dl=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&dr=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&ul=en-us&de=UTF-8&dt=Banrural&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABCAAAAC~&jid=403531965&gjid=2099758590&cid=1852003485.1694644146&tid=UA-597118-7&_gid=1556817346.1694644146&_r=1&_slc=1&gtm=45He39b0n71T2VG59&z=1769041181

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://subsbanrural.webcindario.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-d5x2uDVHd7ALE.js Show response
rules.quantcount.com/ 160 B
632 B 207ms
60ms Script
application/javascript 2600:9000:2176:e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-d5x2uDVHd7ALE.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2176:e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d60c833406c5cca9095b3cabd40d6f65e486a0a4c0b59105031c9a6e94595f5a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:06:12 GMT
via: 1.1 b7c42ea41c475732c36f88559a1aa3d2.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP64-C3
age: 2243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 22:55:53 GMT
server: AmazonS3
etag: "ceee564f54e512a948f918e2710eab6e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: kTYs-CiSiCCBlfYKgJ8Au2QjKK9_Aiz8idi60VOteWtt3ZtM8H7AbA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
358 B 175ms
54ms XHR
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-597118-7&cid=1852003485.1694644146&jid=403531965&gjid=2099758590&_gid=1556817346.1694644146&_u=YEBAAAAACAAAAC~&z=255992533

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0cb3ad59518a9b556a3900b3f67c8312cf1f2db88f77cbadad1e6e4f7b425e0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 13 Sep 2023 22:29:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://subsbanrural.webcindario.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=335766878;source=gtm;rf=0;a=p-d5x2uDVHd7ALE;url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests;ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F;uht=2;fpan=1;fpa=P0-119...
pixel.quantserve.com/ 35 B
371 B 65ms
57ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=335766878;source=gtm;rf=0;a=p-d5x2uDVHd7ALE;url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests;ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F;uht=2;fpan=1;fpa=P0-1194784726-1694644146101;pbc=;ns=0;ce=1;qjs=1;qv=44310d19-20230908150619;cm=;gdpr=0;d=webcindario.com;dst=1;et=1694644146311;tzo=-60;ogl=;ses=8511c4b0-14e3-489e-a0f8-6cff30b910d8;mdl=

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:06 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 179ms
64ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-597118-7&cid=1852003485.1694644146&jid=403531965&_u=YEBAAAAACAAAAC~&z=572123553

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ru/ads/ 42 B
408 B 190ms
64ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ru/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-597118-7&cid=1852003485.1694644146&jid=403531965&_u=YEBAAAAACAAAAC~&z=572123553

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 397 B
605 B 173ms
60ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=subsbanrural.webcindario.com&callback=_gfp_s_&client=ca-pub-7294310421616689

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

188f6b9067b0c3afd0d4bf568fe0e5ebc26cf83ee51cfb48c6cac25b0bff5757

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 253
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DA89 11 KB
5 KB 147ms
147ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1694640546&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x540_l%7C500x540_r&format=0x0&url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&ea=0&pra=5&wgl=1&easpi=1&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1694644145654&bpp=3&bdt=329&idt=352&shv=r20230912&mjsv=m202309120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4362404685913&rume=1&frm=20&pv=2&ga_vid=1852003485.1694644146&ga_sid=1694644146&ga_hid=443327569&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44798879%2C31077774%2C44795922%2C44801485%2C31077838%2C44798322%2C21065725%2C31061691%2C31061693&oid=2&pvsid=1995844241833690&tmod=66020851&uas=0&nvt=1&fsapi=1&ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=724

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f381540d7c64990501dc08a4ccdebe9ae120bc22cd80b6b20c5264cf4d728024

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 4624
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 22:29:06 GMT
expires: Wed, 13 Sep 2023 22:29:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxUXHLFKq6ewxoI1nnY1CILwKMOQNweXU117mhq4fUUMgQv7XDWrmeD8egYRX69uZiDU808t0PEDCUxuW7cKZSeMif7b-LgxFlkKWjD3YGB3PsnZA_6UXopCmlqChAyAOfcLGAISPQ== Show response
fundingchoicesmessages.google.com/f/ 13 KB
7 KB 94ms
93ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUXHLFKq6ewxoI1nnY1CILwKMOQNweXU117mhq4fUUMgQv7XDWrmeD8egYRX69uZiDU808t0PEDCUxuW7cKZSeMif7b-LgxFlkKWjD3YGB3PsnZA_6UXopCmlqChAyAOfcLGAISPQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQ0MTQ2LDM4MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9zdWJzYmFucnVyYWwud2ViY2luZGFyaW8uY29tL2d0Lmh0bWwiLG51bGwsW1s4LCJLcDkzRFhuOWxBSSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

