subsbanrural.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ayudas-banrurals.liveblog365.com/
Effective URL:
https://subsbanrural.webcindario.com/gt.html?=prests
Submission: On September 13 via api (September 13th 2023, 10:17:49 pm UTC) from US — Scanned from GB

Summary HTTP 68 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 21 IPs in 5 countries across 17 domains to perform 68 HTTP transactions. The main IP is 5.57.226.202, located in Madrid, Spain and belongs to SERVIHOSTING-AS AireNetworks, ES. The main domain is subsbanrural.webcindario.com.
TLS certificate: Issued by R3 on June 24th 2023. Valid for: 3 months.

This is the only time subsbanrural.webcindario.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banrural (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 3	185.27.134.117 185.27.134.117	34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
17	5.57.226.202 5.57.226.202	29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks)
7	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	64.185.227.156 64.185.227.156	18450 (WEBNX) (WEBNX)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:13e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
16	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223c:6000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0b::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
68	21

3 185.27.134.117 (United Kingdom) 1 redirects

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)

ayudas-banrurals.liveblog365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 5.57.226.202 (Madrid, Spain)

ASN29119 (SERVIHOSTING-AS AireNetworks, ES)

subsbanrural.webcindario.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

hosting.miarroba.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.185.227.156 (United States)

ASN18450 (WEBNX, US)
PTR: 64-185-227-156.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:13e5 (United States)

ASN13335 (CLOUDFLARENET, US)

bancavirtual.banrural.com.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:ef75:8280:f209:5ba1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:6000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1542 www.google.com — Cisco Umbrella Rank: 2	64 KB
17	webcindario.com subsbanrural.webcindario.com	404 KB
10	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 105 tpc.googlesyndication.com — Cisco Umbrella Rank: 152	239 KB
3	gstatic.com fonts.gstatic.com	24 KB
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 47 stats.g.doubleclick.net — Cisco Umbrella Rank: 98	10 KB
3	liveblog365.com 1 redirects ayudas-banrurals.liveblog365.com	32 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1343 pixel.quantserve.com — Cisco Umbrella Rank: 1130	10 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 44	21 KB
2	miarroba.info hosting.miarroba.info	2 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 56 ajax.googleapis.com — Cisco Umbrella Rank: 419	32 KB
1	google.ru www.google.ru — Cisco Umbrella Rank: 9401	408 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1183	607 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1253	641 B
1	banrural.com.gt bancavirtual.banrural.com.gt — Cisco Umbrella Rank: 729772	133 KB
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 6828	515 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2903	222 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 63	66 KB
68	17

	Domain	Requested by
17	subsbanrural.webcindario.com	ayudas-banrurals.liveblog365.com subsbanrural.webcindario.com
16	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
7	pagead2.googlesyndication.com	subsbanrural.webcindario.com pagead2.googlesyndication.com tpc.googlesyndication.com
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
3	fonts.gstatic.com	fonts.googleapis.com
3	ayudas-banrurals.liveblog365.com	1 redirects ayudas-banrurals.liveblog365.com
2	www.google.com	subsbanrural.webcindario.com tpc.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	hosting.miarroba.info	subsbanrural.webcindario.com
1	www.google.ru	subsbanrural.webcindario.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	pixel.quantserve.com	subsbanrural.webcindario.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	www.googletagmanager.com
1	bancavirtual.banrural.com.gt	subsbanrural.webcindario.com
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	www.googletagmanager.com	subsbanrural.webcindario.com
1	ajax.googleapis.com	subsbanrural.webcindario.com
1	fonts.googleapis.com	subsbanrural.webcindario.com
68	22

This site contains links to these domains. Also see Links.

Domain
www.banrural.com.gt
bancavirtual.banrural.com.gt

Subject Issuer	Validity	Valid
*.webcindario.com R3	`2023-06-24` - `2023-09-22`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
miarroba.info E1	`2023-08-11` - `2023-11-09`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
ipinfo.io R3	`2023-08-09` - `2023-11-07`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.banrural.com.gt DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-18` - `2024-06-15`	a year	crt.sh
quantserve.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.google.com.ru GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://subsbanrural.webcindario.com/gt.html?=prests
Frame ID: 5F82B5A0A1DA290AE3C2229C9800E4F1
Requests: 60 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/zrt_lookup.html
Frame ID: B1566C874C3646ADFEF08C47499CE8C1
Requests: 1 HTTP requests in this frame

Frame: https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Frame ID: 5CD55F4EED129E86BB0C1B07380F00E1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1694639863&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A32768%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x540_l%7C500x540_r&format=0x0&url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&asladp=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1694643462601&bpp=31&bdt=308&idt=424&shv=r20230912&mjsv=m202309070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7692591199630&frm=20&pv=2&ga_vid=1154631013.1694643463&ga_sid=1694643463&ga_hid=1865810226&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31076839%2C31077699%2C31077703%2C31077773%2C42532403%2C31076994%2C31077789%2C44798321&oid=2&pvsid=615894623778982&tmod=955337384&uas=0&nvt=1&fsapi=1&ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=779
Frame ID: E3E0F95784260B7B73031927A43208B8
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 366D6068AA7A23E58BEC79AB55796E25
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8B91631038B6BB90B390C2C49CF64DDD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banrural

Page URL History Show full URLs

http://ayudas-banrurals.liveblog365.com/ Page URL
http://ayudas-banrurals.liveblog365.com/?i=1 HTTP 301
https://subsbanrural.webcindario.com/gt.html?=prests Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

68
Requests

97 %
HTTPS

81 %
IPv6

17
Domains

22
Subdomains

21
IPs

5
Countries

1038 kB
Transfer

2023 kB
Size

12
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.banrural.com.gt/
Title: Inicio

Search URL Search Domain Scan URL

URL: https://www.banrural.com.gt/site/BanruralCorp/GestionesFormulario.html?paginaAnterior=Personas.html
Title: Olvidé mi usuario

