exey.io Open in urlscan Pro
2606:4700:20::681a:837 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://exe.io/MGv8V
Effective URL:
https://exey.io/MGv8V
Submission: On June 10 via manual (June 10th 2022, 12:25:34 am UTC) from US — Scanned from DE

Summary HTTP 118 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 42 IPs in 6 countries across 38 domains to perform 118 HTTP transactions. The main IP is 2606:4700:20::681a:837, located in United States and belongs to CLOUDFLARENET, US. The main domain is exey.io. The Cisco Umbrella rank of the primary domain is 339249.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 14th 2022. Valid for: a year.

This is the only time exey.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:20:... 2606:4700:20::681a:367	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:20:... 2606:4700:20::681a:837	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	52.72.133.128 52.72.133.128	14618 (AMAZON-AES) (AMAZON-AES)
5	2600:9000:215... 2600:9000:2156:d400:7:5c7d:44c0:21	16509 (AMAZON-02) (AMAZON-02)
1	23.109.87.100 23.109.87.100	7979 (SERVERS-COM) (SERVERS-COM)
1	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3030::ac43:dadd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	108.157.4.106 108.157.4.106	16509 (AMAZON-02) (AMAZON-02)
6	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f10... 2a03:2880:f106:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:80f::200d	15169 (GOOGLE) (GOOGLE)
11	139.45.197.239 139.45.197.239	9002 (RETN-AS) (RETN-AS)
2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
4	2a0c:5c81:514... 2a0c:5c81:5142::2	55081 (24SHELLS) (24SHELLS)
1	2606:4700:303... 2606:4700:3034::ac43:cdf0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.195.254 139.45.195.254	9002 (RETN-AS) (RETN-AS)
6 15	2606:4700:20:... 2606:4700:20::681a:c1b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	139.45.197.153 139.45.197.153	9002 (RETN-AS) (RETN-AS)
4	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
2	45.133.44.3 45.133.44.3	7018 (ATT-INTER...) (ATT-INTERNET4)
1 2	5.178.65.246 5.178.65.246	50673 (SERVERIUS-AS) (SERVERIUS-AS)
1	178.250.2.131 178.250.2.131	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	147.75.85.234 147.75.85.234	54825 (PACKET) (PACKET)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	52.31.92.156 52.31.92.156	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::6816:2460	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	37.252.172.249 37.252.172.249	29990 (ASN-APPNEX) (ASN-APPNEX)
1	77.245.57.72 77.245.57.72	36057 (WEBAIR-IN...) (WEBAIR-INTERNET-MTL)
1	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
1	50.31.142.31 50.31.142.31	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
118	42

3 2606:4700:20::681a:367 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

exe.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::681a:837 (United States)

ASN13335 (CLOUDFLARENET, US)

exey.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.72.133.128 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-133-128.compute-1.amazonaws.com

platform.pubfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2156:d400:7:5c7d:44c0:21 (United States)

ASN16509 (AMAZON-02, US)

dba9ytko5p72r.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.109.87.100 (Netherlands)

ASN7979 (SERVERS-COM, US)

hematalmicast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3030::ac43:dadd (United States)

ASN13335 (CLOUDFLARENET, US)

freychang.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 108.157.4.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-106.dus51.r.cloudfront.net

cesspervic.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

quiremuken.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
player.adtcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f106:83:face:b00c:0:25de (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 139.45.197.239 (United Kingdom)

ASN9002 (RETN-AS, GB)

forfrogadiertor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a0c:5c81:5142::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)

ghb.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:cdf0 (United States)

ASN13335 (CLOUDFLARENET, US)

tzegilo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.254 (United Kingdom)

ASN9002 (RETN-AS, GB)

fleraprt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:4700:20::681a:c1b (United States) 6 redirects

ASN13335 (CLOUDFLARENET, US)

papayads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.papayads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 139.45.197.153 (United Kingdom)

ASN9002 (RETN-AS, GB)

static.cdnativepush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.212.162 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.133.44.3 (Philadelphia, United States)

ASN7018 (ATT-INTERNET4, US)

player.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.178.65.246 (Amsterdam, Netherlands) 1 redirects

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net

pbjs.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.131 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.am5.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.85.234 (Schiphol, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

adsparc-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.92.156 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-92-156.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:2460 (United States)

ASN13335 (CLOUDFLARENET, US)

useast.quantumdex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.249 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 77.245.57.72 (United States)

ASN36057 (WEBAIR-INTERNET-MTL, US)

cpm.unibots.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net

prebid-eu.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.31.142.31 (Lombard, United States)

ASN23352 (SERVERCENTRAL, US)
PTR: chi.outbrain.com

b1h.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	papayads.net 6 redirects papayads.net — Cisco Umbrella Rank: 37778 www.papayads.net — Cisco Umbrella Rank: 40733	33 KB
12	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 109 6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 142	61 KB
11	forfrogadiertor.com forfrogadiertor.com — Cisco Umbrella Rank: 271235	39 KB
6	cdnativepush.com static.cdnativepush.com — Cisco Umbrella Rank: 22305	15 KB
6	adtelligent.com ghb.adtelligent.com — Cisco Umbrella Rank: 6518 player.adtelligent.com — Cisco Umbrella Rank: 5712	33 KB
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 345	109 KB
5	cesspervic.xyz cesspervic.xyz	6 KB
5	cloudfront.net dba9ytko5p72r.cloudfront.net	230 KB
4	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190	164 KB
4	google.com accounts.google.com — Cisco Umbrella Rank: 102 adservice.google.com — Cisco Umbrella Rank: 79 www.google.com — Cisco Umbrella Rank: 4	2 KB
4	quiremuken.xyz quiremuken.xyz — Cisco Umbrella Rank: 24879	2 KB
4	freychang.fun freychang.fun — Cisco Umbrella Rank: 26987	202 KB
4	gstatic.com fonts.gstatic.com	93 KB
3	exey.io exey.io — Cisco Umbrella Rank: 339249	90 KB
3	exe.io 1 redirects exe.io — Cisco Umbrella Rank: 364187	2 KB
2	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 225	1 KB
2	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 1207	742 B
2	e-planning.net 1 redirects pbjs.e-planning.net — Cisco Umbrella Rank: 6625	1 KB
2	adtcdn.com player.adtcdn.com — Cisco Umbrella Rank: 23426	100 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 43	20 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 75 googletagmanager.com — Cisco Umbrella Rank: 74	108 KB
2	pubfuture.com platform.pubfuture.com — Cisco Umbrella Rank: 61503	4 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 52	2 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 8654	792 B
1	zemanta.com b1h.zemanta.com — Cisco Umbrella Rank: 4418	122 B
1	creativecdn.com prebid-eu.creativecdn.com — Cisco Umbrella Rank: 6658	178 B
1	unibots.in cpm.unibots.in — Cisco Umbrella Rank: 33753	263 B
1	quantumdex.io useast.quantumdex.io — Cisco Umbrella Rank: 10575	403 B
1	servenobid.com ads.servenobid.com — Cisco Umbrella Rank: 2007	649 B
1	openx.net adsparc-d.openx.net — Cisco Umbrella Rank: 51883	380 B
1	criteo.com bidder.criteo.com — Cisco Umbrella Rank: 718	218 B
1	fleraprt.com fleraprt.com — Cisco Umbrella Rank: 56684	477 B
1	tzegilo.com tzegilo.com — Cisco Umbrella Rank: 61227	18 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11551	538 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 92
1	hematalmicast.com hematalmicast.com — Cisco Umbrella Rank: 538576	1 KB
0	criteo.net Failed static.criteo.net Failed
0	smilewanted.com Failed prebid.smilewanted.com Failed
118	38

	Domain	Requested by
11	forfrogadiertor.com	exey.io forfrogadiertor.com
9	www.papayads.net	platform.pubfuture.com www.papayads.net papayads.net
8	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.papayads.net cdn.ampproject.org
6	static.cdnativepush.com	exey.io forfrogadiertor.com
6	papayads.net	6 redirects
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	cesspervic.xyz	dba9ytko5p72r.cloudfront.net
5	dba9ytko5p72r.cloudfront.net	exey.io cesspervic.xyz
4	securepubads.g.doubleclick.net	papayads.net securepubads.g.doubleclick.net www.papayads.net
4	ghb.adtelligent.com	platform.pubfuture.com player.adtelligent.com
4	quiremuken.xyz	exey.io
4	freychang.fun	dba9ytko5p72r.cloudfront.net
4	fonts.gstatic.com	fonts.googleapis.com
3	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	exey.io	exey.io
3	exe.io	1 redirects exey.io
2	ib.adnxs.com	player.adtcdn.com
2	prebid.a-mo.net	player.adtcdn.com
2	pbjs.e-planning.net	1 redirects
2	player.adtelligent.com	player.adtcdn.com
2	player.adtcdn.com	papayads.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	accounts.google.com	exey.io
2	platform.pubfuture.com	exey.io platform.pubfuture.com
2	fonts.googleapis.com	exey.io securepubads.g.doubleclick.net
1	www.google.com	tpc.googlesyndication.com
1	6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	b1h.zemanta.com	player.adtcdn.com
1	prebid-eu.creativecdn.com	player.adtcdn.com
1	cpm.unibots.in	player.adtcdn.com
1	useast.quantumdex.io	player.adtcdn.com
1	ads.servenobid.com	player.adtcdn.com
1	adsparc-d.openx.net	player.adtcdn.com
1	bidder.criteo.com	player.adtcdn.com
1	googletagmanager.com	papayads.net
1	fleraprt.com	tzegilo.com
1	tzegilo.com	forfrogadiertor.com
1	my.rtmark.net	forfrogadiertor.com
1	www.facebook.com	exey.io
1	www.googletagmanager.com	exey.io
1	hematalmicast.com	exey.io
0	static.criteo.net Failed	player.adtcdn.com
0	prebid.smilewanted.com Failed	player.adtcdn.com
118	45

This site contains links to these domains. Also see Links.

Domain
pubfuture.com

Subject Issuer	Validity	Valid
exe.io Cloudflare Inc ECC CA-3	`2022-03-23` - `2023-03-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-14` - `2023-03-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
platform.pubfuture.com R3	`2022-03-27` - `2022-06-25`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
hematalmicast.com R3	`2022-04-25` - `2022-07-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
cesspervic.xyz Amazon	`2022-05-31` - `2023-06-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-03-19` - `2022-06-17`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
forfrogadiertor.com R3	`2022-05-02` - `2022-07-31`	3 months	crt.sh
*.rtmark.net Sectigo RSA Domain Validation Secure Server CA	`2021-11-20` - `2022-11-26`	a year	crt.sh
ghb.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2022-06-06` - `2022-09-04`	3 months	crt.sh
fleraprt.com Sectigo RSA Domain Validation Secure Server CA	`2022-01-14` - `2023-01-14`	a year	crt.sh
cdnativepush.com R3	`2022-05-30` - `2022-08-28`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
player.adtelligent.com R3	`2022-05-20` - `2022-08-18`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-07`	3 months	crt.sh
*.a-mo.net R3	`2022-05-05` - `2022-08-03`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
ads.servenobid.com Amazon	`2022-05-29` - `2023-06-27`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.unibots.in AlphaSSL CA - SHA256 - G2	`2021-09-02` - `2022-10-04`	a year	crt.sh
*.creativecdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-17` - `2023-04-12`	a year	crt.sh
*.zemanta.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-29` - `2022-08-29`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://exey.io/MGv8V
Frame ID: E39F3C44E08AEE5109CB8187E617541F
Requests: 47 HTTP requests in this frame

Frame: https://cesspervic.xyz/bE1ucEMNLw0dfA1wDFY2HiFTVXEqaFw2Jw4sVwk3ByJbAHReP0ATLwM4ChYxAyMaXi0JOUtCBTsaOAArNSBaRg09dSslEFw3LCZ6OyxcGBY5Cx5VcSoALDkNLQ4CHgcbfSQ9BBsAIxwsIwkrExQqCV8eFjkcLT8HPQo2QCRUAy86JTR+VkcBPQ86EhsbGysXBhUXGT0PLw4jBQIbIjs9KhwFKAd6BwMZRBouNztCAikpDThxVR07GzceLAUbFS43DVVxLgkGJScKCgYiBy49VhEFKhk2HicdHyg1MAoKBiIFPS5dEgU6BTYiN0l/KCVyJRoMQnYlH18IMyM1QzUQLScZBAEtDCg9AFkIOzMrHyw4Kg40GldVcSoYXzoEIScnJgcbB1YRACYFNjcoXg4vGw8KCgYiAT0+WD0SWQE9QjcdDAkfICInDTURXToIEXIqHD83L1wbKDomDgU8KBZcORwRKyUJLTQkAw4rFCAkf1cjFTkPHxIGDxU7QiRKJx0fLRxwAB8kBXsDIHc7Gw
Frame ID: 7E30780F09613223DA843768B0B65F9B
Requests: 2 HTTP requests in this frame

Frame: https://cesspervic.xyz/TlFtY0EvMw4Ofi9sD0U0PD1QRnMIdF8lJSwwVBo1JT5YE3Z8I0MALSEkCQUzIT8ZTS8rJUhRBx8IXA8XHARVIg8kIgcAAy0mIDspfQdfEy8tYlglDDcIHCoTADolKxB/GD8uBwQ7GigEHCVdLRIYIg4ZBH8TXzEtFyggIA80G1kCEBdiIw0pa2MvMRUpKSdQCxY3FCIqLTZZUQ03JgcnOyYmCRQtGTVfNSYoByMbCCcmBSE7FzgjDjEcMDkQOS89KxMbBgcFNnI2PC9RMRwwPioyBwc7FyIGCCMxLDo9PTstFjIlIXIoJiQTCx06HCUFOWIhChgWNypOIgo0ASE0K2I3VhMjJQEBEh8dITcmPjABJiAtGQlGcwgVFyJkfBMkJDEcMDkqJgIQClEnCRNUNjshaCMaAAEBJSFyDQcnExt8JUhRBxoGFQ8lFiEjAXMcNgs1DD8fLi40CwUvFCU5PToCLAQjCyUXa2MrKgkmdF8hZyQiAg0xcxhcGQMEAQ4QKAYfXBkHew
Frame ID: 9E6828D47EA7C0BC4704DE889E29E25D
Requests: 2 HTTP requests in this frame

