www.veronicdicaire.com Open in urlscan Pro
107.181.163.26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://v.ht/9agv
Effective URL:
https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Submission: On April 15 via manual (April 15th 2020, 7:12:17 am UTC) from GB

Summary HTTP 77 Redirects Behaviour Indicators

Summary

This website contacted 14 IPs in 4 countries across 15 domains to perform 77 HTTP transactions. The main IP is 107.181.163.26, located in Atlanta, United States and belongs to TOTAL-SERVER-SOLUTIONS, US. The main domain is www.veronicdicaire.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 14th 2020. Valid for: 3 months.

This is the only time www.veronicdicaire.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	69.61.26.122 69.61.26.122	22653 (GLOBALCOM...) (GLOBALCOMPASS)
3	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
3	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
2 2	162.214.70.142 162.214.70.142	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	195.216.243.155 195.216.243.155	57724 (DDOS-GUARD) (DDOS-GUARD)
2	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
2	107.181.163.26 107.181.163.26	46562 (TOTAL-SER...) (TOTAL-SERVER-SOLUTIONS)
1 4	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1 2	88.212.201.216 88.212.201.216	39134 (UNITEDNET) (UNITEDNET)
8	122.51.111.126 122.51.111.126	45090 (CNNIC-TEN...) (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
1	2606:4700::68... 2606:4700::6810:84e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
77	14

1 69.61.26.122 (Atlanta, United States)

ASN22653 (GLOBALCOMPASS, US)

v.ht	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.214.70.142 (Provo, United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-214-70-142.unifiedlayer.com

www.indianz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.216.243.155 (Moscow, Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: s5.unet.com

u.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.181.163.26 (Atlanta, United States)

ASN46562 (TOTAL-SERVER-SOLUTIONS, US)
PTR: SERV-11003.newsabah.net

www.veronicdicaire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.216 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host216.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 122.51.111.126 (Beijing, China)

ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

timetax.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:84e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	timetax.cn timetax.cn	63 KB
5	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	10 KB
4	yandex.ru 1 redirects mc.yandex.ru	95 KB
3	doubleclick.net securepubads.g.doubleclick.net	86 KB
2	yadro.ru 1 redirects counter.yadro.ru	935 B
2	veronicdicaire.com www.veronicdicaire.com	61 KB
2	indianz.com 2 redirects www.indianz.com	465 B
2	google-analytics.com www.google-analytics.com	18 KB
1	cloudflare.com cdnjs.cloudflare.com	30 KB
1	u.to u.to	1 KB
1	google.com adservice.google.com	171 B
1	google.de adservice.google.de	171 B
1	googletagmanager.com www.googletagmanager.com	30 KB
1	googletagservices.com www.googletagservices.com	14 KB
1	v.ht v.ht	2 KB
77	15

	Domain	Requested by
8	timetax.cn	www.veronicdicaire.com
4	mc.yandex.ru	1 redirects u.to
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	counter.yadro.ru	1 redirects
2	www.veronicdicaire.com	u.to v.ht
2	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
2	www.indianz.com	2 redirects
2	www.google-analytics.com	www.googletagmanager.com v.ht
1	cdnjs.cloudflare.com	www.veronicdicaire.com
1	u.to	v.ht
1	adservice.google.com	www.googletagservices.com
1	adservice.google.de	www.googletagservices.com
1	www.googletagmanager.com	v.ht
1	www.googletagservices.com	v.ht
1	v.ht
77	16

This site contains no links.