Search URL Search Domain Scan URL

URL: https://bancavirtual.banrural.com.gt/cb/pages/jsp-ns/login-cons.jsp
Title: close

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ayudas-banrurals.liveblog365.com/ Page URL
http://ayudas-banrurals.liveblog365.com/?i=1 HTTP 301
https://subsbanrural.webcindario.com/gt.html?=prests Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

68 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
ayudas-banrurals.liveblog365.com/ 843 B
838 B 132ms
57ms Document
text/html 185.27.134.117
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://ayudas-banrurals.liveblog365.com/
Protocol: HTTP/1.1
Server: 185.27.134.117 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: e9cf55f5eea1592be069a0e0f223e003ee3378dff62232c6f495dfd4938bd8f7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 13 Sep 2023 22:17:41 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK aes.js Show response
ayudas-banrurals.liveblog365.com/ 30 KB
31 KB 56ms
56ms Script
application/javascript 185.27.134.117
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://ayudas-banrurals.liveblog365.com/aes.js
Requested by: Host: ayudas-banrurals.liveblog365.com
URL: http://ayudas-banrurals.liveblog365.com/
Protocol: HTTP/1.1
Server: 185.27.134.117 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ayudas-banrurals.liveblog365.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Wed, 13 Sep 2023 22:17:41 GMT
Last-Modified: Sat, 08 Aug 2015 08:32:49 GMT
Server: nginx
ETag: "55c5beb1-79e6"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31206

GET
H2

200

Primary Request gt.html Show response
subsbanrural.webcindario.com/
Redirect Chain

http://ayudas-banrurals.liveblog365.com/?i=1
https://subsbanrural.webcindario.com/gt.html?=prests

15 KB
4 KB

245ms
65ms

Document
text/html

5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/gt.html?=prests
Requested by: Host: ayudas-banrurals.liveblog365.com
URL: http://ayudas-banrurals.liveblog365.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: e9d9e238ef66f8a49eafd8af370bb4d5aaa1ba61171201d6382935787967d452

Request headers

Referer: http://ayudas-banrurals.liveblog365.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 13 Sep 2023 22:17:42 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: Webcindario Hosting Service

Redirect headers

Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 260
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 13 Sep 2023 22:17:41 GMT
Expires: Wed, 13 Sep 2023 22:17:41 GMT
Location: https://subsbanrural.webcindario.com/gt.html?=prests
Server: nginx

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 217ms
104ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7475d7fb3a1cacd6a74ed3bcc7860dda1b74c30e74f99aa8133d291e5c1b449

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50542
x-xss-protection: 0
server: cafe
etag: 12164309210636407744
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:17:42 GMT

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
877 B 175ms
62ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

89c215b171f87309d651a69b7e2c2c2d0dd7a7b0cdf8ec6b72ef3458d8631ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Wed, 13 Sep 2023 22:17:42 GMT

GET
H2 200 jquery-ui.css
subsbanrural.webcindario.com/pape/ 57 KB
9 KB 77ms
75ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/jquery-ui.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 6439cc87266daaff74ba9fd244c4b6a5e5b4e0273a782ea26acb08dffb8ba440

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:40 GMT
server: nginx
etag: W/"650181b8-e4bd"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 normalize.css
subsbanrural.webcindario.com/pape/ 8 KB
3 KB 77ms
75ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/normalize.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: c8945609a935ce0e38ce4f3eaac75e764738bcffafe9a68e647055b2c516f1da

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:44 GMT
server: nginx
etag: W/"650181bc-21c6"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 font-futura.css
subsbanrural.webcindario.com/pape/ 915 B
1 KB 77ms
76ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/font-futura.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 2b8748b21696872317d6f518ee2f34fd01dc9e92ae5f836e3d0a872bc75eeb26

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
last-modified: Wed, 13 Sep 2023 09:32:38 GMT
server: nginx
etag: "650181b6-393"
x-powered-by: Webcindario Hosting Service
content-type: text/css
accept-ranges: bytes
content-length: 915

GET
H2 200 FF.min.css
subsbanrural.webcindario.com/pape/ 12 KB
2 KB 78ms
76ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/FF.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: b94497936e2ff5deea225626cb5029d5dbf640a34f3a267751f5af1db008b99e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:37 GMT
server: nginx
etag: W/"650181b5-2f5e"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 login.css
subsbanrural.webcindario.com/pape/ 33 KB
7 KB 78ms
76ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/login.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: e0ee71ccf8903462f77a37c75d04c49fa633c58a4b2cf152776bbb914dcfd477

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:42 GMT
server: nginx
etag: W/"650181ba-8549"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 layout.css
subsbanrural.webcindario.com/pape/ 13 KB
4 KB 78ms
77ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/layout.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: f4722046a6261fbad08665f4fb34bbcda5d881da85c331c1ad493d09aee5f651

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:40 GMT
server: nginx
etag: W/"650181b8-35cc"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 showLoading.min.css
subsbanrural.webcindario.com/pape/ 508 B
658 B 78ms
77ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/showLoading.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 7f25e98925c35509f28eac7b335392c5a43dfdcc2fa0ed80171e59a3c0756ad0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
last-modified: Wed, 13 Sep 2023 09:32:46 GMT
server: nginx
etag: "650181be-1fc"
x-powered-by: Webcindario Hosting Service
content-type: text/css
accept-ranges: bytes
content-length: 508

GET
H2 200 ui.selectmenu.min.css
subsbanrural.webcindario.com/pape/ 2 KB
742 B 78ms
77ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/ui.selectmenu.min.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 52d26165b37d436d7544d574dfeb5a810c66c85985dce2e26e334bb19fa7101b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:47 GMT
server: nginx
etag: W/"650181bf-876"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 180ms
52ms Script
text/javascript 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 12 Sep 2023 16:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 107933
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Sep 2024 16:18:49 GMT

GET
H2 200 nilson.png
subsbanrural.webcindario.com/pape/ 3 KB
3 KB 84ms
83ms Image
image/png 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/nilson.png
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
last-modified: Wed, 13 Sep 2023 09:32:43 GMT
server: nginx
etag: "650181bb-ab7"
x-powered-by: Webcindario Hosting Service
content-type: image/png
accept-ranges: bytes
content-length: 2743