05bfffaf5f2f776ecb8944501dc216dc0b45c294fb56ac5375987fa59ca704a8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-f1w3zZ3na9aXvvojHLwwyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:06 GMT
content-security-policy: script-src 'report-sample' 'nonce-f1w3zZ3na9aXvvojHLwwyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 67ms
66ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=2.693762159494204

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GI88k9-LRI_6gsAv-psgHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:07 GMT
content-security-policy: script-src 'report-sample' 'nonce-GI88k9-LRI_6gsAv-psgHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 107ms
106ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=3.718510016917234

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pWlqNgdGXpndmj8zeJ7WCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:07 GMT
content-security-policy: script-src 'report-sample' 'nonce-pWlqNgdGXpndmj8zeJ7WCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 175ms
65ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-x0wweRxUvqurk665LOayvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:07 GMT
content-security-policy: script-src 'report-sample' 'nonce-x0wweRxUvqurk665LOayvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
fundingchoicesmessages.google.com/f/AGSKWxUgw_vqJDB0mPRCVTt45a_f6WG0uNo9Eqk-8azaqWNYwIXVKiLOs5o9pIqjhaSljNFO555EpioSfd_MV0CeW-kqfOvfQUSI0d-5lcnAEPxN3shXZKG0kqqnwPfNT3N74mmRTl50wvupl7XZGhCSaBxQUooLs... 54 B
109 B 69ms
68ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUgw_vqJDB0mPRCVTt45a_f6WG0uNo9Eqk-8azaqWNYwIXVKiLOs5o9pIqjhaSljNFO555EpioSfd_MV0CeW-kqfOvfQUSI0d-5lcnAEPxN3shXZKG0kqqnwPfNT3N74mmRTl50wvupl7XZGhCSaBxQUooLsDZ0mFStSivCeiw5fKoTES-m7-wmftKg/_/sidebaradvertisement._adview_/expop.js/ad/special.-source/ads/

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7798dd80a4b7ece84fec8d6454036d8958b6e748bf4b7a77488929481c278681

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-l9JDheHeJX3KHtie4apa0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-l9JDheHeJX3KHtie4apa0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
49 KB 123ms
122ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

770aa33d53f0666f2316ba7d843eea9ee27ba39ad9387ed2822540d7cf0749af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50482
x-xss-protection: 0
server: cafe
etag: 3589169398724656471
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:29:08 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 66ms
66ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Nyc1LtnLreO4SNtuVG8cCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-Nyc1LtnLreO4SNtuVG8cCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 64ms
64ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_7eWPewDZERLbwT8l35dBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-_7eWPewDZERLbwT8l35dBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 65ms
65ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-C1Wt7Ex9aGWqfB07X_SMFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-C1Wt7Ex9aGWqfB07X_SMFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 101ms
101ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kqlmvIkGmsAxO7dbwfnikQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kqlmvIkGmsAxO7dbwfnikQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUYwdXNwEzRTqCZPv9jVZ6kHgjtmGZUbuhGI2D9j01iHi5MxBzq48DAxPqB_8bIDWvv2Efwha21fe_2HHQmsmdAQiPJDcw4LSiAxOwUbdSxU1b1YdVyyJYXFcgVK56YC2kcaH1Cqw== Show response
fundingchoicesmessages.google.com/f/ 4 KB
2 KB 84ms
84ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUYwdXNwEzRTqCZPv9jVZ6kHgjtmGZUbuhGI2D9j01iHi5MxBzq48DAxPqB_8bIDWvv2Efwha21fe_2HHQmsmdAQiPJDcw4LSiAxOwUbdSxU1b1YdVyyJYXFcgVK56YC2kcaH1Cqw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQ0MTQ4LDM0NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vc3Vic2JhbnJ1cmFsLndlYmNpbmRhcmlvLmNvbS9ndC5odG1sIixudWxsLFtbOCwiS3A5M0RYbjlsQUkiXSxbOSwiZW4tR0IiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