Subject Issuer	Validity	Valid
www.v.ht Let's Encrypt Authority X3	`2020-04-11` - `2020-07-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
u.to Sectigo RSA Domain Validation Secure Server CA	`2019-08-23` - `2021-08-22`	2 years	crt.sh
veronicdicaire.com cPanel, Inc. Certification Authority	`2020-04-14` - `2020-07-13`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2019-09-23` - `2020-09-22`	a year	crt.sh
counter.yadro.ru GoGetSSL ECC DV CA	`2020-02-02` - `2022-05-02`	2 years	crt.sh
timetax.cn TrustAsia TLS RSA CA	`2020-01-02` - `2021-01-01`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Frame ID: E7B950C852FD2265C10959F8E2A91A95
Requests: 76 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: DC15E9CE065832B84F0526856CB99477
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://v.ht/9agv Page URL
http://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 301
https://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 302
https://u.to/4LQUGA Page URL
https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/?hit=pm1110vc0qpvqze Page URL
https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0 Page URL

Page Statistics

77
Requests

40 %
HTTPS

50 %
IPv6

15
Domains

16
Subdomains

14
IPs

4
Countries

408 kB
Transfer

1251 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://v.ht/9agv Page URL
http://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 301
https://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 302
https://u.to/4LQUGA Page URL
https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/?hit=pm1110vc0qpvqze Page URL
https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

http://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 301
https://www.indianz.com/my.asp?url=https://u.to/4LQUGA HTTP 302
https://u.to/4LQUGA

Request Chain 18

https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461 HTTP 302
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461

Request Chain 19

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200415091151%3Aet%3A1586934712%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1029298416%3Ahid%3A978926184%3Ads%3A1%2C218%2C71%2C0%2C875%2C0%2C0%2C%2C%2C1175%2C%2C%2C%3Agdpr%3A14%3Av%3A1845%3Awv%3A2%3Ast%3A1586934712%3Au%3A1586934712682626738%3At%3ARedirecting HTTP 302
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200415091151%3Aet%3A1586934712%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1029298416%3Ahid%3A978926184%3Ads%3A1%2C218%2C71%2C0%2C875%2C0%2C0%2C%2C%2C1175%2C%2C%2C%3Agdpr%3A14%3Av%3A1845%3Awv%3A2%3Ast%3A1586934712%3Au%3A1586934712682626738%3At%3ARedirecting

77 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK 9agv Show response
v.ht/ 3 KB
2 KB 464ms
119ms Document
text/html 69.61.26.122
GLOBALCOMPASS

General

Check archive.org

Show headers Download Go to

Full URL

https://v.ht/9agv

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.61.26.122 Atlanta, United States, ASN22653 (GLOBALCOMPASS, US),

Reverse DNS

Software

Hotcores.com /

Resource Hash

85eacecac052a3f80d980c288457174047b3d1d4ddb9a3c36aef18c645a8d149

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Host: v.ht
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: Hotcores.com
Date: Wed, 15 Apr 2020 07:11:44 GMT
Content-Type: text/html; Charset=UTF-8;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
X-Robots-Tag: noindex, nofollow
I-AM: Beta
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 42 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:819::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: v.ht
URL: https://v.ht/9agv

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd2da9fc69887da8658af5688aacaf16bf76541964f19fb40c22497855e15740

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "486 / 953 of 1000 / last-modified: 1586794147"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14292
x-xss-protection: 0
expires: Wed, 15 Apr 2020 07:11:50 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-31510493-3

Requested by

Host: v.ht
URL: https://v.ht/9agv

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0948cbfe5d891900311773f2ed2dda8837c7f92ebba4a2931747c59a7c93323a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 30189
x-xss-protection: 0
last-modified: Wed, 15 Apr 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Apr 2020 07:11:50 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:819::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=v.ht

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:819::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=v.ht

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020040702.js Show response
securepubads.g.doubleclick.net/gpt/ 167 KB
61 KB 80ms
29ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020040702.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

740078cb1778d885689a3108d2ca696b01fd80cb73437528af4ed0dd6e7466b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Apr 2020 20:25:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62521
x-xss-protection: 0
expires: Wed, 15 Apr 2020 07:11:50 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-31510493-3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 5596
date: Wed, 15 Apr 2020 05:38:34 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Wed, 15 Apr 2020 07:38:34 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=606368625&t=pageview&_s=1&dl=https%3A%2F%2Fv.ht%2F9agv&ul=en-us&de=UTF-8&dt=9agv&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1051548867&gjid=1342068394&cid=1774824107.1586934710&tid=UA-31510493-3&_gid=1970961177.1586934710&_r=1&gtm=2ou432&z=1175018655