Frame: https://cesspervic.xyz/emZFNHcbBCZZSBtbJxICCAp4EUU8Q3dyExgHfE0DEQlwREBIFGtXGxUTIVIFFQgxGhkfEmAGMTA8d3lEGTN9cTM8DR1XNTctEAQPST50WzMpLjF2NC83IH0lHgMjYSIgJxdyDT8PdXklLysJf0YKMgBmRw8lFGU8LB8qfjY7FgRVJiMuE2EPTTcXUD8yDxdVNixSHXolNyQdQwQRIHViND8uDH8zP1YcfQAJJQBfOjAzLgQ/LC50bCRKJxx9JjcrFHU9CzATei04MTViIg08B20hHiEHcDkLMBN6Nj0lA2YhAiwGcCIwNAdDG08zdVskK1V9czJKSyZQPBInAmIlFQsABC48KHZEIiwkKXcSLywXdkYRDQFMExsuEkQhMyQPcBENFQ5sNSgXE2I5KyAGQzo+JHBhESwFBGwANwEGUy4pNzJYIC8RE1IRSgoSdkc8UBZiIj0wDQUvPyAcbDsSMw5xHDcsEFg2Oz52TCUoMw95ER1AL0cYFBZ4fkMsADdwFBgN
Frame ID: F437FF9B0B9B8071C896EED11B507D54
Requests: 2 HTTP requests in this frame

Frame: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10
Frame ID: E10ADC00B547E8B2412212D2EAA86B6A
Requests: 55 HTTP requests in this frame

Frame: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Frame ID: E6B59AF25AD91C49F4252E4A15E8C95B
Requests: 3 HTTP requests in this frame

Frame: https://6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: F8D0F562C1A3E4E24DD5D2A2488850E4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 99364116AD9543D0191FA92DB4202BF3
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 76733B3F80D23303D43C5A57868D9912
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

exe.io

Page URL History Show full URLs

http://exe.io/MGv8V HTTP 301
https://exe.io/MGv8V Page URL
https://exey.io/MGv8V Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Page Statistics

118
Requests

90 %
HTTPS

56 %
IPv6

38
Domains

45
Subdomains

42
IPs

6
Countries

1337 kB
Transfer

3402 kB
Size

17
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://pubfuture.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://exe.io/MGv8V HTTP 301
https://exe.io/MGv8V Page URL
https://exey.io/MGv8V Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://exe.io/MGv8V HTTP 301
https://exe.io/MGv8V

Request Chain 41

https://papayads.net/self/clnt/1085-1498/adtags-if-300x250.html HTTP 301
https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html

Request Chain 45

https://papayads.net/self/clnt/1085-1498/adtags.js HTTP 301
https://www.papayads.net/self/clnt/1085-1498/adtags.js

Request Chain 49

https://papayads.net/self/clnt/1085-1498/adtags.js HTTP 301
https://www.papayads.net/self/clnt/1085-1498/adtags.js

Request Chain 52

https://papayads.net/self/clnt/1085-1498/adtags.js HTTP 301
https://www.papayads.net/self/clnt/1085-1498/adtags.js

Request Chain 53

https://papayads.net/self/common/adtags.css HTTP 301
https://www.papayads.net/self/common/adtags.css

Request Chain 54

https://papayads.net/self/common/adtagswhitelabel.css HTTP 301
https://www.papayads.net/self/common/adtagswhitelabel.css

Request Chain 68

https://pbjs.e-planning.net/pbjs/1/2e43c/1/www.papayads.net/ROS?rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&pbv=6.7.0-pre&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&e_pubcid=dff9f0a9-f8bf-42a5-98f3-c8f119d20d3c HTTP 302
https://pbjs.e-planning.net/hb/1/2e43c/1/www.papayads.net/ROS?ct=1&r=pbjs&rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&pbv=6.7.0-pre&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&e_pubcid=dff9f0a9-f8bf-42a5-98f3-c8f119d20d3c

118 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

MGv8V Show response
exe.io/
Redirect Chain

http://exe.io/MGv8V
https://exe.io/MGv8V

195 B
977 B

65ms
44ms

Document
text/html

2606:4700:20::681a:367
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://exe.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:367 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72a71f8fed15184a35e74a149af4f459db98ffe175761519bb453744047ce797

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 718df856efb89b25-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 10 Jun 2022 00:25:29 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mkzm9ULcoJ82jerxgan3HBJdzt%2BxURL0g8m0famrut1e%2BVu9a%2FViH6h2idE7JGqlTDSb0ax5tQ2Lpil0XrIMjUIuDBc710OCPvpbS%2BPkHhLiQCWwsqjbQpen%2F56U5mJLrZeHUw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block

Redirect headers

CF-RAY: 718df856ae6b905b-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Fri, 10 Jun 2022 00:25:29 GMT
Expires: Fri, 10 Jun 2022 01:25:29 GMT
Location: https://exe.io/MGv8V
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ye7hMYHYJRxHox44Fk6G9jlyMddlaNJNZm64rNJy1DnxBLTf4bERoFUAh0QXS64wkZYr03CtEHCZCVvZhZu3D4QXdXm6h4Ycv5rf%2BPXGEh0M09UaBUv2GSHZ3Lpmw%2F0oeq44dg%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 Primary Request MGv8V Show response
exey.io/ 128 KB
49 KB 127ms
92ms Document
text/html 2606:4700:20::681a:837
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:837 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71f6e73b4afc83f7ecdbb100ba117b6c1142715d2295211766c78f2430babb64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://exe.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 718df857892a91ea-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 10 Jun 2022 00:25:29 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ECrS2xuDCcas1Zf2pYi3N5edHvUdvYU1XgSAgShk7sXiH%2BcCxqgf0ZmCzLmCfSGEzW6Srr0EORYcLjPd8CnbPfOg9tUmpxqo4DZNKIGYQOZFcOMwBC776m1qinHMnTZdNV7OMWY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 41ms
18ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f259e1ac72c23752a935508137a234c6411c9abe1f04f9d951003ca60241cdb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 09 Jun 2022 22:44:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 10 Jun 2022 00:25:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Jun 2022 00:25:29 GMT

GET
H2 200 continue.css
exey.io/css/ 179 KB
41 KB 16ms
15ms Stylesheet
text/css 2606:4700:20::681a:837
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://exey.io/css/continue.css

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:837 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8f2d5487d860696dee2e6037ae07ff063ae5959b8d4b4658a284f9dc9711ca1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/MGv8V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1568086
cf-polished: origSize=211643
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Fri, 20 Nov 2020 17:25:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fXK8e6SJ%2FgdBG4lQRWI%2FIjg%2FWdnNl5f2%2BCe%2F8ey2SAs%2BnsqTvdrY2ck3sEk%2Bvj26TCvsogLxrYpZfOIb1%2BhKIzug5z4vwAC22igyQ7Zgy5OkRK6WrA4VYq9Yh02Aj%2F0MnPWKKyM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 718df8585a0c91ea-FRA
expires: Tue, 21 Jun 2022 20:50:43 GMT

GET
H2 200 nr.js Show response
exey.io/js/scripts/ 186 B
516 B 14ms
13ms Script
application/javascript 2606:4700:20::681a:837
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://exey.io/js/scripts/nr.js

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:837 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26bbadf324d400b12bea32f232b42870889357c483db6c1c4b1baa0202a41539

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/MGv8V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1568086
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Thu, 06 May 2021 10:32:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kmNT5FWafcU0HxvPXcp7gf5%2FdUWRVS8y1PAsmq%2F0VFKYSskbpvbQn71R8SDoLGLosRpyzo8k0pqK4M0cqUTteGvaOPXCqQy5z58ACdTCoUM5cPKg8jSpV0BJVfNQCFLG4nQO5WU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 718df8585a0d91ea-FRA
expires: Tue, 21 Jun 2022 20:50:43 GMT

GET
H2 200 623444fe30482400586261c9.js Show response
platform.pubfuture.com/v1/unit/ 3 KB
2 KB 478ms
186ms Script
application/javascript 52.72.133.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.pubfuture.com/v1/unit/623444fe30482400586261c9.js?v=2

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.72.133.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-72-133-128.compute-1.amazonaws.com

Software

nginx /

Resource Hash

4a1d4d06cefd96b2a94b54e21240a9d92ed493c9c13aacd786d5968b43554c49

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
vary: Accept-Encoding
x-xss-protection: 0
pragma: public
referrer-policy: no-referrer
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"a3f-SjjsmxSxeIp+3gJy385/FXFqH/4"
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=7200, public
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
expires: Fri, 10 Jun 2022 02:25:30 GMT

GET
H2 200 / Show response
dba9ytko5p72r.cloudfront.net/ 350 KB
114 KB 229ms
182ms Script
text/plain 2600:9000:2156:d400:7:5c7d:44c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:7:5c7d:44c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 390bffee1e815045bca580de43eb308af5dcda27d562d86d2ba60728c0c24d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:29 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-length: 116124
via: 1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
x-amz-cf-id: R_3iy4LO672XSMndwFT6WvL3Y1mGmljaWcZI3_suRcEs06yCt5vQyw==

GET
H/1.1 200
OK 29529 Show response
hematalmicast.com/1clkn/ 6 B
1 KB 185ms
21ms Script
application/javascript 23.109.87.100
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://hematalmicast.com/1clkn/29529

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

23.109.87.100 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

b7848d86edc8dc3b5bc6a5c666069f9a31e000cee51575d3b6083951607e1550

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 00:25:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=1
Keep-Alive: timeout=20

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
39 KB 43ms
20ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-135952122-1

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e16b22175cf4805b2e5708af25968a60a9a8838f17344cdd2192742ef91f8f4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39769
x-xss-protection: 0
last-modified: Fri, 10 Jun 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Jun 2022 00:25:29 GMT

GET
H2 200 prebid-ads.js Show response
exe.io/js/ 19 B
457 B 17ms
16ms Script
application/javascript 2606:4700:20::681a:367
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://exe.io/js/prebid-ads.js

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:367 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0e99c90d9cb7411a4b06a0132c284c9f507452ea0b2b01b893988460a7417d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1160063
cf-polished: origSize=21
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19
x-xss-protection: 1; mode=block
last-modified: Wed, 02 Mar 2022 16:13:09 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fIjRvJgTACmrS5AEIwFq%2F6O4smhTfybGzCvStXUgKiVxYxUW7qkCnadUkMPsEIeT6TxbA0ZOhcnAvLWpPlHoiEEIXUVe9%2BVHPPY4S1bim8jO4cDzJRR4c9nYYyw1Dor2MN%2FlWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 718df85859209b25-FRA
expires: Sun, 26 Jun 2022 14:11:06 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ 44 KB
44 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://exey.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 23:32:09 GMT
x-content-type-options: nosniff
age: 262400
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jun 2023 23:32:09 GMT

GET
H2 200 memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
fonts.gstatic.com/s/opensans/v29/ 17 KB
18 KB 35ms
15ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

738161904fe560fd83c26e301998e35ac1e87cb40bebd4b190a5f141309d40b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://exey.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 18:07:27 GMT
x-content-type-options: nosniff
age: 281882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17816
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:26:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jun 2023 18:07:27 GMT

GET
H2 200 asd100.bin Show response
freychang.fun/ 100 KB
101 KB 42ms
15ms Fetch
binary/octet-stream 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/asd100.bin
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
access-control-allow-methods: GET
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6835
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 09 Jun 2022 22:31:34 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhsM5Ro3EJ0rH%2F4BZByZbLS5fn5BKWp3kH8O67jsSjFoRvHn44mLrak3PDcK0PRYreGDhafVA1bQuQqXfEocPxiRFdCw4XnW6pIElb%2F2xhzT3x7MYRCSO%2FjvGwzG2xqmMQSqwYWLjcduLj0o"}],"group":"cf-nel","max_age":604800}
content-type: binary/octet-stream
access-control-allow-origin: https://exey.io
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 718df85a0e579125-FRA
access-control-allow-headers: X-Requested-With, content-type

GET
H2 200 / Show response
freychang.fun/ 27 B
415 B 130ms
104ms Fetch
text/plain 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d43675f272da10dafc0bf4c6f126d67f5e8d8c69c59d0cdae331e8691e4119a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://exey.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V56FeWwbT8kiLL3sfZ1nluoyXE50ifpIR%2FmadfpZwP%2BzSd27Yc%2FpuxstS0X0HfVVEJ4M%2FXNLSpYkx99%2F1yGqDKWfW5%2Fvq%2Fb%2BHzAVga0i45oR97U7nSjsPXlR6DCOramiM8MUQIUrMY7ahF%2Bc"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 718df85a0e599125-FRA
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 utx Show response
cesspervic.xyz/ 0
483 B 136ms
101ms XHR
text/plain 108.157.4.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cesspervic.xyz/utx?cb=d1zb2D5H6QxR&top=exey.io&tid=822524
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-106.dus51.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:29 GMT
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://exey.io
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-amz-cf-id: Au-tyKd00RSP2RCIeJbUcEkfFIYuGSHd8i2ndhJJU8bziuBfbwKsNA==

