www.usuarioson.multisistemas.biz Open in urlscan Pro
162.244.82.65 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.usuarioson.multisistemas.biz/
Submission: On August 22 via automatic, source certstream-suspicious (August 22nd 2021, 3:11:28 am UTC)

Summary HTTP 69 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 18 IPs in 6 countries across 20 domains to perform 69 HTTP transactions. The main IP is 162.244.82.65, located in United States and belongs to SERVERROOM, US. The main domain is www.usuarioson.multisistemas.biz.
TLS certificate: Issued by R3 on August 15th 2021. Valid for: 3 months.

This is the only time www.usuarioson.multisistemas.biz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
17	162.244.82.65 162.244.82.65	19624 (SERVERROOM) (SERVERROOM)
1	54.36.167.79 54.36.167.79	16276 (OVH) (OVH)
13	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	37.157.2.235 37.157.2.235	198622 (ADFORM) (ADFORM)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
5	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1 1	18.195.172.136 18.195.172.136	16509 (AMAZON-02) (AMAZON-02)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:5262:f748:a686:7ff3	16509 (AMAZON-02) (AMAZON-02)
1 1	217.182.200.20 217.182.200.20	16276 (OVH) (OVH)
69	18

17 162.244.82.65 (United States)

ASN19624 (SERVERROOM, US)
PTR: gedan.com.br

www.usuarioson.multisistemas.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tdg.gedan.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
noticias.gedan.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
usuarioson.multisistemas.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.36.167.79 (Leyton, United Kingdom)

ASN16276 (OVH, FR)
PTR: s5.my-control-panel.com

hostinghg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.2.235 (Denmark)

ASN198622 (ADFORM, DK)

track.seadform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.172.136 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-172-136.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:5262:f748:a686:7ff3 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.182.200.20 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: gcm6.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	390 KB
13	gedan.com.br tdg.gedan.com.br noticias.gedan.com.br	20 KB
10	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	39 KB
5	google.com adservice.google.com www.google.com	2 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	53 KB
3	googletagservices.com www.googletagservices.com	92 KB
3	multisistemas.biz www.usuarioson.multisistemas.biz	159 KB
2	addthis.com 2 redirects e.dlx.addthis.com	1 KB
2	google.de adservice.google.de	1018 B
1	gemius.pl 1 redirects googlecm.hit.gemius.pl	338 B
1	innovid.com ag.innovid.com	297 B
1	mookie1.com odr.mookie1.com	324 B
1	agkn.com 1 redirects d.agkn.com	761 B
1	everesttech.net 1 redirects pixel.everesttech.net	376 B
1	quantserve.com cms.quantserve.com	463 B
1	seadform.net track.seadform.net
1	googleapis.com fonts.googleapis.com	687 B
1	multisistemas.bid usuarioson.multisistemas.bid	1018 B
1	googleadservices.com partner.googleadservices.com	665 B
1	hostinghg.com hostinghg.com	4 KB
69	20

	Domain	Requested by
13	pagead2.googlesyndication.com	www.usuarioson.multisistemas.biz pagead2.googlesyndication.com noticias.gedan.com.br googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
10	tdg.gedan.com.br	www.usuarioson.multisistemas.biz
9	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
5	cm.g.doubleclick.net	googleads.g.doubleclick.net
5	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	www.google.com	googleads.g.doubleclick.net tpc.googlesyndication.com
3	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	noticias.gedan.com.br	www.usuarioson.multisistemas.biz noticias.gedan.com.br
3	www.usuarioson.multisistemas.biz	www.usuarioson.multisistemas.biz
2	e.dlx.addthis.com	2 redirects
2	fonts.gstatic.com	fonts.googleapis.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
1	googlecm.hit.gemius.pl	1 redirects
1	ag.innovid.com	googleads.g.doubleclick.net
1	odr.mookie1.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	pixel.everesttech.net	1 redirects
1	cms.quantserve.com	googleads.g.doubleclick.net
1	track.seadform.net	googleads.g.doubleclick.net
1	www.gstatic.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	usuarioson.multisistemas.bid	noticias.gedan.com.br
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	hostinghg.com	www.usuarioson.multisistemas.biz
69	25

This site contains links to these domains. Also see Links.

Domain
tdg.gedan.com.br
hiperseo.mixwebup.com
lojavirtual.cidadejardimplantas.com.br
www.galerax.com
www.hipergrana.com
aumentatrafego.gedan.com.br
www.hiperhits.com
www.hiperbanner.net
hipercontador.gedan.com.br
www.cliquebanner.com
hostinghg.com

Subject Issuer	Validity	Valid
usuarioson.multisistemas.biz R3	`2021-08-15` - `2021-11-13`	3 months	crt.sh
tdg.gedan.com.br R3	`2021-08-15` - `2021-11-13`	3 months	crt.sh
hostinghg.com R3	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
noticias.gedan.com.br R3	`2021-08-15` - `2021-11-13`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
usuarioson.multisistemas.bid R3	`2021-08-15` - `2021-11-13`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.seadform.net DigiCert SHA2 Secure Server CA	`2020-10-05` - `2021-11-03`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh

This page contains 12 frames:

Primary Page: https://www.usuarioson.multisistemas.biz/
Frame ID: 5402A3E7D5EE4B5DF2EF65534CCCA89A
Requests: 23 HTTP requests in this frame