Requested by

Host: v.ht
URL: https://v.ht/9agv

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Apr 2020 07:11:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads
securepubads.g.doubleclick.net/gampad/ 393 B
708 B 53ms
53ms XHR
text/plain 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2529598879832487&correlator=252079518692032&output=ldjh&impl=fif&adsid=NT&eid=20194812%2C21065392%2C21065782&vrg=2020040702&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200415&iu_parts=5837603%2CVht_360&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x360&cookie_enabled=1&bc=31&abxe=1&lmt=1586934710&dt=1586934710238&dlt=1586934709953&idt=267&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=495576698&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fv.ht%2F9agv&dssz=10&icsg=680&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=330x423&msz=0x0&ga_vid=1774824107.1586934710&ga_sid=1586934710&ga_hid=606368625&fws=128&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020040702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 206
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://v.ht
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020040702.js Show response
securepubads.g.doubleclick.net/gpt/ 64 KB
23 KB 28ms
28ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020040702.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020040702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

sffe /

Resource Hash

fb30d19bfdc58c092bdabad889657613116021c0d07e936fdb3e9e5dbd669872

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Apr 2020 20:25:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 23928
x-xss-protection: 0
expires: Wed, 15 Apr 2020 07:11:50 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020040702.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H/1.1

200
OK

Cookie set 4LQUGA Show response
u.to/
Redirect Chain

http://www.indianz.com/my.asp?url=https://u.to/4LQUGA
https://www.indianz.com/my.asp?url=https://u.to/4LQUGA
https://u.to/4LQUGA

1 KB
1 KB

290ms
71ms

Document
text/html

195.216.243.155
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL: https://u.to/4LQUGA
Requested by: Host: v.ht
URL: https://v.ht/9agv
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.243.155 Moscow, Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS: s5.unet.com
Software: nginx/1.8.0 /
Resource Hash: 78ef04bbdfd5d1fba2272c77a1c4e05a7c9dd9508a44ba6434d137b211d3bfb5

Request headers

Host: u.to
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://v.ht/9agv

Response headers

Server: nginx/1.8.0
Date: Wed, 15 Apr 2020 07:11:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Set-Cookie: lng=en; path=/; expires=Thu, 15-Apr-2021 07:11:51 GMT; domain=.u.to;
Cache-Control: no-cache no-store
Pragma: no-cache
Vary: host
Content-Encoding: gzip

Redirect headers

status: 302
cache-control: private
content-type: text/html
location: https://u.to/4LQUGA
server: Microsoft-IIS/10.0
set-cookie: ASPSESSIONIDQUCCAQAS=NKELONLCGIFBCJOHPEPPNHIA; secure; path=/
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Wed, 15 Apr 2020 07:11:48 GMT
content-length: 140

GET
H2 200 sodar
pagead2.googlesyndication.com/getconfig/ 6 KB
5 KB 20ms
20ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020040702&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020040702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5073
x-xss-protection: 0

GET
H2 200 sodar2.js
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020040702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 15 Apr 2020 07:11:50 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame DC15 0
0 6ms
6ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://v.ht/9agv
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://v.ht/9agv