GET
H2 200 font-awesome.css
subsbanrural.webcindario.com/pape/ 29 KB
6 KB 81ms
80ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/font-awesome.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: cf0d27974608ac6ec8e4acd56b5d5eba00ae1d65ac1d6edfde4259f0cd0e9f96

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:38 GMT
server: nginx
etag: W/"650181b6-7521"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 tesla.png
subsbanrural.webcindario.com/pape/ 5 KB
5 KB 85ms
83ms Image
image/png 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/tesla.png
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 5fc0d5c960ca212b704d31a451fc2aea06a4a7b53ead3ef98ab7b1a3a21b1eb1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
last-modified: Wed, 13 Sep 2023 09:32:47 GMT
server: nginx
etag: "650181bf-14d0"
x-powered-by: Webcindario Hosting Service
content-type: image/png
accept-ranges: bytes
content-length: 5328

GET
H2 200 Telegram.js Show response
subsbanrural.webcindario.com/ 3 KB
894 B 79ms
79ms Script
application/javascript 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/Telegram.js
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 9bf79cc6c024b28ab0fc9cbf916e87d94942e0ab5d50ca4ca34c18615291fd16

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/gt.html?=prests
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:30 GMT
server: nginx
etag: W/"650181ae-cae"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 / Show response
hosting.miarroba.info/ 1 KB
1 KB 275ms
167ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hosting.miarroba.info/?__muid=df9e997f3b19f6dc92dabbd053eaff2debb74277&h=2142533&t=1694643462&k=753c7b16866b1e4c75768a600a78ece5
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e7f25167f247bdf243fae3bc06ea612a7ce6796d9f85bc0b8253098b1c7b73c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 13 Sep 2023 22:17:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VTjgYI26ptc%2Fs9wlvwzHhTYxC%2BeSi%2BlF9yOML1nMy6baOz5ZezWAn8KnJIiwa%2Bw6DUDyEd37mFCrkjPR5TGnxXJz1DxuM0vEXOkWiY8BzV1%2BZJYGDU0GUzBiDLNlQsVKGVDWByKwoIwwiaALkZcLkdMk9oU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=iso-8859-1
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache
cf-ray: 8063c30a3e6d4182-LHR
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 180 KB
66 KB 180ms
67ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2dc96935f05685463099c8fb26e222eaee7e0292fa5023e99ee178bd603f0ed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67375
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 21:21:55 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 13 Sep 2023 22:17:42 GMT

GET
H2 200 icons.css
subsbanrural.webcindario.com/pape/ 48 KB
7 KB 143ms
143ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/icons.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 9c18722da234f453de03c0b6992c350628501160dee0d1c022198268af352cc0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:39 GMT
server: nginx
etag: W/"650181b7-c191"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 forms.css
subsbanrural.webcindario.com/pape/ 33 KB
6 KB 143ms
143ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/forms.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 3a7941e1d0a24e8551e50b4897372a865d4da0d4d7378aa0e8cfcd0ee893c548

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:39 GMT
server: nginx
etag: W/"650181b7-847e"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H2 200 commons.css
subsbanrural.webcindario.com/pape/ 18 KB
5 KB 144ms
143ms Stylesheet
text/css 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to

Full URL: https://subsbanrural.webcindario.com/pape/commons.css
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 04272b51fed9af20e39ac1afb27c5ae5d93cce30b5b068bdb39b6bb7f8511ff9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: gzip
last-modified: Wed, 13 Sep 2023 09:32:37 GMT
server: nginx
etag: W/"650181b5-47df"
x-powered-by: Webcindario Hosting Service
vary: Accept-Encoding
content-type: text/css

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309070101/ 378 KB
129 KB 224ms
118ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7294310421616689&plah=subsbanrural.webcindario.com&bust=31077789

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8120dd80fc7d3e740b4039b7bbf37fdf122e3e8548f690243b675c7f934dd4f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131522
x-xss-protection: 0
server: cafe
etag: 4354116305210183213
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:17:42 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/ Frame B156 10 KB
5 KB 165ms
52ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230912/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7294310421616689

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

age: 1342
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4438
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 21:55:20 GMT
etag: 8554266389219770021
expires: Wed, 27 Sep 2023 21:55:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 352ms
113ms XHR
application/json 64.185.227.156
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.185.227.156 , United States, ASN18450 (WEBNX, US),
Reverse DNS: 64-185-227-156.static.webnx.com
Software: nginx/1.25.1 /
Resource Hash: 1e156ef707047ce51226a1fa213c119c1282d7fcef1f99d3e9a2637306569645

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 13 Sep 2023 22:17:42 GMT
Server: nginx/1.25.1
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET
H2 200 / Show response
ipinfo.io/ 253 B
515 B 274ms
165ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

b62b83d88e3538c7355619ae76f33139bee564c0ba4a7d67953c2d6239c7a784

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 bg-login-1.jpg
subsbanrural.webcindario.com/pape/ 340 KB
341 KB 83ms
83ms Image
image/jpeg 5.57.226.202
SERVIHOSTING-AS A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subsbanrural.webcindario.com/pape/bg-login-1.jpg
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/login.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: e2bc7402cff9d4252634885c4541611db2482b56e2fc03c1a6475e2ec81564ea

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/pape/login.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:42 GMT
last-modified: Wed, 13 Sep 2023 09:32:36 GMT
server: nginx
etag: "650181b4-55077"
x-powered-by: Webcindario Hosting Service
content-type: image/jpeg
accept-ranges: bytes
content-length: 348279

GET
H2 200 pxiByp8kv8JHgFVrLDz8Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 171ms
58ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 08 Sep 2023 15:14:29 GMT
x-content-type-options: nosniff
age: 457393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7840
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:05:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Sep 2024 15:14:29 GMT