Frame: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css
Frame ID: 9A1A3CC9A4B53E82D09C196316895DC4
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210816/r20190131/zrt_lookup.html
Frame ID: C9D400F73CB34368F029343F5BDAFFD4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=100&slotname=4819524882&adk=2370501189&adf=1178029432&pi=t.ma~as.4819524882&w=320&lmt=1629601851&psa=0&format=320x100&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851147&bpp=3&bdt=376&idt=63&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&correlator=7002548720626&frm=20&pv=2&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=257&ady=793&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZpRcy3DlvM&p=https%3A//www.usuarioson.multisistemas.biz&dtd=82
Frame ID: AEA30DC5C44B616EAAE7527B1417B77D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&adk=1812271804&adf=3025194257&lmt=1629601851&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851158&bpp=1&bdt=387&idt=78&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&prev_fmts=320x100&nras=1&correlator=7002548720626&frm=20&pv=1&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=82
Frame ID: EEA93E167A9DEF773C6C1A8CA785BA4C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
Frame ID: 476D506CA5249F3820BED34C4ED17752
Requests: 17 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6D02FD19620C511462AB18DDA1359C1D
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js
Frame ID: 8C19E4DAC5455E143E14727D1C60BDAE
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: A98F593D7C3E231AF4CE15A98CC72127
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 70A69CCCDA965083002779A736056333
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 9EAF6E6FF14F031EFFB2D45D92CD1BE8
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 73C9017CAEB8A4AAB4F3206EAEDAE6F7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Usuários On :: Contador Gratuito de usuários online para colocar em seu Site ou BLOG

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Page Statistics

69
Requests

100 %
HTTPS

52 %
IPv6

20
Domains

25
Subdomains

18
IPs

6
Countries

764 kB
Transfer

1639 kB
Size

2
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: http://tdg.gedan.com.br/
Title: TUDO GRÁTIS

Search URL Search Domain Scan URL

URL: http://hiperseo.mixwebup.com/
Title: http:////hiperseo.mixwebup.com

Search URL Search Domain Scan URL

URL: http://lojavirtual.cidadejardimplantas.com.br/
Title: http://lojavirtual.cidadejardimpla ...

Search URL Search Domain Scan URL

URL: https://www.galerax.com/
Title: https://www.galerax.com

Search URL Search Domain Scan URL

URL: http://www.hipergrana.com/?PG=gratis

Search URL Search Domain Scan URL

URL: http://tdg.gedan.com.br/?SV=cart%F5es
Title:

Search URL Search Domain Scan URL

URL: http://tdg.gedan.com.br/?PG=classificados
Title:

Search URL Search Domain Scan URL

URL: http://tdg.gedan.com.br/?PG=jogos
Title:

Search URL Search Domain Scan URL

URL: http://tdg.gedan.com.br/?PG=imagens
Title:

Search URL Search Domain Scan URL

URL: http://aumentatrafego.gedan.com.br/
Title:

Search URL Search Domain Scan URL

URL: http://www.hiperhits.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.hiperbanner.net/
Title:

Search URL Search Domain Scan URL

URL: http://hipercontador.gedan.com.br/
Title:

Search URL Search Domain Scan URL

URL: http://www.cliquebanner.com/
Title:

Search URL Search Domain Scan URL

URL: https://hostinghg.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBES2pT1LmqqLQoKc7GRI5-RZcx4jQtSutQhiKDjLedivaCH6s5OYUR72ZaN&google_gid=CAESELWflS02LiUr_i_HwDrlcKw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVNIQVBRQUFCSkMyVGk3Uw&google_push=AYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBES2pT1LmqqLQoKc7GRI5-RZcx4jQtSutQhiKDjLedivaCH6s5OYUR72ZaN

Request Chain 50

https://d.agkn.com/pixel/2175/?google_gid=CAESEAHMXWqBgSaZ0Mt_0R3bNm8&google_cver=1&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf&google_hm=Q0FFU0VBSE1YV3FCZ1NhWjBNdF8wUjNiTm04

Request Chain 51

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMCmtgfK_Y1561yH8Cs3mjK_xPH5wDNgD&google_gid=CAESEAFjS6ySyPaUC8XA2Q2oCRQ&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMCmtgfK_Y1561yH8Cs3mjK_xPH5wDNgD&google_gid=CAESEAFjS6ySyPaUC8XA2Q2oCRQ&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjIwMzEwNTMwMDA4ODI1MDQ3NDkyOA%3D%3D&google_push=AYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMCmtgfK_Y1561yH8Cs3mjK_xPH5wDNgD

Request Chain 54

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELW9TiZL6n4CP2-9dxKvv1Q&google_cver=1&google_push=AYg5qPKfEFvNr_lwlq9SwmV8JIs7iFAThu4IIvPD-FgKerP6vHVt84hN_TT95kzw_mWbdH0oHEkIElfUSO27VeiLxOQdN_Onm16tjQ HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKfEFvNr_lwlq9SwmV8JIs7iFAThu4IIvPD-FgKerP6vHVt84hN_TT95kzw_mWbdH0oHEkIElfUSO27VeiLxOQdN_Onm16tjQ&google_hm=

69 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.usuarioson.multisistemas.biz/ 8 KB
8 KB 494ms
105ms Document
text/html 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) / PHP/5.6.40

Resource Hash

cbcdf107408ced3e91f4fa05e504266a817b1f2245040609953ad69499575923

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Host: www.usuarioson.multisistemas.biz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:50 GMT
Server: Apache/2.4.46 (IUS)
X-Powered-By: PHP/5.6.40
X-Content-Type-Options: nosniff
X-XSS-Protection: 1;mode=block
Access-Control-Allow-Origin: *
X-Supported-By: Kloxo-MR 7.0
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Connection: Upgrade, close
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1

GET
H/1.1 200
OK usuarioson.js Show response
www.usuarioson.multisistemas.biz/ 367 B
820 B 285ms
95ms Script
text/javascript 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.usuarioson.multisistemas.biz/usuarioson.js

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

fed33cfb49c36ece03617711c0e2bcffbf277c26fa3b42debced6c821919d901

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: www.usuarioson.multisistemas.biz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://www.usuarioson.multisistemas.biz/
Connection: keep-alive
Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 23 May 2020 14:09:52 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "16f-5a6514ca50c00"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 367
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK hg.gif
tdg.gedan.com.br/files/ 380 B
827 B 691ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/hg.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

f84113ebbb94d57580e3b1d751fdb26aa09bd1ed44952cc3862addfc10938782

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 18:56:28 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "17c-3af1acdddaf00"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 380
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK cartao.gif
tdg.gedan.com.br/files/ 312 B
759 B 406ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/cartao.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