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 15 Apr 2020 07:05:19 GMT
expires: Thu, 15 Apr 2021 07:05:19 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 391
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 15ms
14ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020040702&jk=2529598879832487&bg=!eHule2NYmwb6RdK8kBkCAAAAM1IAAAAJmQFQLC85jUJ-kHC_vVLe7rFBhm1fHYa3j6eBTniTxKUfglKtIUCc61RdsN2NpUWzKSOfbuSb7a0mCxwUp6YeFEi0SZi1iExEh1ptAy7amraTBKb4uvkh-rQNTYE6KB8BM9ISpotPPQorFIB9R8rrWECZabvu9BEIJQJxbjzuGTC013MmwspJVAmMfbISqFQ0G5gbSrstnzpWwn5ijqBi20dCzANlplogcPpD5QPKBWQ29rsFLVk0BaOHxRzjZ7f2sN1C4dTxsTi3-GWVMIULTFNb-DwFb9m2Qsu_nFHFsQodv9O5CUe2oXlbDXph-t4DkVVh-_jxzvOBV5WhDUeRXA4OxjBvM2KRIULXofRcedkeFqRMX-uFPiTEolOhCMnPytEggTZcPQ_rfHKG3NDNNuemUIXAn8D9NC2K7TkCABjuHO_rh9Sh0AAOvgfGkmic28Kl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/9agv
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Apr 2020 07:11:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/ 3 KB
3 KB 12670ms
881ms Document
text/html 107.181.163.26
TOTAL-SERVER-SOLU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/?hit=pm1110vc0qpvqze
Requested by: Host: u.to
URL: https://u.to/4LQUGA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.181.163.26 Atlanta, United States, ASN46562 (TOTAL-SERVER-SOLUTIONS, US),
Reverse DNS: SERV-11003.newsabah.net
Software: Apache /
Resource Hash: 9d8692bf09a8282a7cb69ac09bd47dd1fc3dabbe830b20aad160021a81d082ce

Request headers

Host: www.veronicdicaire.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://u.to/4LQUGA
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://u.to/4LQUGA

Response headers

Date: Wed, 15 Apr 2020 07:12:03 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK tag.js
mc.yandex.ru/metrika/ 363 KB
92 KB 130ms
42ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: u.to
URL: https://u.to/4LQUGA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://u.to/4LQUGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 07:11:51 GMT
Content-Encoding: br
Last-Modified: Mon, 13 Apr 2020 10:07:41 GMT
Server: nginx/1.14.2
ETag: "5e9439ed-16fc9"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Length: 94153
Expires: Wed, 15 Apr 2020 08:11:51 GMT

GET
H/1.1

200
OK

hit;utostat
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461

43 B
421 B

89ms
88ms

Image
image/gif

88.212.201.216
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 88.212.201.216 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS: host216.rax.ru
Software: nginx/1.17.9 /
Resource Hash

Request headers

Referer: https://u.to/4LQUGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 07:11:51 GMT
Server: nginx/1.17.9
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 15 Apr 2019 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 07:11:51 GMT
Server: nginx/1.17.9
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/4LQUGA%23xwtqafcsphcqum;1586934711461
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Mon, 15 Apr 2019 21:00:00 GMT

GET
H/1.1

200
OK

1
mc.yandex.ru/watch/51604940/
Redirect Chain

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr...
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Af...

152 B
692 B

87ms
44ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200415091151%3Aet%3A1586934712%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1029298416%3Ahid%3A978926184%3Ads%3A1%2C218%2C71%2C0%2C875%2C0%2C0%2C%2C%2C1175%2C%2C%2C%3Agdpr%3A14%3Av%3A1845%3Awv%3A2%3Ast%3A1586934712%3Au%3A1586934712682626738%3At%3ARedirecting

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://u.to/4LQUGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 07:11:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 15-Apr-2020 07:11:51 GMT
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://u.to
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 152
X-XSS-Protection: 1; mode=block
Expires: Wed, 15-Apr-2020 07:11:51 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 07:11:51 GMT
Last-Modified: Wed, 15-Apr-2020 07:11:51 GMT
Server: nginx/1.14.2
Access-Control-Allow-Origin: https://u.to
Strict-Transport-Security: max-age=31536000
Location: /watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2F4LQUGA%23xwtqafcsphcqum&charset=utf-8&browser-info=ti%3A10%3Ans%3A1586934710287%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200415091151%3Aet%3A1586934712%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1029298416%3Ahid%3A978926184%3Ads%3A1%2C218%2C71%2C0%2C875%2C0%2C0%2C%2C%2C1175%2C%2C%2C%3Agdpr%3A14%3Av%3A1845%3Awv%3A2%3Ast%3A1586934712%3Au%3A1586934712682626738%3At%3ARedirecting
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Wed, 15-Apr-2020 07:11:51 GMT