GET
H2 200 KCVyJRoMQnYlH18IMyM1QzUQLScZBAEtDCg9AFkIOzMrHyw4Kg40GldVcSoYXzoEIScnJgcbB1YRACYFNjcoXg4vGw8KCgYiAT0+WD0SWQE9QjcdDAkfICInDTURXToIEXIqHD83L1wbKDomDgU8KBZcORwRKyUJLTQkAw4rFCAkf1cjFTkPHxIGDxU7QiRKJx0fL... Show response
cesspervic.xyz/bE1ucEMNLw0dfA1wDFY2HiFTVXEqaFw2Jw4sVwk3ByJbAHReP0ATLwM4ChYxAyMaXi0JOUtCBTsaOAArNSBaRg09dSslEFw3LCZ6OyxcGBY5Cx5VcSoALDkNLQ4CHgcbfSQ9BBsAIxwsIwkrExQqCV8eFjkcLT8HPQo2QCRUAy86JTR+VkcBPQ... Frame 7E30 3 KB
2 KB 115ms
104ms Document
text/html 108.157.4.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cesspervic.xyz/bE1ucEMNLw0dfA1wDFY2HiFTVXEqaFw2Jw4sVwk3ByJbAHReP0ATLwM4ChYxAyMaXi0JOUtCBTsaOAArNSBaRg09dSslEFw3LCZ6OyxcGBY5Cx5VcSoALDkNLQ4CHgcbfSQ9BBsAIxwsIwkrExQqCV8eFjkcLT8HPQo2QCRUAy86JTR+VkcBPQ86EhsbGysXBhUXGT0PLw4jBQIbIjs9KhwFKAd6BwMZRBouNztCAikpDThxVR07GzceLAUbFS43DVVxLgkGJScKCgYiBy49VhEFKhk2HicdHyg1MAoKBiIFPS5dEgU6BTYiN0l/KCVyJRoMQnYlH18IMyM1QzUQLScZBAEtDCg9AFkIOzMrHyw4Kg40GldVcSoYXzoEIScnJgcbB1YRACYFNjcoXg4vGw8KCgYiAT0+WD0SWQE9QjcdDAkfICInDTURXToIEXIqHD83L1wbKDomDgU8KBZcORwRKyUJLTQkAw4rFCAkf1cjFTkPHxIGDxU7QiRKJx0fLRxwAB8kBXsDIHc7Gw
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-106.dus51.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 844b99214e0be7d3aee539f149d0332d37e149e4f658b41f28e0e322ed959e97

Request headers

Referer: https://exey.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cache-control: no-store, no-cache, must-revalidate, no-transform
content-encoding: gzip
content-length: 1230
content-type: text/html
date: Fri, 10 Jun 2022 00:25:29 GMT
p3p: CP="NID DSP ALL COR"
pragma: no-cache
server: openresty/1.17.8.2
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
x-amz-cf-id: ys_j7gUd_tpkdVgpiABbqxhUa3iKr3bh8q2nP3d1piy6cgUACOwP6w==
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront

GET
H2 200 GD8uBwQ7GigEHCVdLRIYIg4ZBH8TXzEtFyggIA80G1kCEBdiIw0pa2MvMRUpKSdQCxY3FCIqLTZZUQ03JgcnOyYmCRQtGTVfNSYoByMbCCcmBSE7FzgjDjEcMDkQOS89KxMbBgcFNnI2PC9RMRwwPioyBwc7FyIGCCMxLDo9PTstFjIlIXIoJiQTCx06HCUFOWIhC... Show response
cesspervic.xyz/TlFtY0EvMw4Ofi9sD0U0PD1QRnMIdF8lJSwwVBo1JT5YE3Z8I0MALSEkCQUzIT8ZTS8rJUhRBx8IXA8XHARVIg8kIgcAAy0mIDspfQdfEy8tYlglDDcIHCoTADolKxB/ Frame 9E68 3 KB
2 KB 106ms
106ms Document
text/html 108.157.4.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cesspervic.xyz/TlFtY0EvMw4Ofi9sD0U0PD1QRnMIdF8lJSwwVBo1JT5YE3Z8I0MALSEkCQUzIT8ZTS8rJUhRBx8IXA8XHARVIg8kIgcAAy0mIDspfQdfEy8tYlglDDcIHCoTADolKxB/GD8uBwQ7GigEHCVdLRIYIg4ZBH8TXzEtFyggIA80G1kCEBdiIw0pa2MvMRUpKSdQCxY3FCIqLTZZUQ03JgcnOyYmCRQtGTVfNSYoByMbCCcmBSE7FzgjDjEcMDkQOS89KxMbBgcFNnI2PC9RMRwwPioyBwc7FyIGCCMxLDo9PTstFjIlIXIoJiQTCx06HCUFOWIhChgWNypOIgo0ASE0K2I3VhMjJQEBEh8dITcmPjABJiAtGQlGcwgVFyJkfBMkJDEcMDkqJgIQClEnCRNUNjshaCMaAAEBJSFyDQcnExt8JUhRBxoGFQ8lFiEjAXMcNgs1DD8fLi40CwUvFCU5PToCLAQjCyUXa2MrKgkmdF8hZyQiAg0xcxhcGQMEAQ4QKAYfXBkHew
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-106.dus51.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 550e514b7d08f67d950ea786201beadab7989f1cafa9505f56d8c18a3ade342b

Request headers

Referer: https://exey.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cache-control: no-store, no-cache, must-revalidate, no-transform
content-encoding: gzip
content-length: 1222
content-type: text/html
date: Fri, 10 Jun 2022 00:25:29 GMT
p3p: CP="NID DSP ALL COR"
pragma: no-cache
server: openresty/1.17.8.2
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
x-amz-cf-id: 6pUZjg1JQQC-heuw1Kpl5NDhk9JyVYv7mCezpEv5X4DU9blZ9K69OA==
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront

GET
H2 200 asd100.bin Show response
freychang.fun/ 100 KB
100 KB 14ms
13ms Fetch
binary/octet-stream 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/asd100.bin
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:29 GMT
access-control-allow-methods: GET
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6835
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 09 Jun 2022 22:31:34 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a4LZUZywSgtAmxZttDqGAlpAA49%2Bb%2FQ7klkbWYXI33RRNQVlNcy1Covng2vY02mYu6V1EN2tQRDIdjkano6%2B0yOYTbigSj1kyTs4RDR9kSfW7EkLIGEv%2B3%2BF9e7ta6hKstAvQjGaH8uCDbV6"}],"group":"cf-nel","max_age":604800}
content-type: binary/octet-stream
access-control-allow-origin: https://exey.io
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 718df85a2e6c9125-FRA
access-control-allow-headers: X-Requested-With, content-type

GET
H2 200 / Show response
freychang.fun/ 27 B
371 B 100ms
99ms Fetch
text/plain 2606:4700:3030::ac43:dadd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:dadd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae3176cc38b9beb6bb1b367675a6139508cef9e5ed06ef73321ab822a1d3a385

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://exey.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5P8E%2B5X5ilkpieoMFYjw%2BJ3OrBdVcrUK2xSDmuiMNIJdMB6wPb5TDoYI0Cu1u86pjU7AZ2exovm5wIIAun7Ox38X1xbwRHTr6PkbZrhA6ZYMxwTlPUKuqYQ4ujUdnWSxsEquQ07yYACE0NDQ"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 718df85a2e6e9125-FRA
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 utx Show response
cesspervic.xyz/ 0
484 B 93ms
93ms XHR
text/plain 108.157.4.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cesspervic.xyz/utx?cb=VRkqlHFp9Orf&top=exey.io&tid=889494
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-106.dus51.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:29 GMT
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://exey.io
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-amz-cf-id: VZjA_Mnai768x_hG_C61Lth9XrkoT2y_1SMXxABReJRxB5vfhrkObA==

GET
H2 200 LC50bCRKJxx9JjcrFHU9CzATei04MTViIg08B20hHiEHcDkLMBN6Nj0lA2YhAiwGcCIwNAdDG08zdVskK1V9czJKSyZQPBInAmIlFQsABC48KHZEIiwkKXcSLywXdkYRDQFMExsuEkQhMyQPcBENFQ5sNSgXE2I5KyAGQzo+JHBhESwFBGwANwEGUy4pNzJYIC8RE... Show response
cesspervic.xyz/emZFNHcbBCZZSBtbJxICCAp4EUU8Q3dyExgHfE0DEQlwREBIFGtXGxUTIVIFFQgxGhkfEmAGMTA8d3lEGTN9cTM8DR1XNTctEAQPST50WzMpLjF2NC83IH0lHgMjYSIgJxdyDT8PdXklLysJf0YKMgBmRw8lFGU8LB8qfjY7FgRVJiMuE2EPTT... Frame F437 3 KB
2 KB 109ms
109ms Document
text/html 108.157.4.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cesspervic.xyz/emZFNHcbBCZZSBtbJxICCAp4EUU8Q3dyExgHfE0DEQlwREBIFGtXGxUTIVIFFQgxGhkfEmAGMTA8d3lEGTN9cTM8DR1XNTctEAQPST50WzMpLjF2NC83IH0lHgMjYSIgJxdyDT8PdXklLysJf0YKMgBmRw8lFGU8LB8qfjY7FgRVJiMuE2EPTTcXUD8yDxdVNixSHXolNyQdQwQRIHViND8uDH8zP1YcfQAJJQBfOjAzLgQ/LC50bCRKJxx9JjcrFHU9CzATei04MTViIg08B20hHiEHcDkLMBN6Nj0lA2YhAiwGcCIwNAdDG08zdVskK1V9czJKSyZQPBInAmIlFQsABC48KHZEIiwkKXcSLywXdkYRDQFMExsuEkQhMyQPcBENFQ5sNSgXE2I5KyAGQzo+JHBhESwFBGwANwEGUy4pNzJYIC8RE1IRSgoSdkc8UBZiIj0wDQUvPyAcbDsSMw5xHDcsEFg2Oz52TCUoMw95ER1AL0cYFBZ4fkMsADdwFBgN
Requested by: Host: dba9ytko5p72r.cloudfront.net
URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-106.dus51.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 07b8bea7c13dcd6101fdf6fed66eede54ff26ffce89c289fe00e4715c7a0b9c6

Request headers

Referer: https://exey.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
cache-control: no-store, no-cache, must-revalidate, no-transform
content-encoding: gzip
content-length: 1224
content-type: text/html
date: Fri, 10 Jun 2022 00:25:30 GMT
p3p: CP="NID DSP ALL COR"
pragma: no-cache
server: openresty/1.17.8.2
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
x-amz-cf-id: KE6wxgTRfqoBRuN9nc4VqU3wix5DyWpCkIGSOMVs31_RMLiAi4gBRA==
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront

GET
H2 204 awcdaAoQNBIgJggWI34nMwV5YGFoVHZsdSoIIGVifBIwOScvEnlpdTMPIjdufBd5aX1pVWpqZHRQYi1ua0cwKDI9XHV+Iy4VKGVibFRwYGFqVnZhampS
quiremuken.xyz/YURYU1pOezsgZzsTbQQ5NSgKBTcvARs/ 0
499 B 141ms
105ms Image
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://quiremuken.xyz/YURYU1pOezsgZzsTbQQ5NSgKBTcvARs/awcdaAoQNBIgJggWI34nMwV5YGFoVHZsdSoIIGVifBIwOScvEnlpdTMPIjdufBd5aX1pVWpqZHRQYi1ua0cwKDI9XHV+Iy4VKGVibFRwYGFqVnZhampS
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8iVVctkpnZoG%2B8L%2FvrlBJ4xmT9WTPiMzcIxTDxQNoC8YRASzmuQ5IKysuWs0eb3HWDF3W%2BlurdEc61s1y0dgyBzWekxa3EKw9pk4RbaJDR%2BgGchw3lckotw1OQ9prFUNA%2BtQZoVKor%2FiG%2FyJ1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 718df85a7b889034-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 login.php
www.facebook.com/ 0
0 133ms
97ms Image
text/html 2a03:2880:f106:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f106:83:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 88ms
65ms Image
text/html 2a00:1450:4001:80f::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 98ms
75ms Image
text/html 2a00:1450:4001:80f::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H2 204 aR87FClyWm0FOjsHdkR4el9zR354WXJMfHc
quiremuken.xyz/a0t1Tk9EdBY9cj15TCIBBR0SFiM6GycZBTITNBwOMScBHA0+AlM6Jg92TXp8WX1EaD8CL0h/d004AS87HjhIf2kCJRMhck09SH9hW2VEYH5NPkh/ 0
259 B 144ms
109ms Image
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://quiremuken.xyz/a0t1Tk9EdBY9cj15TCIBBR0SFiM6GycZBTITNBwOMScBHA0+AlM6Jg92TXp8WX1EaD8CL0h/d004AS87HjhIf2kCJRMhck09SH9hW2VEYH5NPkh/aR87FClyWm0FOjsHdkR4el9zR354WXJMfHc
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6QVPa7di0%2BtVykTaO86CTPM8Tt%2FeMRL4uSBnisDPMM4szM0Tm5cbnqKa8BcYNOt%2FzothZzdAvZx0QCNra74qcTVFz4GGu0UucdmJz6xW3fTdp6Jeqb553h1jmAjtjMBEecHzHmiFAsYgQFerA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 718df85a7b8a9034-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 204 Z0kBPhwLV01uTA9bUycRUlJEcQtCDgEiCwteUz4WUABIcQ4LXltkTBhdQnlJEBpIZl5CHxQwRQdJBSMMWlJEYU0CV0dnTwRWTGNI
quiremuken.xyz/eDZvdVdXCQwGahxdXiA2PmAnEQAuZDYwDU5UKRk6LAUHHw8/ 0
265 B 141ms
106ms Image
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://quiremuken.xyz/eDZvdVdXCQwGahxdXiA2PmAnEQAuZDYwDU5UKRk6LAUHHw8/Z0kBPhwLV01uTA9bUycRUlJEcQtCDgEiCwteUz4WUABIcQ4LXltkTBhdQnlJEBpIZl5CHxQwRQdJBSMMWlJEYU0CV0dnTwRWTGNI
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AJwWbHn98sa%2F3dP3KgZvM67a4p7fja%2FsUww04sF%2Fzu7bM2364n1OgtkjsgrExf%2F7GXXe060%2FiKqIdrMhQUU9GQGzGZSOzbsqpFbKW6oITo1GR4q%2FmCl8uXB4BskZGCq6mCOquqwZbo75NlynaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 718df85a7b8b9034-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
dba9ytko5p72r.cloudfront.net/ 350 KB
114 KB 192ms
175ms Fetch 2600:9000:2156:d400:7:5c7d:44c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dba9ytko5p72r.cloudfront.net/?tyabd=822524
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:7:5c7d:44c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9ea0fdf892749dadf67a7ff4c8f58bc1820aff60627f3b9a11af59bb6b9b0160

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: https://exey.io
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
access-control-allow-credentials: true
content-length: 116121
via: 1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront)
x-amz-cf-id: X2LpiXG-0OeloYFArFYDvASbUZsgE9tRD2wzvZc_sZa6nBxuhI7YoQ==

GET
H2 200 3230648 Show response
forfrogadiertor.com/400/ 73 KB
29 KB 67ms
32ms Script
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://forfrogadiertor.com/400/3230648