GET
H2 200 icons-new.png
bancavirtual.banrural.com.gt/cb/web/images/ 132 KB
133 KB 731ms
610ms Image
image/png 2606:4700::6812:13e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bancavirtual.banrural.com.gt/cb/web/images/icons-new.png

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/pape/icons.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:13e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Servlet/3.0

Resource Hash

006bc55beae308cdb1965abc2f7a382d92bf0c4138469ffaafbb9db0d1df5c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 24 Aug 2023 21:47:52 GMT
server: cloudflare
x-powered-by: Servlet/3.0
x-frame-options: SAMEORIGIN
content-type: image/png
content-language: en-US
cache-control: public,max-age=86400, must-revalidate
cf-ray: 8063c30a5acb3690-LHR
content-length: 135508
retry-after: Thu, 14 Sep 2023 02:17:43 GMT
expires: Thu, 14 Sep 2023 02:17:43 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 90ms
52ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 07 Sep 2023 21:12:23 GMT
x-content-type-options: nosniff
age: 522319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:10:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Sep 2024 21:12:23 GMT

GET
H2 200 pxiByp8kv8JHgFVrLDD4Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 104ms
66ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDD4Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://subsbanrural.webcindario.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 08 Sep 2023 23:17:23 GMT
x-content-type-options: nosniff
age: 428419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7824
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:15:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Sep 2024 23:17:23 GMT

POST
H2 200 607f6b0b381bbc1f64fa027d62891072_cookie.php Show response
hosting.miarroba.info/ Frame 5CD5 46 B
445 B 98ms
98ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19603242f3bfa5b6cf922d65bc2353813d1b4c3a4b970638f3fa1c5b6dd39a88

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://subsbanrural.webcindario.com
Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8063c30b58c04182-LHR
content-encoding: br
content-type: text/html; charset=iso-8859-1
date: Wed, 13 Sep 2023 22:17:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i5f3GVjt%2FYGFJbC7gxyhp8mhPr5gLNHmqZBqxnhJeqMFRmgk2LAmzl5vJUjdgknN719MmME74INWeuc4929ZvzTA5EKm%2F%2B6HKSwvUMc%2BlF7NALdBrTrkvIpfnF8sWZeF3%2BWWZ6TlrZfMBwcv6PWAFSLG2YU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 173ms
55ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 13 Sep 2023 21:44:21 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2002
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 13 Sep 2023 23:44:21 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 216ms
62ms Script
application/javascript 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
content-encoding: gzip
etag: "6ioqmyHWSWLYz5hkRjy8Uw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 20 Sep 2023 22:17:43 GMT

GET
H2 200 ca-pub-7294310421616689 Show response
fundingchoicesmessages.google.com/i/ 154 KB
51 KB 213ms
85ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-7294310421616689?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7294310421616689&plah=subsbanrural.webcindario.com&bust=31077789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ea115978da013d183a74551134ada969413a07753608aabd6aa3f2edeeef8988

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-OXN5w2Y7yeNxvuwfUvgeYQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
content-security-policy: script-src 'nonce-OXN5w2Y7yeNxvuwfUvgeYQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
218 B 62ms
62ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1865810226&t=pageview&_s=1&dl=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&dr=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&ul=en-us&de=UTF-8&dt=Banrural&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABCAAAAC~&jid=485113475&gjid=468783056&cid=1154631013.1694643463&tid=UA-597118-7&_gid=847769151.1694643463&_r=1&_slc=1&gtm=45He39b0n71T2VG59&z=852719655

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://subsbanrural.webcindario.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-d5x2uDVHd7ALE.js Show response
rules.quantcount.com/ 160 B
641 B 189ms
54ms Script
application/javascript 2600:9000:223c:6000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-d5x2uDVHd7ALE.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d60c833406c5cca9095b3cabd40d6f65e486a0a4c0b59105031c9a6e94595f5a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:00:39 GMT
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 1560
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 22:55:53 GMT
server: AmazonS3
etag: "ceee564f54e512a948f918e2710eab6e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: 7c0wjV-Dru6028qWoah4EIt6wx65xhaUfs6AVbnlvpj_HW2HI882NQ==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
358 B 163ms
54ms XHR
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-597118-7&cid=1154631013.1694643463&jid=485113475&gjid=468783056&_gid=847769151.1694643463&_u=YEBAAAAACAAAAC~&z=1092806028

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0cb3ad59518a9b556a3900b3f67c8312cf1f2db88f77cbadad1e6e4f7b425e0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 13 Sep 2023 22:17:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://subsbanrural.webcindario.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=898913263;source=gtm;rf=0;a=p-d5x2uDVHd7ALE;url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests;ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F;uht=2;fpan=1;fpa=P0-198...
pixel.quantserve.com/ 35 B
324 B 65ms
56ms Image
image/gif 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.quantserve.com/pixel;r=898913263;source=gtm;rf=0;a=p-d5x2uDVHd7ALE;url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests;ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F;uht=2;fpan=1;fpa=P0-1982149865-1694643463142;pbc=;ns=0;ce=1;qjs=1;qv=44310d19-20230908150619;cm=;gdpr=0;d=webcindario.com;dst=1;et=1694643463334;tzo=-60;ogl=;ses=9e3ecd64-270d-4010-9ee6-48e20d02c466;mdl=
Requested by: Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
date: Wed, 13 Sep 2023 22:17:43 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 397 B
607 B 173ms
60ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=subsbanrural.webcindario.com&callback=_gfp_s_&client=ca-pub-7294310421616689

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

426d2193190620c66de89c295a9e0d6ec79659a5dd227e46bf33b8b86c6e4f6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E3E0 11 KB
5 KB 182ms
181ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1694639863&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A32768%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x540_l%7C500x540_r&format=0x0&url=https%3A%2F%2Fsubsbanrural.webcindario.com%2Fgt.html%3F%3Dprests&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&asladp=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1694643462601&bpp=31&bdt=308&idt=424&shv=r20230912&mjsv=m202309070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7692591199630&frm=20&pv=2&ga_vid=1154631013.1694643463&ga_sid=1694643463&ga_hid=1865810226&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31076839%2C31077699%2C31077703%2C31077773%2C42532403%2C31076994%2C31077789%2C44798321&oid=2&pvsid=615894623778982&tmod=955337384&uas=0&nvt=1&fsapi=1&ref=http%3A%2F%2Fayudas-banrurals.liveblog365.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=779