4ddaab23aaaf3c0b1d2c3148ae1c8803c038d79021fd991f410d231b3748f6b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 18:58:32 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "138-3af1ad541c600"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 312
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK classif.gif
tdg.gedan.com.br/files/ 774 B
1 KB 488ms
96ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/classif.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

084377c1dc10cf9aa0857e965f324b92f67073901fffef535af1c923a41880ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 21:20:20 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "306-3af1cd05f8d00"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 774
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK jogos.gif
tdg.gedan.com.br/files/ 368 B
815 B 680ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/jogos.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

d75a8c2fba0ac5e9b88d219d34c5a1121e15235eab89ea08f3cfe6de6eef6cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 20:39:46 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "170-3af1c3f4ba880"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 368
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK img.gif
tdg.gedan.com.br/files/ 414 B
861 B 682ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/img.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

8483a6a40f03704567642f9357d44ed56847955aa17a932007b1a66f2b2cf7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 21:38:38 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "19e-3af1d11d1b380"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 414
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK trafego.gif
tdg.gedan.com.br/files/ 417 B
864 B 683ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/trafego.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

e51d9e0382082135378a0ce6bd912851b8df45ed470f6553562eadb73ce2d21b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 20:38:18 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "1a1-3af1c3a0ce280"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 417
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK tubine.gif
tdg.gedan.com.br/files/ 391 B
838 B 177ms
97ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/tubine.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

b3258a7d44fee9d1268e3b46af7f567b053967f50d867a542d230736ac6ab0ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 20:36:46 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "187-3af1c34911380"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 391
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK hbnet.gif
tdg.gedan.com.br/files/ 1 KB
2 KB 370ms
95ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/hbnet.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

d13e73866324ddef9e14a8006953d244e36d8ac9f081eb3fb3052151d7f3d3c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 20:33:48 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "589-3af1c29f50300"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 1417
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK hc.gif
tdg.gedan.com.br/files/ 244 B
690 B 373ms
94ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/hc.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

aa02332859483bcfd41936e44d21a06b8b7b41e36813f7d705d6d8198e96ed55

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 22:07:10 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "f4-3af1d77dcbf80"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 244
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK cb.gif
tdg.gedan.com.br/files/ 257 B
704 B 374ms
94ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tdg.gedan.com.br/files/cb.gif

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

7de854fd06154ecc54850207d93ede14e5aca505e75133baf15214f4f0a15ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Nov 2002 20:43:26 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "101-3af1c4c689780"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 257
X-XSS-Protection: 1;mode=block

GET
H2 200 bthost.gif
hostinghg.com/ 4 KB
4 KB 170ms
43ms Image
image/gif 54.36.167.79
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hostinghg.com/bthost.gif
Requested by: Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.36.167.79 Leyton, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: s5.my-control-panel.com
Software: LiteSpeed /
Resource Hash: 27f87d9b16cdba16a5a62bc3c42a1561c8051ce983f8dc93717e5aa3ca5d2894

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
last-modified: Sat, 11 Oct 2014 02:24:10 GMT
server: LiteSpeed
etag: "1067-543894ca-c3f9be762a3b43c2;;;"
vary: User-Agent
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length: 4199
expires: Sun, 29 Aug 2021 03:10:51 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 139 KB
49 KB 57ms
35ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2d2846040ce0726ba6ace389110fad3b2c7f1cc23caf00adc4f8a016892ad57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49909
x-xss-protection: 0
server: cafe
etag: 14305058684536401169
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 22 Aug 2021 03:10:51 GMT

GET
H/1.1 200
OK fundo.jpg
www.usuarioson.multisistemas.biz/images/ 150 KB
150 KB 288ms
96ms Image
image/jpeg 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.usuarioson.multisistemas.biz/images/fundo.jpg

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

43c5d8a539dda38e349b319c007587df3eb11e0470b944d43bd3bbec6bfa68d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: www.usuarioson.multisistemas.biz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://www.usuarioson.multisistemas.biz/
Connection: keep-alive
Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 20 Oct 2018 02:45:18 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "257f5-578a002a4ab80"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 153589
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK sites.php Show response
noticias.gedan.com.br/ Frame 9A1A 7 KB
7 KB 493ms
99ms Document
text/html 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css

Requested by

Host: www.usuarioson.multisistemas.biz
URL: https://www.usuarioson.multisistemas.biz/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) / PHP/5.6.40

Resource Hash

afd0fac1871f97f8391758c2800f65d8f664404063449d614124bbc63723a3af

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Host: noticias.gedan.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.usuarioson.multisistemas.biz/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
Server: Apache/2.4.46 (IUS)
X-Powered-By: PHP/5.6.40
X-Content-Type-Options: nosniff
X-XSS-Protection: 1;mode=block
Access-Control-Allow-Origin: *
X-Supported-By: Kloxo-MR 7.0
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Connection: Upgrade, close
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108190101/ 252 KB
93 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108190101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8500587267418417&plah=www.usuarioson.multisistemas.biz

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e50923eeab2fab42aabd0b1dd0295ed74f9bf5eec3f91bdcb4b36316a40860bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95447
x-xss-protection: 0
server: cafe
etag: 5134495107379379254
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 22 Aug 2021 03:10:51 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210816/r20190131/ Frame C9D4 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210816/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5f3085127d154cbd72e219052312767d460633fafa6e38bb9a9446ddb03a270

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210816/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.usuarioson.multisistemas.biz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 21 Aug 2021 09:18:41 GMT
expires: Sat, 04 Sep 2021 09:18:41 GMT
content-type: text/html; charset=UTF-8
etag: 8999110079160743657
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4576
x-xss-protection: 0
age: 64330
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 207 B
665 B 115ms
41ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.usuarioson.multisistemas.biz&callback=_gfp_s_&client=ca-pub-8500587267418417

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108190101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8500587267418417&plah=www.usuarioson.multisistemas.biz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

99c0ae196a8ebff68faa39b67dd4e945fbe2d2be6b1ba97f8608ddd127e3b94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 33ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.usuarioson.multisistemas.biz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.usuarioson.multisistemas.biz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AEA3 436 B
235 B 106ms
105ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=100&slotname=4819524882&adk=2370501189&adf=1178029432&pi=t.ma~as.4819524882&w=320&lmt=1629601851&psa=0&format=320x100&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851147&bpp=3&bdt=376&idt=63&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&correlator=7002548720626&frm=20&pv=2&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=257&ady=793&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZpRcy3DlvM&p=https%3A//www.usuarioson.multisistemas.biz&dtd=82