db0393d64c8b2bb6532f8da66757cd476bad49ddf38fbbf6ed82a36f90eeec39

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JKygdB901uS1NEJqmH-_6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-JKygdB901uS1NEJqmH-_6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 64ms
64ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-S5516Cf9JRZjE0qXEefEMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-S5516Cf9JRZjE0qXEefEMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUcp64U9cKwNuO05kuLCJn0cOH-yMcHTFBeuCbDn-LaMZcfcCkcKfSBtV_XDaM6mypYXzh6ccup5kPXFo0rXtca0OrTJFZPcoBe3cTN_scGKQsl2ROxAEwzX1NSxE_tg3dui3NlaQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 83ms
82ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUcp64U9cKwNuO05kuLCJn0cOH-yMcHTFBeuCbDn-LaMZcfcCkcKfSBtV_XDaM6mypYXzh6ccup5kPXFo0rXtca0OrTJFZPcoBe3cTN_scGKQsl2ROxAEwzX1NSxE_tg3dui3NlaQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQ0MTQ4LDQzNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vc3Vic2JhbnJ1cmFsLndlYmNpbmRhcmlvLmNvbS9ndC5odG1sIixudWxsLFtbOCwiS3A5M0RYbjlsQUkiXSxbOSwiZW4tR0IiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

348c2d6f0d89b106a03d32facb2420883b65f8408864bf23ca436542d94d286b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6rUvBwgw0XBH-1mUqTJ8Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-6rUvBwgw0XBH-1mUqTJ8Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWtnar-aRT4v2GHb8ICMm5XqRc92TtxBi_LW-Q3m2Kn1Kyl_Y-lzwgfEMKxpPsA3n_TEFyv0_ip6CM9HW35L6IXxns_1YvWkKUTofd5LThrWCR4yOb6IILewrnhpsJeJy0fs1Zhig== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 81ms
81ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWtnar-aRT4v2GHb8ICMm5XqRc92TtxBi_LW-Q3m2Kn1Kyl_Y-lzwgfEMKxpPsA3n_TEFyv0_ip6CM9HW35L6IXxns_1YvWkKUTofd5LThrWCR4yOb6IILewrnhpsJeJy0fs1Zhig==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQ0MTQ4LDUyMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZXMiLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9zdWJzYmFucnVyYWwud2ViY2luZGFyaW8uY29tL2d0Lmh0bWwiLG51bGwsW1s4LCJLcDkzRFhuOWxBSSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

875003de59d830ab432a90032b42f19147c18f6703c74c1c4d466ba5dcd09d5d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1mTVn_W1eg6xFJwtKQl9ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: script-src 'report-sample' 'nonce-1mTVn_W1eg6xFJwtKQl9ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWHZT_qm4ORyw5EE57cqndKNcRL_a6LVEDfFvXQ4H6TPZ4j3IjqgPyTZjfu_1K6Vwlm0GwozZobkatmdBByHRr7GprgQzUlgEDNCj3pMQsh1S9QZf6Ga-OrNv_8Bldfv7iVPmsHZA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 64ms
64ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWHZT_qm4ORyw5EE57cqndKNcRL_a6LVEDfFvXQ4H6TPZ4j3IjqgPyTZjfu_1K6Vwlm0GwozZobkatmdBByHRr7GprgQzUlgEDNCj3pMQsh1S9QZf6Ga-OrNv_8Bldfv7iVPmsHZA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-2Balo5Yp9t-Y1Cm-5M1shw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-2Balo5Yp9t-Y1Cm-5M1shw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 98ms
98ms XHR
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVszGIgAATnKNeu5KLjg4ijp-Dq0S65XRMI6aO5WP-h-gGZO-SUC8fZnRCFFFQ8bQjhxZhKAKJknfoLiHXYfVCLoRkOcBMla9Bjtq-v1_7_OMa_fvqz3hfCWResqSUTbOVrIN_chg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3K6e3nDNi5kiLnHhImryXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:29:08 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3K6e3nDNi5kiLnHhImryXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 607f6b0b381bbc1f64fa027d62891072_cookie.php Show response
hosting.miarroba.info/ Frame 20B1 46 B
441 B 93ms
92ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19603242f3bfa5b6cf922d65bc2353813d1b4c3a4b970638f3fa1c5b6dd39a88