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc5a9f12c197aebecf1c974f2c49197ebbebe240b36de6b7797eee6c794d925f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 4593
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 22:17:43 GMT
expires: Wed, 13 Sep 2023 22:17:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxWKZf-mBzufJZTsdk6_n_VjdB5A6RCUBpCUbNkoZfiESoeM3nV5FETYlzf2oJXEYcVGe2haRD4Ij3ie-LtNM3iU2RFvUNyd1rH6olTlTFymnsF9mKBbAcNtt0ysbs39FhvK6KiHGw== Show response
fundingchoicesmessages.google.com/f/ 13 KB
6 KB 100ms
99ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWKZf-mBzufJZTsdk6_n_VjdB5A6RCUBpCUbNkoZfiESoeM3nV5FETYlzf2oJXEYcVGe2haRD4Ij3ie-LtNM3iU2RFvUNyd1rH6olTlTFymnsF9mKBbAcNtt0ysbs39FhvK6KiHGw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQzNDYzLDM4NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9zdWJzYmFucnVyYWwud2ViY2luZGFyaW8uY29tL2d0Lmh0bWwiLG51bGwsW1s4LCJLcDkzRFhuOWxBSSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cbead066082aa70483aa63de41559905e2bcdb9cfe0b4c284b9993ad9670aaaa

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-5RZQ9mUfAQx2RAHyBTFMAg' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
content-security-policy: script-src 'nonce-5RZQ9mUfAQx2RAHyBTFMAg' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 176ms
63ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-597118-7&cid=1154631013.1694643463&jid=485113475&_u=YEBAAAAACAAAAC~&z=1324575784

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ru/ads/ 42 B
408 B 189ms
64ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ru/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-597118-7&cid=1154631013.1694643463&jid=485113475&_u=YEBAAAAACAAAAC~&z=1324575784

Requested by

Host: subsbanrural.webcindario.com
URL: https://subsbanrural.webcindario.com/gt.html?=prests

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 101ms
100ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230912&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f229df00a8b46f8d985ce750fda5e5be496069cb3989e44c060aac004c1b0073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11653
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 186ms
73ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 13 Sep 2023 22:17:44 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 366D 13 KB
5 KB 54ms
52ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1209
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 21:57:35 GMT
expires: Thu, 12 Sep 2024 21:57:35 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8B91 829 B
978 B 63ms
62ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

316ba4b15210b438f27d1d7a2fff7eb27311d492750b578edd31870933c33da2

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce--1GlJ8Zd-BtrZNep-eTm5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'self';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subsbanrural.webcindario.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 534
content-security-policy: script-src 'nonce--1GlJ8Zd-BtrZNep-eTm5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'self';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Sep 2023 22:17:44 GMT
expires: Wed, 13 Sep 2023 22:17:44 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Uw2xNewqLMvs4rZz24Xmy1GvWBTM7qWVeNEZF5moV5c.js Show response
pagead2.googlesyndication.com/bg/ Frame 366D 37 KB
14 KB 54ms
52ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Uw2xNewqLMvs4rZz24Xmy1GvWBTM7qWVeNEZF5moV5c.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

530db135ec2a2ccbece2b673db85e6cb51af5814cceea59578d1191799a85797

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:34:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2603
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 04 Sep 2023 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Sep 2024 21:34:21 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8B91 0
0 86ms
85ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230912&jk=615894623778982&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 366D 0
10 B 60ms
60ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?T5YLzA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:44 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
66 B 69ms
68ms Image
image/gif 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=0.5565133153907602

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'nonce-v8EdzfNkpisM43EGt5o0wQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:44 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'nonce-v8EdzfNkpisM43EGt5o0wQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
66 B 66ms
65ms Image
image/gif 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=9.87091279625187

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-islO1sBkQAEralvwoor9ow' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 13 Sep 2023 22:17:44 GMT
content-security-policy: script-src 'nonce-islO1sBkQAEralvwoor9ow' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 170ms
64ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-z3ZltufarV7niuI8EPY1cA' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:44 GMT
content-security-policy: script-src 'nonce-z3ZltufarV7niuI8EPY1cA' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230912&jk=615894623778982&bg=!vb6lvvHNAAa6D61Rmg87ADQBe5WfOLyWydmLbEvN6_0mGeKptdI748EDs2p02jhk_RKNNi4gHODcxuTmv3aoBcCaNdEuAgAAAE5SAAAACGgBBwoAeBEW1cJ-iRDKhQj0WMwr8d5-ctsXoKu6EisVm0082qhpr7BWcgFFb_25zrXcyIgdxQJ6ZDX5H6fLVKGaN1KgUfbPlWMeHPGd_vjNsBhc8sp17QLJNW0XbuPQ-2Gex9HqExCgB9rTHbLoINOMuRQOlSIDi-rv9fqqtpkCq9lcz5Pf3NVomVwU-bI-1Mk6w8FKHo6FRh-JqTEAwaqcgkCT0tuhB6F68PC8qasg58kchXfV1DbX5WnqwiPGJ0Mia9IpHc0iZqKHcJu4p8P5FDbZXylhyMfKoye28IZFzleTIOS-WVyz8qUP-PBI-WqB2a8F4SEz4W6cX6yHecyY8ia1ys1XNOny0g9xNacimuXpo1WqmVN7_Alx5m-RueDSy8Cac2WJOe17Lj68mfvaSTbBAYCKJgzZI6qeKsTga63ccZhUF8KOM2aIC_wqX8Umv7pb_N05owkIjWEIlO8WmK2HF9uqJWS6S-KQS2bcPwFJjE75XyaDM2xB2QbFzDgTzSRb8490Lhzx5QfU36XwFKTAgLS50-BDBAdkwfvHG4XdwOVdjH3cIB-1iKMIfegt4sFcHrlcBKVkyOZJaBGg-LZQRXu_M3RCjzyRMy7q17CybiGg8OxmK8subGjGjW7gZHp2cPZufGrCjWKsa_5MZy-WNK0nThlUaO6AmIOktKb17Cyef2cLahntga65LqOsPo1xJI6Jrvx-tDuttit0CbnlaOIieIgVek4TRHTO5jhVwKYqoKGTWdbzpuDJ2AdW-pGRU3UNPxOggiMW2dR_3gU-4pCOK8lLtUusxy8xWj-XKZZfiIh1EW0478NvD0klZ-kY_GPiUNtJPqJTe5aqPngLwrGUxsSMwfIVo99VACnQKLP434tuqKuEPwiYwaOcehXmx2yKewrxup2ZlaCALH3Xc6qFvYAlgXt16suwkxBuqPJoJvHDwsYlmHrrwA0ckIyzL6mg6spJ39-aI7FSYiJ3eHCDzKdEp3LvqxHfj1uJ22QdsFCs_jqNDTCqBl2MggVzOfOJrpVdzErRhqrCa8xN0Cs66bOq3A_8OpE3zGIoF4jBG30jh0jA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