Requested by

Host: exey.io
URL: https://exey.io/MGv8V

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

f8c780064cd4b2d091253b7465340e05d316c53c807339e309e30fb4ae8dbf87

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-trace-id: 6a30257e8e30cbe5ff19557c96a65553
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-135952122-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3044
date: Thu, 09 Jun 2022 23:34:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 10 Jun 2022 01:34:46 GMT

GET
H2 200 U1JGMjIVDwJ8aCJHXGk2CAkLfGhRBQs6MQ5LS2tqAgocNjcER1wfa1FQQGl0VFJebHRXU0trahIDCDgoCEdcH29SVUBqbEcXU2g Show response
dba9ytko5p72r.cloudfront.net/WWVphYm46NQ8EUS0zBV9Wa2hUUFp/MBINAClnDw0JMGwMMloODEcWFD1nUUQCODQGX0g8NAJfX387BQBTbXwVEgEyZwMLCCMuAwoUMipHFw9kNw4YBzU2AEdcH29PUktrakkVBzc+DhUdfGhRDBp8aFFTXndqRFEsfGhRFQc... Frame 7E30 682 B
780 B 162ms
162ms Script
text/plain 2600:9000:2156:d400:7:5c7d:44c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dba9ytko5p72r.cloudfront.net/WWVphYm46NQ8EUS0zBV9Wa2hUUFp/MBINAClnDw0JMGwMMloODEcWFD1nUUQCODQGX0g8NAJfX387BQBTbXwVEgEyZwMLCCMuAwoUMipHFw9kNw4YBzU2AEdcH29PUktrakkVBzc+DhUdfGhRDBp8aFFTXndqRFEsfGhRFQc3bFVHXRt/U1IWb25IR1xpOx-ESAjwtBAAFMC5EUChsaVZMXW9/U1JGMjIVDwJ8aCJHXGk2CAkLfGhRBQs6MQ5LS2tqAgocNjcER1wfa1FQQGl0VFJebHRXU0trahIDCDgoCEdcH29SVUBqbEcXU2g
Requested by: Host: cesspervic.xyz
URL: https://cesspervic.xyz/bE1ucEMNLw0dfA1wDFY2HiFTVXEqaFw2Jw4sVwk3ByJbAHReP0ATLwM4ChYxAyMaXi0JOUtCBTsaOAArNSBaRg09dSslEFw3LCZ6OyxcGBY5Cx5VcSoALDkNLQ4CHgcbfSQ9BBsAIxwsIwkrExQqCV8eFjkcLT8HPQo2QCRUAy86JTR+VkcBPQ86EhsbGysXBhUXGT0PLw4jBQIbIjs9KhwFKAd6BwMZRBouNztCAikpDThxVR07GzceLAUbFS43DVVxLgkGJScKCgYiBy49VhEFKhk2HicdHyg1MAoKBiIFPS5dEgU6BTYiN0l/KCVyJRoMQnYlH18IMyM1QzUQLScZBAEtDCg9AFkIOzMrHyw4Kg40GldVcSoYXzoEIScnJgcbB1YRACYFNjcoXg4vGw8KCgYiAT0+WD0SWQE9QjcdDAkfICInDTURXToIEXIqHD83L1wbKDomDgU8KBZcORwRKyUJLTQkAw4rFCAkf1cjFTkPHxIGDxU7QiRKJx0fLRxwAB8kBXsDIHc7Gw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:7:5c7d:44c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b09efc8e4a97b24d3d6bdcc2b708717d25d768e9db95174d1f3e80910b7a16f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cesspervic.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 503
via: 1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
x-amz-cf-id: ue8hdYO_5TLjpIp5n_GxsocZk3ZVUZpaZovOWmn2-yhXQ_4eQ3H3HA==

GET
H2 200 IHh+ Show response
dba9ytko5p72r.cloudfront.net/QY1lVRU8ANjsjcBcwMXh3V2pnc35FMyYqIRNkHHQ1IRMFJjwKERt0NSVsczE1B2RlYyMCNzJ4aQY3Nnh+RTgxJ3JXfyAkcg42LywjDzhwdwlWd2VgfVNxIiwhBzYiNmpRaTsxalFpZHVhU3xmB2pRaSIsIVVtcHYNRmtlPXl... Frame 9E68 183 B
464 B 157ms
157ms Script
text/plain 2600:9000:2156:d400:7:5c7d:44c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dba9ytko5p72r.cloudfront.net/QY1lVRU8ANjsjcBcwMXh3V2pnc35FMyYqIRNkHHQ1IRMFJjwKERt0NSVsczE1B2RlYyMCNzJ4aQY3Nnh+RTgxJ3JXfyAkcg42LywjDzhwdwlWd2VgfVNxIiwhBzYiNmpRaTsxalFpZHVhU3xmB2pRaSIsIVVtcHYNRmtlPXlXcHB3fwIpJSkqFDw3LiYXfG-cDelBue3Z5RmtlbSQLLTgpalEacHd/DzA+IGpRaTIgLAg2fGB9Uzo9NyAOPHB3CVJpZ2t/TWxldXpNb2RgfVMqNCMuETBwdwlWamJrfFV/IHh+
Requested by: Host: cesspervic.xyz
URL: https://cesspervic.xyz/TlFtY0EvMw4Ofi9sD0U0PD1QRnMIdF8lJSwwVBo1JT5YE3Z8I0MALSEkCQUzIT8ZTS8rJUhRBx8IXA8XHARVIg8kIgcAAy0mIDspfQdfEy8tYlglDDcIHCoTADolKxB/GD8uBwQ7GigEHCVdLRIYIg4ZBH8TXzEtFyggIA80G1kCEBdiIw0pa2MvMRUpKSdQCxY3FCIqLTZZUQ03JgcnOyYmCRQtGTVfNSYoByMbCCcmBSE7FzgjDjEcMDkQOS89KxMbBgcFNnI2PC9RMRwwPioyBwc7FyIGCCMxLDo9PTstFjIlIXIoJiQTCx06HCUFOWIhChgWNypOIgo0ASE0K2I3VhMjJQEBEh8dITcmPjABJiAtGQlGcwgVFyJkfBMkJDEcMDkqJgIQClEnCRNUNjshaCMaAAEBJSFyDQcnExt8JUhRBxoGFQ8lFiEjAXMcNgs1DD8fLi40CwUvFCU5PToCLAQjCyUXa2MrKgkmdF8hZyQiAg0xcxhcGQMEAQ4QKAYfXBkHew
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:7:5c7d:44c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: b29d10bd58a5e666015851ae1113eb776dcb6cefdec716c98acc351a3ba1b508

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cesspervic.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 187
via: 1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
x-amz-cf-id: -Ub__wWqzrbe4VaIk83pYWrQjJwSP2lXk7K4icvO7vHKcCRF_Rwe0Q==

GET
H2 200 JZ2M3cU8EDFkXcBMKU0x3X1oDSHtBCUQeIRdefUUZARFzEi0MRUMLK1pTER0uCQQKVyoJAApAaQYHVUx7QRdHHiRaAV4XNRMBXwskF0VCEHIKDE0YIwsCEkMJUk0HVH1XS0AYIQMMQAJqVVNZBWpVUwZBYVdGBDNqVVNAGCFRVxJCDUJRBwl5U0oSQ38GE0-cdKhA... Show response
dba9ytko5p72r.cloudfront.net/ Frame F437 853 B
878 B 164ms
164ms Script
text/plain 2600:9000:2156:d400:7:5c7d:44c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dba9ytko5p72r.cloudfront.net/JZ2M3cU8EDFkXcBMKU0x3X1oDSHtBCUQeIRdefUUZARFzEi0MRUMLK1pTER0uCQQKVyoJAApAaQYHVUx7QRdHHiRaAV4XNRMBXwskF0VCEHIKDE0YIwsCEkMJUk0HVH1XS0AYIQMMQAJqVVNZBWpVUwZBYVdGBDNqVVNAGCFRVxJCDUJRBwl5U0oSQ38GE0-cdKhAGVRomE0YFN3pUVBlCeUJRB1kkDxdaHWpVIBJDfwsKXBRqVVNQFCwMDB5UfVcAXwMgCgYSQwlWUwVff0lWB0F6SVUGVH1XEFYXLhUKEkMJUlAAX3xRRUJMfg
Requested by: Host: cesspervic.xyz
URL: https://cesspervic.xyz/emZFNHcbBCZZSBtbJxICCAp4EUU8Q3dyExgHfE0DEQlwREBIFGtXGxUTIVIFFQgxGhkfEmAGMTA8d3lEGTN9cTM8DR1XNTctEAQPST50WzMpLjF2NC83IH0lHgMjYSIgJxdyDT8PdXklLysJf0YKMgBmRw8lFGU8LB8qfjY7FgRVJiMuE2EPTTcXUD8yDxdVNixSHXolNyQdQwQRIHViND8uDH8zP1YcfQAJJQBfOjAzLgQ/LC50bCRKJxx9JjcrFHU9CzATei04MTViIg08B20hHiEHcDkLMBN6Nj0lA2YhAiwGcCIwNAdDG08zdVskK1V9czJKSyZQPBInAmIlFQsABC48KHZEIiwkKXcSLywXdkYRDQFMExsuEkQhMyQPcBENFQ5sNSgXE2I5KyAGQzo+JHBhESwFBGwANwEGUy4pNzJYIC8RE1IRSgoSdkc8UBZiIj0wDQUvPyAcbDsSMw5xHDcsEFg2Oz52TCUoMw95ER1AL0cYFBZ4fkMsADdwFBgN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:7:5c7d:44c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2a5dd8dcb735a8372426a2424f672e5c4f03c4ee0d1243a7fc297e1211a64713

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cesspervic.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 601
via: 1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
x-amz-cf-id: weIWYGwdOhUca9KRxu5cKdNU8L4zU3MYljLngj0q6TGCoC63sFQ-nw==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 30ms
14ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1634115387&t=pageview&_s=1&dl=https%3A%2F%2Fexey.io%2FMGv8V&ul=en-us&de=UTF-8&dt=exe.io&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2088028283&gjid=1269956013&cid=1415716945.1654820730&tid=UA-135952122-1&_gid=722663787.1654820730&_r=1&gtm=2ou680&z=642035669

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://exey.io/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://exey.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
538 B 50ms
14ms XHR
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js

Requested by

Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

9dfd48e6df2f0a05981a50827733b51560550605faf47a539159450320c37aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://exey.io
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H/1.1 200
OK geo Show response
ghb.adtelligent.com/ 156 B
419 B 82ms
17ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/geo
Requested by: Host: platform.pubfuture.com
URL: https://platform.pubfuture.com/v1/unit/623444fe30482400586261c9.js?v=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: a2e8f8ea5793d7994d9382ab663fa213e81a2b7ba1dff4665aec7d3d2dffc91c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 00:25:29 GMT
Server: Adtelligent
Content-Type: application/json
Access-Control-Allow-Origin: https://exey.io
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 156

GET
H2 200 3230648 Show response
forfrogadiertor.com/400/ 2 KB
1 KB 16ms
15ms XHR
application/json 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://forfrogadiertor.com/400/3230648?oo=1&oaid=73d0ca7221db441f9dddd5cbd696da0b

Requested by

Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

d6468fb1b104ff0b483bb62661989ef8ca5b198862b987fcbc353b3852897093

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-trace-id: 8b2fee0b5ad2481bec9f7dd135720648
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/json
access-control-allow-origin: https://exey.io
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 stattag.js Show response
tzegilo.com/ 49 KB
18 KB 47ms
19ms Script
application/javascript 2606:4700:3034::ac43:cdf0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tzegilo.com/stattag.js
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:cdf0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3676e16a1358628756bda4274db53b7a9f299e3dfa82ec22301c83ba142ad774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3600
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 09 Jun 2022 09:20:35 GMT
server: cloudflare
etag: W/"62a1bb63-c24f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2B3pRvHgtnyjK3GRLC8eVeLGARcYbpLCw5fwkrCd42S%2B6Dr9KjJkNZIV7o%2FxbdG4BrOIXKYORF7F%2Fl2zzCAyq%2F1KgLPv34BgxEhmmjhvtkRdXdhn7f4oN%2BbeCFNkgfqBy8agoocuqw%2FC3A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 718df85bcc7e5c80-FRA
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin

GET
H2 200 623444fe30482400586261c9.js Show response
platform.pubfuture.com/v1/config/ 4 KB
2 KB 97ms
96ms Script
application/javascript 52.72.133.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.pubfuture.com/v1/config/623444fe30482400586261c9.js?v=6&ip=MmEwMTo0YTA6MmI6OjEy&cc=Q0g=&c=MjY2MTYwNA==&d=ZGVza3RvcF93aW5kb3dz&s=aHR0cHM6Ly9leGV5LmlvL01HdjhW

Requested by

Host: platform.pubfuture.com
URL: https://platform.pubfuture.com/v1/unit/623444fe30482400586261c9.js?v=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.72.133.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-72-133-128.compute-1.amazonaws.com

Software

nginx /

Resource Hash

931fbcb210858d14a74eaa63c371436612e5b1b667969514a032d9ebb860fe31

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
vary: Accept-Encoding
x-xss-protection: 0
referrer-policy: no-referrer
server: nginx
x-frame-options: SAMEORIGIN, SAMEORIGIN
etag: W/"e8a-mUcZ/Ovpk+1faivXLqCgkhAhdps"
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests

GET
H2 200 3230648 Show response
forfrogadiertor.com/500/ 4 KB
3 KB 17ms
17ms XHR
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://forfrogadiertor.com/500/3230648?excludes=&oaid=73d0ca7221db441f9dddd5cbd696da0b&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Requested by

Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

30d98422155fdef5cd5cecc1f6377840812facdcee2c3ae7dd12df8ae0c6bae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://exey.io/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: 828e16f80449c6ff2ed6d55847d1b0d0
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://exey.io
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

OPTIONS
H2 200 3230648
forfrogadiertor.com/500/ Frame 0
0 40ms
13ms Preflight 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://exey.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://exey.io
access-control-max-age: 600
allow: GET, OPTIONS
content-length: 0
date: Fri, 10 Jun 2022 00:25:30 GMT
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: *
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options: nosniff

POST
H/1.1 200
OK add Show response
fleraprt.com/log/ 12 B
477 B 47ms
14ms Fetch
application/json 139.45.195.254
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
Requested by: Host: tzegilo.com
URL: https://tzegilo.com/stattag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.195.254 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Request headers