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d9743d930a921872a411279749a08cd5404a9c617c578ebf02f808aad2ed3ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8500587267418417&output=html&h=100&slotname=4819524882&adk=2370501189&adf=1178029432&pi=t.ma~as.4819524882&w=320&lmt=1629601851&psa=0&format=320x100&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851147&bpp=3&bdt=376&idt=63&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&correlator=7002548720626&frm=20&pv=2&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=257&ady=793&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZpRcy3DlvM&p=https%3A//www.usuarioson.multisistemas.biz&dtd=82
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.usuarioson.multisistemas.biz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 22 Aug 2021 03:10:51 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 22-Aug-2021 03:25:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 22 Aug 2021 03:10:51 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 40ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a2478978968eefdc87127bfe6619a9de514b2ccb89b2a95824a53e6bea1f9cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458978809797"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27677
x-xss-protection: 0
expires: Sun, 22 Aug 2021 03:10:51 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EEA9 10 KB
4 KB 104ms
104ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&adk=1812271804&adf=3025194257&lmt=1629601851&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851158&bpp=1&bdt=387&idt=78&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&prev_fmts=320x100&nras=1&correlator=7002548720626&frm=20&pv=1&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=82

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93ea9e25aea382a84245a11c4366b632bac1df4352e6199a72b3f3238f79a1fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8500587267418417&output=html&adk=1812271804&adf=3025194257&lmt=1629601851&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601851158&bpp=1&bdt=387&idt=78&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&abxe=1&prev_fmts=320x100&nras=1&correlator=7002548720626&frm=20&pv=1&ga_vid=525908111.1629601851&ga_sid=1629601851&ga_hid=534671291&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C20211866%2C44748389%2C31062297&oid=3&pvsid=4172528469507036&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=82
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.usuarioson.multisistemas.biz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 22 Aug 2021 03:10:51 GMT
server: cafe
content-length: 4411
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 22-Aug-2021 03:25:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 22 Aug 2021 03:10:51 GMT
cache-control: private

GET
H/1.1 200
OK classe.css
usuarioson.multisistemas.bid/ Frame 9A1A 572 B
1018 B 567ms
95ms Stylesheet
text/css 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://usuarioson.multisistemas.bid/classe.css

Requested by

Host: noticias.gedan.com.br
URL: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

c66969e10358534b5fcc95c4383ab1d3622dd466eafd82a87495e4db55aea91a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 30 Oct 2018 04:04:58 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "23c-5796a49f76e80"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: text/css
Content-Length: 572
X-XSS-Protection: 1;mode=block

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9A1A 139 KB
49 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: noticias.gedan.com.br
URL: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2d2846040ce0726ba6ace389110fad3b2c7f1cc23caf00adc4f8a016892ad57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49909
x-xss-protection: 0
server: cafe
etag: 14305058684536401169
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 22 Aug 2021 03:10:51 GMT

GET
H/1.1 200
OK notifica.js Show response
noticias.gedan.com.br/ Frame 9A1A 2 KB
2 KB 289ms
98ms Script
text/javascript 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://noticias.gedan.com.br/notifica.js

Requested by

Host: noticias.gedan.com.br
URL: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

0644457e66839d658cde6152a46dd17a98b3cb584caf067c08dd8f83eab61045

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 19:20:06 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "632-5af5f09e04580"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 1586
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK gedan.gif
noticias.gedan.com.br/imagens/ Frame 9A1A 2 KB
2 KB 289ms
97ms Image
image/gif 162.244.82.65
SERVERROOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://noticias.gedan.com.br/imagens/gedan.gif

Requested by

Host: noticias.gedan.com.br
URL: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.244.82.65 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

gedan.com.br

Software

Apache/2.4.46 (IUS) /

Resource Hash

93341c62500c6d7b82552ee5750d2311533c6b823a6d8d3247b1e6f0b4000342

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: https://noticias.gedan.com.br/sites.php?P=H&Estilo=usuarioson.multisistemas.bid/classe.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 22 Aug 2021 03:10:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 03 Jan 2010 00:09:52 GMT
Server: Apache/2.4.46 (IUS)
X-Supported-By: Kloxo-MR 7.0
ETag: "6c8-47c376c7cb400"
Strict-Transport-Security: max-age=2592000; preload
Upgrade: h2
Access-Control-Allow-Origin: *
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 1736
X-XSS-Protection: 1;mode=block

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108190101/ Frame 9A1A 252 KB
93 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108190101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8500587267418417&plah=noticias.gedan.com.br

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e50923eeab2fab42aabd0b1dd0295ed74f9bf5eec3f91bdcb4b36316a40860bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95447
x-xss-protection: 0
server: cafe
etag: 5134495107379379254
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 22 Aug 2021 03:10:52 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 9A1A 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=noticias.gedan.com.br

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 9A1A 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=noticias.gedan.com.br

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 476D 86 KB
29 KB 523ms
523ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