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://subsbanrural.webcindario.com
Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8063d3cc8c08068e-LHR
content-encoding: br
content-type: text/html; charset=iso-8859-1
date: Wed, 13 Sep 2023 22:29:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zySImKpZ8AX2W7KTafWj6YhSVds4OiPkCJFHYo58eb5ABc3Lsxcy36%2FQDBzHhsqGwcEi1HXDdwCOWKARqnF7Noh0cYCoSy1gzLuRy6yLhUeqJTAmH%2BwmlbVI0YcA6%2BxIYRh95QLn9Y0zJP72INdftL5pq98%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 104ms
103ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230912&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

111c57e8c4df8d06e382910990f8dee3b551ca2f46272134bfc1db46ef908b06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11579
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 186ms
60ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 13 Sep 2023 22:29:09 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7F72 13 KB
5 KB 53ms
52ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1894
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 21:57:35 GMT
expires: Thu, 12 Sep 2024 21:57:35 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 25D1 829 B
993 B 63ms
63ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ac0d1b7040895f86bfdc605f74b8bb039e6df8a9e994c159b7808f23a1feff71

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fJvmj6P6oB_6E2m_EQI4PA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 536
content-security-policy: script-src 'report-sample' 'nonce-fJvmj6P6oB_6E2m_EQI4PA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 22:29:09 GMT
expires: Wed, 13 Sep 2023 22:29:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Uw2xNewqLMvs4rZz24Xmy1GvWBTM7qWVeNEZF5moV5c.js Show response
pagead2.googlesyndication.com/bg/ Frame 7F72 37 KB
14 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Uw2xNewqLMvs4rZz24Xmy1GvWBTM7qWVeNEZF5moV5c.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