GET
H/1.1 200
OK advert.gif
mc.yandex.ru/metrika/ 43 B
425 B 81ms
42ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://u.to/4LQUGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 07:11:51 GMT
Last-Modified: Fri, 17 Jan 2020 08:05:01 GMT
Server: nginx/1.14.2
ETag: "5e216aad-2b"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Wed, 15 Apr 2020 08:11:51 GMT

GET
H/1.1 200
OK Primary Request / Show response
www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/ 57 KB
58 KB 968ms
968ms Document
text/html 107.181.163.26
TOTAL-SERVER-SOLU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Requested by: Host: v.ht
URL: https://v.ht/9agv
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.181.163.26 Atlanta, United States, ASN46562 (TOTAL-SERVER-SOLUTIONS, US),
Reverse DNS: SERV-11003.newsabah.net
Software: Apache /
Resource Hash: b95e8b08bf3ea65fdaae3400cc7f5232c72a484fe7b72d3feb1275e436d098df

Request headers

Host: www.veronicdicaire.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/?hit=pm1110vc0qpvqze
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/xnckv/nzbyy/?hit=pm1110vc0qpvqze

Response headers

Date: Wed, 15 Apr 2020 07:12:05 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 ouibounce.css
timetax.cn/html/de/css/ 4 KB
1 KB 1135ms
286ms Stylesheet
text/css 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://timetax.cn/html/de/css/ouibounce.css
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: 9af171df04c5d2ec5c97b490453a6beec46da794810c24cc4e0862aed0a57b7d

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: W/"5e8dcd99-f92"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=43200
expires: Wed, 15 Apr 2020 19:12:07 GMT

GET
H2 200 bootstrap.css
timetax.cn/html/de/css/ 147 KB
26 KB 1408ms
560ms Stylesheet
text/css 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://timetax.cn/html/de/css/bootstrap.css
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: 6a4dd42a51d139daba9631c26daab8a8d4a1e238704caa78f7920a316a218e5b

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: W/"5e8dcd99-24ccf"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=43200
expires: Wed, 15 Apr 2020 19:12:07 GMT

GET
H2 200 style.css
timetax.cn/html/de/css/ 8 KB
2 KB 1411ms
564ms Stylesheet
text/css 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://timetax.cn/html/de/css/style.css
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: dc3e40a283a2e359ac6ec65e207c6264ff06246576bd0bed924a9658537537c5

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: W/"5e8dcd99-1faf"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=43200
expires: Wed, 15 Apr 2020 19:12:07 GMT

GET
H2 200 backDay-de.js Show response
timetax.cn/html/de/lib/ 741 B
922 B 1411ms
564ms Script
application/javascript 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://timetax.cn/html/de/lib/backDay-de.js
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: a3770b0519974c3b9d09384c1ed062800cb71ee1642e3fdd2ab5b4e2e04e1f1f

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: "5e8dcd99-2e5"
content-type: application/javascript
status: 200
cache-control: max-age=43200
accept-ranges: bytes
content-length: 741
expires: Wed, 15 Apr 2020 19:12:07 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 32ms
31ms Script
application/javascript 2606:4700::6810:84e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:06 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 22893861
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
served-in-seconds: 0.003
timing-allow-origin: *
last-modified: Wed, 01 May 2019 21:45:59 GMT
server: cloudflare
etag: W/"5cca1397-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5843db359a8a9704-FRA
expires: Mon, 05 Apr 2021 07:12:06 GMT

GET
H2 200 theme_c3b2nq.css
timetax.cn/html/de/css/ 21 B
191 B 1134ms
287ms Stylesheet
text/css 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://timetax.cn/html/de/css/theme_c3b2nq.css
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: 4e0f2cb203e4cbd5c7433d348c079f8e08f305de9b8fc88ae19ff4c57974962f