403da2458bc3b973f1dd13fe86d8aa1f1d38f60e4b8e74e91e667de815039850

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://noticias.gedan.com.br/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://noticias.gedan.com.br/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 22 Aug 2021 03:10:52 GMT
server: cafe
content-length: 29611
x-xss-protection: 0
set-cookie: IDE=AHWqTUme_bd1RQOoUEibFJyaIoOPO0w_ownlkwd0Xn5kMFAOKBCQNeiBFqwtn7snv2U; expires=Fri, 16-Sep-2022 03:10:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 22 Aug 2021 03:10:52 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9A1A 72 KB
27 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a2478978968eefdc87127bfe6619a9de514b2ccb89b2a95824a53e6bea1f9cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458978809797"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27677
x-xss-protection: 0
expires: Sun, 22 Aug 2021 03:10:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 476D 3 KB
687 B 20ms
19ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 02:48:47 GMT
server: ESF
date: Sun, 22 Aug 2021 03:10:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 22 Aug 2021 03:10:52 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 476D 1 KB
937 B 31ms
11ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 00:49:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8506
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Sep 2021 00:49:06 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/ Frame 476D 18 KB
8 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:04:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Sep 2021 03:04:27 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 476D 2 KB
1 KB 26ms
10ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 02:28:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2535
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Sep 2021 02:28:37 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 476D 124 KB
37 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629458990649126"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38246
x-xss-protection: 0
expires: Sun, 22 Aug 2021 03:10:52 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/ Frame 476D 14 KB
6 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210816/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 02:29:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2475
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Sep 2021 02:29:37 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 476D 0
0 14ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTktbbLWlC3ov0nE5GfjDitUyObR2yZ6mVi_AGHLcLfG1AVO7ZToSr1varxaE4tIteGbQ61q7Ifuv4G9-934sw9VKXZ6w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 b0b7c8cfc8b22cb6a71ecf22b35577d4.js Show response
www.gstatic.com/mysidia/ Frame 476D 26 KB
11 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b0b7c8cfc8b22cb6a71ecf22b35577d4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21fbea093a7e9bf8bac159496306302109665a5643c7c82f64f5b18c4b056aae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 13:07:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 223404
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10765
x-xss-protection: 0
last-modified: Tue, 17 Aug 2021 04:05:51 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 17 Nov 2021 13:07:28 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5373103328878875059/ Frame 476D 10 KB
10 KB 23ms
11ms Image
image/jpeg 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5373103328878875059/downsize_200k_v1?w=400&h=209

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4235c0d5e12262c098f8df2e2d62aeedd41a3c4866d310da73c1f52715b99959

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 11:50:52 GMT
x-content-type-options: nosniff
age: 228000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9893
x-xss-protection: 0
last-modified: Tue, 17 Aug 2021 13:37:47 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Aug 2022 11:50:52 GMT

GET
DATA 200
OK truncated
/ Frame 476D 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 /
track.seadform.net/adfserve/ Frame 476D 35 B
0 139ms
46ms Fetch
image/gif 37.157.2.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.seadform.net/adfserve/?bn=48293841;1x1inv=1;srctype=3;ord=1803658153&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:52 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
expires: -1

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 476D 0
0 17ms
17ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6kfsPMAhYdLYEtKxlQfOs6rYA-DymYhkqeqa0fENiKe2lYsDEAEggZvwJWCVAqAByOTXigPIAQmpAjDVE-QdobM-qAMByAPLBKoE_AFP0LJQopuIujjNjTnvLMuz08wQFk7UGyBW0Yw3tYGG8-TBYgtxTzGtexSSulnBRgK67KiSZq7Jljun-9PC3UhE7LKVK53nC_m4Mn57y4tbmYIz_m2wfbyTl0nzyxVuJ_7O4rKbu3Z9zIdHeSR-U6IIGyN8esYEkyZThYDQQfJfrY5TtTK9kMuSq4IFCnc35Va5Y5DDiz3X4-yrpBpVb3zwG1Yb7noi5ZfMx2cuLFlDZxF6mcvB08rILIGSLJYOmpHrvAt9cMdr1qc7tzZ1y_2XtsvUZRxc3WcVaY4AnvCKKnzE9VFyH1tEnPLTuLzU-7X8ll1lFOxbe-UbEgLABLO1x7fQA5IFBAgEGAGSBQQIBRgEoAYugAegm6h1qAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEMPAO9IICQiA4YAQEAEYH4AKAcgLAbgTiCfYEw2IFALQFQGYFgGAFwGyFxwKGggAEhRwdWItODUwMDU4NzI2NzQxODQxNxgA&sigh=6n9ogc69XZ4&uach_m=[UACH]&template_id=5000&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 22 Aug 2021 03:10:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6D02 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 22 Aug 2021 03:09:05 GMT
expires: Mon, 23 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 107
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 476D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9740281684e56685455d0815b61f7b6edc995a6a84c136635b8e6e9c713ef948

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 476D 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:11 GMT
x-content-type-options: nosniff
age: 356981
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:01:04 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:11 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 476D 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 00:01:03 GMT
x-content-type-options: nosniff
age: 356989
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:00:52 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Aug 2022 00:01:03 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6D02 35 B
463 B 25ms
8ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAlS0Iuwn8_dfvVwTwY_EK4&google_cver=1&google_push=AYg5qPLVjYhorGm5-I3tomYrEm4wCITDabVIcP2LN9wq2oqlvzsKaEDNXEm1I7D-AZLu1uVtKQoLQ8IesCj1_EEzzcN1kDMUYexd

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:52 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6D02
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBE...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVNIQVBRQUFCSkMyVGk3Uw&google_push=AYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBES2pT1LmqqLQoKc7GRI5-RZcx4jQtSutQhiKDjLedivaCH6s5OYUR72ZaN

170 B
188 B

83ms
42ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVNIQVBRQUFCSkMyVGk3Uw&google_push=AYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBES2pT1LmqqLQoKc7GRI5-RZcx4jQtSutQhiKDjLedivaCH6s5OYUR72ZaN

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVNIQVBRQUFCSkMyVGk3Uw&google_push=AYg5qPJKjsdQIz4uO5wmqY55wtS1c0i9NPte1F67HBES2pT1LmqqLQoKc7GRI5-RZcx4jQtSutQhiKDjLedivaCH6s5OYUR72ZaN
Date: Sun, 22 Aug 2021 03:10:53 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6D02
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEAHMXWqBgSaZ0Mt_0R3bNm8&google_cver=1&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf&google_hm=Q0FFU0VBSE1YV3FCZ1NhW...

170 B
188 B

51ms
41ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf&google_hm=Q0FFU0VBSE1YV3FCZ1NhWjBNdF8wUjNiTm04

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 22 Aug 2021 03:10:52 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJrYYxopvxZvkDliW3s-7GekakoS5pjyYoaf9rwtMTNS9os30eFdIfKD8b1YpJPeav2v2-zSZl9d3-rmhsTSyqxf8ZCDFuf&google_hm=Q0FFU0VBSE1YV3FCZ1NhWjBNdF8wUjNiTm04
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6D02
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKBypU0...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKBypU0...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjIwMzEwNTMwMDA4ODI1MDQ3NDkyOA%3D%3D&google_push=AYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMC...