530db135ec2a2ccbece2b673db85e6cb51af5814cceea59578d1191799a85797

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 21:57:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1893
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 04 Sep 2023 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Sep 2024 21:57:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 25D1 0
0 86ms
85ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230912&jk=1995844241833690&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7F72 0
10 B 52ms
52ms Image
text/plain 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?pNDWtw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 22:29:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 89ms
88ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230912&jk=1995844241833690&bg=!X1ylXBPNAAa6D61Rmg87ADQBe5WfOAyHztSRHoz09zFxUWspGcnOG3T-05wVTbQoGmGBFJAcg7mqC3y1xBXD9Vz82JtEAgAAAEpSAAAACWgBB5kCtiHi7xm62lAJmzIkZLukVPMJ_e2sscARdYrhuvQzU00ES4_EJB1OnL46cPRONtk1ORYtFlx_30vtlOp9utRBzdQ6a_GQFn3ITMW9zm2srGBSBhmxzIDb2k7azzImJ7Sqx64VMFaXyUlPfiHPwzipQdNFzaWnEmN-appG1HiY2hKoQec-ZvCCrNMSyj6HYbf1DQ7IuCBdnIqiAgomSgmdEbn1YvhsEnxMsT9xecvtyKvCMag57mDuR7HsXnEIlDaE5xKiUa0qfe31rnoDsf1gVTplkwkxY40hBkp59AkWWinXomwwQiWlVwMXHfstYBU-4xk4ctM3fS3-jeNu13WkdHga44kJ7QKqzfS7EhPt46Z83ogXFbS3BmFRPaoqQNA1SlqVpdc2y4YErtOh3v14QyJ43yL27FtAgKH11EuGbog1UC_DQJzrjnxwyRfvZLaKR76qqesheT7Z7Rnixz_N0MUBQkZBIrL9tqsHWbFTSe3Gync2xtNZSw3pB7pg-0XYrymnpxvemRT55DYpOIlpqQHV6doptv24597t-Z9PHKsV19QIM3phACm7vXBEn5kdzXjOvPCdfXRobrzKoh-IhFxIdiSrAf0iFuJo5ii0sorGiE8G-KuOlZEINjUVIR1Fjx1sN8tLLirS5mlvnZChr7cauO0EZ81m16Pf9fs9_2Ws5ZHruH3j0b14ySTSDBVNqtW-cH4JAD3krHs_pB1Oj1_193h0hwB7zhU2FS-2xVFOCIhtBmc5MJwRZVSRVF8-LvL5zLKERBVjDoLPLNB458alqJYjt0Togqf8YnCDFP5LqK4XaBCaUKIpcnd1LoZtqyygsxVmoYHPkW_rL9i_2Wknec7jigdm_vzUXFfa7Yc-5AQuSV5FfaO5KL_OQB_I4UdN3VMvIXuxHNtM-37xpYkImo8z_Fs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ 0
234 B 947ms
327ms Ping
image/gif 2404:6800:4004:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lmibdbqv&c=1995844241833690&e=44759876%2C44759927%2C44759837%2C44798879%2C31077774%2C44795922%2C44801485%2C31077838%2C21065725%2C31061691%2C31061693&ctx=1&met.3=1001.hq_1__1~164.hs_1~165.hp_3~166.he_p~640.i7_2~640.iv~640.ky~640.ly~1032.rh~326.sj_1~832.sl~868.sl~216.rh_15~215.rh_15~843.rg_16~112.u6_1~889.11r~639.11w~429.16w~990.16y__2~353.16x_1~754.16z__3~629.171_1~166.2kd_4~113.3al_1&met.7=CBsQCMABwaPFvA8~CAEQChgBILYCKLYCMO8EOLkCQLcCSMYCUMYCWL0DYPoCaL0DcKQEeLiOA4ABjIwDiAG7gwmwAQG4AQPAAd6Ov5sB~CBIQBxgBILcCKLcCMPQDOL0BQLgCSLoCULoCWLEDYO4CaLIDcPIDeNYGgAGqBIgBujSqASYKJFBvcHBpbnM6d2dodEAzMDA7NDAwOzUwMDs2MDA7NzAwOzgwMLABAbgBA8ABsaC7qQo~CBsQByC3AjiOAcABg6mO6AQ~CBsQByC3AjhPwAGmvMN8~CBsQByC3AjhPwAGlmNOlCA~CBsQByC4AjhTwAHtiKLRDQ~CBsQByC4AjiUAcABxZTusQM~CBsQByC4AjhZwAHz99e3CQ~CBsQByC4AjhawAGJmpXoDw~CBsQByC4AjhcwAGGgpOsBQ~CBsQChgBILkCKLkCMLIEOPkBQLsCSLwCULwCWLsDYPMCaLwDcPQDeNn0AYABrfIBiAGEuwWwAQG4AQPAAfPI9KoI~CBsQBiC5AjjVAsABjPjiiAo~CBsQByC5Aji-AsABk8Kw2Q4~CBsQBiC5AjjYAsAB7K33zQ0~CBsQCiC5AjjRAsABsfiUogQ~CBsQChgBINoCKNoCMN4GOIUEwAHVntOmDA~CBsQAiDNAzhMwAHLuJejBQ~CBsQAiDOAzhOwAGXwZykBw~CBsQAiDOAzhJwAHW48jOBg~CBsQDSDCBDjoA8AB7Yno5AE~CBsQDSDDBDiYAsAB-fjD_gM~CBsQAiDTBDj4AcABoPGUiA4~CAMQChgBIP4EKP4EMNQHONcCUP4EWOgFYP8EaOkFcOAGePuICIABz4YIiAGb3RewAQG4AQPAAfWO840G~CAwQBRgBIIsFKIsFMLsGOK8BQIwFSI0FUI0FWIMGYMMFaIMGcLoGeIIlgAHWIogBpE-wAQG4AQPAAdPlnZAM~CBsQCiDtBjjAAcAB2euw8wo~CBsQCiDvBjjKAcABwNTO7wo~CBwQChgBIIQIKIQIMLoIODdohAhwuAh426cBgAGvpQGIAdCvA7ABAbgBA8AB07fZvgI~CBsQDSC2CDhAwAGAkfKHCA~CBsQCiC9CDjQAcAB1q6kpQI~CCgQDRgBIPgIKPgIMKkKOLEBwAHisoC5Aw~CEAQChgBIP4HKP4HMK4KOLACQP4HSI0IUI0IWIMJYMAIaIQJcOAJePqQA4ABzo4DiAGCzwmwAQG4AQPAAfXY7pIH~CBsQBiCRCjhCwAHbp7SGDA~CD8QChgBINcKKNcKMLgLOGJo1wpwtAt4kjOAAeYwiAG1a7ABAbgBA8AB59qs0AU~CBsQBhgBIKoKKKoKMN0LOLMBQKoKSKoKUKoKWJwLYN4KaJwLcNwLeNYCgAEqiAEqsAEBuAEDwAH_5ujMCw~CBsQBhgBIKoKKKoKMOkLOL8BQKoKSLgKULgKWKgLYOwKaKgLcOgLeNYCgAEqiAEqsAEBuAEDwAH_5O3XCA~CAUQBRgBINMKKNMKMOgLOJUBaNQKcOcLeLwmgAGQJIgBwViwAQG4AQPAAZDHsvAI~CBsQChgBIMQKKMQKMPILOK4BQMQKSMUKUMUKWLQLYPgKaLULcPELeKkEgAH9AYgBjQOwAQG4AQPAAeSq4PAC~CBsQAiDVBDiyCcAB4-jAxAU~CD8QBhgBIKUTKKUTMOoTOEXAAZah8eMM~CD8QBhgBIKUTKKUTMJIUOG3AAZah8eMM~CD8QDRgBIJgUKJgUMMkVOLEBwAGngNKZDA~CD8QDRgBIO8YKO8YMLIZOEPAAaeA0pkM~CD8QChgBIO8YKO8YMLQZOEbAAaqb2p0M~CD8QDRgBILUZKLUZMPYZOEHAAaeA0pkM~CAEQChgBIO8YKO8YMPoZOIsBaPAYcOoZeN6MA4ABsooDiAG8_wiwAQG4AQPAAd6Ov5sB~CD8QDRgBIIEaKIEaMMMaOELAAaeA0pkM~CD8QChgBIIMaKIMaMNgaOFVogxpw1xp4kBOAAeQQiAHXIbABAbgBA8ABtdK2qwY~CD8QDRgBIIIaKIIaMOcaOGXAAaeA0pkM~CD8QDRgBINoaKNoaMJsbOEHAAaeA0pkM~CD8QChgBINsaKNsaMK8bOFNo2xpwrht4kg6AAeYLiAGNF7ABAbgBA8AB99Oe3wE~CD8QChgBILEbKLEbMIMcOFJoshtwgxx44Q-AAbUNiAHMGrABAbgBA8ABzPrKvgk~CD8QDRgBIIUcKIUcMMYcOEHAAeL53acI~CD8QDRgBIIYcKIYcMOkcOGPAAaeA0pkM~CBsQCiC5AjiMHsAB3sbU-Aw~CBsQCDisIcABwaPFvA8~CCcQDRgBIKwhKKwhMJoiOG5orSFwlCJ451yAAbtaiAHrd7ABAbgBA8AB8_LLrgs~CCcQChgBIJsiKJsiMNgjOL0BwAHiwZvaBQ~CCcQBRgBINojKNojMJ8kOEXAAZmVn6AL~CBsQBRgBIN0jKN0jMKckOErAAc_G2uIB&met.1=1.lmibdawp~6.1n~7.1o~8.2r~9.2r~10.6k~11.4k~12.6k~13.8f~14.8h~15.8k~16.37t~17.37t~18.37u~19.3aj~20.3aj~21.3ak~22.gr~23.gr
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20230912/r20110914/rum_fy2021.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80b::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:29:11 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banrural (Banking)