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: "5e8dcd99-15"
content-type: text/css
status: 200
cache-control: max-age=43200
accept-ranges: bytes
content-length: 21
expires: Wed, 15 Apr 2020 19:12:07 GMT

GET
H2 200 news-top.png
timetax.cn/html/de/images/ 8 KB
8 KB 284ms
284ms Image
image/png 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://timetax.cn/html/de/images/news-top.png
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: "5e8dcd99-1e3e"
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7742
expires: Fri, 15 May 2020 07:12:07 GMT

GET
H2 200 asseenin.jpg
timetax.cn/html/de/images/ 24 KB
24 KB 575ms
574ms Image
image/jpeg 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://timetax.cn/html/de/images/asseenin.jpg
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: 6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: "5e8dcd99-60b9"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 24761
expires: Fri, 15 May 2020 07:12:07 GMT

GET
H2 200 top-banner.png
timetax.cn/html/de/images/ 128 KB
0 573ms
566ms Image
image/png 122.51.111.126
CNNIC-TENCENT-NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://timetax.cn/html/de/images/top-banner.png
Requested by: Host: www.veronicdicaire.com
URL: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 122.51.111.126 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://www.veronicdicaire.com/upload/_thumbs/install-xbench/compras.php/mrufb/qtyh/?9cc9rb9u9av0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 15 Apr 2020 07:12:07 GMT
last-modified: Wed, 08 Apr 2020 13:11:53 GMT
server: nginx
etag: "5e8dcd99-2d65c"
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 185948
expires: Fri, 15 May 2020 07:12:07 GMT