GET
H3 200 gafsads Show response
fundingchoicesmessages.google.com/f/AGSKWxWlJgC7y2upDXbChl9X5LxP0W48Y3_aBC4s9hwdQn2TosVHOZhIbuLOaipmJmv3ljU7TwkEDiQrGJsGGBHFkGl5MU-gav_cTHd6xg8_kIn1iFPtD52SofUTU5rayzjhPNkGh3sTE13Si5bAyo8ig8IPyKe2y... 54 B
107 B 70ms
69ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWlJgC7y2upDXbChl9X5LxP0W48Y3_aBC4s9hwdQn2TosVHOZhIbuLOaipmJmv3ljU7TwkEDiQrGJsGGBHFkGl5MU-gav_cTHd6xg8_kIn1iFPtD52SofUTU5rayzjhPNkGh3sTE13Si5bAyo8ig8IPyKe2yFeftxBxAXJ_VoP0yTqVllmr4k7kTWPM/_/adspot./gafsads?/adperf_-ads.swf/ads-footer.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5284eedb77d5a55ce92b2312abcaa63c9d50c4de07e190d92c513f9ea1a42f2a

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-VtHFfIWT3E20F6-BzwkI2g' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: script-src 'nonce-VtHFfIWT3E20F6-BzwkI2g' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 61 KB
23 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.Kp93DXn9lAI.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMy1ubRGIkmy2vkhkm6hk-LrCnDbKA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a95451be6e53fa4a280c90276478ea0365428962a3ff0db8290da826600b552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:47:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1806
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23241
x-xss-protection: 0
server: cafe
etag: 13973718040851992629
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 13 Sep 2023 22:47:39 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 65ms
65ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-ZbBu7J9SoQgDSnMdeY51YQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: script-src 'nonce-ZbBu7J9SoQgDSnMdeY51YQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 65ms
65ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-Cm6smAQErGv7oabxKslQXw' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-Cm6smAQErGv7oabxKslQXw' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 91ms
91ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-GvR1JagUlfHdYnjbF6tTkw' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-GvR1JagUlfHdYnjbF6tTkw' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 103ms
103ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-Y3Fx4WUUCH69GbBQ3nD4ug' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-Y3Fx4WUUCH69GbBQ3nD4ug' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxU528XETHzBj80ju4LX93agQuer_jwf-t3gmFMr-rv-E0e_5migjUVvDOoI-qdZ3TaTBl-qUi2S8kVllrEaSF6bgEx3yx5XoIzeQceFxk9_u1bey-VhAFpu-0VlXZtU7sIq4z38FQ== Show response
fundingchoicesmessages.google.com/f/ 4 KB
2 KB 81ms
81ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU528XETHzBj80ju4LX93agQuer_jwf-t3gmFMr-rv-E0e_5migjUVvDOoI-qdZ3TaTBl-qUi2S8kVllrEaSF6bgEx3yx5XoIzeQceFxk9_u1bey-VhAFpu-0VlXZtU7sIq4z38FQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQzNDY1LDIzODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vc3Vic2JhbnJ1cmFsLndlYmNpbmRhcmlvLmNvbS9ndC5odG1sIixudWxsLFtbOCwiS3A5M0RYbjlsQUkiXSxbOSwiZW4tR0IiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b8fb7706a677b47452c9530b44a4e09881b42f1b6ee7fbf4fc946b37637540e0

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-Oezu6qCwFjPz7KbKVl_00Q' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: script-src 'nonce-Oezu6qCwFjPz7KbKVl_00Q' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 67ms
66ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-XA1Gc3Kf6W9fMund2wdwhQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: script-src 'nonce-XA1Gc3Kf6W9fMund2wdwhQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxVSNmlA503taGNdsQl9jTIxZmUwOYTSC2Vs0Hu-EGiPZR3gr_mUeCOz-qF2O5lC3x9Z3t-aA89iW6z5H8im2lQNpbvJX9UTyQEsTbE57got9ci8A7w9HJHKBTGs7Yce9TyUFvvNpQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 82ms
82ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVSNmlA503taGNdsQl9jTIxZmUwOYTSC2Vs0Hu-EGiPZR3gr_mUeCOz-qF2O5lC3x9Z3t-aA89iW6z5H8im2lQNpbvJX9UTyQEsTbE57got9ci8A7w9HJHKBTGs7Yce9TyUFvvNpQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQzNDY1LDMyNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vc3Vic2JhbnJ1cmFsLndlYmNpbmRhcmlvLmNvbS9ndC5odG1sIixudWxsLFtbOCwiS3A5M0RYbjlsQUkiXSxbOSwiZW4tR0IiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7022c8a6d863ec84bec128b9daa6939363bdb5b2a1b62c4662cba7156b1da876