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ayudas-banrurals.liveblog365.com/	1970-01-21 00:20:04	Name: __test Value: 359e5beab4ed0b43dbd3747c7fa7a1f5
.webcindario.com/	1970-01-21 00:20:04	Name: __muid Value: 30d41b564ee3c6ca118ddd4dbb300cc4ca8d5d49
.subsbanrural.webcindario.com/	1970-01-21 00:20:04	Name: _ga Value: GA1.3.1852003485.1694644146
.subsbanrural.webcindario.com/	1970-01-20 14:45:30	Name: _gid Value: GA1.3.1556817346.1694644146
.subsbanrural.webcindario.com/	1970-01-20 14:44:04	Name: _gat_UA-597118-7 Value: 1
.quantserve.com/	1970-01-21 00:14:18	Name: mc Value: 650237b2-56260-c5c0a-475fa
.webcindario.com/	1970-01-21 00:08:32	Name: __qca Value: P0-1194784726-1694644146101
bancavirtual.banrural.com.gt/	1969-12-31 23:59:59	Name: UHTWMETM Value: 028f09417e-ddad-4aX7IQoDZpGY0CkiBK8dKkBL4VpY12FcvNKoJX6-t5BVo4v2bTRTrM3Viejrd5vbY4vEw
.bancavirtual.banrural.com.gt/	1970-01-20 14:44:05	Name: __cf_bm Value: i4rrN7bV2UheQDcpKtbwG2OixT_toFCpFQGO6.GE.Dc-1694644146-0-AVbnrHfgi19uaza/dUPh7b1sTkiBf/yiQxHwg9qkaz85jF9RN1HcVboEGa7opomjCfhf0y3JxpOIvmiNrlou+0U=
.doubleclick.net/	1970-01-20 14:44:05	Name: test_cookie Value: CheckForPermission
.webcindario.com/	1970-01-21 00:05:40	Name: __gads Value: ID=fcbc3f30621e6c20-22dc919170de00b4:T=1694644146:RT=1694644146:S=ALNI_Ma5ml54vezOJr-loF_YNrqwtZcs4g
.webcindario.com/	1970-01-21 00:05:40	Name: __gpi Value: UID=00000d927cc8dc7c:T=1694644146:RT=1694644146:S=ALNI_MaJVDLlTfTFIu3OcLv_d2zW2b8DZg
.webcindario.com/	1970-01-20 23:29:40	Name: FCNEC Value: %5B%5B%22AKsRol_S0A5OcVDxOsASD9zw44kDOKspR_teyl4elaspsxF7jpmN_moWpSLwEkyp72_FVET42Pdf2jocGPYLPHwmmsQX1c-t2mCUPuusCyTrijhgBLKjJ5xjKBr2yLA2a99XWIw_22MOiFvfpvqhnOnH7OUWIIjlyQ%3D%3D%22%5D%2Cnull%2C%5B%5D%5D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
ayudas-banrurals.liveblog365.com
bancavirtual.banrural.com.gt
csi.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
hosting.miarroba.info
ipinfo.io
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.quantserve.com
rules.quantcount.com
secure.quantserve.com
stats.g.doubleclick.net
subsbanrural.webcindario.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.ru
www.googletagmanager.com
173.231.16.77
185.27.134.117
2404:6800:4004:80b::2003
2600:9000:2176:e00:6:44e3:f8c0:93a1
2606:4700::6812:13e5
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:806::2001
2a00:1450:4001:806::200a
2a00:1450:4001:809::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::2004
2a00:1450:4001:811::200e
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2008
2a00:1450:4001:830::2003
2a00:1450:4001:830::200e
2a00:1450:400c:c07::9d
2a06:98c1:3121::3
34.117.59.81
5.57.226.202
006bc55beae308cdb1965abc2f7a382d92bf0c4138469ffaafbb9db0d1df5c4f
04272b51fed9af20e39ac1afb27c5ae5d93cce30b5b068bdb39b6bb7f8511ff9
05bfffaf5f2f776ecb8944501dc216dc0b45c294fb56ac5375987fa59ca704a8
0cb3ad59518a9b556a3900b3f67c8312cf1f2db88f77cbadad1e6e4f7b425e0c
111c57e8c4df8d06e382910990f8dee3b551ca2f46272134bfc1db46ef908b06
1299a634ef90e58f8b94c8e58d07661d999c912bb1c6f8a995d8112a3e38b193
188f6b9067b0c3afd0d4bf568fe0e5ebc26cf83ee51cfb48c6cac25b0bff5757
19603242f3bfa5b6cf922d65bc2353813d1b4c3a4b970638f3fa1c5b6dd39a88
1ba8a2bf4378d7358c9cfbbc3001f4e4f518510e24f7489c557ab61b4c783f25
2b8748b21696872317d6f518ee2f34fd01dc9e92ae5f836e3d0a872bc75eeb26