Referer: https://exey.io/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 10 Jun 2022 00:25:46 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://exey.io
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 12

GET
H2

200

adtags-if-300x250.html Show response
www.papayads.net/self/clnt/1085-1498/ Frame E10A
Redirect Chain

https://papayads.net/self/clnt/1085-1498/adtags-if-300x250.html
https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html

2 KB
885 B

31ms
23ms

Document
text/html

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html

Requested by

Host: platform.pubfuture.com
URL: https://platform.pubfuture.com/v1/config/623444fe30482400586261c9.js?v=6&ip=MmEwMTo0YTA6MmI6OjEy&cc=Q0g=&c=MjY2MTYwNA==&d=ZGVza3RvcF93aW5kb3dz&s=aHR0cHM6Ly9leGV5LmlvL01HdjhW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

40273eeb294d7f317bee26de5fb1ea94ab7e9c99f72f818399564c5c888955f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://exey.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2707
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 718df85d7c2b9bd7-FRA
content-encoding: br
content-type: text/html
date: Fri, 10 Jun 2022 00:25:30 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Mon, 04 Apr 2022 14:44:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tXEHGgY18Hc%2FxtALvWALh88CmCOJK0uViKaf7852kCDC9nBTpjII4jPutGwvzZo3Yv3wYh7TRdja5B5xqEu9QBioWC1QRkS%2BtaEfu0vgxsNNlbN17HAQFGvEbMWYzXTJVA3EnYt3Dy6U0TSwjxw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
x-powered-by: PleskLin

Redirect headers

age: 724
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 718df85d4bdb9bd7-FRA
content-type: text/html; charset=iso-8859-1
date: Fri, 10 Jun 2022 00:25:30 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3cj5VS4ldvYQhl3oJrNgcrdLdTnZLv7Tbl7F3jvlfwub9tUFGQJvDk5UpXZ3Sf4Yf5gpbNp7qTEbhOEzfmTgVqAcxG9M2wxyuCXBWyCVB%2Bwx3QE9CiW%2BuZKFAGamqSzOz6cYNT7NYQDunA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
x-powered-by: PleskLin

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 2 KB
3 KB 46ms
13ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H3 200 popunder.gif
quiremuken.xyz/ 35 B
630 B 38ms
18ms Image
image/gif 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://quiremuken.xyz/popunder.gif
Requested by: Host: exey.io
URL: https://exey.io/MGv8V
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: public
date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
last-modified: Sat, 04 Jun 2022 01:00:12 GMT
server: cloudflare
age: 516318
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TwVzLWXNa1NmsN75seZi41FFjBleR34CGiQyLFqy0nTNOkACv%2FCoQcTDPvtRKde5wf1HWp2pWpF5XldhIb2MUH97UZY57Ryp7XTbHc4dGoxKLzvIoXD7WtjCPRJaR4qhVIg%2Fo020c%2B9P1hnrNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 718df85dabea902a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 rocket-loader.min.js Show response
www.papayads.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ Frame E10A 12 KB
4 KB 25ms
11ms Script
application/javascript 2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Jun 2022 16:41:14 GMT
server: cloudflare
etag: W/"629796aa-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BhqWsw6KzNSnrtnKMlhvMCAC7Kzw5kOvAMo3hi4Vdm3NFVCSB%2BhIJKOaZgQArQivSribAyXnCLUfJ3iQZncvs5Kowg2nLOTfFmKZNZJaQDoBoXHEtCqAQ7gvSToHho6%2FxCm9d%2FdD9j6Exhv7C%2F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 718df85dedd79122-FRA
vary: Accept-Encoding
expires: Sun, 12 Jun 2022 00:25:30 GMT

GET
H3

200

adtags.js Show response
www.papayads.net/self/clnt/1085-1498/ Frame E10A
Redirect Chain

https://papayads.net/self/clnt/1085-1498/adtags.js
https://www.papayads.net/self/clnt/1085-1498/adtags.js

35 KB
6 KB

16ms
15ms

Script
application/javascript

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

21c5692146f12e93a87bf5f05ba3f8b39267bba0c9b9595601f6ba5c52279b94

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2668
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 06 Jun 2022 15:34:21 GMT
server: cloudflare
etag: W/"629e1e7d-b62b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5L2mxSqteSIbF5AV3%2BfvvgTrHnWLFF97S%2B8UrPmNegMTqyIvYrZ%2FVKmnRQ1IisHX7PvwnfPcD6EU%2BzV9EoiCxcetv4X5RT3RJpaNMijCdbkhWaPGTfJ%2FNA79AHi94bk2%2BZVzaSR80PTOpzSyPwU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-polished: origSize=46635
cf-ray: 718df85e3e289122-FRA
cf-bgj: minify

Redirect headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 761
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=73IfPA2LiQnzj3rBTUqTjJYP0fgwypYobwMPv4X14ufDnnhVtMvDu3AsltfY25HrDjRVLw%2FseTIx%2BtOLY7OGMumMLFkcZYQ8pjBjbYFhD5tahvAQ4ssJPXfiO9DcemQUAPokzYu%2FwbbIsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: https://www.papayads.net/self/clnt/1085-1498/adtags.js
cache-control: max-age=14400
strict-transport-security: max-age=15768000; includeSubDomains
cf-ray: 718df85e1df69122-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 41gmab2cQqZR_4rAhmu-D1Umyq9ooUsAR0b7zEUHkbpY45iGdetmo4V8Ht-F8ZZGby43QE2UIQHpOBfYJ5taI1bcc5yR4Tau3TLCVBgb4CqOL8MrcNGmNP48gq4YYl61wBPGF9HDd5sIJ4JAoyYUcko8WE3l1ZOsM8_mTDwjhEkLtqw4dmp5Pz3ZSf5UpXo5VBUKQ...
forfrogadiertor.com/impression/ 43 B
420 B 15ms
14ms Image
image/gif 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forfrogadiertor.com/impression/41gmab2cQqZR_4rAhmu-D1Umyq9ooUsAR0b7zEUHkbpY45iGdetmo4V8Ht-F8ZZGby43QE2UIQHpOBfYJ5taI1bcc5yR4Tau3TLCVBgb4CqOL8MrcNGmNP48gq4YYl61wBPGF9HDd5sIJ4JAoyYUcko8WE3l1ZOsM8_mTDwjhEkLtqw4dmp5Pz3ZSf5UpXo5VBUKQIlUg6ieAL8nzgAgIerBLrHiHJyLiScHjJLoucyn7KMgUtXbcDt5PRTJXUSiLlhOrpgnV9u4FHc0lp18BFpqIbNVEomHBd8qpz_SQtHcFCuA_3IunuI8IWPZv2S1vxJM30Kltr0psXuxPTnxr-uqJqHw2rEVJF70lBW0OgZ_qL-TdzSXvNDKmUYJhoziaefc9X98E_-5KMO2aab_p6dj9OHU8fO1kGNpXGYE-CNa5ECIGZVdg7Za2mDfju9sfQeL3qQRDIvTuIAi9A0adxnmHmvXGuu_wAZlqEcRM_JFvAOgtAdVnj-XrCTM8wbGYW90uqLi7uKl29Xmto0ezwPjEyUZ_R4pMAuK7iE9qKIU2q8LPR6l2Anb4Q_-BqEdxmpmQyF1OeGm8H808NK7FcorORr-9GQCMM8vWWHclT6uysFfVaVzw0uamKhN_-9UwL4_S7CtKXCCcP3-8q2FcLwuxvgZgi6H9tuZuFQtFYW23vK8ys83WiBcaQ9XOHnyBF6YvqwYK5EW5dhs?_z=3230648&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=2&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-trace-id: e1995b2dcf4ac349c4cbee4ae2502830
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
content-length: 43
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H3 200 adtags-if-300x250.html Show response
www.papayads.net/self/clnt/1085-1498/ Frame E10A 2 KB
1 KB 27ms
27ms Document
text/html 2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10

Requested by

Host: papayads.net
URL: https://papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

02ce823108d66ac8435ea693a3c84a54d44579e1adc504518de16a0dc6d0ff32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1526
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 718df85e5e459122-FRA
content-encoding: br
content-type: text/html
date: Fri, 10 Jun 2022 00:25:30 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Mon, 04 Apr 2022 14:44:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VZ3s3zwPAiV3Idj8R9bACGUDsq698BHf3WK1H505EVENQs0ZCpB5CW%2BZslZuDoX513UagP1tgLCimACGpU3mqNyr5J072kDUd4Jp8yHQ45kG%2BO04yKIQuJOxiBNhwObD2Onclrssn8Klr6I0bu4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
x-powered-by: PleskLin

GET
H3 200 rocket-loader.min.js Show response
www.papayads.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ Frame E10A 12 KB
4 KB 10ms
10ms Script
application/javascript 2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Jun 2022 16:41:14 GMT
server: cloudflare
etag: W/"629796aa-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0hVIXOQ%2FkwkaEYwxJwGtAjexlZIv4kOhoYZdlMoLYqj9lLP7Bx9%2BKWoZfrQ8YD%2BmvOYoIYRIbALjBcasECvensFJbvZQPZGTknd4V4tD1qINXiRscx34EiBbe6hQR4foHUn5ZHkkKmU2PmLkOKM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 718df85e9e709122-FRA
vary: Accept-Encoding
expires: Sun, 12 Jun 2022 00:25:30 GMT

GET
H3

200

adtags.js Show response
www.papayads.net/self/clnt/1085-1498/ Frame E10A
Redirect Chain

https://papayads.net/self/clnt/1085-1498/adtags.js
https://www.papayads.net/self/clnt/1085-1498/adtags.js

35 KB
6 KB

17ms
17ms

Script
application/javascript

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

21c5692146f12e93a87bf5f05ba3f8b39267bba0c9b9595601f6ba5c52279b94

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2668
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 06 Jun 2022 15:34:21 GMT
server: cloudflare
etag: W/"629e1e7d-b62b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QU4i1v7OXv1BqXEvUHeMZ0sovhreyRqKNf0McXyKZaPOBBLeB1S2BVUpT79hFM2bY4gE2TUk6Qicpa9rLtSBDJ2D5BHGtWaeSSxkvAC6OrznQfZ2JgykjIec8wzWBQmCcLlzFU%2F4pPeGNzia8oo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-polished: origSize=46635
cf-ray: 718df85f1eee9122-FRA
cf-bgj: minify

Redirect headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 761
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MWZ5Om2sMSAHhbdr0BoLnx1UFctw2hIw1cPepkxkdX8YsfFVbhbZNTkEywZugUZWp79TlrM74sVBfQvlhXZtPA3myZgrkvdFa%2Fx%2FbcUEqoe%2F2NCgWxxzVkvFSz1dNm8RxL%2BztExfSX1rZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: https://www.papayads.net/self/clnt/1085-1498/adtags.js
cache-control: max-age=14400
strict-transport-security: max-age=15768000; includeSubDomains
cf-ray: 718df85ebe8c9122-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 0
0

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ Frame E6B5 2 KB
3 KB 18ms
17ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H3

200

adtags.js Show response
www.papayads.net/self/clnt/1085-1498/ Frame E10A
Redirect Chain

https://papayads.net/self/clnt/1085-1498/adtags.js
https://www.papayads.net/self/clnt/1085-1498/adtags.js

35 KB
6 KB

17ms
17ms

Script
application/javascript

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

21c5692146f12e93a87bf5f05ba3f8b39267bba0c9b9595601f6ba5c52279b94

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2668
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 06 Jun 2022 15:34:21 GMT
server: cloudflare
etag: W/"629e1e7d-b62b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fGIIv9In2RMdscNXW6ubvIFRWdyaTHlil4RIBEf3vZclZMGUQ6Bu7Ww6BLCkodJOyxUin1zZjve881zy0k7llgpll5EwsNoSW7IE7k5eVxRqN7ynOr1ItKRCCzcu6ng8ILLE6IOMCJ1tEd%2B4p8s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-polished: origSize=46635
cf-ray: 718df85f5f339122-FRA
cf-bgj: minify

Redirect headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 761
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mvE6ZDFyXwdKgBJugF65VQeuFckNXWgTgS7w4Q2qFBEJsOX7BCuT9UuZkV4vjA2DkaccH4EescMdrM7KM0OSrRCQsd5vQ3jg7BICvvJ%2F6ixE%2FRZGzm1dVKMeqGlCKwZkIw82%2B5TJ8Q0FjA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: https://www.papayads.net/self/clnt/1085-1498/adtags.js
cache-control: max-age=14400
strict-transport-security: max-age=15768000; includeSubDomains
cf-ray: 718df85f3f0c9122-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

adtags.css
www.papayads.net/self/common/ Frame E10A
Redirect Chain

https://papayads.net/self/common/adtags.css
https://www.papayads.net/self/common/adtags.css

911 B
1004 B

14ms
13ms

Stylesheet
text/css

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/common/adtags.css

Protocol

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

4b97ae0fa0dd0b1fef8a2bdc76c592809f356e157aead67c3358adc416d8a8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1117
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 18 May 2022 12:39:43 GMT
server: cloudflare
etag: W/"6284e90f-512"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2BzxKenAYy3IOa%2FsIBQzpCAGqjyvIS7c3ydTsuOhSZQAHe8kCLmnBm6RPFl1XzdSYKcV%2F1DGiQ9TKyrOWi4Le8oSXHuubKpPEjPDqs0wLb2VKh21pslSiXCDa19uKH953c3IAyfzl9etmBNPC2U%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-polished: origSize=1298
cf-ray: 718df85f5f309122-FRA
cf-bgj: minify

Redirect headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 449
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=im6Piy8II8ao1MTHixit5emeABKFvnHHDAw1yYGgNSjVSdvWJTyqtA4QcLoU9aJlXp5QD6OgLhajb%2B3ualovITw%2Fj9oGMVDd1Iibpe7dZShZkGAPy%2BXi5AzhPQ0xpYZchH5jtIv%2B%2BMfH2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: https://www.papayads.net/self/common/adtags.css
cache-control: max-age=14400
strict-transport-security: max-age=15768000; includeSubDomains
cf-ray: 718df85f3f0f9122-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

adtagswhitelabel.css
www.papayads.net/self/common/ Frame E10A
Redirect Chain

https://papayads.net/self/common/adtagswhitelabel.css
https://www.papayads.net/self/common/adtagswhitelabel.css