170 B
188 B

42ms
42ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjIwMzEwNTMwMDA4ODI1MDQ3NDkyOA%3D%3D&google_push=AYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMCmtgfK_Y1561yH8Cs3mjK_xPH5wDNgD

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MjIwMzEwNTMwMDA4ODI1MDQ3NDkyOA%3D%3D&google_push=AYg5qPKBypU0vlsMONlH6GYeKE2vGwq3-7ErCxxoCVeyVzsUpI45AEBRXph9BtMmvpyzMCmtgfK_Y1561yH8Cs3mjK_xPH5wDNgD
pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Sun, 22 Aug 2021 03:10:53 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 6D02 43 B
324 B 90ms
36ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEPFIDP3UIzBueZdQgOwkwiE&google_push=AYg5qPJn8znx88wURaKpH4dqBK3AN_boV8ml15abTh70hzsfHFIrip_-1_H_kPykQwwMlX7OEr_ngMoj7ELR8e8RyKu4144Sr5bn&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:52 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 trk
ag.innovid.com/ Frame 6D02 43 B
297 B 79ms
21ms Image
image/gif 2a05:d01c:1d8:8100:5262:f748:a686:7ff3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEOc8QWqVjN6bAJgWNSqRwfc&google_cver=1&google_push=AYg5qPIqMBxkLOBtjvYMI-PPbtyThVSF-lGwr_Z_bjZ3Sy1xoH0KqrHDx-MVMZXh0_lnYtpkPo1iWbdFH3orJGavgeAy8OZPfsoj
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8500587267418417&output=html&h=280&slotname=8546388886&adk=3109863375&adf=3279755397&pi=t.ma~as.8546388886&w=580&fwrn=16&fwrnh=100&lmt=1629601852&rafmt=1&psa=0&format=580x280&url=https%3A%2F%2Fnoticias.gedan.com.br%2Fsites.php%3FP%3DH%26Estilo%3Dusuarioson.multisistemas.bid%2Fclasse.css&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629601852162&bpp=4&bdt=572&idt=115&shv=r20210816&mjsv=m202108190101&ptt=9&saldr=aa&correlator=814256886425&frm=22&ife=1&pv=2&ga_vid=1843810002.1629601852&ga_sid=1629601852&ga_hid=2094506542&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=580&ish=850&ifk=2428751381&scr_x=-12245933&scr_y=-12245933&eid=20211866%2C31062297&oid=2&pvsid=3103516290604700&top=https%3A%2F%2Fwww.usuarioson.multisistemas.biz%2F&eae=0&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C580%2C850&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=1.m7s1r43cg74u&fsb=1&xpc=eeT9GqMhae&p=https%3A//noticias.gedan.com.br&dtd=128
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:5262:f748:a686:7ff3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:52 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6D02
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELW9TiZL6n4CP2-9dxKvv1Q&google_cver=1&google_push=AYg5qPKfEFvNr_lwlq9SwmV8...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKfEFvNr_lwlq9SwmV8JIs7iFAThu4IIvPD-FgKerP6vHVt84hN_TT95kzw_mWbdH0oHEkIElfUSO27VeiLxOQdN_Onm16tjQ&google_hm=

170 B
188 B

42ms
42ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKfEFvNr_lwlq9SwmV8JIs7iFAThu4IIvPD-FgKerP6vHVt84hN_TT95kzw_mWbdH0oHEkIElfUSO27VeiLxOQdN_Onm16tjQ&google_hm=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKfEFvNr_lwlq9SwmV8JIs7iFAThu4IIvPD-FgKerP6vHVt84hN_TT95kzw_mWbdH0oHEkIElfUSO27VeiLxOQdN_Onm16tjQ&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sat, 21 Aug 2021 03:10:53 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 6D02 0
253 B 118ms
39ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LuH8lQkfLcgBbotm5hdpomMWb9k9uL28IO849tnuTuoM49L6ZwjeHBEJKs3SsZtRHGlR0Blg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9A1A 11 KB
8 KB 27ms
25ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210816&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e0ef721e78a7679b31d4d1f1fb2393c455b1e39fab6a2c6f96f7040ef3409c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8548
x-xss-protection: 0

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 25ms
24ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210816&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c3997b00247f30c41d1ee48ea06dc0b3271dc7e3f66052e8a94452dd1f3d188

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 Aug 2021 03:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8519
x-xss-protection: 0

GET
H3-29 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame 8C19 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:13:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57418
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 11:13:54 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 664ms
663ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Sun, 22 Aug 2021 03:10:53 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9A1A 17 KB
6 KB 664ms
663ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 22 Aug 2021 03:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Sun, 22 Aug 2021 03:10:53 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame A98F 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.usuarioson.multisistemas.biz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Sat, 21 Aug 2021 23:04:48 GMT
expires: Sun, 21 Aug 2022 23:04:48 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 14765
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 70A6 783 B
533 B 60ms
60ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5199f711b1cabd62b1269baada06297d5dda0717100f51dfd0c43054f67e399d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yC2H6qMDyvj4M3IyMwoGLQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.usuarioson.multisistemas.biz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.usuarioson.multisistemas.biz/

Response headers

expires: Sun, 22 Aug 2021 03:10:53 GMT
date: Sun, 22 Aug 2021 03:10:53 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-yC2H6qMDyvj4M3IyMwoGLQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 9EAF 12 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://noticias.gedan.com.br/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://noticias.gedan.com.br/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Sat, 21 Aug 2021 23:04:48 GMT
expires: Sun, 21 Aug 2022 23:04:48 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 14765
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 73C9 783 B
531 B 27ms
26ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dcb2cb8b69382d1a8938f0dc69953a6c75f9420b56c2fd52d258e98b380e2982

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5yOxq0s17Jr3isa8lVn0mQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://noticias.gedan.com.br/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://noticias.gedan.com.br/