GET janie.png
timetax.cn/html/de/images/ 0
0

GET 2.jpg
timetax.cn/html/de/images/ 0
0

GET mid-image.png
timetax.cn/html/de/images/ 0
0

GET code-step3.png
timetax.cn/html/de/images/ 0
0

GET t1.jpg
timetax.cn/html/de/images/ 0
0

GET t2.jpg
timetax.cn/html/de/images/ 0
0

GET t3.jpg
timetax.cn/html/de/images/ 0
0

GET t4.jpg
timetax.cn/html/de/images/ 0
0

GET t5.jpg
timetax.cn/html/de/images/ 0
0

GET side1.png
timetax.cn/html/de/images/ 0
0

GET side2.png
timetax.cn/html/de/images/ 0
0

GET side3.png
timetax.cn/html/de/images/ 0
0

GET side4.png
timetax.cn/html/de/images/ 0
0

GET side5.png
timetax.cn/html/de/images/ 0
0

GET side6.png
timetax.cn/html/de/images/ 0
0

GET side7.png
timetax.cn/html/de/images/ 0
0

GET checkmark.png
timetax.cn/html/de/images/ 0
0

GET codeside-step1.png
timetax.cn/html/de/images/ 0
0

GET codeside-step2.png
timetax.cn/html/de/images/ 0
0

GET codeside-step3.png
timetax.cn/html/de/images/ 0
0

GET code-step1.png
timetax.cn/html/de/images/ 0
0

GET code-step2.png
timetax.cn/html/de/images/ 0
0

GET lewis.jpg
timetax.cn/html/de/images/ 0
0

GET tanya.jpg
timetax.cn/html/de/images/ 0
0

GET jenni.jpg
timetax.cn/html/de/images/ 0
0

GET cash.jpg
timetax.cn/html/de/images/ 0
0

GET katy.jpg
timetax.cn/html/de/images/ 0
0

GET amanda.jpg
timetax.cn/html/de/images/ 0
0

GET julie.jpg
timetax.cn/html/de/images/ 0
0

GET sarah.jpg
timetax.cn/html/de/images/ 0
0

GET kirs.jpg
timetax.cn/html/de/images/ 0
0

GET celia.jpg
timetax.cn/html/de/images/ 0
0

GET alanna.jpg
timetax.cn/html/de/images/ 0
0

GET alice.jpg
timetax.cn/html/de/images/ 0
0

GET mark.jpg
timetax.cn/html/de/images/ 0
0

GET ashley.jpg
timetax.cn/html/de/images/ 0
0

GET hick.jpg
timetax.cn/html/de/images/ 0
0

GET brit.jpg
timetax.cn/html/de/images/ 0
0

GET shel.jpg
timetax.cn/html/de/images/ 0
0

GET jill.jpg
timetax.cn/html/de/images/ 0
0

GET molly.jpg
timetax.cn/html/de/images/ 0
0

GET jenna.jpg
timetax.cn/html/de/images/ 0
0

GET laura.jpg
timetax.cn/html/de/images/ 0
0

GET sara.jpg
timetax.cn/html/de/images/ 0
0

GET silver.jpg
timetax.cn/html/de/images/ 0
0

GET got.jpg
timetax.cn/html/de/images/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/janie.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/2.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/mid-image.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/code-step3.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/t1.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/t2.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/t3.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/t4.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/t5.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side1.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side2.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side3.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side4.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side5.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side6.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/side7.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/checkmark.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/codeside-step1.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/codeside-step2.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/codeside-step3.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/code-step1.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/code-step2.png

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/lewis.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/tanya.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/jenni.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/cash.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/katy.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/amanda.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/julie.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/sarah.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/kirs.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/celia.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/alanna.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/alice.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/mark.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/ashley.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/hick.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/brit.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/shel.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/jill.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/molly.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/jenna.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/laura.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/sara.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/silver.jpg

Domain: timetax.cn
URL: https://timetax.cn/html/de/images/got.jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
cdnjs.cloudflare.com
counter.yadro.ru
mc.yandex.ru
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
timetax.cn
tpc.googlesyndication.com
u.to
v.ht
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.indianz.com
www.veronicdicaire.com
timetax.cn
107.181.163.26
122.51.111.126
162.214.70.142
172.217.18.98
195.216.243.155
2606:4700::6810:84e5
2a00:1450:4001:808::2001
2a00:1450:4001:817::200e
2a00:1450:4001:819::2002
2a00:1450:4001:81d::2008
2a00:1450:4001:820::2002
2a02:6b8::1:119
69.61.26.122
88.212.201.216
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0948cbfe5d891900311773f2ed2dda8837c7f92ebba4a2931747c59a7c93323a
4e0f2cb203e4cbd5c7433d348c079f8e08f305de9b8fc88ae19ff4c57974962f
6a4dd42a51d139daba9631c26daab8a8d4a1e238704caa78f7920a316a218e5b
6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e
740078cb1778d885689a3108d2ca696b01fd80cb73437528af4ed0dd6e7466b7
78ef04bbdfd5d1fba2272c77a1c4e05a7c9dd9508a44ba6434d137b211d3bfb5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85eacecac052a3f80d980c288457174047b3d1d4ddb9a3c36aef18c645a8d149
9af171df04c5d2ec5c97b490453a6beec46da794810c24cc4e0862aed0a57b7d
9d8692bf09a8282a7cb69ac09bd47dd1fc3dabbe830b20aad160021a81d082ce
a3770b0519974c3b9d09384c1ed062800cb71ee1642e3fdd2ab5b4e2e04e1f1f
b95e8b08bf3ea65fdaae3400cc7f5232c72a484fe7b72d3feb1275e436d098df
bd2da9fc69887da8658af5688aacaf16bf76541964f19fb40c22497855e15740
dc3e40a283a2e359ac6ec65e207c6264ff06246576bd0bed924a9658537537c5
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
fb30d19bfdc58c092bdabad889657613116021c0d07e936fdb3e9e5dbd669872

www.veronicdicaire.com Open in urlscan Pro 107.181.163.26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

77 Requests

40 %HTTPS

50 %IPv6

15 Domains

16 Subdomains

14 IPs

4 Countries

408 kBTransfer

1251 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.veronicdicaire.com Open in urlscan Pro
107.181.163.26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

40 %
HTTPS

50 %
IPv6

15
Domains

16
Subdomains

14
IPs

4
Countries

408 kB
Transfer

1251 kB
Size

0
Cookies

77 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!