128 B
716 B

13ms
12ms

Stylesheet
text/css

2606:4700:20::681a:c1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.papayads.net/self/common/adtagswhitelabel.css

Protocol

Server

2606:4700:20::681a:c1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e1aacb60d9b556cb78677f24e09d16a841e2a8aa469ee928374ed8d16bd510e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1088
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 17 Jan 2022 22:56:13 GMT
server: cloudflare
etag: W/"a5-5d5cf0f320259-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JCD%2BMTTRiS%2F0IjjoJqyMCng1ijjRDd3xJAgjFL8hlDdDtfrjFohcoEE8ELUf5GbudEC1vMV8t%2FqtsBnDea7ltdKE6QUrHA5CWz9tHIzf9cVQYaJAXe92GT2egazdAWZhGUB93hShQ1%2BMqfVHffc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=14400
cf-polished: origSize=165
cf-ray: 718df85f5f329122-FRA
cf-bgj: minify

Redirect headers

date: Fri, 10 Jun 2022 00:25:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 335
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=addlBYqeilCVRqmNBDpksE4PBR4ugrm6Zzw6xgeVIGieGqblNphnaRLFCk%2BXPGHfHfDMkHVPM2ltk9vKojBYkrLtEHUs8DOFYQSc%2FEHUq4iJvi7DR0DNr3uEVX%2BREZvqlFD5eQtRSynuTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
location: https://www.papayads.net/self/common/adtagswhitelabel.css
cache-control: max-age=14400
strict-transport-security: max-age=15768000; includeSubDomains
cf-ray: 718df85f3f119122-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 hb_313926_14641.js Show response
player.adtcdn.com/prebidlink/459672/ Frame E10A 330 KB
99 KB 52ms
23ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Requested by: Host: papayads.net
URL: https://papayads.net/self/clnt/1085-1498/adtags.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 539e3c40ac0165fa975069e323156919287a424d5deb3ede2a43dbba33253144

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 556
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 May 2022 11:35:32 GMT
server: cloudflare
etag: W/"6290b784-5263d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YK66Y2%2B9RAU1pKg1vw4nB%2FAHrMmp0q7ZGJ5gsNT9ttV%2F1tDWNbfD38BT6dyKP17f3oYtuTH3fsKAK8hG6kb8vdDVr3jWuM4b4b168I7tdoL186PngupEZROSq7QeXUzrAc7AWGfqUidEpH6EEhz2Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=345600
cf-ray: 718df85f69295bf5-FRA
expires: Fri, 10 Jun 2022 00:31:14 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame E10A 82 KB
28 KB 46ms
22ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: papayads.net
URL: https://papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

b3bdd131a95066c8eb345afd484b230830445504a2941191cd5d69df245102a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28144
x-xss-protection: 0
server: sffe
etag: "1240 / 688 of 1000 / last-modified: 1654812564"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 10 Jun 2022 00:25:30 GMT

GET
H2 200 wrapper_hb_313926_14641.js Show response
player.adtcdn.com/prebidlink/459672/ Frame E10A 787 B
1 KB 44ms
16ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtcdn.com/prebidlink/459672/wrapper_hb_313926_14641.js
Requested by: Host: papayads.net
URL: https://papayads.net/self/clnt/1085-1498/adtags.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b4677e407b6f2c413f8400df6029f0a1073897c80c360151f040915743c6832

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 556
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 09 Jun 2022 10:27:04 GMT
server: cloudflare
etag: W/"62a1caf8-313"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A7ObHdDLkErmmtgOAGVESgo%2B1BOFDgBEl6enc6bN7as907kOyM5fKK2DtOdssGFThOJD4wiD1rRvmIkBmfEmoAMsQW4Osct%2BfxmiWYK4pOydZnbG0OwiOjIs7kadukNCxtdGE79FuUcg31BfdzLdQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=345600
cf-ray: 718df85f692a5bf5-FRA
expires: Fri, 10 Jun 2022 00:31:14 GMT

GET
H2 200 js Show response
googletagmanager.com/gtag/ Frame E10A 191 KB
69 KB 66ms
22ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googletagmanager.com/gtag/js?id=G-5ZGTXRNT8J

Requested by

Host: papayads.net
URL: https://papayads.net/self/clnt/1085-1498/adtags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ffb4d706890118c7163dbe02aa3b7a26b5b8064a2cfe559e0229d000b6b95577

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69981
x-xss-protection: 0
expires: Fri, 10 Jun 2022 00:25:30 GMT

GET
H2 200 3230648 Show response
forfrogadiertor.com/500/ 4 KB
3 KB 122ms
120ms XHR
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://forfrogadiertor.com/500/3230648?excludes=13057094&oaid=73d0ca7221db441f9dddd5cbd696da0b&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=3&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Requested by

Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

1c1ba90d5f667f3f6e2215f0b4257e38591e1dbc74174db0432e1fd824db4cdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://exey.io/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: cd745ac2a774f1f2f7cec7d3a7276407
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://exey.io
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

OPTIONS
H2 200 3230648
forfrogadiertor.com/500/ Frame 0
0 13ms
13ms Preflight 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://exey.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://exey.io
access-control-max-age: 600
allow: GET, OPTIONS
content-length: 0
date: Fri, 10 Jun 2022 00:25:30 GMT
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: *
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options: nosniff

GET
H2 200 hbw_master_313926_14641.js Show response
player.adtelligent.com/prebidlink/459672/ Frame E10A 128 KB
29 KB 143ms
7ms Script
application/javascript 45.133.44.3
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/prebidlink/459672/hbw_master_313926_14641.js
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/wrapper_hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: 0a54a1ed8b270bcc48ed36fb9000e51a6cc9ce5f8267d0a89b7dc3d7d2a64c67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 18:00:28 GMT
server: nginx
etag: W/"62a0e3bc-1ff2b"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sun, 12 Jun 2022 00:25:30 GMT
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H3 200 pubads_impl_2022060701.js Show response
securepubads.g.doubleclick.net/gpt/ Frame E10A 368 KB
125 KB 25ms
7ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

72ec618723da6d0be7eeda72a1842f3b6925229960b5b31aa54f38b10041dda7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 08 Jun 2022 10:47:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127778
x-xss-protection: 0
last-modified: Tue, 07 Jun 2022 08:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 08 Jun 2023 10:47:14 GMT

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 2 KB
3 KB 13ms
13ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:30 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H2 200 config.json Show response
player.adtelligent.com/exchange_rates/313925/ Frame E10A 6 KB
3 KB 22ms
7ms XHR
application/json 45.133.44.3
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/exchange_rates/313925/config.json?cb=https%3A%2F%2Fexey.io
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: 4b0815fb4b7b0a9ecb3d4bf032fdb09bd056580112d6c8668e816247ee379664

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 10 Jun 2022 00:25:31 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 12:01:15 GMT
server: nginx
etag: W/"62a08f8b-19a5"
content-type: application/json
access-control-allow-origin: https://www.papayads.net
expires: Sun, 12 Jun 2022 00:25:31 GMT
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H/1.1 200
OK / Show response
ghb.adtelligent.com/geo/ Frame E10A 156 B
428 B 18ms
17ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/geo/
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/459672/hbw_master_313926_14641.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: a2e8f8ea5793d7994d9382ab663fa213e81a2b7ba1dff4665aec7d3d2dffc91c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 00:25:30 GMT
Server: Adtelligent
Content-Type: application/json
Access-Control-Allow-Origin: https://www.papayads.net
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 156

GET
H/1.1 200
OK tracking Show response
ghb.adtelligent.com/adunit/ Frame E10A 43 B
433 B 54ms
18ms XHR
image/gif 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/adunit/tracking?event=11&type=0&client_id=313926&site_id=14641&full_page_url=https%3A%2F%2Fexey.io&adid=7pjbz1.r6&features=16416&vpbv=N061&lifecycle_tte=374
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/459672/hbw_master_313926_14641.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 00:25:30 GMT
Server: Adtelligent
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.papayads.net
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 43

GET
H2 200 085nEV9cEk5I0dC4Sv-hDosTpDscz68FJk4RpdtZ6e3bp2pTdGOyk1J6DcHIjM9kFGebiOzoi5h7gFdTuT34hY1r3SRZOGFWPFjJHpVz9CTq-31n741L_MwrCDxOUShfOUt6_Etv4Fglt5FhnUOcwhvPejSkeoNa9yQr6L7Pd91fZNk9yEyHrkylg9KkM6ZG6NPj-...
forfrogadiertor.com/impression/ 43 B
421 B 15ms
15ms Image
image/gif 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forfrogadiertor.com/impression/085nEV9cEk5I0dC4Sv-hDosTpDscz68FJk4RpdtZ6e3bp2pTdGOyk1J6DcHIjM9kFGebiOzoi5h7gFdTuT34hY1r3SRZOGFWPFjJHpVz9CTq-31n741L_MwrCDxOUShfOUt6_Etv4Fglt5FhnUOcwhvPejSkeoNa9yQr6L7Pd91fZNk9yEyHrkylg9KkM6ZG6NPj-t7nl5wrJ_fmlOZUJC1Yrnv-uA5NnzM1FOIb1comgTmDhtJyHr9lLXxfSjrfqi4BlYafDJApPV06NjEk6vhDXS_XDajGsxl2lqfoP8ZjqujIIEzzrCvAE-Q2YCGF1pK635b9HffH2NwbuLj8RsgCMVlKL6bQaMu9qjom7Fb2DlgoHmIE_02HCKyNog-YyJHHiwYiGV87zQ171ceXWR2YmP_NDCPZawYxI6LDTxM02Pyh6AGDwhwR8Ka-fyMyw3y5BfE_e5qtsB2tIGDZvuSeSDl1Iu6K9m85LAX6b1vRwkKCirbEmC7NM5WgbQrTVXqV_wKtaa8j8GZ3FJ-7wSLq7JRdRlaPzOU_v9xkl0uFdh1YJ7HCPXUEZaF92FJGrdYCXLQ4YpzbK9UlLuTegkUqcWqBZHVt0qXtF5PIP8ie1s_lxJfCQvHSflS3btkZGvbQidw61Fqmeb89hKYeW7hjArevoNf_nB8V1KMN5FpMtpXMJLlNfW03Ak7jXVBUnTu17rh0TBrZdo-fBzausg==?_z=3230648&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=3&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-trace-id: f849bcc4d0747ffe09d41c82ccf72f94
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:31 GMT
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
content-length: 43
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2

200

ROS Show response
pbjs.e-planning.net/hb/1/2e43c/1/www.papayads.net/ Frame E10A
Redirect Chain

https://pbjs.e-planning.net/pbjs/1/2e43c/1/www.papayads.net/ROS?rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&pbv...
https://pbjs.e-planning.net/hb/1/2e43c/1/www.papayads.net/ROS?ct=1&r=pbjs&rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x25...

376 B
793 B

15ms
15ms

XHR
application/json

5.178.65.246
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbjs.e-planning.net/hb/1/2e43c/1/www.papayads.net/ROS?ct=1&r=pbjs&rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&pbv=6.7.0-pre&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&e_pubcid=dff9f0a9-f8bf-42a5-98f3-c8f119d20d3c
Protocol: H2
Server: 5.178.65.246 Amsterdam, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 93e1c6c3060d40eb0fea1c933a2860460780228ef5522b735e745878c7eeba28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:31 GMT
server: openresty
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-allow-origin: https://www.papayads.net
expires: Fri, 10 Jun 2022 00:25:31 GMT
cache-control: max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 376
x-sid: AMS-607

Redirect headers

date: Fri, 10 Jun 2022 00:25:31 GMT
server: openresty
access-control-allow-origin: https://www.papayads.net
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /hb/1/2e43c/1/www.papayads.net/ROS?ct=1&r=pbjs&rnd=0.7437237730789374&e=300x250_0%3A300x250&ur=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&pbv=6.7.0-pre&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&e_pubcid=dff9f0a9-f8bf-42a5-98f3-c8f119d20d3c
access-control-allow-credentials: true
content-type: text/html; charset=iso-8859-1
x-sid: AMS-607

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame E10A 0
218 B 224ms
13ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.7.0-pre&cb=92095231202

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

bidder.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 10 Jun 2022 00:25:31 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://www.papayads.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 204 c Show response
prebid.a-mo.net/a/ Frame E10A 0
299 B 275ms
234ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.papayads.net
date: Fri, 10 Jun 2022 00:25:31 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 220
vary: origin, Accept-Encoding

GET
H2 200 arj Show response
adsparc-d.openx.net/w/1.0/ Frame E10A 73 B
380 B 80ms
25ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adsparc-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=undefined&be=1&bc=hb_pb_3.0.3&dddid=2dcb8dec-4a60-483d-a4e2-4882b6ce715f&nocache=1654820731805&pubcid=dff9f0a9-f8bf-42a5-98f3-c8f119d20d3c&schain=1.0%2C1!papayads.net%2C313926%2C1%2C%2C%2C&aus=300x250&divids=div-gpt-ad-1619368991731-0&aucs=%252F22377623070%252F1085-1498_PapayAds_Square_1%2523div-gpt-ad-1619368991731-0
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 7a8059b8f987d28469aa3eb205c0fe575c6e6effea9816c9d6713c5103e774f8

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:31 GMT
content-encoding: gzip
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.papayads.net
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ Frame E10A 0
443 B 114ms
75ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.papayads.net
date: Fri, 10 Jun 2022 00:25:31 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 60
vary: origin, Accept-Encoding

POST
H2 200 adreq Show response
ads.servenobid.com/ Frame E10A 607 B
649 B 105ms
33ms XHR
application/json 52.31.92.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=7090
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.92.156 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-92-156.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a79035f23f714ef7093e5fea8bf910e3ca77ccdbdef4aeb4ae33606ce172ea42