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-XRI4S6Ttj8c1sUccf30t5A' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: script-src 'nonce-XRI4S6Ttj8c1sUccf30t5A' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUWgSEIeBuLaAIw6HL1v_3sYn1OkhH9JkNwHaBU8yAyL6t6fZzABXAAP6LLMQH0cqWdt24dUDRYIC2RvymcLfxSrZ_BF0XejyGq_Kt4LibEuv_cD9X6mfrpd7iAcgGwYkjKG0gWxA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 85ms
85ms Script
application/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUWgSEIeBuLaAIw6HL1v_3sYn1OkhH9JkNwHaBU8yAyL6t6fZzABXAAP6LLMQH0cqWdt24dUDRYIC2RvymcLfxSrZ_BF0XejyGq_Kt4LibEuv_cD9X6mfrpd7iAcgGwYkjKG0gWxA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk0NjQzNDY1LDQxMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZXMiLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9zdWJzYmFucnVyYWwud2ViY2luZGFyaW8uY29tL2d0Lmh0bWwiLG51bGwsW1s4LCJLcDkzRFhuOWxBSSJdLFs5LCJlbi1HQiJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d574d5200ae561f1af66a5063e8c3a434c4b2a629082c5e096886427da571748

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'nonce-JAPCu0veTWhCXVD8jHlv0A' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://subsbanrural.webcindario.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'nonce-JAPCu0veTWhCXVD8jHlv0A' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self'
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUcBsoa8a4VxJvtcpmoZa3Bf3mZtQxrf8dVS_tcGDAyQC10vEWKEqqNNN-adzy8gwGbUk42VX2b0hb3wBJH-e3kFc9TXPugTjtoBJVqan_jKcrFBU7Zkz9g5YjVv3lFQm4DeS4YcQ== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 65ms
65ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUcBsoa8a4VxJvtcpmoZa3Bf3mZtQxrf8dVS_tcGDAyQC10vEWKEqqNNN-adzy8gwGbUk42VX2b0hb3wBJH-e3kFc9TXPugTjtoBJVqan_jKcrFBU7Zkz9g5YjVv3lFQm4DeS4YcQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-bdcB7Y8-I3QHOV5a1vCf0g' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-bdcB7Y8-I3QHOV5a1vCf0g' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://subsbanrural.webcindario.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw== Show response
fundingchoicesmessages.google.com/el/ 0
26 B 73ms
73ms XHR
text/html 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUzBAjvLAMqDQbbwX7i0SgnnnnjbhvG9B2CiUC8aHD51jd6LtxcLHu-F_UeOSDPU1SxA1LaTc1X1WXVIvavxfb9CpUQ0KfhgrV_cHi0yu5r2bKS5Osn6UX17h8MtLxEKcpctgw5zw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-qmKT4Tv_lSvFaWAKLNk9cQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://subsbanrural.webcindario.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

date: Wed, 13 Sep 2023 22:17:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'nonce-qmKT4Tv_lSvFaWAKLNk9cQ' 'unsafe-inline';object-src 'self';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self'
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://subsbanrural.webcindario.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banrural (Banking)