Response headers

expires: Sun, 22 Aug 2021 03:10:53 GMT
date: Sun, 22 Aug 2021 03:10:53 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-5yOxq0s17Jr3isa8lVn0mQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame A98F 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:13:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 11:13:54 GMT

GET
H3-29 200 1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js Show response
pagead2.googlesyndication.com/bg/ Frame 9EAF 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1uDPM70x-solQtk3bMKouXIpBOJMxNO_wSEEjkbCROo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:13:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13303
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 11:13:54 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A1A 0
20 B 16ms
15ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210816&jk=3103516290604700&bg=!v7ylvPjNAAZvV8FTb1c7ACkAdvg8WtWTyROf3CE3qpw1ydv5laobtWIBO9BaezOWufC2FN3imSfDjQIAAABbUgAAAAtoAQeZAp9IKXzq8TVWjrg__ot6wg4QGDTRbccXvk8gzCY4BF9y-RFIcHO_-DgCIj8aOadV-DveWXVt6nlE9iz8rwYU4sZfP_h7PiJdlqZIFKWODkxEaJNf_MYAl3ZTeTT6kfF8RV8_GMeI_MTrVxqvaVAssFbKhuJAjlXb_JxS7KanzeuSQ9CgVgVH34faQbTNx6QFWPf6yzweIOnuDZuLPvb3iZ-BqfkwWQGJ9GhWoj01h5j-g0jL4AJYEXxsGtkkjCWGc6oJ4_A3wvf_IDD2XO4xAx-14ARDkB6aSH4OrL8j8dOjv1uzw_1IuVp4lHbG8ybS-3y59eYvlklv5XAMaBzKToHngLrHuxSeusDXaGkjroBeotuP9nEomKxxScCILiUDOdXfBfopy8pezULhUleBvfJ2AS9hzvGYzvuaAlr5HOFBoAaUH1kddpAHtshW68gMit-SkyK9u0tu8IMM2__h-kYz-eYzLWHwchlAF1r2dVf4GBkFidpMn7vBKA1cArfmN6TP18u-leM4LAeAFYHEpwtVtkB-zuUep8tXScRI0ALTgl5VEes7laL4mUR5R9U1hiFi0qNtJ0duJG6nlUCSZbG7GKE2iZGA25PhIovpWQEhIkYgmjlzjQ9V8yFMHLyS4dH1C7NP_HUATe_UWhpE1v-C7qUexga_bN5IPvdOIMnvVp6njHdoAebm52T520yj-4YN2M9B-V-OVO6p1nEDc4Sw8aaTslqX_KswXGzpRZ-WYr55D0GMRlF899nhjAOXzj-rp17zamE6AYLZj_2eJgib6GBSGiErpMtK-V6oDdAklBNyhO6I7CHUyvWDvTb3Pjtg7UkdzJWkbLNqZbcbSXXemEYwAdLvaLGZB5uXpodgazRnRoM_zkFPpaiGkKRhKQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://noticias.gedan.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 16ms
15ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210816&jk=4172528469507036&bg=!7u2l7anNAAZvV8FTb1c7ACkAdvg8Wrf_M6Fqm-4CKT5iD2N-CY9zvvQ-GrdDMLvWz_bhpTpeRDzhPgIAAABqUgAAAAhoAQcKAF1ovmyRq8r2UDBqoh2smjdWSCP4vT8oDmTMZGqWCueaB-70w1mqRRgM5Vk4xybLcoQqAGPQ-sizuNymOtMPwebsMXuucXFMxMBm2xX485Klersx_D_DUrjex3e5XwiZAoHCzXxv7zIuKlIHiwNjrL8_p4tWQ-3DOTYTHDkPPL_6BCCIyZoIoy6gprAr1woey9Ier3mueBIYkHuaKMuMVbrvKtqTbRM07FpriHmw0qii0QkqGGvxNxOfneSLjH0VyukOPictUB4kqkzsY9pITwvr54gyxMjfOfND-xTwvNsjuzh2YpLBAB8EXaeXqbrbtQACsBhk6-4oF65giG5ZR0wfwfXlBkvOTywp8yt1N5gxRx3wyVRj534ndLVQ9oy0UDx3pXORM3b1cU0frBP4p4WmVOYZvmQH5UeyMh36CtIpsCoYcZbBiAbKYCgLakyyjxBvbvYVo_NbIPhfYuG7RRzfK6vWFRwgPdPAYQu2jDKNZlOVRItwveK82llFe4tnmI8aJdjSFr2vSyUjz5jdciUajR82kxwei1iZtQJErupQ_llB6lnNBEY4jcTzCT9dDBMySGRKJHF05bk2dH09F19zzTyfaJB5NpKGPIphhq4J9w296dynZ-DY3pu-MZ8og06D7dEjxbQMwfeX3LudNS2rUKtqZCVSWiNKL90kDoIo7OTS8p6-SsQhLLhSmQNXOTfp5YZAVokxEmGNb5pdU-gCKPEt7C3CzoxH_PoTRKoOx9EKPoAx4VWvjwd-EqspDWXnzftCbTUUWcnBptgpeBvaZYmmOxKcLo6lO_ltQhXzMM9trbeip-NKBFHJ9bqerzPzcINShb3T1Uw3E3BwEj9k3Mmr8qDEDhSxJiEYm10PaIAZGdWeNCGLPv6ce3tXdMLiRRWdR2CFYOVaiIQUyP_-08c1ktc3YDACCcO4JwLu1MgcNh2ZyT-1rJGx3jBf3L-hVL6rTFnCBnKiiK2yZRX2qQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.usuarioson.multisistemas.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 476D 42 B
64 B 21ms
21ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv2YQqS4_JNjMC7vDIGrfKnNCEa_azaQixpTivtj7D-3iOJW8VQNea0X86N5q-QEt4IHLJuyhldmg5hvl80DwxhVYjvtsTb08Jm84hB3hUAnT46d7SOQJ4UDcQMNA&sai=AMfl-YQr8NA2ROEUnbFSFXjPuRXDrzdeXA7JsJd4xouFX5ypwj0nIaa3i5BpbUcxNr83KN-DojraKip9agftwJvxkTB8gwmH8VJ_aWI&sig=Cg0ArKJSzFW48AMlsqyjEAE&cid=CAASF-RowwX2ioPcVLFHaIdRlpNE5MfydmHx&id=lidar2&mcvt=1000&p=0,0,280,580&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210820&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3109863375&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629601852292&dlt=528&rpt=37&isd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Aug 2021 03:10:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-20 06:01:37	Name: IDE Value: AHWqTUme_bd1RQOoUEibFJyaIoOPO0w_ownlkwd0Xn5kMFAOKBCQNeiBFqwtn7snv2U
			.multisistemas.biz/	1970-01-20 06:01:37	Name: __gads Value: ID=8787520ece9ff6bb-22231344b1c90032:T=1629601851:RT=1629601851:S=ALNI_MYjHDFbuquVxVke_GLZHk7G9gyOWQ