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 10 Jun 2022 00:25:31 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.papayads.net
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 500 adapter Show response
useast.quantumdex.io/auction/ Frame E10A 0
403 B 159ms
131ms XHR
text/plain 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/adapter
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 10 Jun 2022 00:25:31 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, GET
access-control-allow-origin: https://www.papayads.net
x-reason: [Inventory] site.domain not match RootDomain, papayads.net != exey.io
access-control-allow-credentials: true
cf-ray: 718df865fa436957-FRA
content-length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E10A 19 B
704 B 32ms
10ms XHR
application/json 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 10 Jun 2022 00:25:31 GMT
X-Proxy-Origin: 81.95.5.37; 81.95.5.37; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4c7424cf-8d77-46e1-a64b-9a04b9fe74d6
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.papayads.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content hb Show response
cpm.unibots.in/ Frame E10A 0
263 B 175ms
13ms XHR
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://cpm.unibots.in/hb?zone=154227&v=1.6
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 10 Jun 2022 00:25:31 GMT
Server: nginx
Age: 0
Access-Control-Allow-Origin: https://www.papayads.net
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame E10A 0
178 B 48ms
14ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.papayads.net
date: Fri, 10 Jun 2022 00:25:31 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST /
prebid.smilewanted.com/ Frame E10A 0
0

POST
H/1.1 204
No Content / Show response
b1h.zemanta.com/api/bidder/prebid/bid/ Frame E10A 0
122 B 427ms
102ms XHR
text/plain 50.31.142.31
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://b1h.zemanta.com/api/bidder/prebid/bid/
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.31 Lombard, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.papayads.net
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E10A 19 B
704 B 27ms
9ms XHR
application/json 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 10 Jun 2022 00:25:31 GMT
X-Proxy-Origin: 81.95.5.37; 81.95.5.37; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ac1b9014-7420-4927-8bbb-688715aab4bb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.papayads.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 3230648 Show response
forfrogadiertor.com/500/ 5 KB
3 KB 162ms
161ms XHR
application/javascript 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://forfrogadiertor.com/500/3230648?excludes=13057094,13044766&oaid=73d0ca7221db441f9dddd5cbd696da0b&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=3&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Requested by

Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

855d23e3cb1cc14e80b5a46443afceb7588f289706c53c5427bb00d0ad643310

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://exey.io/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: 5fd807020e820686224f9cf5cfc38ec0
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://exey.io
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
expires: Tue, 11 Jan 1994 10:00:00 GMT

OPTIONS
H2 200 3230648
forfrogadiertor.com/500/ Frame 0
0 13ms
13ms Preflight 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://exey.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://exey.io
access-control-max-age: 600
allow: GET, OPTIONS
content-length: 0
date: Fri, 10 Jun 2022 00:25:31 GMT
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: *
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options: nosniff

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 2 KB
3 KB 14ms
13ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:32 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 0
0

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ Frame E6B5 2 KB
3 KB 16ms
15ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:32 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame E10A 107 B
792 B 42ms
17ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.papayads.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame E10A 107 B
549 B 65ms
27ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.papayads.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame E10A 49 KB
12 KB 294ms
294ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1368771846435611&correlator=695875653979735&eid=31067967%2C31065401%2C31067488&output=ldjh&gdfp_req=1&vrg=2022060701&ptt=17&impl=fifs&iu_parts=22377623070%2C1085-1498_PapayAds_Square_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=3124569436&sfv=1-0-38&ecs=20220610&fsapi=false&prev_scp=test%3Drefresh%26hb_rfBid%3D0%26excl_cat%3DPREPOST&eri=1&sc=1&cdm=www.papayads.net&abxe=1&dt=1654820732271&lmt=1649083484&dlt=1654820730648&idt=310&biw=-12245933&bih=-12245933&isw=300&ish=250&adxs=0&adys=0&ucis=sqmowyf6f7sl&oid=2&u_his=4&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&nhd=1&url=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html%3F2022-06-10&ref=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&top=https%3A%2F%2Fwww.papayads.net%2Fself%2Fclnt%2F1085-1498%2Fadtags-if-300x250.html&frm=8&vis=1&scr_x=-12245933&scr_y=-12245933&psz=300x-1&msz=300x-1&fws=256&ohw=0&ea=0&ga_vid=971029878.1654820732&ga_sid=1654820732&ga_hid=1064755194&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

7ec2484397040de4e115d513248b25c938aebb57317a2e3f64976591a30cf79a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11810
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.papayads.net
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E10A 14 KB
11 KB 51ms
21ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022060701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5724f4a2a77e270f005ee3f59b9ac1b345f69cd4d08707e40aa527671b50ad1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10747
x-xss-protection: 0

GET
H2 200 container.html Show response
6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F8D0 6 KB
4 KB 88ms
16ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.papayads.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jun 2022 00:25:32 GMT
expires: Sat, 10 Jun 2023 00:25:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame E10A 17 KB
7 KB 58ms
28ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 10 Jun 2022 00:25:32 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9936 13 KB
5 KB 28ms
8ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.papayads.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 12890
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jun 2022 20:50:42 GMT
expires: Fri, 09 Jun 2023 20:50:42 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7673 783 B
1 KB 56ms
18ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

da411ea0e6634bbd0b21cdbe9f4112358c2c525fc93cf63a9ad82fda3406a4d9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HVNFfhT64c5R9CGPD8ohMQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.papayads.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-HVNFfhT64c5R9CGPD8ohMQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jun 2022 00:25:32 GMT
expires: Fri, 10 Jun 2022 00:25:32 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 0A402iRY5hLk7vfRuKaxnQONXP61muIeBT4Iz070aFY.js Show response
pagead2.googlesyndication.com/bg/ Frame 9936 36 KB
14 KB 30ms
9ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0A402iRY5hLk7vfRuKaxnQONXP61muIeBT4Iz070aFY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e34da2458e612e4eef7d1b8a6b19d038d5cfeb59ae21e053e08cf4ef46856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 12:34:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42654
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 09 Jun 2023 12:34:38 GMT

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 7673 0
0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9936 0
9 B 7ms
7ms Image
text/plain 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?TjJvYw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012205232225000/ Frame E10A 220 KB
60 KB 71ms
18ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205232225000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3f58f3312c76a6f539c52aec847073a1006d926523a05488196a4cbbd65a65e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 289588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61365
x-xss-protection: 0
server: sffe
date: Mon, 06 Jun 2022 15:59:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4579876533dc4005"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Jun 2023 15:59:04 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012205232225000/v0/ Frame E10A 14 KB
6 KB 64ms
12ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205232225000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0adf1237c7f4225da0d9caa843c47f93486794e415e4db68a59df3a689041334

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 289588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5185
x-xss-protection: 0
server: sffe
date: Mon, 06 Jun 2022 15:59:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e8b03820359a38cb"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Jun 2023 15:59:04 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012205232225000/v0/ Frame E10A 94 KB
28 KB 82ms
30ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205232225000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7c9452fde41ea8c1edaeaac061cdbc3e61c14ad4fd3eb1ebb08fd4c2a1b5796

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 289588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28839
x-xss-protection: 0
server: sffe
date: Mon, 06 Jun 2022 15:59:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fea41acf0887ba56"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Jun 2023 15:59:04 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012205232225000/v0/ Frame E10A 5 KB
2 KB 67ms
16ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205232225000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04b9c4e75a95191d5d055f6a0b43ecabbe26a8c0c804e7fbb88b4a7f02d1de1e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 289588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1905
x-xss-protection: 0
server: sffe
date: Mon, 06 Jun 2022 15:59:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "544a564eb1dfeb4f"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Jun 2023 15:59:04 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012205232225000/v0/ Frame E10A 40 KB
13 KB 79ms
27ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205232225000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66adaa239f3adfca9c0b4dff99152181b29fd61b12cdc990dea1c6f98a3692a4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 289588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12947
x-xss-protection: 0
server: sffe
date: Mon, 06 Jun 2022 15:59:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "52c760a2cdc81e95"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Jun 2023 15:59:04 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E10A 4 KB
621 B 33ms
17ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060701.js?cb=31067967

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 09 Jun 2022 23:32:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 10 Jun 2022 00:25:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Jun 2022 00:25:32 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E10A 2 KB
2 KB 9ms
9ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 09:41:38 GMT
x-content-type-options: nosniff
server: cafe
age: 53034
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 10 Jun 2022 09:41:38 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E10A 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 09:53:05 GMT
x-content-type-options: nosniff
server: cafe
age: 52347
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 10 Jun 2022 09:53:05 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E10A 0
0 55ms
55ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CJKL7fI-iYuqYE4P33gOMvLCYB-iqy4dq7d25sOoP6fXmiM8uEAEgntHtf2CVgoCAmAegAc2Fk_MCyAEJ4AIAqAMByAMKqgSHAk_QIHBZEiDqp85WgEDQhEZvu3Z4Fqk2e7Ahu_1XDk1y5PYH7DFU4ZJYfelRQM_QFUX1fqrxjhTyGCmYMoq-9JBiZ70FzIZEIhYk3idcVdzBffJlh3piFrDB1VWBg-O2YjxCdtqKbPw8driUAx42zXslF1U6xQh1sBeHcXk5MDvww_jCaxJUHtLaycs6h_0Lk0B_-RDMuOGEPd007gRUW8-44xxp9u-oZsLMo0z11MUqf86NVxHyLTWj6qN2QtWameT0PzV6Gw2gCzFXeE3L1LvYaxNiffIjIgXPVAN6eYZby2DZLRPyRV_80HEkWNAuJMe1IHSqe4LkaL5M18zSkyQuJ-3uaFG-wATn8ufv8wPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHxaKsmQOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCc_QPSCAkIgOGAEBABGB2ACgHICwG4E4gn2BMM0BUBgBcBshceChwIABIUcHViLTQ2MjE5NjYxOTczMDE3MDMY9pB7&sigh=dpPK_yXn0Jc&uach_m=[UACH]&template_id=5000
Requested by: Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/9165483673565732779/ Frame E10A 16 KB
16 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9165483673565732779/downsize_200k_v1?w=400&h=209

Requested by

Host: www.papayads.net
URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20e1b92fe795ce345fc3324656ffd15c06baeaf96d03630dc074a076446ee3da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 08 Jun 2022 21:46:47 GMT
x-content-type-options: nosniff
age: 95925
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15983
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 07:44:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 08 Jun 2023 21:46:47 GMT

GET
DATA 200
OK truncated
/ Frame E10A 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame E10A 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1468a5037c2f2d3702f0dccc800ce8756a34e2bc9485d385d79b3e8ede559c43

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame E10A 16 KB
16 KB 41ms
11ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.papayads.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 16:12:47 GMT
x-content-type-options: nosniff
age: 288765
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jun 2023 16:12:47 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame E10A 15 KB
15 KB 38ms
11ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.papayads.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 06 Jun 2022 11:07:47 GMT
x-content-type-options: nosniff
age: 307065
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jun 2023 11:07:47 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E10A 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012205232225000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 09:41:38 GMT
x-content-type-options: nosniff
server: cafe
age: 53034
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 10 Jun 2022 09:41:38 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E10A 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012205232225000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 09:53:05 GMT
x-content-type-options: nosniff
server: cafe
age: 52347
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 10 Jun 2022 09:53:05 GMT

POST
H/1.1 204
No Content multitracking Show response
ghb.adtelligent.com/adunit/ Frame E10A 0
227 B 19ms
18ms XHR
text/plain 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/adunit/multitracking
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/459672/hbw_master_313926_14641.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.papayads.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.papayads.net
Date: Fri, 10 Jun 2022 00:25:32 GMT
Access-Control-Allow-Credentials: true
Server: Adtelligent
Connection: Keep-Alive
X-Robots-Tag: noindex

GET
H2 200 VBlRoEraZsbdhxNIZipiZxok2C-5kM1jSr-2gi1tIz286NX2d7FjPVnrzUS8tdZ2nz2PXpf9TNqmyLge6mMBm5CCu3b0IZgq03Z1EinkbbbwWPegBjgwt_ua1hVcLkR-g-5PLEV-Mij_Um1oSWPR9QM__SOe5qJpzpoJeBzbHd0kOMQ_QhGIzClTBScCewOyNVy95...
forfrogadiertor.com/impression/ 43 B
421 B 42ms
41ms Image
image/gif 139.45.197.239
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forfrogadiertor.com/impression/VBlRoEraZsbdhxNIZipiZxok2C-5kM1jSr-2gi1tIz286NX2d7FjPVnrzUS8tdZ2nz2PXpf9TNqmyLge6mMBm5CCu3b0IZgq03Z1EinkbbbwWPegBjgwt_ua1hVcLkR-g-5PLEV-Mij_Um1oSWPR9QM__SOe5qJpzpoJeBzbHd0kOMQ_QhGIzClTBScCewOyNVy95fv32K-Axyv7zEgap1MLuio_2cpkWU6r6OhAZkbXngtg1bRe58_I-zYWnyqZkfFFb1N_PX9m9rKUYAfZuk2W938D_lAaawdItEntmrhfFSYLpBovyeuMYV6WfJcj6KEcd5VVBiLKOCZ4HeM78iYWyRql3w6L4fl_OxU8ayKp2rdSeND9EK2CQWRWUmd0KxpZgqOpb2JuYJbioLeTGF7vz2PbLIXZPcaQeiJCRDJ7nRK8DMg4FtmAPlZ1NtmwVeErLnnnI5nCTai6xbUm7Q1E3tMiCBoMJcnVk6wcegxWfrhGUk9N3fJqb5naRhAcX-in1g_cO9D6B4LROb8D2ABBz7ZnM4G8cOpdOBj4fcNF6anPS8PsMwdHIvcpswfvtrCfRVSF9rF_KTPV_1AhhraVVorT4Iwn_b_3_yN4-yBs1yu2oHm_UDA9A9P7dYD4H4mTI3YtUaRBn6Caa7QrEhlnsiLMEYcKyh4iBKvAmA8=?_z=3230648&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=3&pl=https%3A%2F%2Fexey.io%2FMGv8V&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://exey.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-trace-id: 2f2d65b85ba6f6fe034558a27e6b0392
pragma: no-cache
date: Fri, 10 Jun 2022 00:25:33 GMT
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *, *
content-length: 43
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ 0
0

GET
H2 200 01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/ Frame E6B5 2 KB
3 KB 16ms
15ms Image
image/png 139.45.197.153
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by: Host: forfrogadiertor.com
URL: https://forfrogadiertor.com/400/3230648
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.153 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 00:25:33 GMT
last-modified: Fri, 04 Feb 2022 11:13:41 GMT
server: nginx
etag: "61fd0a65-86d"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length: 2157