2dc96935f05685463099c8fb26e222eaee7e0292fa5023e99ee178bd603f0ed6
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
348c2d6f0d89b106a03d32facb2420883b65f8408864bf23ca436542d94d286b
3a7941e1d0a24e8551e50b4897372a865d4da0d4d7378aa0e8cfcd0ee893c548
52d26165b37d436d7544d574dfeb5a810c66c85985dce2e26e334bb19fa7101b
530db135ec2a2ccbece2b673db85e6cb51af5814cceea59578d1191799a85797
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5fc0d5c960ca212b704d31a451fc2aea06a4a7b53ead3ef98ab7b1a3a21b1eb1
60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6439cc87266daaff74ba9fd244c4b6a5e5b4e0273a782ea26acb08dffb8ba440
770aa33d53f0666f2316ba7d843eea9ee27ba39ad9387ed2822540d7cf0749af
7798dd80a4b7ece84fec8d6454036d8958b6e748bf4b7a77488929481c278681
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb
7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4
7f25e98925c35509f28eac7b335392c5a43dfdcc2fa0ed80171e59a3c0756ad0
83ac7e6ff86bc619881d5afba113b6cc42c02d52987e8d4c6bc6d4fb07ab018a
875003de59d830ab432a90032b42f19147c18f6703c74c1c4d466ba5dcd09d5d
9bf79cc6c024b28ab0fc9cbf916e87d94942e0ab5d50ca4ca34c18615291fd16
9c18722da234f453de03c0b6992c350628501160dee0d1c022198268af352cc0
a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a10e06a176e9108d8a496ef2e088f826fc6a62e14aed68182256b4279c0d5de9
a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd
ac0d1b7040895f86bfdc605f74b8bb039e6df8a9e994c159b7808f23a1feff71
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b33c1beac6fcf2bba0cc6ff41e1b25a982e583e739836c50571aba48e0c40530
b94497936e2ff5deea225626cb5029d5dbf640a34f3a267751f5af1db008b99e
bc363a10d38799359dd365c81fae895eee6011595a095c4acc25c3db243a0392
c0198ce329041bced9b0291d5e0ca0675cdf0a92a032faa0607ab87fedc47c22
c8945609a935ce0e38ce4f3eaac75e764738bcffafe9a68e647055b2c516f1da
cb7c9c787038f0f5c07bde040c3de6e2369fc19bb4a95fccdd9583bd413b92cd
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
cf0d27974608ac6ec8e4acd56b5d5eba00ae1d65ac1d6edfde4259f0cd0e9f96
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
d3a6769b590ee6ec86b1d82d009f70c94cfd710eec909e2cdee243db9cedf655
d60c833406c5cca9095b3cabd40d6f65e486a0a4c0b59105031c9a6e94595f5a
db0393d64c8b2bb6532f8da66757cd476bad49ddf38fbbf6ed82a36f90eeec39
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0ee71ccf8903462f77a37c75d04c49fa633c58a4b2cf152776bbb914dcfd477
e2bc7402cff9d4252634885c4541611db2482b56e2fc03c1a6475e2ec81564ea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f381540d7c64990501dc08a4ccdebe9ae120bc22cd80b6b20c5264cf4d728024
f3c725b1dea64704c14ac3bd6d2932ad23ce30328a5d9f42fa8452b3a5382be9
f4722046a6261fbad08665f4fb34bbcda5d881da85c331c1ad493d09aee5f651
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

subsbanrural.webcindario.com Open in urlscan Pro 5.57.226.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

70 Requests

97 %HTTPS

80 %IPv6

17 Domains

23 Subdomains

20 IPs

6 Countries

1086 kBTransfer

2162 kBSize

13 Cookies

3 Outgoing links

Page URL History

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

subsbanrural.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

97 %
HTTPS

80 %
IPv6

17
Domains

23
Subdomains

20
IPs

6
Countries

1086 kB
Transfer

2162 kB
Size

13
Cookies

70 HTTP transactions
0 data transactions