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
cm.g.doubleclick.net
cms.quantserve.com
d.agkn.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
hostinghg.com
noticias.gedan.com.br
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
tdg.gedan.com.br
tpc.googlesyndication.com
track.seadform.net
usuarioson.multisistemas.bid
www.google.com
www.googletagservices.com
www.gstatic.com
www.usuarioson.multisistemas.biz
104.111.215.191
142.250.184.194
142.250.186.34
162.244.82.65
18.195.172.136
217.182.200.20
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:800::2002
2a00:1450:4001:803::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::2004
2a00:1450:4001:828::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2001
2a00:1450:4001:831::200a
2a05:d01c:1d8:8100:5262:f748:a686:7ff3
34.98.67.61
37.157.2.235
52.18.11.109
54.36.167.79
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
0644457e66839d658cde6152a46dd17a98b3cb584caf067c08dd8f83eab61045
084377c1dc10cf9aa0857e965f324b92f67073901fffef535af1c923a41880ac
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
21fbea093a7e9bf8bac159496306302109665a5643c7c82f64f5b18c4b056aae
27f87d9b16cdba16a5a62bc3c42a1561c8051ce983f8dc93717e5aa3ca5d2894
403da2458bc3b973f1dd13fe86d8aa1f1d38f60e4b8e74e91e667de815039850
4235c0d5e12262c098f8df2e2d62aeedd41a3c4866d310da73c1f52715b99959
43c5d8a539dda38e349b319c007587df3eb11e0470b944d43bd3bbec6bfa68d7
4ddaab23aaaf3c0b1d2c3148ae1c8803c038d79021fd991f410d231b3748f6b4
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5199f711b1cabd62b1269baada06297d5dda0717100f51dfd0c43054f67e399d
5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a
6d9743d930a921872a411279749a08cd5404a9c617c578ebf02f808aad2ed3ea
7a2478978968eefdc87127bfe6619a9de514b2ccb89b2a95824a53e6bea1f9cf
7c3997b00247f30c41d1ee48ea06dc0b3271dc7e3f66052e8a94452dd1f3d188
7de854fd06154ecc54850207d93ede14e5aca505e75133baf15214f4f0a15ccc
7e0ef721e78a7679b31d4d1f1fb2393c455b1e39fab6a2c6f96f7040ef3409c3
8483a6a40f03704567642f9357d44ed56847955aa17a932007b1a66f2b2cf7d4
86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e
93341c62500c6d7b82552ee5750d2311533c6b823a6d8d3247b1e6f0b4000342
93ea9e25aea382a84245a11c4366b632bac1df4352e6199a72b3f3238f79a1fa
9740281684e56685455d0815b61f7b6edc995a6a84c136635b8e6e9c713ef948
99c0ae196a8ebff68faa39b67dd4e945fbe2d2be6b1ba97f8608ddd127e3b94a
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
aa02332859483bcfd41936e44d21a06b8b7b41e36813f7d705d6d8198e96ed55
afd0fac1871f97f8391758c2800f65d8f664404063449d614124bbc63723a3af
b3258a7d44fee9d1268e3b46af7f567b053967f50d867a542d230736ac6ab0ee
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
be8e3fb00d98e93afe954eb362d24a5d80537eb55c896bba9734e5771b6b34b3
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c66969e10358534b5fcc95c4383ab1d3622dd466eafd82a87495e4db55aea91a
cbcdf107408ced3e91f4fa05e504266a817b1f2245040609953ad69499575923
d13e73866324ddef9e14a8006953d244e36d8ac9f081eb3fb3052151d7f3d3c9
d2d2846040ce0726ba6ace389110fad3b2c7f1cc23caf00adc4f8a016892ad57
d5f3085127d154cbd72e219052312767d460633fafa6e38bb9a9446ddb03a270
d6e0cf33bd31faca2542d9376cc2a8b9722904e24cc4d3bfc121048e46c244ea
d75a8c2fba0ac5e9b88d219d34c5a1121e15235eab89ea08f3cfe6de6eef6cad
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
dcb2cb8b69382d1a8938f0dc69953a6c75f9420b56c2fd52d258e98b380e2982
ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50923eeab2fab42aabd0b1dd0295ed74f9bf5eec3f91bdcb4b36316a40860bc
e51d9e0382082135378a0ce6bd912851b8df45ed470f6553562eadb73ce2d21b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f84113ebbb94d57580e3b1d751fdb26aa09bd1ed44952cc3862addfc10938782
fed33cfb49c36ece03617711c0e2bcffbf277c26fa3b42debced6c821919d901

www.usuarioson.multisistemas.biz Open in urlscan Pro 162.244.82.65 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

69 Requests

100 %HTTPS

52 %IPv6

20 Domains

25 Subdomains

18 IPs

6 Countries

764 kBTransfer

1639 kBSize

2 Cookies

15 Outgoing links

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.usuarioson.multisistemas.biz Open in urlscan Pro
162.244.82.65 Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

100 %
HTTPS

52 %
IPv6

20
Domains

25
Subdomains

18
IPs

6
Countries

764 kB
Transfer

1639 kB
Size

2
Cookies

69 HTTP transactions
2 data transactions