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E10A 42 B
64 B 43ms
42ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssdlDKgYnoCyWm_Helb8mgMu-FDyLfngYPlNCAlT5HUKJSPwVhri_97TXn5UPujr0BZcgVIwDiH7S_01-xOS_qSwxUulGaoc_5mwkGoPm8OimpLwHkyiO_MpG75&sai=AMfl-YQI0QTbxdfogQhTUuSssvVWitcqwHQ8zVTEeXRbm7ox5ZVGvOqODMywcaT84JXyYfiLySH7CUxVjUXX&sig=Cg0ArKJSzGQPl6HUcZ8JEAE&id=ampim&o=0,251&d=300,250&ss=1600,1200&bs=300,250&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=2138&tls=3138&g=100&h=100&tt=3138&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=3124569436

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.papayads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 00:25:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET publishertag.prebid.117.js
static.criteo.net/js/ld/ Frame E10A 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.cdnativepush.com
URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: static.cdnativepush.com
URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022060701&jk=1368771846435611&rc=

Domain: static.cdnativepush.com
URL: https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png

Domain: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Verdicts & Comments Add Verdict or Comment

67 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
exe.io/	1969-12-31 23:59:59	Name: AppSession Value: 07b0884be1b88b77037a52aea3bf4b81
exe.io/	1969-12-31 23:59:59	Name: csrfToken Value: 364d50d482972e962e860e5a933cafb3226c6a9663fcd02f944ad3f9860aae70d64e032b30a34f08eb957ba3b293661cf83e93dfa13b15b3298393f07be1402c
exey.io/	1969-12-31 23:59:59	Name: AppSession Value: b112efcaff9dbc9cb6e1519bfeb0f7ed
exey.io/	1969-12-31 23:59:59	Name: csrfToken Value: 4567d1312cac51fe0fd03d10f657d2d3fcd902b31504bab7496e620574b3f8ddc3e4c559d53f3b0a4708d3d1aa255c2df920c806c7275809da452113758bfb75
hematalmicast.com/	1970-01-20 03:41:47	Name: GL_UI4 Value: eJw9jd1OgzAcxYHy4TIhnoQH8BHaoW5cGh%2FCS1LoH9YN2qXUEd%2FexkSvzi%2FnIyeKoqSuEN9zBvYlX%2FHcvr1QI8ejaLgQgxhPnPqTUqqR8ti2grDTa%2BdlP5NP8TiRIaeHbrCKSjyF6M%2B5GruZFFnvpFElsiU05hJF7%2By2kqsZUiMXQv5xdjZotsiLdWCCHwJrEzjmSOxas2qH4lMbFYbVHongVZlH2N9m6Ufrlk6rPEY2OakI8TseBulpsu4bhaL16u0NsLPq%2Fvu%2Fv2wTHLmiux7CufVncj%2FEQ0rx
hematalmicast.com/	1970-01-20 03:41:47	Name: GL_GI10 Value: eJxNjNGKwjAURGuq0arrMrC%2FYWERUV%2BrxW%2FYpxDbawm7zQ1pFOvXW7cgvs2c4UwUReJrAWEcptvvdLdO1%2Blqg7gihjjkmBd8scG3yuqaMD6Sr7VtIT1Vhi1E9oNZn1XBJWF0yJdvrLcyfdXeaAwLE1pMcv%2BnbUUWybP33qzzXjw2jcPHnj0tM138ntgSEktBNY6oRNItjr0OhMWL%2Ft%2FIGBPTKOf51soBPoOp6d7Zis%2FnhoIUGFyleAAm3Ukr
freychang.fun/	1970-01-20 12:18:44	Name: csu Value: 1459833977160619@1@1654820729
.exey.io/	1970-01-20 21:11:32	Name: _ga Value: GA1.2.1415716945.1654820730
.exey.io/	1970-01-20 03:41:47	Name: _gid Value: GA1.2.722663787.1654820730
.exey.io/	1970-01-20 03:40:20	Name: _gat_gtag_UA_135952122_1 Value: 1
my.rtmark.net/	1970-01-20 12:25:56	Name: ID Value: 73d0ca7221db441f9dddd5cbd696da0b
forfrogadiertor.com/	1970-01-20 12:25:56	Name: OAID Value: 73d0ca7221db441f9dddd5cbd696da0b
pbjs.e-planning.net/	1969-12-31 23:59:59	Name: CT Value: 1
.e-planning.net/	1970-01-22 16:59:32	Name: E Value: ABsU54XXkKm678Cw
prebid.a-mo.net/	1970-01-20 12:25:56	Name: __amc Value: 1_1654820731_1654820731
.quantumdex.io/	1970-01-20 04:23:32	Name: uid Value: 91dea2cd-65dd-4727-adc8-05771b541629
.doubleclick.net/	1970-01-20 13:01:56	Name: IDE Value: AHWqTUkojQhxnqHpp8niM_7gPHkTggLaiwS2u9NR1QIVR-veV-mwh53vIYWSKkdc4ps

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.papayads.net/self/clnt/1085-1498/adtags-if-300x250.html?2022-06-10 Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://www.papayads.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://useast.quantumdex.io/auction/adapter Message: Failed to load resource: the server responded with a status of 500 ()
other	warning	URL: https://cdn.ampproject.org/rtv/012205232225000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
security	error	URL: https://player.adtcdn.com/prebidlink/459672/hb_313926_14641.js(Line 2) Message: Refused to load the script 'https://static.criteo.net/js/ld/publishertag.prebid.117.js' because it violates the following Content Security Policy directive: "script-src https://cdn.ampproject.org/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6f7bea1287b6d65489b33903004ca1f6.safeframe.googlesyndication.com
accounts.google.com
ads.servenobid.com
adservice.google.com
adservice.google.de
adsparc-d.openx.net
b1h.zemanta.com
bidder.criteo.com
cdn.ampproject.org
cesspervic.xyz
cpm.unibots.in
dba9ytko5p72r.cloudfront.net
exe.io
exey.io
fleraprt.com
fonts.googleapis.com
fonts.gstatic.com
forfrogadiertor.com
freychang.fun
ghb.adtelligent.com
googletagmanager.com
hematalmicast.com
ib.adnxs.com
my.rtmark.net
pagead2.googlesyndication.com
papayads.net
pbjs.e-planning.net
platform.pubfuture.com
player.adtcdn.com
player.adtelligent.com
prebid-eu.creativecdn.com
prebid.a-mo.net
prebid.smilewanted.com
quiremuken.xyz
securepubads.g.doubleclick.net
static.cdnativepush.com
static.criteo.net
tpc.googlesyndication.com
tzegilo.com
useast.quantumdex.io
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.papayads.net
pagead2.googlesyndication.com
prebid.smilewanted.com
static.cdnativepush.com
static.criteo.net
108.157.4.106
139.45.195.254
139.45.195.8
139.45.197.153
139.45.197.239
147.75.85.234
178.250.2.131
185.184.8.90
216.58.212.162
23.109.87.100
2600:9000:2156:d400:7:5c7d:44c0:21
2606:4700:10::6816:2460
2606:4700:20::681a:367
2606:4700:20::681a:837
2606:4700:20::681a:c1b
2606:4700:3030::ac43:dadd
2606:4700:3034::ac43:cdf0
2a00:1450:4001:801::2002
2a00:1450:4001:802::2001
2a00:1450:4001:808::2001
2a00:1450:4001:80b::2001
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::200d
2a00:1450:4001:810::2002
2a00:1450:4001:813::2003
2a00:1450:4001:827::2004
2a00:1450:4001:827::2008
2a00:1450:4001:828::200a
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2008
2a03:2880:f106:83:face:b00c:0:25de
2a06:98c1:3121::3
2a0c:5c81:5142::2
35.244.159.8
37.252.172.249
45.133.44.3
5.178.65.246
50.31.142.31
52.31.92.156
52.72.133.128
77.245.57.72
02ce823108d66ac8435ea693a3c84a54d44579e1adc504518de16a0dc6d0ff32
04b9c4e75a95191d5d055f6a0b43ecabbe26a8c0c804e7fbb88b4a7f02d1de1e
07b8bea7c13dcd6101fdf6fed66eede54ff26ffce89c289fe00e4715c7a0b9c6
0a54a1ed8b270bcc48ed36fb9000e51a6cc9ce5f8267d0a89b7dc3d7d2a64c67
0adf1237c7f4225da0d9caa843c47f93486794e415e4db68a59df3a689041334
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
1468a5037c2f2d3702f0dccc800ce8756a34e2bc9485d385d79b3e8ede559c43
1c1ba90d5f667f3f6e2215f0b4257e38591e1dbc74174db0432e1fd824db4cdb
20e1b92fe795ce345fc3324656ffd15c06baeaf96d03630dc074a076446ee3da
21c5692146f12e93a87bf5f05ba3f8b39267bba0c9b9595601f6ba5c52279b94
26bbadf324d400b12bea32f232b42870889357c483db6c1c4b1baa0202a41539
2a5dd8dcb735a8372426a2424f672e5c4f03c4ee0d1243a7fc297e1211a64713
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30d98422155fdef5cd5cecc1f6377840812facdcee2c3ae7dd12df8ae0c6bae1
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3676e16a1358628756bda4274db53b7a9f299e3dfa82ec22301c83ba142ad774
390bffee1e815045bca580de43eb308af5dcda27d562d86d2ba60728c0c24d96
40273eeb294d7f317bee26de5fb1ea94ab7e9c99f72f818399564c5c888955f4
46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2
4a1d4d06cefd96b2a94b54e21240a9d92ed493c9c13aacd786d5968b43554c49
4b0815fb4b7b0a9ecb3d4bf032fdb09bd056580112d6c8668e816247ee379664
4b4677e407b6f2c413f8400df6029f0a1073897c80c360151f040915743c6832
4b97ae0fa0dd0b1fef8a2bdc76c592809f356e157aead67c3358adc416d8a8d4
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
539e3c40ac0165fa975069e323156919287a424d5deb3ede2a43dbba33253144
550e514b7d08f67d950ea786201beadab7989f1cafa9505f56d8c18a3ade342b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5724f4a2a77e270f005ee3f59b9ac1b345f69cd4d08707e40aa527671b50ad1c
587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66adaa239f3adfca9c0b4dff99152181b29fd61b12cdc990dea1c6f98a3692a4
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71f6e73b4afc83f7ecdbb100ba117b6c1142715d2295211766c78f2430babb64
72a71f8fed15184a35e74a149af4f459db98ffe175761519bb453744047ce797
72ec618723da6d0be7eeda72a1842f3b6925229960b5b31aa54f38b10041dda7
738161904fe560fd83c26e301998e35ac1e87cb40bebd4b190a5f141309d40b9
7a8059b8f987d28469aa3eb205c0fe575c6e6effea9816c9d6713c5103e774f8
7b09efc8e4a97b24d3d6bdcc2b708717d25d768e9db95174d1f3e80910b7a16f
7ec2484397040de4e115d513248b25c938aebb57317a2e3f64976591a30cf79a
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844b99214e0be7d3aee539f149d0332d37e149e4f658b41f28e0e322ed959e97
855d23e3cb1cc14e80b5a46443afceb7588f289706c53c5427bb00d0ad643310
931fbcb210858d14a74eaa63c371436612e5b1b667969514a032d9ebb860fe31
93e1c6c3060d40eb0fea1c933a2860460780228ef5522b735e745878c7eeba28
9dfd48e6df2f0a05981a50827733b51560550605faf47a539159450320c37aed
9ea0fdf892749dadf67a7ff4c8f58bc1820aff60627f3b9a11af59bb6b9b0160
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2e8f8ea5793d7994d9382ab663fa213e81a2b7ba1dff4665aec7d3d2dffc91c
a3f58f3312c76a6f539c52aec847073a1006d926523a05488196a4cbbd65a65e
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a79035f23f714ef7093e5fea8bf910e3ca77ccdbdef4aeb4ae33606ce172ea42
ae3176cc38b9beb6bb1b367675a6139508cef9e5ed06ef73321ab822a1d3a385
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022
b29d10bd58a5e666015851ae1113eb776dcb6cefdec716c98acc351a3ba1b508
b3bdd131a95066c8eb345afd484b230830445504a2941191cd5d69df245102a9
b7848d86edc8dc3b5bc6a5c666069f9a31e000cee51575d3b6083951607e1550
b7c9452fde41ea8c1edaeaac061cdbc3e61c14ad4fd3eb1ebb08fd4c2a1b5796
c0e99c90d9cb7411a4b06a0132c284c9f507452ea0b2b01b893988460a7417d5
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d00e34da2458e612e4eef7d1b8a6b19d038d5cfeb59ae21e053e08cf4ef46856
d43675f272da10dafc0bf4c6f126d67f5e8d8c69c59d0cdae331e8691e4119a5
d6468fb1b104ff0b483bb62661989ef8ca5b198862b987fcbc353b3852897093
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
da411ea0e6634bbd0b21cdbe9f4112358c2c525fc93cf63a9ad82fda3406a4d9
e16b22175cf4805b2e5708af25968a60a9a8838f17344cdd2192742ef91f8f4d
e1aacb60d9b556cb78677f24e09d16a841e2a8aa469ee928374ed8d16bd510e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8f2d5487d860696dee2e6037ae07ff063ae5959b8d4b4658a284f9dc9711ca1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f259e1ac72c23752a935508137a234c6411c9abe1f04f9d951003ca60241cdb3
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8c780064cd4b2d091253b7465340e05d316c53c807339e309e30fb4ae8dbf87
ffb4d706890118c7163dbe02aa3b7a26b5b8064a2cfe559e0229d000b6b95577

exey.io Open in urlscan Pro 2606:4700:20::681a:837 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

118 Requests

90 %HTTPS

56 %IPv6

38 Domains

45 Subdomains

42 IPs

6 Countries

1337 kBTransfer

3402 kBSize

17 Cookies

1 Outgoing links

Page URL History

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

exey.io Open in urlscan Pro
2606:4700:20::681a:837 Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

90 %
HTTPS

56 %
IPv6

38
Domains

45
Subdomains

42
IPs

6
Countries

1337 kB
Transfer

3402 kB
Size

17
Cookies

118 HTTP transactions
2 data transactions