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ayudas-banrurals.liveblog365.com/	1970-01-21 00:20:03	Name: __test Value: 080c7aed123b5876150a30dde2573145
.webcindario.com/	1970-01-21 00:20:03	Name: __muid Value: df9e997f3b19f6dc92dabbd053eaff2debb74277
.subsbanrural.webcindario.com/	1970-01-21 00:20:03	Name: _ga Value: GA1.3.1154631013.1694643463
.subsbanrural.webcindario.com/	1970-01-20 14:45:29	Name: _gid Value: GA1.3.847769151.1694643463
.subsbanrural.webcindario.com/	1970-01-20 14:44:03	Name: _gat_UA-597118-7 Value: 1
bancavirtual.banrural.com.gt/	1969-12-31 23:59:59	Name: UHTWMETM Value: 028f09417e-ddad-4ag6PtLHEIizdC7r03joqBp4nZ4kyMG6CFS5xnCOC8qx8mfrFyKSYwwlEOjrl-TyT1Uek
.bancavirtual.banrural.com.gt/	1970-01-20 14:44:05	Name: __cf_bm Value: 3FqA2MuJD7i2.d5wif6Uj66gfNf7GiUGqj.F7WIJkio-1694643463-0-ATXCwp81U9uNLm4r5BPzPzYfqNzIwIAfvh9yYLnGTBWXjNVjpTFzXvV75jmyCr0zdbfFYJsNtQ2S2Pp45C7HuXk=
.webcindario.com/	1970-01-21 00:08:32	Name: __qca Value: P0-1982149865-1694643463142
.webcindario.com/	1970-01-21 00:05:39	Name: __gads Value: ID=fc0b7adfadb0a87b-22d94fd570de00f4:T=1694643463:RT=1694643463:S=ALNI_MYqSm5N6xFDF_-h6m4in51w0nX3zA
.webcindario.com/	1970-01-21 00:05:39	Name: __gpi Value: UID=00000d927b1cce2b:T=1694643463:RT=1694643463:S=ALNI_Mbjy9LZjf26us3biMyrJCoGuCmP-Q
.doubleclick.net/	1970-01-20 14:44:04	Name: test_cookie Value: CheckForPermission
.webcindario.com/	1970-01-20 23:29:39	Name: FCNEC Value: %5B%5B%22AKsRol-GzDEPTZf0RJxeJArP2XnWwavlq84m7nCHewGKRiZJH2fwTZ6Cd9tvhOesTLZgZrlbtqVS3ntPoR8Km3W-dy2qzb9Pf0_gc-nwt2c2llmLqWqjU0_USbuqzV4OWJnXtuXNl38CcghtqCSkOHCNcRy2g8ZXaQ%3D%3D%22%5D%2Cnull%2C%5B%5D%5D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
ayudas-banrurals.liveblog365.com
bancavirtual.banrural.com.gt
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
hosting.miarroba.info
ipinfo.io
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.quantserve.com
rules.quantcount.com
secure.quantserve.com
stats.g.doubleclick.net
subsbanrural.webcindario.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.ru
www.googletagmanager.com
185.27.134.117
2600:9000:223c:6000:6:44e3:f8c0:93a1
2606:4700::6812:13e5
2620:116:800d:21:ef75:8280:f209:5ba1
2a00:1450:4001:806::2003
2a00:1450:4001:808::2002
2a00:1450:4001:809::200a
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:80e::200a
2a00:1450:4001:80f::2001
2a00:1450:4001:81c::200e
2a00:1450:4001:829::2004
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2003
2a00:1450:400c:c0b::9b
2a06:98c1:3121::3
34.117.59.81
5.57.226.202
64.185.227.156
006bc55beae308cdb1965abc2f7a382d92bf0c4138469ffaafbb9db0d1df5c4f
04272b51fed9af20e39ac1afb27c5ae5d93cce30b5b068bdb39b6bb7f8511ff9
0cb3ad59518a9b556a3900b3f67c8312cf1f2db88f77cbadad1e6e4f7b425e0c
19603242f3bfa5b6cf922d65bc2353813d1b4c3a4b970638f3fa1c5b6dd39a88
1e156ef707047ce51226a1fa213c119c1282d7fcef1f99d3e9a2637306569645
2b8748b21696872317d6f518ee2f34fd01dc9e92ae5f836e3d0a872bc75eeb26
2dc96935f05685463099c8fb26e222eaee7e0292fa5023e99ee178bd603f0ed6
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
316ba4b15210b438f27d1d7a2fff7eb27311d492750b578edd31870933c33da2
3a7941e1d0a24e8551e50b4897372a865d4da0d4d7378aa0e8cfcd0ee893c548
426d2193190620c66de89c295a9e0d6ec79659a5dd227e46bf33b8b86c6e4f6c
4a95451be6e53fa4a280c90276478ea0365428962a3ff0db8290da826600b552
5284eedb77d5a55ce92b2312abcaa63c9d50c4de07e190d92c513f9ea1a42f2a
52d26165b37d436d7544d574dfeb5a810c66c85985dce2e26e334bb19fa7101b
530db135ec2a2ccbece2b673db85e6cb51af5814cceea59578d1191799a85797
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5fc0d5c960ca212b704d31a451fc2aea06a4a7b53ead3ef98ab7b1a3a21b1eb1
60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6439cc87266daaff74ba9fd244c4b6a5e5b4e0273a782ea26acb08dffb8ba440
7022c8a6d863ec84bec128b9daa6939363bdb5b2a1b62c4662cba7156b1da876
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb
7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4
7f25e98925c35509f28eac7b335392c5a43dfdcc2fa0ed80171e59a3c0756ad0
8120dd80fc7d3e740b4039b7bbf37fdf122e3e8548f690243b675c7f934dd4f6
89c215b171f87309d651a69b7e2c2c2d0dd7a7b0cdf8ec6b72ef3458d8631ca0
8e7f25167f247bdf243fae3bc06ea612a7ce6796d9f85bc0b8253098b1c7b73c
9bf79cc6c024b28ab0fc9cbf916e87d94942e0ab5d50ca4ca34c18615291fd16
9c18722da234f453de03c0b6992c350628501160dee0d1c022198268af352cc0
a011595b8a7a4aecacbb9bdd095cf4e446e368e8c897b2daf1807e6016137c1a
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b62b83d88e3538c7355619ae76f33139bee564c0ba4a7d67953c2d6239c7a784
b7475d7fb3a1cacd6a74ed3bcc7860dda1b74c30e74f99aa8133d291e5c1b449
b8fb7706a677b47452c9530b44a4e09881b42f1b6ee7fbf4fc946b37637540e0
b94497936e2ff5deea225626cb5029d5dbf640a34f3a267751f5af1db008b99e
c8945609a935ce0e38ce4f3eaac75e764738bcffafe9a68e647055b2c516f1da
cbead066082aa70483aa63de41559905e2bcdb9cfe0b4c284b9993ad9670aaaa
cc5a9f12c197aebecf1c974f2c49197ebbebe240b36de6b7797eee6c794d925f
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
cf0d27974608ac6ec8e4acd56b5d5eba00ae1d65ac1d6edfde4259f0cd0e9f96
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
d574d5200ae561f1af66a5063e8c3a434c4b2a629082c5e096886427da571748
d60c833406c5cca9095b3cabd40d6f65e486a0a4c0b59105031c9a6e94595f5a
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0ee71ccf8903462f77a37c75d04c49fa633c58a4b2cf152776bbb914dcfd477
e2bc7402cff9d4252634885c4541611db2482b56e2fc03c1a6475e2ec81564ea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9cf55f5eea1592be069a0e0f223e003ee3378dff62232c6f495dfd4938bd8f7
e9d9e238ef66f8a49eafd8af370bb4d5aaa1ba61171201d6382935787967d452
ea115978da013d183a74551134ada969413a07753608aabd6aa3f2edeeef8988
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f229df00a8b46f8d985ce750fda5e5be496069cb3989e44c060aac004c1b0073
f4722046a6261fbad08665f4fb34bbcda5d881da85c331c1ad493d09aee5f651
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

subsbanrural.webcindario.com Open in urlscan Pro 5.57.226.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

68 Requests

97 %HTTPS

81 %IPv6

17 Domains

22 Subdomains

21 IPs

5 Countries

1038 kBTransfer

2023 kBSize

12 Cookies

3 Outgoing links

Page URL History

Redirected requests

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

subsbanrural.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

68
Requests

97 %
HTTPS

81 %
IPv6

17
Domains

22
Subdomains

21
IPs

5
Countries

1038 kB
Transfer

2023 kB
Size

12
Cookies

68 HTTP transactions
0 data transactions